cdk-local 0.147.21 → 0.148.0

package/dist/{local-studio-J8BtocsI.js → local-studio-DoyRYZf6.js}

@@ -5,6 +5,13 @@ import * as path$1 from "node:path";
 import path, { dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { Command, Option } from "commander";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
+import { Agent, createServer, request } from "node:http";
+import { Agent as Agent$1, createServer as createServer$1 } from "node:https";
+import { NodeHttpHandler } from "@smithy/node-http-handler";
+import { Agent as Agent$2 } from "agent-base";
+import { HttpProxyAgent } from "http-proxy-agent";
+import { HttpsProxyAgent } from "https-proxy-agent";
+import { getProxyForUrl } from "proxy-from-env";
 import { unzipSync } from "fflate";
 import { MultiSelectPrompt } from "@clack/core";
 import { S_BAR, S_BAR_END, S_BAR_START, S_CHECKBOX_ACTIVE, S_CHECKBOX_INACTIVE, S_CHECKBOX_SELECTED, confirm, isCancel, multiselect, select, text } from "@clack/prompts";
@@ -15,7 +22,7 @@ import { GetFunctionConfigurationCommand, LambdaClient } from "@aws-sdk/client-l
 import { BedrockAgentCoreControlClient, GetAgentRuntimeCommand } from "@aws-sdk/client-bedrock-agentcore-control";
 import { GetParameterCommand, GetParametersCommand, SSMClient } from "@aws-sdk/client-ssm";
 import { execFile, spawn } from "node:child_process";
-import { connect, createServer } from "node:net";
+import { connect, createServer as createServer$2 } from "node:net";
 import { promisify } from "node:util";
 import * as nodeCrypto from "node:crypto";
 import { X509Certificate, createHash, createHmac, createPublicKey, createVerify, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -25,8 +32,6 @@ import { join as join$1 } from "path";
 import { WebSocket, WebSocketServer } from "ws";
 import { Readable } from "node:stream";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { createServer as createServer$1, request } from "node:http";
-import { createServer as createServer$2 } from "node:https";
 import { mkdir, mkdtemp, readFile as readFile$1, readdir, rm, writeFile } from "node:fs/promises";
 import { pipeline } from "node:stream/promises";
 import * as chokidar from "chokidar";
@@ -42,6 +47,290 @@ import { CloudFrontClient, paginateListKeyValueStores } from "@aws-sdk/client-cl
 import { CloudFrontKeyValueStoreClient, GetKeyCommand, ResourceNotFoundException } from "@aws-sdk/client-cloudfront-keyvaluestore";
 import { EventEmitter } from "node:events";
 
+//#region src/utils/url-authority.ts
+/**
+* Compose the authority component of a URL from a host and a port.
+*
+* Every local serve prints an endpoint banner, and several of those banners
+* are MACHINE-PARSED — `cdkl studio` reads them to learn where to point its
+* capture proxy (`local/studio-serve-manager`'s `readyRe` /
+* `parsePublishedHostEndpoint`), then resolves the result with `new URL(...)`
+* before it will forward anything there. So an authority that the WHATWG
+* parser rejects is not a cosmetic log defect: the serve is refused.
+*
+* The one shape that used to be composed wrong is an IPv6 literal. RFC 3986
+* 3.2.2 requires it to be bracketed inside an authority, so a bare
+* `${host}:${port}` turns `--container-host ::` into `http://:::8080`, which
+* is not a URL — while the IPv4 wildcard `0.0.0.0`, the same intention spelled
+* differently, works. Issue go-to-k/cdk-local#599.
+*
+* The detection is mechanical rather than a list of known values: a colon is
+* forbidden in both a registered name and an IPv4 address, so a host carrying
+* one is an IPv6 literal — PROVIDED the rest of it could be one, which is a
+* character-class test (hex digits, `:`, and `.` for the IPv4-mapped form)
+* rather than an enumeration. The qualifier is load-bearing rather than
+* pedantry: `buildRedirectLocation` fills its host from an ALB `#{host}`
+* template or a configured literal, so a CRLF-injection attempt reaches this
+* function AS-IS — `example.test\r\nx-injected: yes`, with the CR/LF still in
+* it, because `front-door-server` sanitises the Location only AFTER building
+* it. Either way it is a colon in something that is not an address and must
+* pass through untouched rather than gain brackets it never had. (CR and LF
+* are outside the character class by construction, so the raw and flattened
+* spellings classify identically — but the raw one is what actually arrives.)
+* Caught by `front-door-server.test.ts`'s raw-socket injection case.
+*/
+/**
+* A host that could be an IPv6 literal: hex digits, `:` separators, and `.`
+* for the IPv4-mapped form (`::ffff:127.0.0.1`). Deliberately NOT a full
+* grammar — the job is to separate "an address" from "not an address", and
+* validating an address that has already been bound to is not this function's
+* business.
+*/
+const IPV6_LITERAL_CHARS = /^[0-9A-Fa-f:.]+$/;
+/**
+* Render `host` as it must appear inside a URL authority.
+*
+* - An IPv6 literal is bracketed, in either case (`FE80::1` -> `[FE80::1]`).
+* - An already-bracketed literal comes back bracketed exactly once, so the
+*   function is idempotent: `[::1]` never becomes `[[::1]]`. That matters
+*   because a caller often feeds back a `URL.hostname`, which is ALREADY
+*   bracketed.
+* - A zone id (`fe80::1%en0`) is DROPPED, keeping `[fe80::1]`. No URL parser
+*   accepts one — Node's `new URL` throws on both the raw `%en0` and the
+*   percent-encoded `%25en0` — and a zone id is a host-local interface
+*   selector that carries no meaning for whoever reads the banner. Emitting
+*   an authority nothing can parse is the exact failure this helper exists to
+*   prevent, so the scope is dropped rather than propagated. The brackets are
+*   removed BEFORE that decision, so `[fe80::1%en0]` is stripped too — an
+*   early return on "already bracketed" would have waved the one input that
+*   is both bracketed and unparseable straight through.
+* - Everything else (IPv4 literal, registered name, the empty string, and a
+*   colon-bearing string that is not an address) is returned untouched.
+*/
+function formatHostForAuthority(host) {
+	const inner = host.length > 1 && host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+	if (!inner.includes(":")) return host;
+	const zoneAt = inner.indexOf("%");
+	const literal = zoneAt === -1 ? inner : inner.slice(0, zoneAt);
+	if (!IPV6_LITERAL_CHARS.test(literal)) return host;
+	return `[${literal}]`;
+}
+/**
+* Compose `<host>:<port>` for use inside a URL, bracketing an IPv6 literal.
+*
+* An empty `host` is passed through as-is rather than substituted: the helper
+* composes an authority, it does not invent a host, and a caller that has no
+* host has a bug of its own. The result (`:8080`) does not parse, which is the
+* honest rendering of that state.
+*/
+function formatAuthority(host, port) {
+	return `${formatHostForAuthority(host)}:${port}`;
+}
+/**
+* Read the HOST out of an authority (`<host>` or `<host>:<port>`), returning
+* it BARE — an IPv6 literal comes back without its brackets, ready to be
+* handed straight back to {@link formatAuthority}.
+*
+* The inverse of {@link formatAuthority}, and it exists for the same reason:
+* `authority.split(':')[0]` is the obvious thing to write and it is wrong for
+* exactly one input. A conforming client sends `Host: [::1]:8080` (measured —
+* see `tests/unit/local/ipv6-host-header.test.ts`), and splitting that on the
+* first colon yields `'['`, so an ALB `#{host}` substitution built from it
+* produced `http://[:8080/...`. Issue go-to-k/cdk-local#599.
+*
+* # It refuses rather than guesses — on BOTH arms
+*
+* This is an attacker-reachable parser: the request `Host` header feeds an
+* ALB `#{host}` substitution, and whatever comes back is composed into a
+* redirect `Location`. So a malformed authority yields the empty string
+* rather than the fragment that happens to be readable, on either branch.
+*
+* BRACKETED — read to the closing `]`, and only when the value is
+* well-formed: there must BE a closing bracket, and what follows it must be
+* empty or `:<digits>`. Guessing here is the worse of the two directions,
+* because the guess PARSES: `[evil.example` (no closing bracket) would come
+* back as `evil.example`, turning a half-named host into a valid `Location`
+* the client would follow, where the malformed input should have produced
+* nothing. `[a:b]junk` would silently drop its trailing junk, and `[x:y`
+* would return a multi-colon value as a host — the very thing the other arm
+* refuses.
+*
+* UNBRACKETED — the text before its single `:`. Two or more colons yields
+* the empty string: it is not a shape any conforming client sends (Node
+* brackets — measured in `tests/unit/local/ipv6-host-header.test.ts`), it has
+* no unambiguous split, and returning the leading fragment would hand a
+* caller a host that is not the one named. `split(':')[0]` did exactly that —
+* `fe80::1:8080` came back as `'fe80'`.
+*/
+function hostFromAuthority(authority) {
+	if (authority.startsWith("[")) {
+		const close = authority.indexOf("]");
+		if (close === -1) return "";
+		const afterBracket = authority.slice(close + 1);
+		if (afterBracket !== "" && !/^:\d+$/.test(afterBracket)) return "";
+		return authority.slice(1, close);
+	}
+	const firstColon = authority.indexOf(":");
+	if (firstColon === -1) return authority;
+	if (authority.includes(":", firstColon + 1)) return "";
+	return authority.slice(0, firstColon);
+}
+
+//#endregion
+//#region src/utils/aws-proxy.ts
+/**
+* Proxy-aware AWS SDK client plumbing (issue #634).
+*
+* The AWS SDK for JavaScript v3 does not read `HTTPS_PROXY` / `HTTP_PROXY` /
+* `NO_PROXY` on its own: a proxy must be supplied through a `requestHandler`
+* by whoever constructs the client. On a machine whose only egress is a
+* corporate forward proxy, every AWS call cdk-local makes would otherwise
+* fail (typically as `CredentialsProviderError: self-signed certificate in
+* certificate chain` — the direct route is intercepted).
+*
+* `buildProxyClientConfig()` is the single seam: it returns an EMPTY config
+* when no proxy environment variable is set (zero behavior change for
+* existing users), and a `{ requestHandler, credentials }` fragment when one
+* is. Every AWS SDK client construction in cdk-local spreads it (directly, or
+* via `buildStsClientConfig` for the STS sites);
+* `tests/unit/utils/aws-proxy-client-audit.test.ts` fences the sweep so a new
+* construction site cannot silently skip it.
+*/
+/**
+* The SDK applies these defaults only when it builds its OWN agents from a
+* plain option bag; an externally supplied Agent instance passes through
+* `NodeHttpHandler.resolveDefaultConfig` untouched. Set them explicitly so
+* the proxied path keeps the same socket profile as the unproxied default.
+*/
+const AGENT_OPTS = {
+	keepAlive: true,
+	maxSockets: 50
+};
+/**
+* Whether any standard proxy environment variable is set (either spelling).
+* `NO_PROXY` alone does not count — with no proxy to route to there is
+* nothing to exempt from.
+*
+* Read live (not memoized) so a host CLI that sets the variables
+* programmatically before constructing clients is honored.
+*/
+function isProxyEnvConfigured() {
+	const env = process.env;
+	return Boolean(env["https_proxy"] || env["HTTPS_PROXY"] || env["http_proxy"] || env["HTTP_PROXY"] || env["all_proxy"] || env["ALL_PROXY"]);
+}
+/**
+* An `agent-base` Agent that decides PER REQUEST whether to tunnel through
+* the configured proxy or connect directly. `NodeHttpHandler` picks its agent
+* by protocol alone, and `https-proxy-agent` does not consult `NO_PROXY` —
+* so the `NO_PROXY` decision has to live in `connect()`, where the target
+* host is known.
+*
+* `getProxyForUrl` (proxy-from-env) implements the standard semantics:
+* lowercase spellings win, entries split on commas AND whitespace, an entry
+* is an EXACT hostname match unless it starts with `.` or `*` (then a
+* suffix match), a `:port` on an entry must match the target port, and a
+* bare `*` disables proxying entirely.
+*
+* The inner agents are cached per proxy URL (not rebuilt per `connect()`),
+* and `destroy()` forwards to every one of them. Exported for unit tests;
+* construct through {@link buildProxyClientConfig} everywhere else.
+*/
+var EnvRoutingProxyAgent = class extends Agent$2 {
+	proxyAgents = /* @__PURE__ */ new Map();
+	directHttpAgent = new Agent(AGENT_OPTS);
+	directHttpsAgent = new Agent$1(AGENT_OPTS);
+	constructor() {
+		super(AGENT_OPTS);
+	}
+	connect(_req, options) {
+		const secure = options.secureEndpoint;
+		const host = options.host ?? "localhost";
+		const port = options.port || (secure ? 443 : 80);
+		const proxyUrl = getProxyForUrl(`${secure ? "https" : "http"}://${formatAuthority(host, port)}`);
+		if (!proxyUrl) return secure ? this.directHttpsAgent : this.directHttpAgent;
+		const key = `${secure ? "https" : "http"}|${proxyUrl}`;
+		let agent = this.proxyAgents.get(key);
+		if (!agent) {
+			agent = secure ? new HttpsProxyAgent(proxyUrl, AGENT_OPTS) : new HttpProxyAgent(proxyUrl, AGENT_OPTS);
+			this.proxyAgents.set(key, agent);
+		}
+		return agent;
+	}
+	destroy() {
+		for (const agent of this.proxyAgents.values()) agent.destroy();
+		this.proxyAgents.clear();
+		this.directHttpAgent.destroy();
+		this.directHttpsAgent.destroy();
+		super.destroy();
+	}
+};
+/**
+* Build a fresh `NodeHttpHandler` that routes through the proxy environment.
+* Fresh per call on purpose: `NodeHttpHandler.destroy()` destroys its agents
+* unconditionally (external instances included), so a handler — and its
+* agents — must never be shared across clients, or one client's `destroy()`
+* strands its siblings.
+*/
+function buildProxyRequestHandler() {
+	const agent = new EnvRoutingProxyAgent();
+	return new NodeHttpHandler({
+		httpAgent: agent,
+		httpsAgent: agent
+	});
+}
+/**
+* AWS SDK client config that honors the standard proxy environment
+* (`HTTPS_PROXY` / `HTTP_PROXY` / `ALL_PROXY`, lowercase spellings included,
+* with `NO_PROXY` exemptions evaluated per request).
+*
+* Returns `{}` when no proxy variable is set, so the unproxied path keeps
+* the SDK's own defaults and the change is a no-op for existing users.
+*
+* When one IS set, the fragment carries:
+*
+* - `requestHandler` — routes the client's own wire calls through the proxy.
+*   The SDK's internal STS hops (`role_arn` profiles, web identity) inherit
+*   it via `parentClientConfig`.
+* - `credentials` — the SDK's default provider chain with the handler ALSO
+*   threaded into `clientConfig`, because the SSO portal / SSOOIDC clients
+*   the chain constructs do NOT inherit the service client's handler (they
+*   coalesce only `logger` / `region` / `userAgentAppId` from it). The
+*   `clientConfig` carries NOTHING but `requestHandler` — a `region` there
+*   would override the SSO portal region. The chain gets its OWN handler
+*   instance so a service client's `destroy()` cannot strand it. IMDS and
+*   ECS container credentials call `node:http` directly and correctly
+*   bypass the proxy (link-local traffic).
+*
+* Sites that resolve their own explicit `credentials` spread this fragment
+* FIRST and their credentials after, so the override wins while the
+* `requestHandler` stays.
+*
+* Host-side use case: a host CLI (e.g. cdkd) constructing its own AWS SDK
+* clients alongside cdk-local's spreads the same fragment so both honor the
+* same proxy environment with the same `NO_PROXY` semantics.
+*/
+function buildProxyClientConfig(opts = {}) {
+	if (!isProxyEnvConfigured()) return {};
+	const profile = opts.profile;
+	const chainHandler = buildProxyRequestHandler();
+	let chain;
+	const credentials = async (identityProperties) => {
+		if (!chain) {
+			const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
+			chain = defaultProvider({
+				...profile ? { profile } : {},
+				clientConfig: { requestHandler: chainHandler }
+			});
+		}
+		return chain(identityProperties);
+	};
+	return {
+		requestHandler: buildProxyRequestHandler(),
+		credentials
+	};
+}
+
+//#endregion
 //#region src/utils/profile-resolver.ts
 /**
 * Resolve `--profile <p>` to a concrete credential set AND the profile's
@@ -65,7 +354,7 @@ import { EventEmitter } from "node:events";
 * `resolveContainerFallbackRegion`.
 */
 async function resolveProfileCredentials(profile) {
-	const sts = new STSClient({ profile });
+	const sts = new STSClient(buildStsClientConfig({ profile }));
 	try {
 		const credsProvider = sts.config.credentials;
 		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
@@ -102,9 +391,14 @@ async function resolveProfileCredentials(profile) {
 * Returns a fresh object each call so callers can spread additional
 * fields (custom `requestHandler`, `maxAttempts`, etc.) without
 * mutating a shared default.
+*
+* Also spreads {@link buildProxyClientConfig} (issue #634), so every STS
+* site through this helper honors `HTTPS_PROXY` / `NO_PROXY` for free —
+* a no-op (empty fragment) when no proxy environment variable is set.
 */
 function buildStsClientConfig(args) {
 	return {
+		...buildProxyClientConfig({ profile: args.profile }),
 		...args.region && { region: args.region },
 		...args.profile && { profile: args.profile }
 	};
@@ -2804,22 +3098,40 @@ async function getClient(service, region) {
 	let client;
 	switch (service) {
 		case "sqs":
-			client = new (await (import("@aws-sdk/client-sqs"))).SQSClient({ region });
+			client = new (await (import("@aws-sdk/client-sqs"))).SQSClient({
+				...buildProxyClientConfig(),
+				region
+			});
 			break;
 		case "sns":
-			client = new (await (import("@aws-sdk/client-sns"))).SNSClient({ region });
+			client = new (await (import("@aws-sdk/client-sns"))).SNSClient({
+				...buildProxyClientConfig(),
+				region
+			});
 			break;
 		case "eventbridge":
-			client = new (await (import("@aws-sdk/client-eventbridge"))).EventBridgeClient({ region });
+			client = new (await (import("@aws-sdk/client-eventbridge"))).EventBridgeClient({
+				...buildProxyClientConfig(),
+				region
+			});
 			break;
 		case "kinesis":
-			client = new (await (import("@aws-sdk/client-kinesis"))).KinesisClient({ region });
+			client = new (await (import("@aws-sdk/client-kinesis"))).KinesisClient({
+				...buildProxyClientConfig(),
+				region
+			});
 			break;
 		case "sfn":
-			client = new (await (import("@aws-sdk/client-sfn"))).SFNClient({ region });
+			client = new (await (import("@aws-sdk/client-sfn"))).SFNClient({
+				...buildProxyClientConfig(),
+				region
+			});
 			break;
 		case "ssm":
-			client = new (await (import("@aws-sdk/client-ssm"))).SSMClient({ region });
+			client = new (await (import("@aws-sdk/client-ssm"))).SSMClient({
+				...buildProxyClientConfig(),
+				region
+			});
 			break;
 		default: throw new Error(`unknown service '${service}'`);
 	}
@@ -5152,6 +5464,7 @@ var CfnLocalStateProvider = class {
 	getClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.client) this.client = new CloudFormationClient({
+			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -5160,6 +5473,7 @@ var CfnLocalStateProvider = class {
 	getLambdaClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.lambdaClient) this.lambdaClient = new LambdaClient({
+			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -5168,6 +5482,7 @@ var CfnLocalStateProvider = class {
 	getAgentCoreControlClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.agentCoreControlClient) this.agentCoreControlClient = new BedrockAgentCoreControlClient({
+			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -5176,6 +5491,7 @@ var CfnLocalStateProvider = class {
 	getSsmClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.ssmClient) this.ssmClient = new SSMClient({
+			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -5555,7 +5871,7 @@ function formatAwsErrorForWarn(err, operation) {
 */
 async function resolveProfileRegion(profile) {
 	if (profile === void 0 || profile === "") return void 0;
-	const sts = new STSClient({ profile });
+	const sts = new STSClient(buildStsClientConfig({ profile }));
 	try {
 		const regionProvider = sts.config.region;
 		const resolved = typeof regionProvider === "function" ? await regionProvider() : regionProvider;
@@ -7878,6 +8194,7 @@ async function pullEcrImage(imageUri, options) {
 	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
 	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
 	const ecr = new ECRClient({
+		...buildProxyClientConfig({ profile: options.profile }),
 		region: parsed.region,
 		...assumed ? { credentials: assumed } : options.profile ? { profile: options.profile } : {}
 	});
@@ -8332,7 +8649,7 @@ async function ensureDockerAvailable() {
 */
 function pickFreePort() {
 	return new Promise((resolvePort, rejectPort) => {
-		const server = createServer();
+		const server = createServer$2();
 		server.unref();
 		server.on("error", rejectPort);
 		server.listen(0, "127.0.0.1", () => {
@@ -8557,136 +8874,6 @@ function extractHashFromImageUri(imageUri) {
 	return /:([a-f0-9]{8,})$/.exec(imageUri)?.[1];
 }
 
-//#endregion
-//#region src/utils/url-authority.ts
-/**
-* Compose the authority component of a URL from a host and a port.
-*
-* Every local serve prints an endpoint banner, and several of those banners
-* are MACHINE-PARSED — `cdkl studio` reads them to learn where to point its
-* capture proxy (`local/studio-serve-manager`'s `readyRe` /
-* `parsePublishedHostEndpoint`), then resolves the result with `new URL(...)`
-* before it will forward anything there. So an authority that the WHATWG
-* parser rejects is not a cosmetic log defect: the serve is refused.
-*
-* The one shape that used to be composed wrong is an IPv6 literal. RFC 3986
-* 3.2.2 requires it to be bracketed inside an authority, so a bare
-* `${host}:${port}` turns `--container-host ::` into `http://:::8080`, which
-* is not a URL — while the IPv4 wildcard `0.0.0.0`, the same intention spelled
-* differently, works. Issue go-to-k/cdk-local#599.
-*
-* The detection is mechanical rather than a list of known values: a colon is
-* forbidden in both a registered name and an IPv4 address, so a host carrying
-* one is an IPv6 literal — PROVIDED the rest of it could be one, which is a
-* character-class test (hex digits, `:`, and `.` for the IPv4-mapped form)
-* rather than an enumeration. The qualifier is load-bearing rather than
-* pedantry: `buildRedirectLocation` fills its host from an ALB `#{host}`
-* template or a configured literal, so a CRLF-injection attempt reaches this
-* function AS-IS — `example.test\r\nx-injected: yes`, with the CR/LF still in
-* it, because `front-door-server` sanitises the Location only AFTER building
-* it. Either way it is a colon in something that is not an address and must
-* pass through untouched rather than gain brackets it never had. (CR and LF
-* are outside the character class by construction, so the raw and flattened
-* spellings classify identically — but the raw one is what actually arrives.)
-* Caught by `front-door-server.test.ts`'s raw-socket injection case.
-*/
-/**
-* A host that could be an IPv6 literal: hex digits, `:` separators, and `.`
-* for the IPv4-mapped form (`::ffff:127.0.0.1`). Deliberately NOT a full
-* grammar — the job is to separate "an address" from "not an address", and
-* validating an address that has already been bound to is not this function's
-* business.
-*/
-const IPV6_LITERAL_CHARS = /^[0-9A-Fa-f:.]+$/;
-/**
-* Render `host` as it must appear inside a URL authority.
-*
-* - An IPv6 literal is bracketed, in either case (`FE80::1` -> `[FE80::1]`).
-* - An already-bracketed literal comes back bracketed exactly once, so the
-*   function is idempotent: `[::1]` never becomes `[[::1]]`. That matters
-*   because a caller often feeds back a `URL.hostname`, which is ALREADY
-*   bracketed.
-* - A zone id (`fe80::1%en0`) is DROPPED, keeping `[fe80::1]`. No URL parser
-*   accepts one — Node's `new URL` throws on both the raw `%en0` and the
-*   percent-encoded `%25en0` — and a zone id is a host-local interface
-*   selector that carries no meaning for whoever reads the banner. Emitting
-*   an authority nothing can parse is the exact failure this helper exists to
-*   prevent, so the scope is dropped rather than propagated. The brackets are
-*   removed BEFORE that decision, so `[fe80::1%en0]` is stripped too — an
-*   early return on "already bracketed" would have waved the one input that
-*   is both bracketed and unparseable straight through.
-* - Everything else (IPv4 literal, registered name, the empty string, and a
-*   colon-bearing string that is not an address) is returned untouched.
-*/
-function formatHostForAuthority(host) {
-	const inner = host.length > 1 && host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-	if (!inner.includes(":")) return host;
-	const zoneAt = inner.indexOf("%");
-	const literal = zoneAt === -1 ? inner : inner.slice(0, zoneAt);
-	if (!IPV6_LITERAL_CHARS.test(literal)) return host;
-	return `[${literal}]`;
-}
-/**
-* Compose `<host>:<port>` for use inside a URL, bracketing an IPv6 literal.
-*
-* An empty `host` is passed through as-is rather than substituted: the helper
-* composes an authority, it does not invent a host, and a caller that has no
-* host has a bug of its own. The result (`:8080`) does not parse, which is the
-* honest rendering of that state.
-*/
-function formatAuthority(host, port) {
-	return `${formatHostForAuthority(host)}:${port}`;
-}
-/**
-* Read the HOST out of an authority (`<host>` or `<host>:<port>`), returning
-* it BARE — an IPv6 literal comes back without its brackets, ready to be
-* handed straight back to {@link formatAuthority}.
-*
-* The inverse of {@link formatAuthority}, and it exists for the same reason:
-* `authority.split(':')[0]` is the obvious thing to write and it is wrong for
-* exactly one input. A conforming client sends `Host: [::1]:8080` (measured —
-* see `tests/unit/local/ipv6-host-header.test.ts`), and splitting that on the
-* first colon yields `'['`, so an ALB `#{host}` substitution built from it
-* produced `http://[:8080/...`. Issue go-to-k/cdk-local#599.
-*
-* # It refuses rather than guesses — on BOTH arms
-*
-* This is an attacker-reachable parser: the request `Host` header feeds an
-* ALB `#{host}` substitution, and whatever comes back is composed into a
-* redirect `Location`. So a malformed authority yields the empty string
-* rather than the fragment that happens to be readable, on either branch.
-*
-* BRACKETED — read to the closing `]`, and only when the value is
-* well-formed: there must BE a closing bracket, and what follows it must be
-* empty or `:<digits>`. Guessing here is the worse of the two directions,
-* because the guess PARSES: `[evil.example` (no closing bracket) would come
-* back as `evil.example`, turning a half-named host into a valid `Location`
-* the client would follow, where the malformed input should have produced
-* nothing. `[a:b]junk` would silently drop its trailing junk, and `[x:y`
-* would return a multi-colon value as a host — the very thing the other arm
-* refuses.
-*
-* UNBRACKETED — the text before its single `:`. Two or more colons yields
-* the empty string: it is not a shape any conforming client sends (Node
-* brackets — measured in `tests/unit/local/ipv6-host-header.test.ts`), it has
-* no unambiguous split, and returning the leading fragment would hand a
-* caller a host that is not the one named. `split(':')[0]` did exactly that —
-* `fe80::1:8080` came back as `'fe80'`.
-*/
-function hostFromAuthority(authority) {
-	if (authority.startsWith("[")) {
-		const close = authority.indexOf("]");
-		if (close === -1) return "";
-		const afterBracket = authority.slice(close + 1);
-		if (afterBracket !== "" && !/^:\d+$/.test(afterBracket)) return "";
-		return authority.slice(1, close);
-	}
-	const firstColon = authority.indexOf(":");
-	if (firstColon === -1) return authority;
-	if (authority.includes(":", firstColon + 1)) return "";
-	return authority.slice(0, firstColon);
-}
-
 //#endregion
 //#region src/local/rie-client.ts
 /**
@@ -14371,7 +14558,7 @@ function defaultCredentialsLoader() {
 		if (cached) return cached;
 		cached = (async () => {
 			const { STSClient } = await import("@aws-sdk/client-sts");
-			const client = new STSClient({});
+			const client = new STSClient({ ...buildProxyClientConfig() });
 			const creds = await client.config.credentials();
 			client.destroy();
 			return {
@@ -15140,13 +15327,13 @@ async function startApiServer(opts) {
 			if (!res.headersSent) writeError$1(res, 502);
 		});
 	};
-	const server = opts.mtls ? createServer$2({
+	const server = opts.mtls ? createServer$1({
 		requestCert: true,
 		rejectUnauthorized: true,
 		ca: opts.mtls.caPem,
 		cert: opts.mtls.certPem,
 		key: opts.mtls.keyPem
-	}, requestHandler) : createServer$1(requestHandler);
+	}, requestHandler) : createServer(requestHandler);
 	const scheme = opts.mtls ? "https" : "http";
 	server.on("connection", (socket) => {
 		socket.setNoDelay(true);
@@ -16507,6 +16694,7 @@ async function assumeRoleForLayer(roleArn, region, options) {
 async function defaultLambdaClientFactory() {
 	const { LambdaClient } = await import("@aws-sdk/client-lambda");
 	return (region, credentials) => new LambdaClient({
+		...buildProxyClientConfig(),
 		region,
 		...credentials && { credentials: {
 			accessKeyId: credentials.accessKeyId,
@@ -16517,7 +16705,10 @@ async function defaultLambdaClientFactory() {
 }
 async function defaultStsClientFactory() {
 	const { STSClient } = await import("@aws-sdk/client-sts");
-	return (region) => new STSClient({ region });
+	return (region) => new STSClient({
+		...buildProxyClientConfig(),
+		region
+	});
 }
 async function buildGetLayerVersionCommand(layerArn, versionNumber) {
 	const { GetLayerVersionCommand } = await import("@aws-sdk/client-lambda");
@@ -19889,6 +20080,7 @@ function defaultFetchObject$1(options) {
 	return async (location) => {
 		const { S3Client, GetObjectCommand } = await import("@aws-sdk/client-s3");
 		const client = new S3Client({
+			...buildProxyClientConfig({ profile: options.profile }),
 			...options.region && { region: options.region },
 			...options.profile && !options.credentials && { profile: options.profile },
 			...options.credentials && { credentials: {
@@ -22429,10 +22621,12 @@ async function resolveEcsSecrets(entries, options = {}) {
 	if (entries.length === 0) return [];
 	const logger = getLogger().child("ecs-secrets");
 	const secretsClient = options.secretsManagerClient ?? new SecretsManagerClient({
+		...buildProxyClientConfig({ profile: options.profile }),
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile }
 	});
 	const ssmClient = options.ssmClient ?? new SSMClient({
+		...buildProxyClientConfig({ profile: options.profile }),
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile }
 	});
@@ -25256,10 +25450,10 @@ async function startFrontDoorServer(opts) {
 			if (!res.headersSent) writeError(res, 502, "Bad Gateway");
 		});
 	};
-	const server = opts.tls ? createServer$2({
+	const server = opts.tls ? createServer$1({
 		cert: opts.tls.certPem,
 		key: opts.tls.keyPem
-	}, requestHandler) : createServer$1(requestHandler);
+	}, requestHandler) : createServer(requestHandler);
 	const scheme = opts.tls ? "https" : "http";
 	server.on("connection", (socket) => socket.setNoDelay(true));
 	server.on("upgrade", (req, clientSocket, head) => {
@@ -31367,10 +31561,10 @@ async function startCloudFrontServer(options) {
 		});
 	};
 	const scheme = options.tls ? "https" : "http";
-	const server = options.tls ? createServer$2({
+	const server = options.tls ? createServer$1({
 		cert: options.tls.certPem,
 		key: options.tls.keyPem
-	}, handler) : createServer$1(handler);
+	}, handler) : createServer(handler);
 	const port = await listen(server, options.host, options.port);
 	return {
 		url: `${scheme}://${formatAuthority(options.host, port)}`,
@@ -31808,6 +32002,7 @@ function defaultFetchObject(bucketName, options) {
 			const { S3Client, GetObjectCommand } = await import("@aws-sdk/client-s3");
 			return {
 				client: new S3Client({
+					...buildProxyClientConfig(),
 					...options.region && { region: options.region },
 					...options.credentials && { credentials: {
 						accessKeyId: options.credentials.accessKeyId,
@@ -31897,6 +32092,7 @@ async function resolveDeployedOriginBucket(options) {
 async function defaultGetOrigins(options) {
 	const { CloudFrontClient, GetDistributionConfigCommand } = await import("@aws-sdk/client-cloudfront");
 	const client = new CloudFrontClient({
+		...buildProxyClientConfig(),
 		region: "us-east-1",
 		...options.credentials && { credentials: {
 			accessKeyId: options.credentials.accessKeyId,
@@ -31921,6 +32117,7 @@ async function defaultGetOrigins(options) {
 */
 function createDeployedKvsDataSource(options) {
 	const client = new CloudFrontKeyValueStoreClient({
+		...buildProxyClientConfig(),
 		region: options.region ?? "us-east-1",
 		...options.credentials !== void 0 && { credentials: options.credentials }
 	});
@@ -31953,6 +32150,7 @@ function createDeployedKvsDataSource(options) {
 */
 async function resolveDeployedKvsArnByName(name, options = {}) {
 	const client = new CloudFrontClient({
+		...buildProxyClientConfig(),
 		region: options.region ?? "us-east-1",
 		...options.credentials !== void 0 && { credentials: options.credentials }
 	});
@@ -32650,7 +32848,7 @@ function attachAgentCoreWsBridge(httpServer, config) {
 */
 function startAgentCoreWsBridge(config) {
 	const host = config.host ?? "127.0.0.1";
-	const httpServer = createServer$1((_req, res) => {
+	const httpServer = createServer((_req, res) => {
 		res.writeHead(426, { "Content-Type": "text/plain" });
 		res.end("Upgrade required: connect over WebSocket.\n");
 	});
@@ -32788,7 +32986,7 @@ function startAgentCoreHttpServer(config) {
 	const routes = config.routes ?? DEFAULT_ROUTES;
 	const attachWs = config.attachWs ?? true;
 	const notFoundHint = buildNotFoundHint(routes, attachWs);
-	const httpServer = createServer$1((req, res) => {
+	const httpServer = createServer((req, res) => {
 		const path = (req.url ?? "/").split("?")[0];
 		const match = routes.find((r) => r.method === req.method && r.path === path);
 		if (!match) {
@@ -37031,7 +37229,7 @@ async function startStudioServer(options) {
 		groups: options.targetGroups,
 		dockerfiles: options.dockerfiles ?? []
 	});
-	const server = createServer$1((req, res) => handleRequest(req, res, options.bus, html, () => targetsJson, options, instanceId));
+	const server = createServer((req, res) => handleRequest(req, res, options.bus, html, () => targetsJson, options, instanceId));
 	const boundPort = await listenWithBump(server, host, options.port, maxBump);
 	return {
 		url: `http://${formatAuthority(host, boundPort)}`,
@@ -37963,7 +38161,7 @@ function startStudioProxy(config) {
 	const upstreamUrl = new URL(resolvedUpstream);
 	const upstreamHost = stripHostBrackets(upstreamUrl.hostname);
 	const upstreamPort = Number(upstreamUrl.port) || 80;
-	const server = createServer$1((clientReq, clientRes) => {
+	const server = createServer((clientReq, clientRes) => {
 		const id = idFactory();
 		const startedAt = clock();
 		const path = clientReq.url ?? "/";
@@ -39627,5 +39825,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, describeCredentialLoadFailure as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, resolveProfileCredentials as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildStsClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, describeAwsFailureForWarn as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-J8BtocsI.js.map
+export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, describeCredentialLoadFailure as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, resolveProfileCredentials as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, buildProxyClientConfig as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, isProxyEnvConfigured as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildStsClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, describeAwsFailureForWarn as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
+//# sourceMappingURL=local-studio-DoyRYZf6.js.map