cdk-local 0.147.18 → 0.147.19

package/dist/{local-studio-BIHN-Erp.js → local-studio-DOdzcjkE.js}

@@ -245,15 +245,84 @@ function buildStsClientConfig(args) {
 * SCOPE, stated so a later sweep finds a decision rather than an oversight:
 * this module governs those nine plus sigv4-verify's one, and its
 * {@link flattenToOneLine} additionally covers every other wire-derived value
-* printed on those lines (the role ARN, on the failure AND success paths). It
-* does NOT yet govern the AWS SDK error relays elsewhere under
-* `src/local/**` — notably
-* `formatAwsErrorForWarn` (`cfn-local-state-provider.ts`, six warn sites and
-* one non-warn caller)
-* and `formatSsmError` (`ssm-parameter-resolver.ts`), which still print an
-* UNCLAMPED wire-derived `err.name`. Those are enumerated and tracked in
-* issue #579; they were left out here so a cross-cutting refactor of eight
-* more files would not share a review with the policy that justifies it.
+* printed on those lines (the role ARN, on the failure AND success paths).
+*
+* Issue #579 extended it to the AWS SDK error relays elsewhere under
+* `src/local/**` (plus `local-studio.ts`'s image-context warn), so the policy
+* is no longer scoped to `src/cli/commands/**`:
+* `cfn-local-state-provider.ts` (`formatAwsErrorForWarn`, six callers),
+* `ssm-parameter-resolver.ts` (whose `formatSsmError` was DELETED rather than
+* fixed — it was a second spelling of the same forging vector),
+* `state-resolver.ts`, `cloudfront-kvs-client.ts`, `cloudfront-s3-origin.ts`,
+* `layer-arn-materializer.ts`, `ecr-puller.ts`, `ecs-secrets-resolver.ts` and
+* `httpv2-service-integration.ts`. Each was decided on the SAME two axes below
+* rather than rewritten mechanically, and a `catch` around a purely LOCAL
+* operation was left alone: `agentcore-s3-bundle.ts`'s unzip and
+* `layer-arn-materializer.ts`'s presigned-URL download / unzip see no
+* credential chain and no service response, so there is nothing here for them.
+*
+* The test is what a `catch` CAN SEE, and applying it by LOCATION instead is
+* how the sweep first got `agentcore-s3-bundle.ts` wrong. Its `try` does wrap
+* `unzipSync` and nothing else — but that made the S3 `GetObject` above it
+* UNCOVERED, not out of scope: it had no `catch` at all, so the raw SDK error
+* propagated to `withErrorHandling` -> `formatError`, which prints
+* `${error.name}: ${error.message}` unflattened and unclamped at DEFAULT
+* level, and the default credential chain is what a run without
+* `--assume-role` uses. "Outside that `catch`" is not "outside the sweep";
+* ask which populations reach the site, and if the answer is "nothing catches
+* it here", follow it to the frame that does.
+*
+* #579 also widened what LEVEL means, and the widening is the useful part:
+* `httpv2-service-integration.ts`'s relay is not a log line at all, it is a
+* served HTTP RESPONSE BODY — the widest reader in the sweep, since it needs
+* neither `--verbose` nor access to the terminal, and the studio capture proxy
+* records it onto the timeline besides. The axis is about READERS, not about
+* logs.
+*
+* TWO CALLING CONVENTIONS this imposes, both found by #579 rather than
+* anticipated here:
+*
+*   1. Render each failure ONCE. {@link describeAwsFailureForWarn} EMITS the
+*      `debug` line, so calling it twice for one error prints that line twice
+*      (`cfn-local-state-provider.ts`'s `load` did, having rendered the same
+*      failure for its warn and for `lastLoadError`).
+*   2. Re-raise cdk-local's OWN throws ABOVE the relay, with an identifiable
+*      class. The discriminator is positive, so a `catch` that also catches
+*      the caller's own `throw new Error('...')` withholds text cdk-local
+*      wrote itself — which is the diagnostic loss this file's
+*      {@link describeCredentialLoadFailure} note calls "a real diagnostic
+*      loss, accepted". #579 stopped accepting it where it was cheap not to:
+*      `layer-arn-materializer.ts`'s ARN-shape and missing-`Content.Location`
+*      guards became `LayerMaterializationError`s and are re-raised, and
+*      `httpv2-service-integration.ts`'s missing-RequestParameter 400 became a
+*      `ServiceIntegrationRequestError` so an actionable 400 body did not
+*      degrade into a class name and a character count.
+*
+* TWO CATCH-ALL relays remain outside it, and both are UNCOVERED. An earlier
+* revision of this note gave them opposite verdicts in adjacent paragraphs —
+* clearing one and rejecting the other on the same evidence — which was simply
+* wrong about the first, so both now read the same way:
+*
+*   - `cloudfront-server.ts:129`'s `Request handling failed: ${err.message}`.
+*     It is what makes `cloudfront-kvs-client.ts`'s throw a DEFAULT-level
+*     line, and for THAT sub-path the text arrives pre-sanitized — but it is a
+*     catch-all over the whole request pipeline, so an origin fetch, an
+*     edge-function invoke or an SDK error raised anywhere below it still
+*     reaches the line RAW.
+*   - `ecs-service-emulator.ts`'s `logger.error` at three sites (`:909`,
+*     `:1508`, `:1599`). One of them does carry
+*     `ecs-secrets-resolver.ts`'s `EcsSecretsResolutionError`, which this
+*     module sanitized on the way in — and reasoning from that to "the relay
+*     is safe" is the SAME generalisation the bullet above rejects. All three
+*     are catch-alls over a whole reload or replica roll, relaying
+*     `err instanceof Error ? err.message : String(err)`, and what they
+*     usually carry is docker CLI stderr, which is multi-line.
+*
+* So: one sub-path arriving pre-sanitized never clears a catch-all. Both need
+* the same per-occurrence call as everything else in this list. Neither is
+* done here — `cloudfront-server.ts` is out of this change's scope, and the
+* emulator's three are a different population (docker output, not SDK errors)
+* that wants the flattening half rather than the withholding half.
 *
 * # The two axes that decide it
 *
@@ -547,13 +616,27 @@ function sanitizeServiceExceptionMessage(message) {
 * echo, plus the clamped {@link clampErrorCode} when the throw carries one.
 *
 * Withholding is NOT free, and the cost lands on cdk-local's own text as well
-* as on the SDK's: `role-arn.ts`'s
-* `AssumeRole(<arn>) returned no usable credentials.` is a plain `Error` with
-* no `$fault`, so it is withheld like any other. That is a real diagnostic
-* loss, accepted because the alternative — an allow-list of messages that may
-* print — is the deny-list this design rejects, wearing the other sign. The
-* fix is to make cdk-local's own throws identifiable rather than to guess at
-* their text; it is not done here, and is noted in issue #579.
+* as on the SDK's. The worked example used to be `role-arn.ts`'s
+* `AssumeRole(<arn>) returned no usable credentials.`: a plain `Error` with no
+* `$fault`, so it was withheld like any other, and the note recorded that as a
+* real diagnostic loss accepted because the alternative — an allow-list of
+* messages that may print — is the deny-list this design rejects, wearing the
+* other sign. It also named the right fix: make cdk-local's own throws
+* IDENTIFIABLE rather than guess at their text.
+*
+* Issue #579 did that, for exactly this example. `role-arn.ts` now throws
+* `AssumeRoleFailure`, carrying a `detail` its relaying callers print verbatim
+* — and the same pattern closed the identical loss in
+* `layer-arn-materializer.ts`, `httpv2-service-integration.ts`,
+* `ecr-puller.ts`, `local-run-task.ts` and `ecs-service-emulator.ts`. The
+* general point stands and is what a new site should apply: the policy cannot
+* tell cdk-local's own sentence from a hostile endpoint's, so a `catch` that
+* can see both must make its own throws recognisable BEFORE the relay.
+*
+* The remaining ARN-length question — an ARN is structured, so the bound
+* belongs at the three resolution points rather than at the log line — is
+* tracked separately at
+* https://github.com/go-to-k/cdk-local/issues/607.
 *
 * The LENGTH is reported, unlike in `ecs-secrets-resolver.ts`, and the
 * difference is deliberate: there the user already knows which secret it is
@@ -622,6 +705,54 @@ function describeAwsFailureForWarn(err, operation) {
 //#endregion
 //#region src/utils/role-arn.ts
 /**
+* {@link assumeRoleCredentials} failed, and the failure is cdk-local's OWN
+* rendering of it rather than a raw SDK error.
+*
+* Exists because this helper has TWO kinds of caller and they need opposite
+* things (issue #579 review round 4, found by #570's own harness going red):
+*
+*   - THREE paths are unguarded all the way to `formatError`
+*     (`local-start-api`'s `assumeLambdaExecutionRole`, and `assumeTaskRole` in
+*     both `local-run-task` and `ecs-service-emulator`). They need this helper
+*     to render the failure, which is why it no longer propagates unwrapped.
+*   - ONE path -- `local-invoke.ts`'s `resolveLambdaContainerEnv` -- ALREADY
+*     renders it, guarded by the #570 lane. Wrapping for the first group broke
+*     that one: the outer `describeAwsFailureForWarn` saw a plain `Error`
+*     (no `$fault`, because it is cdk-local's own), withheld the
+*     already-sanitized text, and turned `ExpiredTokenException: The security
+*     token ... is expired` into `Error; 138-character message withheld`. The
+*     policy withholding its OWN output is the worst of both branches.
+*
+* So `message` carries the framed sentence for the first group, and `detail`
+* carries the bare half for a caller that supplies its own framing. A relay
+* that re-renders `detail` would double-withhold it again; print it verbatim.
+*
+* BOTH of this helper's throws use it (issue #579 review round 5). The
+* no-usable-credentials sibling was left a bare `Error` in round 4 and carried
+* the identical defect one throw over: at `local-invoke.ts` it missed the
+* `instanceof` test and rendered as `Error; 47-character message withheld`.
+* That is the exact loss `credential-error.ts` documents as accepted and
+* points here to fix, so it is fixed here rather than described again.
+*
+* NOT thrown when `makeError` is supplied -- that caller asked for its own
+* class, and every `makeError` path today is in the unguarded group.
+*/
+var AssumeRoleFailure = class AssumeRoleFailure extends Error {
+	/**
+	* The bare half, with no `AssumeRole(<arn>) ...` framing, safe to print
+	* VERBATIM on a line that adds its own. Already policy-rendered when the
+	* cause was an SDK error; cdk-local's own literal otherwise. Never re-render
+	* it -- that is what double-withholds.
+	*/
+	detail;
+	constructor(message, detail) {
+		super(message);
+		this.name = "AssumeRoleFailure";
+		this.detail = detail;
+		Object.setPrototypeOf(this, AssumeRoleFailure.prototype);
+	}
+};
+/**
 * Issue an STS AssumeRole for `roleArn` and return the temporary
 * credentials (issue #509).
 *
@@ -635,33 +766,65 @@ function describeAwsFailureForWarn(err, operation) {
 *
 * `sessionNameSuffix` distinguishes the callers in CloudTrail
 * (`<resourceNamePrefix>-<suffix>-<epochMs>`). `makeError` lets a
-* caller surface the no-usable-credentials failure as its own error
-* class (the ECS emulator throws `LocalStartServiceError`); STS
-* transport errors always propagate unwrapped.
+* caller surface the failure as its own error class (the ECS emulator
+* throws `LocalStartServiceError`).
+*
+* CHANGED by issue #579 review round 4: "STS transport errors always
+* propagate unwrapped" is no longer true, and it was the last instance of the
+* `try { send } finally { destroy }` with no `catch` that the derived
+* population found. Propagating unwrapped meant the raw SDK error reached
+* `withErrorHandling` -> `formatError`, which prints
+* `${error.name}: ${error.message}` UNFLATTENED and UNCLAMPED at DEFAULT
+* level — so a `CredentialsProviderError` carrying a `credential_process`
+* command line landed there verbatim, from every `--assume-role` /
+* `--assume-task-role` path in the CLI. This is the file `/review-pr`'s
+* `UP_PATHS` names as credential-material surface, which is exactly why it is
+* the wrong place to leave the relay open.
+*
+* The no-usable-credentials check sits OUTSIDE the `try` rather than being
+* re-raised through an `instanceof` guard, because `makeError` mints the
+* CALLER's class and there is no sentinel this function could test for.
+* `sts.destroy()` still runs first — the `finally` fires on the way out of the
+* `try`, and the response has already been read by then.
+*
+* What that buys is narrower than an earlier revision of this note claimed,
+* and the overclaim is worth correcting rather than deleting: being outside the
+* `try` means this function never routes its own text through the withholding
+* policy, which is what the THREE `formatError` paths need — they print
+* `message` directly. It does NOT help a caller that RE-RENDERS the error,
+* because such a caller tests a class rather than a line number. That is what
+* {@link AssumeRoleFailure} is for, and why BOTH throws below use it.
 */
 async function assumeRoleCredentials(opts) {
 	const sts = new STSClient(buildStsClientConfig({
 		region: opts.region,
 		profile: opts.profile
 	}));
+	const shownArn = flattenToOneLine(opts.roleArn);
+	let response;
 	try {
-		const creds = (await sts.send(new AssumeRoleCommand({
+		response = await sts.send(new AssumeRoleCommand({
 			RoleArn: opts.roleArn,
 			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-${opts.sessionNameSuffix}-${Date.now()}`,
 			DurationSeconds: 3600
-		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) {
-			const message = `AssumeRole(${opts.roleArn}) returned no usable credentials.`;
-			throw opts.makeError ? opts.makeError(message) : new Error(message);
-		}
-		return {
-			accessKeyId: creds.AccessKeyId,
-			secretAccessKey: creds.SecretAccessKey,
-			sessionToken: creds.SessionToken
-		};
+		}));
+	} catch (err) {
+		const detail = describeAwsFailureForWarn(err, "STS AssumeRole");
+		const message = `AssumeRole(${shownArn}) failed: ${detail}`;
+		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, detail);
 	} finally {
 		sts.destroy();
 	}
+	const creds = response.Credentials;
+	if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) {
+		const message = `AssumeRole(${shownArn}) returned no usable credentials.`;
+		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, "the response carried no usable credentials");
+	}
+	return {
+		accessKeyId: creds.AccessKeyId,
+		secretAccessKey: creds.SecretAccessKey,
+		sessionToken: creds.SessionToken
+	};
 }
 /**
 * Resolve the role-arn argument (CLI flag or `CDKL_ROLE_ARN` env var) and,
@@ -692,27 +855,31 @@ async function applyRoleArnIfSet(opts) {
 	const roleArn = opts.roleArn || process.env[`${getEmbedConfig().envPrefix}_ROLE_ARN`];
 	if (!roleArn) return;
 	const logger = getLogger().child("role-arn");
-	logger.debug(`Assuming role ${roleArn}...`);
+	const shownArn = flattenToOneLine(roleArn);
+	logger.debug(`Assuming role ${shownArn}...`);
 	const sts = new STSClient(buildStsClientConfig({
 		region: opts.region,
 		profile: opts.profile
 	}));
+	let response;
 	try {
-		const response = await sts.send(new AssumeRoleCommand({
+		response = await sts.send(new AssumeRoleCommand({
 			RoleArn: roleArn,
 			RoleSessionName: `${getEmbedConfig().binaryName}-${Date.now()}`,
 			DurationSeconds: 3600
 		}));
-		if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${roleArn}`);
-		const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
-		if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${roleArn}`);
-		process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
-		process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
-		process.env["AWS_SESSION_TOKEN"] = SessionToken;
-		logger.info(`Assumed role ${roleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
+	} catch (err) {
+		throw new Error(`AssumeRole(${shownArn}) failed: ${describeAwsFailureForWarn(err, "STS AssumeRole")}`);
 	} finally {
 		sts.destroy();
 	}
+	if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${shownArn}`);
+	const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
+	if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${shownArn}`);
+	process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
+	process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
+	process.env["AWS_SESSION_TOKEN"] = SessionToken;
+	logger.info(`Assumed role ${shownArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
 }
 
 //#endregion
@@ -2674,13 +2841,35 @@ async function dispatchSfnStopExecution(params, region) {
 async function dispatchAppConfigGetConfiguration(params, region) {
 	return errorResponse(501, `AppConfig-GetConfiguration is recognized but ${getEmbedConfig().productName} does not yet bundle @aws-sdk/client-appconfig. Use the deployed API for this subtype, or open an issue if you need local emulation.`);
 }
+/**
+* A REQUEST-shape rejection raised by cdk-local itself, before any AWS call.
+*
+* Issue #579 — it needs its own class so {@link translateSdkError} can tell it
+* apart from a relayed SDK failure. Its message is cdk-local's own literal and
+* names the missing parameter, so it is the diagnosis and must reach the
+* client verbatim; the credential-error policy withholds every non-service
+* exception, which would otherwise have turned this 400 into a class name and
+* a character count. `credential-error.ts` names exactly this remedy: make
+* cdk-local's own throws identifiable rather than guess at their text.
+*
+* The ONE remaining cdk-local-authored throw inside the guarded `try` is
+* `getClient`'s `unknown service '<x>'`, and it is left withheld deliberately:
+* its `switch` is exhaustive over the dispatched subtypes, so the arm is dead
+* code guarding against a future subtype added without a client case. If it
+* ever does fire, the developer who added that subtype reads the full text on
+* the `debug` line the helper emits.
+*/
+var ServiceIntegrationRequestError = class ServiceIntegrationRequestError extends Error {
+	statusCode = 400;
+	constructor(message) {
+		super(message);
+		this.name = "ServiceIntegrationRequestError";
+		Object.setPrototypeOf(this, ServiceIntegrationRequestError.prototype);
+	}
+};
 function requireParams(params, required) {
 	const missing = required.filter((k) => !params[k] || params[k].trim() === "");
-	if (missing.length > 0) {
-		const err = /* @__PURE__ */ new Error(`missing required RequestParameter(s): ${missing.join(", ")}`);
-		err.statusCode = 400;
-		throw err;
-	}
+	if (missing.length > 0) throw new ServiceIntegrationRequestError(`missing required RequestParameter(s): ${missing.join(", ")}`);
 }
 function splitCsv(value) {
 	return value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
@@ -2726,14 +2915,38 @@ function errorResponse(statusCode, message) {
 * Translate an AWS SDK error to an HTTP response. AWS SDK v3 surfaces
 * errors as instances carrying `$metadata.httpStatusCode` + `name`;
 * we honor the status code when present, default to 500.
-*/
+*
+* Issue #579 routed the two relayed fields through the credential-error
+* policy. LEVEL: this one is NOT a log line — it is a RESPONSE BODY served on
+* the local API port, which makes it the widest reader of the set: the studio
+* capture proxy records a served response body onto the timeline, so the text
+* reaches the same browser the log ring does, and any HTTP client reaches it
+* without `--verbose`. RECONSTRUCTION: the `catch` wraps the per-subtype
+* dispatch, i.e. one `client.send(...)`, so a `CredentialsProviderError`
+* carrying a `credential_process` command line would have been JSON-encoded
+* into that body verbatim. A modeled service exception's message is what a
+* real API Gateway service integration surfaces and is the diagnosis, so it
+* keeps printing; `code` is `err.name`, wire-derived, and is clamped.
+*/
+/** A value usable as an HTTP status line without raising `ERR_HTTP_INVALID_STATUS_CODE`. */
+function isHttpStatus(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 100 && value < 600;
+}
 function translateSdkError(subtype, err) {
+	if (err instanceof ServiceIntegrationRequestError) return {
+		statusCode: err.statusCode,
+		body: JSON.stringify({
+			message: err.message,
+			code: err.name
+		}),
+		headers: { "content-type": "application/json" }
+	};
 	if (err && typeof err === "object") {
 		const e = err;
-		const status = typeof e.statusCode === "number" && e.statusCode >= 100 && e.statusCode < 600 ? e.statusCode : e.$metadata?.httpStatusCode ?? 500;
+		const status = isHttpStatus(e.statusCode) ? e.statusCode : isHttpStatus(e.$metadata?.httpStatusCode) ? e.$metadata.httpStatusCode : 500;
 		const body = {
-			message: e.message ?? "AWS SDK call failed",
-			code: e.name ?? "UnknownError"
+			message: isAwsServiceException(err) ? sanitizeServiceExceptionMessage(typeof e.message === "string" ? e.message : stringifyThrown(err)) : describeAwsFailureForWarn(err, `${subtype} service integration`),
+			code: clampErrorName(err)
 		};
 		logger.debug(`[${subtype}] SDK error (${status}): ${stringifyValue(body)}`);
 		return {
@@ -2742,7 +2955,7 @@ function translateSdkError(subtype, err) {
 			headers: { "content-type": "application/json" }
 		};
 	}
-	return errorResponse(500, `Unexpected error invoking ${subtype}: ${String(err)}`);
+	return errorResponse(500, `Unexpected error invoking ${subtype}: ${describeAwsFailureForWarn(err, `${subtype} service integration`)}`);
 }
 /**
 * Apply HTTP API v2 `ResponseParameters` mapping (per AWS docs:
@@ -4709,7 +4922,7 @@ async function resolveSsmParameters(client, refs, label) {
 			const invalid = resp.InvalidParameters ?? [];
 			if (invalid.length > 0) logger.warn(`${label}: SSM GetParameters reported invalid parameter name(s): ${invalid.join(", ")}. Ref to the matching CloudFormation parameter(s) will warn-and-drop (was the SSM parameter created?).`);
 		} catch (err) {
-			logger.warn(`${label}: SSM GetParameters(${names.join(", ")}) failed: ${formatSsmError(err)}. Ref to the matching CloudFormation parameter(s) will warn-and-drop (grant ssm:GetParameters or override via --env-vars).`);
+			logger.warn(`${label}: SSM GetParameters(${flattenToOneLine(names.join(", "))}) failed: ${describeAwsFailureForWarn(err, "SSM GetParameters")}. Ref to the matching CloudFormation parameter(s) will warn-and-drop (grant ssm:GetParameters or override via --env-vars).`);
 			continue;
 		}
 		for (const p of resolved) {
@@ -4725,17 +4938,6 @@ async function resolveSsmParameters(client, refs, label) {
 	}
 	return out;
 }
-/**
-* Format an SSM SDK error as `<name>: <message>` so the warn names the
-* error class (e.g. `AccessDeniedException`, `ThrottlingException`).
-* Mirrors `formatAwsErrorForWarn` in `cfn-local-state-provider.ts`.
-* Exported for unit testing.
-*/
-function formatSsmError(err) {
-	if (!(err instanceof Error)) return String(err);
-	const name = err.name && err.name !== "Error" ? err.name : void 0;
-	return name !== void 0 ? `${name}: ${err.message}` : err.message;
-}
 
 //#endregion
 //#region src/local/cfn-local-state-provider.ts
@@ -4890,7 +5092,7 @@ var CfnLocalStateProvider = class {
 		try {
 			return (await client.send(new GetFunctionConfigurationCommand({ FunctionName: functionPhysicalId }))).Environment?.Variables ?? {};
 		} catch (err) {
-			logger.warn(`${this.label}: GetFunctionConfiguration(${functionPhysicalId}) failed: ${formatAwsErrorForWarn(err)}. Intrinsic-valued env vars that need the deployed value will warn-and-drop (grant lambda:GetFunctionConfiguration or override via --env-vars).`);
+			logger.warn(`${this.label}: GetFunctionConfiguration(${flattenToOneLine(functionPhysicalId)}) failed: ${formatAwsErrorForWarn(err, "Lambda GetFunctionConfiguration")}. Intrinsic-valued env vars that need the deployed value will warn-and-drop (grant lambda:GetFunctionConfiguration or override via --env-vars).`);
 			return;
 		}
 	}
@@ -4913,7 +5115,7 @@ var CfnLocalStateProvider = class {
 			if (typeof resp.Role === "string" && resp.Role.startsWith("arn:")) return resp.Role;
 			return;
 		} catch (err) {
-			logger.warn(`${this.label}: GetFunctionConfiguration(${functionPhysicalId}) for --assume-role auto-resolve failed: ${formatAwsErrorForWarn(err)}. Pass the ARN explicitly: --assume-role <arn>.`);
+			logger.warn(`${this.label}: GetFunctionConfiguration(${flattenToOneLine(functionPhysicalId)}) for --assume-role auto-resolve failed: ${formatAwsErrorForWarn(err, "Lambda GetFunctionConfiguration (--assume-role auto-resolve)")}. Pass the ARN explicitly: --assume-role <arn>.`);
 			return;
 		}
 	}
@@ -4936,7 +5138,7 @@ var CfnLocalStateProvider = class {
 			if (typeof resp.roleArn === "string" && resp.roleArn.startsWith("arn:")) return resp.roleArn;
 			return;
 		} catch (err) {
-			logger.warn(`${this.label}: GetAgentRuntime(${runtimePhysicalId}) for --assume-role auto-resolve failed: ${formatAwsErrorForWarn(err)}. Pass the ARN explicitly: --assume-role <arn>.`);
+			logger.warn(`${this.label}: GetAgentRuntime(${flattenToOneLine(runtimePhysicalId)}) for --assume-role auto-resolve failed: ${formatAwsErrorForWarn(err, "bedrock-agentcore-control GetAgentRuntime (--assume-role auto-resolve)")}. Pass the ARN explicitly: --assume-role <arn>.`);
 			return;
 		}
 	}
@@ -4961,8 +5163,9 @@ var CfnLocalStateProvider = class {
 		try {
 			resourceMap = buildResourceStateMap(await fetchAllStackResources(client, this.cfnStackName));
 		} catch (err) {
-			this.lastLoadError = `ListStackResources(${this.cfnStackName}) failed: ${formatAwsErrorForWarn(err)} (region='${this.region}')`;
-			logger.warn(`${this.label}: ListStackResources(${this.cfnStackName}) failed: ${formatAwsErrorForWarn(err)}. Was the stack deployed in region '${this.region}'? Falling back.`);
+			const detail = formatAwsErrorForWarn(err, "CloudFormation ListStackResources");
+			this.lastLoadError = `ListStackResources(${this.cfnStackName}) failed: ${detail} (region='${this.region}')`;
+			logger.warn(`${this.label}: ListStackResources(${this.cfnStackName}) failed: ${detail}. Was the stack deployed in region '${this.region}'? Falling back.`);
 			return;
 		}
 		let outputs;
@@ -4973,7 +5176,7 @@ var CfnLocalStateProvider = class {
 				outputs = {};
 			} else outputs = buildOutputsMap(stack.Outputs ?? []);
 		} catch (err) {
-			logger.warn(`${this.label}: DescribeStacks(${this.cfnStackName}) failed: ${formatAwsErrorForWarn(err)}. Outputs will be empty (Fn::GetStackOutput cannot resolve).`);
+			logger.warn(`${this.label}: DescribeStacks(${this.cfnStackName}) failed: ${formatAwsErrorForWarn(err, "CloudFormation DescribeStacks")}. Outputs will be empty (Fn::GetStackOutput cannot resolve).`);
 			outputs = {};
 		}
 		return {
@@ -5023,7 +5226,7 @@ var CfnLocalStateProvider = class {
 		const ensureExports = () => {
 			if (exportsPromise) return exportsPromise;
 			exportsPromise = fetchAllExports(client).catch((err) => {
-				logger.warn(`${label}: ListExports (${region}) failed: ${formatAwsErrorForWarn(err)}. Fn::ImportValue intrinsics will warn-and-drop.`);
+				logger.warn(`${label}: ListExports (${region}) failed: ${formatAwsErrorForWarn(err, "CloudFormation ListExports")}. Fn::ImportValue intrinsics will warn-and-drop.`);
 			});
 			return exportsPromise;
 		};
@@ -5163,24 +5366,36 @@ async function fetchAllExports(client) {
 * with bucket / region context), so the CFn provider extracts the
 * pieces directly here.
 *
-* Issue #578 — the result is FLATTENED TO ONE LINE via
-* {@link flattenToOneLine}, the same helper `credential-error` applies to
-* every other wire-derived value that lands on a log line, rather than a
-* second spelling of it. Both `err.name` and `err.message` come off the wire,
-* and this warn is relayed onto a `cdkl studio` serve child's stdout, where
-* `studio-serve-manager` splits on `\n`: an embedded newline puts line 2 on
-* the stream with no `WARN: ` prefix, so it clears the diagnostic bound and
-* matches a ready pattern at `^`. One line in, one line out.
-*/
-function formatAwsErrorForWarn(err) {
-	if (!(err instanceof Error)) return flattenToOneLine(String(err));
-	const name = err.name && err.name !== "Error" ? err.name : void 0;
-	const status = err.$metadata?.httpStatusCode;
-	const prefixParts = [];
-	if (name !== void 0) prefixParts.push(name);
-	if (status !== void 0) prefixParts.push(`HTTP ${status}`);
-	if (prefixParts.length === 0) return flattenToOneLine(err.message);
-	return flattenToOneLine(`${prefixParts.join(" ")}: ${err.message}`);
+* Issue #578 flattened the result to ONE LINE, because this warn is relayed
+* onto a `cdkl studio` serve child's stdout where `studio-serve-manager`
+* splits on `\n`: an embedded newline puts line 2 on the stream with no
+* `WARN: ` prefix, so it clears the diagnostic bound and matches a ready
+* pattern at `^`.
+*
+* Issue #579 finished the job. Flattening closed the forged-LINE half while
+* leaving the OTHER two open: the wire-derived `err.name` was interpolated
+* UNCLAMPED (`@aws-sdk/core` builds it from `x-amzn-errortype` with no length
+* cap and no character class), and `err.message` printed verbatim whatever
+* population it came from. LEVEL: every caller below is a DEFAULT-level warn.
+* RECONSTRUCTION: each `catch` wraps a `client.send(...)` — CloudFormation,
+* Lambda, or bedrock-agentcore-control — which resolves the credential chain
+* before the request goes out, so the `catch` sees both a
+* `CredentialsProviderError` (whose message can be a `credential_process`
+* command line) and a modeled service exception whose message IS the
+* diagnosis. That is exactly {@link describeAwsFailureForWarn}'s split, so
+* this is now a thin decoration over it rather than a second spelling of the
+* policy: `operation` names the call for the `debug` line the helper emits on
+* the withheld branch.
+*
+* The HTTP status is KEPT and moved to a suffix. Unlike the name it is not
+* body-derived — the SDK reads it off the HTTP response line — but it is
+* still range-guarded to an integer status, since `$metadata` is a plain
+* object a hostile shape could carry anything on.
+*/
+function formatAwsErrorForWarn(err, operation) {
+	const described = describeAwsFailureForWarn(err, operation);
+	const status = err?.$metadata?.httpStatusCode;
+	return typeof status === "number" && Number.isInteger(status) && status >= 100 && status < 600 ? `${described} (HTTP ${status})` : described;
 }
 
 //#endregion
@@ -5398,6 +5613,109 @@ function toFlagName(field) {
 //#endregion
 //#region src/local/state-resolver.ts
 /**
+* State-driven env-var resolution for `cdkl invoke --from-state`.
+*
+* The PR 1 env-resolver classifies any non-literal env-var value (a CFn
+* intrinsic like `Ref` / `Fn::GetAtt` / `Fn::Sub`) as "unresolved" and
+* drops it. That's correct when there's no source of truth for the
+* deployed value — which is also the SAM behavior — but it's wrong when
+* cdk-local has already deployed the stack and the AWS-current physical IDs
+* sit in the cdk-local state file.
+*
+* `--from-state` closes that gap: it loads the host's S3 state for the target
+* stack and substitutes `Ref` / `Fn::GetAtt` / `Fn::Sub` placeholders in
+* the function's `Properties.Environment.Variables` with the deployed
+* values. The result feeds back into the existing
+* `resolveEnvVars(...)` pipeline so `--env-vars` overrides still take
+* precedence — that ordering matters because users routinely override a
+* single variable while using `--from-state` to recover the rest.
+*
+* Scope:
+*
+*   - `Ref: <LogicalId>` — substituted with `state.resources[id].physicalId`.
+*   - `Fn::GetAtt: [<LogicalId>, <attr>]` (and the `"LogicalId.attr"`
+*     string form) — substituted with
+*     `state.resources[id].attributes[attr]`. We deliberately do NOT
+*     synthesize attributes the provider would normally compute (e.g.
+*     IAM role ARNs derived from physicalId + accountId) — `--from-state`
+*     surfaces only what cdk-local recorded at deploy time, which is what the
+*     deployed Lambda's env actually saw.
+*   - `Fn::Sub: '<template>'` (and the two-argument `[template, vars]`
+*     form) — `${LogicalId}` / `${LogicalId.attr}` placeholders are
+*     substituted in place; pseudo parameters (`${AWS::AccountId}` /
+*     `${AWS::Region}` / `${AWS::Partition}` / `${AWS::URLSuffix}`) are
+*     substituted from the optional `pseudoParameters` bag; unrelated
+*     placeholders (mapping references, parameters) are left untouched
+*     and the value is treated as unresolved.
+*   - `Fn::Join: [<delimiter>, [<elements>...]]` — every element is
+*     recursively resolved via this same module and joined with the
+*     delimiter. Closes Gap 1 of issue #286 (the SSM Parameter
+*     `ecs.Secret.fromSsmParameter` shape CDK synthesizes is
+*     `Fn::Join` with pseudo-parameter `Ref`s + a `Ref` to the
+*     parameter; without Fn::Join support the secret silently drops).
+*   - `Fn::Select: [<index>, <list>]` — picks the indexed element of an
+*     array. Index may be a number or a numeric string (CFn templates
+*     often carry the string form). The list argument may be a literal
+*     array of intrinsics OR an intrinsic that resolves to a
+*     `string[]` (today: only `Fn::Split`). Out-of-bounds / negative /
+*     non-finite index reports unresolved. Closes issue #636 — the
+*     `Fn.select(N, Fn.split(':', secret.secretArn))` shape CDK
+*     synthesizes for parsing secret ARN segments.
+*   - `Fn::Split: [<delimiter>, <string>]` — splits a string into a
+*     `string[]`. **Only valid INSIDE `Fn::Select`** — at the env-var
+*     top level the result is an array which can't be an env-var
+*     value, so the top-level dispatcher reports unresolved with a
+*     clear reason.
+*   - `Ref: AWS::AccountId` / `AWS::Region` / `AWS::Partition` /
+*     `AWS::URLSuffix` — substituted from the optional
+*     `pseudoParameters` bag the caller supplies. When the bag is
+*     missing (or the specific key isn't set), the placeholder reports
+*     unresolved — same warn-and-drop policy as every other miss.
+*
+* Cross-stack intrinsics (when the caller supplies a `crossStackResolver`
+* on the `SubstitutionContext` via the async API):
+*
+*   - `Fn::ImportValue: '<exportName>'` (or an intrinsic-valued argument
+*     that resolves to a string against state + pseudo parameters) —
+*     looked up via `crossStackResolver.resolveImport(exportName)`. The
+*     resolver typically reads the host's persistent exports index,
+*     falling back to a per-stack state.json scan on index miss
+*     (closes issue #454).
+*   - `Fn::GetStackOutput: { StackName, OutputName, Region? }` — looked
+*     up via `crossStackResolver.resolveGetStackOutput(stackName, region,
+*     outputName)`. The resolver typically reads the producer stack's
+*     state.json from S3 directly. `Region` defaults to the consumer's
+*     deploy region when omitted.
+*
+*   Both resolvers return `string | undefined`; an `undefined` value
+*   reports unresolved per the standard warn-and-drop policy. Cross-account
+*   `Fn::GetStackOutput.RoleArn` is rejected at the resolver layer (cdk-local
+*   uses S3 state, not CloudFormation; cross-account would require
+*   assuming the role and reading the producer account's separate state
+*   bucket — tracked under #449).
+*
+*   Only the async API (`substituteAgainstStateAsync` /
+*   `substituteEnvVarsFromStateAsync`) handles these. The legacy sync API
+*   surfaces them as `unresolved` ("unsupported intrinsic") so existing
+*   callers (e.g. `ecs-task-resolver.ts`'s sync container parsing) stay
+*   unchanged and the per-key warn-and-drop UX still fires.
+*
+* Out of scope (deferred):
+*
+*   - Cross-region `Fn::ImportValue` (tracked under #451).
+*   - Cross-account `Fn::GetStackOutput.RoleArn` (tracked under #449).
+*   - Other intrinsics (`Fn::If`, `Fn::FindInMap`, etc.). Anything
+*     beyond the supported set is reported as unresolved and the env
+*     var is dropped, matching PR 1's "warn-and-drop" semantics.
+*
+* Failure mode: per-key best-effort. When a substitution can't be
+* produced (state missing for the referenced logical ID, attribute not
+* captured at deploy time, unsupported intrinsic in `Fn::Sub`), the key
+* is reported as unresolved and the caller drops it from the env block
+* with a warn. We never throw out of substitution — a bad reference in
+* one env var must not abort the whole `cdkl invoke` call.
+*/
+/**
 * Substitute a single env-var / secret-ValueFrom value (which may be a
 * CFn intrinsic) against the provided state-recorded resources map and
 * optional pseudo-parameter bag.
@@ -5842,7 +6160,7 @@ async function resolveImportValueAsync(arg, context) {
 	} catch (err) {
 		return {
 			kind: "unresolved",
-			reason: `Fn::ImportValue '${exportName}': lookup failed: ${err instanceof Error ? err.message : String(err)}`
+			reason: `Fn::ImportValue '${flattenToOneLine(exportName)}': lookup failed: ${describeAwsFailureForWarn(err, "CrossStackResolver.resolveImport (Fn::ImportValue)")}`
 		};
 	}
 	if (resolved === void 0) return {
@@ -5917,7 +6235,7 @@ async function resolveGetStackOutputAsync(arg, context) {
 	} catch (err) {
 		return {
 			kind: "unresolved",
-			reason: `Fn::GetStackOutput '${stackName}.${outputName}' (${region}): lookup failed: ${err instanceof Error ? err.message : String(err)}`
+			reason: `Fn::GetStackOutput '${flattenToOneLine(stackName)}.${flattenToOneLine(outputName)}' (${flattenToOneLine(region)}): lookup failed: ${describeAwsFailureForWarn(err, "CrossStackResolver.resolveGetStackOutput (Fn::GetStackOutput)")}`
 		};
 	}
 	if (resolved === void 0) return {
@@ -7406,6 +7724,9 @@ async function pullEcrImage(imageUri, options) {
 			if (!identity.Account) throw new LocalInvokeBuildError("STS GetCallerIdentity returned no Account. Verify your AWS credentials.");
 			callerAccount = identity.Account;
 			CALLER_IDENTITY_CACHE.set(callerIdentityKey, callerAccount);
+		} catch (err) {
+			if (err instanceof LocalInvokeBuildError) throw err;
+			throw new LocalInvokeBuildError(`STS GetCallerIdentity failed while preparing the ECR pull: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity (ECR pull)")}. Verify your AWS credentials.`);
 		} finally {
 			sts.destroy();
 		}
@@ -7471,7 +7792,8 @@ async function assumeRoleForEcr(roleArn, callerRegion, profile, logger) {
 		};
 	} catch (err) {
 		if (err instanceof LocalInvokeBuildError) throw err;
-		throw new LocalInvokeBuildError(`Failed to assume role ${roleArn} for ECR pull: ${err instanceof Error ? err.message : String(err)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
+		const reason = describeAwsFailureForWarn(err, "STS AssumeRole (ECR pull)");
+		throw new LocalInvokeBuildError(`Failed to assume role ${flattenToOneLine(roleArn)} for ECR pull: ${reason}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
 	} finally {
 		sts.destroy();
 	}
@@ -7483,7 +7805,9 @@ async function assumeRoleForEcr(roleArn, callerRegion, profile, logger) {
 */
 async function ecrLogin(client, accountId, region) {
 	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region})`);
-	const authData = (await client.send(new GetAuthorizationTokenCommand({}))).authorizationData?.[0];
+	const authData = (await client.send(new GetAuthorizationTokenCommand({})).catch((err) => {
+		throw new LocalInvokeBuildError(`ECR GetAuthorizationToken failed (account=${accountId}, region=${region}): ${describeAwsFailureForWarn(err, "ECR GetAuthorizationToken")}. Verify the credentials can call ecr:GetAuthorizationToken.`);
+	})).authorizationData?.[0];
 	if (!authData?.authorizationToken) throw new LocalInvokeBuildError("Failed to get ECR authorization token");
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError("ECR authorization token has unexpected shape (missing username/password)");
@@ -15942,6 +16266,45 @@ var LayerMaterializationError = class LayerMaterializationError extends Error {
 		Object.setPrototypeOf(this, LayerMaterializationError.prototype);
 	}
 };
+/**
+* cdk-local's OWN rejection raised INSIDE a guarded region, still needing the
+* call site's framing (issue #579, review round 2).
+*
+* Two classes are needed, not one, because the guarded regions contain BOTH
+* kinds of cdk-local throw and they want opposite handling:
+*
+*   - ALREADY FRAMED — the ARN-shape guard raises
+*     `Layer <arn>: not a layer-version ARN ...`, which names the layer and the
+*     problem and fires before any AWS call. Re-raising it INTACT is right;
+*     wrapping it would double the `Layer <arn>:` prefix and, worse, prepend
+*     `GetLayerVersion failed` to a failure where no call was ever made.
+*   - UNFRAMED — `AssumeRole returned no Credentials` and
+*     `GetLayerVersion response did not include Content.Location` are bare
+*     sentences that mean nothing without the site's `Layer <arn>: <call>
+*     failed: ... <remedy>` envelope.
+*
+* A first pass at #579 made both `LayerMaterializationError` and re-raised
+* both, which silently DROPPED the envelope (and the `looksLikeAccessDenied`
+* hint) from the second group. The existing tests only substring-match the
+* inner sentence, so nothing went red. Hence a distinct type rather than a
+* shared one: the catch keeps the message verbatim — it is cdk-local's own
+* text, never anything off the wire, so the credential-error policy has
+* nothing to decide about it — and still applies the framing.
+*/
+var UnframedLayerError = class UnframedLayerError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "UnframedLayerError";
+		Object.setPrototypeOf(this, UnframedLayerError.prototype);
+	}
+};
+/**
+* The detail half of a layer failure message: cdk-local's own text kept
+* verbatim, anything else rendered by the shared credential-error policy.
+*/
+function layerFailureDetail(err, operation) {
+	return err instanceof UnframedLayerError ? err.message : describeAwsFailureForWarn(err, operation);
+}
 async function materializeLayerFromArn(layer, options = {}) {
 	const logger = getLogger();
 	let credentials;
@@ -15949,14 +16312,16 @@ async function materializeLayerFromArn(layer, options = {}) {
 		credentials = await assumeRoleForLayer(options.roleArn, layer.region, options);
 		logger.debug(`Layer ${layer.arn}: assumed role ${options.roleArn} for GetLayerVersion`);
 	} catch (err) {
-		throw new LayerMaterializationError(`Layer ${layer.arn}: STS AssumeRole(${options.roleArn}) failed: ${errMsg(err)}. Check the role trust policy permits your principal and sts:AssumeRole is allowed.`);
+		if (err instanceof LayerMaterializationError) throw err;
+		throw new LayerMaterializationError(`Layer ${layer.arn}: STS AssumeRole(${flattenToOneLine(options.roleArn)}) failed: ${layerFailureDetail(err, "STS AssumeRole (--layer-role-arn)")}. Check the role trust policy permits your principal and sts:AssumeRole is allowed.`);
 	}
 	let presignedUrl;
 	try {
 		presignedUrl = await fetchLayerContentUrl(layer, credentials, options);
 	} catch (err) {
+		if (err instanceof LayerMaterializationError) throw err;
 		const hint = looksLikeAccessDenied(err) ? " GetLayerVersion access denied; check the credentials / role can read the layer (grant lambda:GetLayerVersion on the layer ARN, or pass --layer-role-arn <arn> to assume a role in the layer account)." : "";
-		throw new LayerMaterializationError(`Layer ${layer.arn}: GetLayerVersion failed in region ${layer.region}: ${errMsg(err)}.${hint}`);
+		throw new LayerMaterializationError(`Layer ${layer.arn}: GetLayerVersion failed in region ${layer.region}: ${layerFailureDetail(err, "Lambda GetLayerVersion")}.${hint}`);
 	}
 	let zipBytes;
 	try {
@@ -15986,7 +16351,7 @@ async function fetchLayerContentUrl(layer, credentials, options) {
 		const versionLessArn = versionSuffix[1];
 		const command = await buildGetLayerVersionCommand(versionLessArn, Number(layer.version));
 		const url = (await client.send(command))?.Content?.Location;
-		if (!url || typeof url !== "string") throw new Error("GetLayerVersion response did not include Content.Location (presigned ZIP URL)");
+		if (!url || typeof url !== "string") throw new UnframedLayerError("GetLayerVersion response did not include Content.Location (presigned ZIP URL)");
 		return url;
 	} finally {
 		client.destroy?.();
@@ -15997,7 +16362,7 @@ async function assumeRoleForLayer(roleArn, region, options) {
 	try {
 		const command = await buildAssumeRoleCommand(roleArn);
 		const creds = (await client.send(command))?.Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey) throw new Error("AssumeRole returned no Credentials");
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey) throw new UnframedLayerError("AssumeRole returned no Credentials");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -16040,7 +16405,7 @@ async function buildAssumeRoleCommand(roleArn) {
 async function downloadPresignedZip(presignedUrl, options) {
 	if (options.fetchZip) return options.fetchZip(presignedUrl);
 	const response = await fetch(presignedUrl);
-	if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText} from layer Content.Location URL`);
+	if (!response.ok) throw new Error(`HTTP ${response.status} ${flattenToOneLine(response.statusText)} from layer Content.Location URL`);
 	const buf = await response.arrayBuffer();
 	return new Uint8Array(buf);
 }
@@ -16114,6 +16479,27 @@ async function inflateRaw(data) {
 		});
 	});
 }
+/**
+* Message of a thrown value, for the two throws that are NOT AWS SDK relays.
+*
+* Issue #579 deliberately left these two on `errMsg`: the presigned-URL
+* download is a plain HTTPS fetch (the URL already carries its authorization,
+* so no credential chain is resolved and no modeled service exception is
+* parsed) and the unzip is a purely LOCAL operation. Neither `catch` can see a
+* `credential_process` command line, so there is nothing for the
+* credential-error policy to DECIDE about them. The two AWS calls in this
+* module — STS `AssumeRole` and `lambda:GetLayerVersion` — go through
+* `describeAwsFailureForWarn` instead.
+*
+* CORRECTED in review round 2: an earlier revision of this note claimed these
+* catches see nothing wire-derived at all, which was stronger than the code.
+* The download `catch` DOES see wire-derived text — `downloadPresignedZip`
+* raises `HTTP <status> <statusText> ...`, and the reason phrase is whatever
+* the presigned host sent. Nothing there needs WITHHOLDING (no credential
+* chain, no secret), but it does need FLATTENING, which is applied at that
+* throw rather than here, because `errMsg` is also used by the unzip `catch`
+* whose input is a local `fflate` error.
+*/
 function errMsg(err) {
 	return err instanceof Error ? err.message : String(err);
 }
@@ -18791,7 +19177,7 @@ async function resolveLambdaContainerEnv(lambda, options, profileCredentials, ex
 			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 			assumeSucceeded = true;
 		} catch (err) {
-			const reason = describeAwsFailureForWarn(err, "STS AssumeRole");
+			const reason = err instanceof AssumeRoleFailure ? err.detail : describeAwsFailureForWarn(err, "STS AssumeRole");
 			logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(resolvedAssumeRoleArn)}) failed: ${reason}. Falling back to the developer's shell credentials.`);
 		}
 	}
@@ -19308,9 +19694,18 @@ async function downloadAndExtractS3Bundle(location, options = {}) {
 		}).then(() => void 0)
 	};
 }
+/**
+* `s3://<bucket>/<key>[?versionId=...]` for a log or error line.
+*
+* FLATTENED (issue #579 review round 3). Under `--from-cfn-stack` the bucket
+* and key are resolved from template intrinsics against DEPLOYED state — a
+* `Ref` / `Fn::ImportValue` answered by `ListStackResources` / `ListExports` —
+* so they are wire-derived on that path, and this string now lands on a
+* default-level error line as well as the `info` progress line it always fed.
+*/
 function formatRef(location) {
-	const version = location.versionId ? `?versionId=${location.versionId}` : "";
-	return `s3://${location.bucket}/${location.key}${version}`;
+	const version = location.versionId ? `?versionId=${flattenToOneLine(location.versionId)}` : "";
+	return `s3://${flattenToOneLine(location.bucket)}/${flattenToOneLine(location.key)}${version}`;
 }
 /**
 * Guard against zip-slip: reject an entry whose normalized path escapes the
@@ -19342,6 +19737,9 @@ function defaultFetchObject$1(options) {
 			}));
 			if (!res.Body) throw new CdkLocalError(`S3 GetObject for ${formatRef(location)} returned an empty body.`, "LOCAL_INVOKE_AGENTCORE_S3_BUNDLE_EMPTY_BODY");
 			return await res.Body.transformToByteArray();
+		} catch (err) {
+			if (err instanceof CdkLocalError) throw err;
+			throw new CdkLocalError(`S3 GetObject for ${formatRef(location)} failed: ${describeAwsFailureForWarn(err, "S3 GetObject (fromS3 bundle)")}`, "LOCAL_INVOKE_AGENTCORE_S3_BUNDLE_FETCH_FAILED");
 		} finally {
 			client.destroy();
 		}
@@ -20456,7 +20854,8 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region,
 	if (assumeRoleArn) try {
 		return await assumeAgentCoreExecutionRole(assumeRoleArn, region, options.profile);
 	} catch (err) {
-		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for --sigv4 signing: ${describeAwsFailureForWarn(err, "STS AssumeRole (--sigv4 signing)")}. Falling back to ${options.profile ? `--profile ${options.profile}` : "shell credentials"}.`);
+		const sigv4Detail = err instanceof AssumeRoleFailure ? err.detail : describeAwsFailureForWarn(err, "STS AssumeRole (--sigv4 signing)");
+		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for --sigv4 signing: ${sigv4Detail}. Falling back to ${options.profile ? `--profile ${options.profile}` : "shell credentials"}.`);
 	}
 	if (options.profile) {
 		const creds = await resolveProfileCredentials(options.profile);
@@ -20579,7 +20978,8 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 	if (assumeRoleArn) try {
 		credentials = await assumeAgentCoreExecutionRole(assumeRoleArn, region, options.profile);
 	} catch (err) {
-		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for the fromS3 bundle download: ${describeAwsFailureForWarn(err, "STS AssumeRole (fromS3 bundle download)")}. Falling back to ${options.profile ? `--profile ${options.profile}` : "the default credentials"}.`);
+		const bundleDetail = err instanceof AssumeRoleFailure ? err.detail : describeAwsFailureForWarn(err, "STS AssumeRole (fromS3 bundle download)");
+		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for the fromS3 bundle download: ${bundleDetail}. Falling back to ${options.profile ? `--profile ${options.profile}` : "the default credentials"}.`);
 	}
 	const bundle = await downloadAndExtractS3Bundle(location, {
 		...region !== void 0 && { region },
@@ -20777,7 +21177,8 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 			assumeSucceeded = true;
 		} catch (err) {
-			logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(args.assumeRoleArn)}) failed: ${describeAwsFailureForWarn(err, "STS AssumeRole")}. Falling back to the developer's shell credentials.`);
+			const assumeDetail = err instanceof AssumeRoleFailure ? err.detail : describeAwsFailureForWarn(err, "STS AssumeRole");
+			logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(args.assumeRoleArn)}) failed: ${assumeDetail}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -20937,7 +21338,7 @@ async function assumeAgentCoreExecutionRole(roleArn, region, profile) {
 			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-invoke-agentcore-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new AssumeRoleFailure(`AssumeRole(${flattenToOneLine(roleArn)}) returned no usable credentials.`, "the response carried no usable credentials");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -21914,7 +22315,7 @@ async function resolveSecretsManager(entry, shape, client) {
 	try {
 		secretString = (await client.send(new GetSecretValueCommand({ SecretId: shape.baseArn }))).SecretString;
 	} catch (err) {
-		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container '${entry.containerName}' / env '${entry.name}' (${shape.baseArn}): ${err instanceof Error ? err.message : String(err)}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container '${entry.containerName}' / env '${entry.name}' (${shape.baseArn}): ${describeAwsFailureForWarn(err, "SecretsManager GetSecretValue")}`);
 	}
 	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container '${entry.containerName}' / env '${entry.name}' (${shape.baseArn}). Binary secrets are not supported.`);
 	if (shape.jsonKey === void 0) return secretString;
@@ -21940,7 +22341,7 @@ async function resolveSsm(entry, shape, client) {
 		return value;
 	} catch (err) {
 		if (err instanceof EcsSecretsResolutionError) throw err;
-		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container '${entry.containerName}' / env '${entry.name}' (${shape.name}): ${err instanceof Error ? err.message : String(err)}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container '${entry.containerName}' / env '${entry.name}' (${shape.name}): ${describeAwsFailureForWarn(err, "SSM GetParameter (ECS secret)")}`);
 	}
 }
 
@@ -24053,6 +24454,22 @@ const defaultReadContainerLogsImpl = async (containerId) => {
 * `read` is injectable so the unit test can assert the formatting without
 * a real container; production callers use the default `docker logs`
 * reader.
+*
+* Issue #579 — ONE `logger.warn` PER TAIL LINE, not one warn carrying an
+* embedded `\n`. LEVEL: a default-level warn, and under `cdkl studio` the
+* serve child's stdout is mirrored into a log ring served over HTTP. The
+* studio serve manager reads that stdout with `streamLines`, which splits on
+* `\n`, and it declines to pattern-match a line carrying cdk-local's own
+* `WARN: ` prefix (issue #578). A multi-line warn defeats that bound from the
+* inside: the logger prefixes the MESSAGE, so line 2 onward arrives
+* prefix-less and is matched at `^` — and the content is the CONTAINER's own
+* stdout, i.e. whatever the application printed. An app that logs
+* `Server listening on http://10.0.0.9:3000` (which is exactly what a web
+* framework prints, and this tail fires when such an app has just crashed)
+* would re-point the capture proxy. RECONSTRUCTION does not arise: this is
+* container output, not an AWS SDK failure, so nothing is withheld — the whole
+* tail still prints, one prefixed line at a time. Each line is additionally
+* flattened, so a `\r` or U+2028 inside one cannot re-split it downstream.
 */
 async function printExitedContainerLogs(replicaIndex, containerId, logger, read = defaultReadContainerLogsImpl) {
 	let raw;
@@ -24064,7 +24481,12 @@ async function printExitedContainerLogs(replicaIndex, containerId, logger, read
 	}
 	const tail = raw.trimEnd();
 	if (tail.length === 0) return;
-	logger.warn(`Replica ${replicaIndex} essential container logs (last ${EXIT_LOG_TAIL_LINES} lines):\n${tail}`);
+	logger.warn(`Replica ${replicaIndex} essential container logs (last ${EXIT_LOG_TAIL_LINES} lines):`);
+	for (const line of tail.split(/\r?\n/)) {
+		const flat = flattenToOneLine(line).trimEnd();
+		if (flat.trim().length === 0) continue;
+		logger.warn(`Replica ${replicaIndex} | ${flat}`);
+	}
 }
 const defaultSleepImpl = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 let sleepImpl = defaultSleepImpl;
@@ -27742,6 +28164,9 @@ async function resolvePlaceholderAccount$1(arn, region, profile) {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
 		if (!account) throw new LocalStartServiceError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'.`);
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
+	} catch (err) {
+		if (err instanceof LocalStartServiceError) throw err;
+		throw new LocalStartServiceError(`--assume-task-role: STS GetCallerIdentity failed while resolving placeholder ARN '${flattenToOneLine(arn)}': ${describeAwsFailureForWarn(err, "STS GetCallerIdentity (task-role placeholder)")}. Pass the ARN explicitly: --assume-task-role <arn>`);
 	} finally {
 		sts.destroy();
 	}
@@ -28289,6 +28714,18 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 	}
 }
 /**
+* cdk-local's own rejection from {@link resolvePlaceholderAccount}, so the
+* relay below can tell it apart from a wire-derived SDK failure and re-raise it
+* intact (issue #579).
+*/
+var PlaceholderAccountError = class PlaceholderAccountError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "PlaceholderAccountError";
+		Object.setPrototypeOf(this, PlaceholderAccountError.prototype);
+	}
+};
+/**
 * If `arn` contains the `${AWS::AccountId}` placeholder emitted by the
 * resolver for inline same-stack IAM Roles, substitute the live caller
 * account via STS `GetCallerIdentity`. Otherwise pass through unchanged.
@@ -28302,8 +28739,13 @@ async function resolvePlaceholderAccount(arn, region, profile) {
 	}));
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'. Pass the ARN explicitly: --assume-task-role <arn>`);
+		if (!account) throw new PlaceholderAccountError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'. Pass the ARN explicitly: --assume-task-role <arn>`);
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
+	} catch (err) {
+		if (err instanceof PlaceholderAccountError) throw err;
+		const shownArn = flattenToOneLine(arn);
+		const detail = describeAwsFailureForWarn(err, "STS GetCallerIdentity (task-role placeholder)");
+		throw new PlaceholderAccountError(`--assume-task-role: STS GetCallerIdentity failed while resolving placeholder ARN '${shownArn}': ${detail}. Pass the ARN explicitly: --assume-task-role <arn>`);
 	} finally {
 		sts.destroy();
 	}
@@ -31155,9 +31597,9 @@ function createS3OriginReader(bucketName, options = {}) {
 			};
 			if (direct.kind === "denied" && !deniedWarned) {
 				deniedWarned = true;
-				getLogger().warn(`S3 denied reading '${key}' from bucket '${bucketName}'. If this is an OAC-locked / private bucket your credentials cannot read, point the origin at a local directory with --origin <originId>=<dir> (or use credentials with s3:GetObject on the bucket). ${getEmbedConfig().cliName} start-cloudfront reads the origin from real S3.`);
+				getLogger().warn(`S3 denied reading '${flattenToOneLine(key)}' from bucket '${flattenToOneLine(bucketName)}'. If this is an OAC-locked / private bucket your credentials cannot read, point the origin at a local directory with --origin <originId>=<dir> (or use credentials with s3:GetObject on the bucket). ${getEmbedConfig().cliName} start-cloudfront reads the origin from real S3.`);
 			}
-			if (direct.kind === "error") getLogger().warn(`S3 read of '${key}' from bucket '${bucketName}' failed: ${direct.message}`);
+			if (direct.kind === "error") getLogger().warn(`S3 read of '${flattenToOneLine(key)}' from bucket '${flattenToOneLine(bucketName)}' failed: ${direct.message}`);
 		}
 		for (const candidate of resolveErrorResponseCandidates(input.customErrorResponses)) {
 			const page = await fetchObject(candidate.errorKey);
@@ -31166,7 +31608,7 @@ function createS3OriginReader(bucketName, options = {}) {
 				headers: { "content-type": contentTypeForKey(candidate.errorKey) },
 				body: page.body
 			};
-			if (page.kind === "denied" || page.kind === "error") getLogger().warn(`S3 could not read custom-error page '${candidate.errorKey}' from bucket '${bucketName}' (${page.kind}); falling through.`);
+			if (page.kind === "denied" || page.kind === "error") getLogger().warn(`S3 could not read custom-error page '${flattenToOneLine(candidate.errorKey)}' from bucket '${flattenToOneLine(bucketName)}' (${page.kind}); falling through.`);
 		}
 		return {
 			statusCode: 404,
@@ -31234,6 +31676,18 @@ function defaultFetchObject(bucketName, options) {
 * Classify an S3 SDK error: a missing key (`NoSuchKey` / 404) is `not-found`
 * (try the SPA fallback), an `AccessDenied` / 403 is `denied` (a credential /
 * OAC config problem), anything else is `error`.
+*
+* Issue #579 — the `error` branch's `message` is the only one that reaches a
+* log line (the reader prints it in a DEFAULT-level `S3 read of ... failed:`
+* warn), so it is rendered by {@link describeAwsFailureForWarn}. LEVEL: a
+* default-level warn, mirrored into the studio log ring. RECONSTRUCTION: the
+* `catch` this classifies for wraps `client.send(GetObjectCommand)`, which
+* resolves the credential chain before the request goes out — a
+* `CredentialsProviderError` here is COMMON, since the whole point of this
+* origin is reading a deployed bucket with the developer's own credentials —
+* alongside a modeled S3 exception whose message is the diagnosis. The
+* `not-found` / `denied` branches carry no message at all and are untouched:
+* their names are structural discriminators, not text that gets printed.
 */
 function classifyS3Error(err) {
 	const e = err;
@@ -31243,7 +31697,7 @@ function classifyS3Error(err) {
 	if (status === 403 || name === "AccessDenied" || name === "Forbidden") return { kind: "denied" };
 	return {
 		kind: "error",
-		message: err instanceof Error ? err.message : String(err)
+		message: describeAwsFailureForWarn(err, "S3 GetObject")
 	};
 }
 
@@ -31305,7 +31759,7 @@ function createDeployedKvsDataSource(options) {
 				}))).Value;
 			} catch (err) {
 				if (isKeyNotFound(err)) return void 0;
-				throw new Error(`cf.kvs().get('${key}') against ${options.kvsArn} failed: ${err instanceof Error ? err.message : String(err)}`);
+				throw new Error(`cf.kvs().get('${key}') against ${flattenToOneLine(options.kvsArn)} failed: ${describeAwsFailureForWarn(err, "CloudFront KeyValueStore GetKey")}`);
 			}
 		}
 	};
@@ -31332,7 +31786,7 @@ async function resolveDeployedKvsArnByName(name, options = {}) {
 			...item.Id !== void 0 && { id: item.Id }
 		};
 	} catch (err) {
-		getLogger().debug(`ListKeyValueStores lookup for '${name}' failed: ${err instanceof Error ? err.message : String(err)}`);
+		getLogger().debug(`ListKeyValueStores lookup for '${name}' failed: ${flattenToOneLine(stringifyThrown(err))}`);
 	}
 }
 /** True when a GetKey error means the key (or store) was not found, not a real failure. */
@@ -38520,7 +38974,7 @@ async function prepareEcsImageContexts(args) {
 			const ctx = await buildEcsImageResolutionContext(stack, stateProvider, options);
 			contextByStack.set(stack.stackName, ctx);
 		} catch (err) {
-			logger.warn(`studio: could not build deployed-state image context for stack '${stack.stackName}'; ECS services in it resolve against the synthed template only. ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`studio: could not build deployed-state image context for stack '${stack.stackName}'; ECS services in it resolve against the synthed template only. ${describeAwsFailureForWarn(err, "deployed-state image context (CloudFormation + SSM)")}`);
 			contextByStack.set(stack.stackName, void 0);
 		} finally {
 			stateProvider?.dispose();
@@ -38998,4 +39452,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, describeCredentialLoadFailure as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, resolveProfileCredentials as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildStsClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, describeAwsFailureForWarn as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-BIHN-Erp.js.map
+//# sourceMappingURL=local-studio-DOdzcjkE.js.map