cdk-local 0.147.7 → 0.147.9

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, St as createLocalStartAlbCommand, a as createLocalStudioCommand, jt as createLocalRunTaskCommand, sn as createLocalInvokeAgentCoreCommand, w as createLocalListCommand } from "./local-studio-BBtUAVNy.js";
+import { D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, St as createLocalStartAlbCommand, a as createLocalStudioCommand, jt as createLocalRunTaskCommand, sn as createLocalInvokeAgentCoreCommand, w as createLocalListCommand } from "./local-studio-xigfWo5b.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.147.7");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.147.9");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalInvokeAgentCoreCommand());
 program.addCommand(createLocalStartApiCommand());

package/dist/index.js

@@ -1,4 +1,4 @@
 import { d as setEmbedConfig, l as getEmbedConfig, u as resetEmbedConfig } from "./docker-cmd-DLX1TqVw.js";
-import { $r as resolveCfnStackName, D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Gr as substituteEnvVarsFromState, Jr as createLocalStateProvider, Kr as substituteEnvVarsFromStateAsync, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, Qr as resolveCfnRegion, St as createLocalStartAlbCommand, T as formatTargetListing, Ur as substituteAgainstState, Wr as substituteAgainstStateAsync, Xr as rejectExplicitCfnStackWithMultipleStacks, Yr as isCfnFlagPresent, Zr as resolveCfnFallbackRegion, a as createLocalStudioCommand, ai as countTargets, ei as CfnLocalStateProvider, jt as createLocalRunTaskCommand, ni as resolveSsmParameters, oi as listTargets, qr as LocalStateSourceError, sn as createLocalInvokeAgentCoreCommand, ti as collectSsmParameterRefs, w as createLocalListCommand } from "./local-studio-BBtUAVNy.js";
+import { $r as resolveCfnStackName, D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Gr as substituteEnvVarsFromState, Jr as createLocalStateProvider, Kr as substituteEnvVarsFromStateAsync, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, Qr as resolveCfnRegion, St as createLocalStartAlbCommand, T as formatTargetListing, Ur as substituteAgainstState, Wr as substituteAgainstStateAsync, Xr as rejectExplicitCfnStackWithMultipleStacks, Yr as isCfnFlagPresent, Zr as resolveCfnFallbackRegion, a as createLocalStudioCommand, ai as countTargets, ei as CfnLocalStateProvider, jt as createLocalRunTaskCommand, ni as resolveSsmParameters, oi as listTargets, qr as LocalStateSourceError, sn as createLocalInvokeAgentCoreCommand, ti as collectSsmParameterRefs, w as createLocalListCommand } from "./local-studio-xigfWo5b.js";
 
 export { CfnLocalStateProvider, LocalStateSourceError, collectSsmParameterRefs, countTargets, createLocalInvokeAgentCoreCommand, createLocalInvokeCommand, createLocalListCommand, createLocalRunTaskCommand, createLocalStartAgentCoreCommand, createLocalStartAlbCommand, createLocalStartApiCommand, createLocalStartCloudFrontCommand, createLocalStartServiceCommand, createLocalStateProvider, createLocalStudioCommand, formatTargetListing, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resetEmbedConfig, resolveCfnFallbackRegion, resolveCfnRegion, resolveCfnStackName, resolveSsmParameters, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync };

package/dist/internal.js

@@ -1,3 +1,3 @@
-import { $ as applyEdgeResponseResult, $n as buildJwksUrlFromIssuer, $t as buildCloudMapIndex, A as startAgentCoreHttpServer, Ai as resolveProfileCredentials, An as classifySourceChange, Ar as ConnectionRegistry, At as addRunTaskSpecificOptions, B as idFromArn, Bn as buildStageMap, Br as resolveRuntimeFileExtension, Bt as resolveEcsAssumeRoleOption, C as addListSpecificOptions, Ci as resolveAgentCoreTarget, Cn as waitForAgentCorePing, Cr as tryParseStatus, Ct as parseLbPortOverrides, Di as tryResolveImageFnJoin, Dn as computeCodeImageTag, Dr as probeHostGatewaySupport, Dt as addStartServiceSpecificOptions, E as addStartAgentCoreSpecificOptions, Ei as substituteImagePlaceholders, En as buildAgentCoreCodeImage, Er as HOST_GATEWAY_MIN_VERSION, Et as resolveAlbFrontDoor, Fn as createWatchPredicates, Fr as buildDisconnectEvent, Ft as addImageOverrideOptions, G as classifyS3Error, Gn as filterRoutesByApiIdentifiers, Gt as enforceImageOverrideOrphans, H as createDeployedKvsDataSource, Hn as resolveEnvVars, Hr as EcsTaskResolutionError, Ht as runEcsServiceEmulator, I as normalizeKvsFileKeys, In as resolveApiTargetSubset, Ir as buildMessageEvent, It as buildEcsImageResolutionContext, J as startCloudFrontServer, Jn as startApiServer, Jt as resolveImageOverrides, K as createS3OriginReader, Kn as groupRoutesByServer, Kt as mergeForService, L as parseKvsFileOverrides, Ln as createAuthorizerCache, Lr as architectureToPlatform, Lt as ecsClusterOption, M as startAgentCoreWsBridge, Mr as handleConnectionsRequest, Mt as MAX_TASKS_SUBNET_RANGE_CAP, N as LocalStartCloudFrontError, Nn as addStartApiSpecificOptions, Nr as parseConnectionsPath, Nt as addCommonEcsServiceOptions, O as buildAgentCoreServeAuthCheck, Oi as LocalInvokeBuildError, On as renderCodeDockerfile, Or as resolveHostGatewayExtraHosts, P as addStartCloudFrontSpecificOptions, Pr as buildConnectEvent, Pt as addEcsAssumeRoleOptions, Q as applyEdgeRequestResult, Qn as buildCognitoJwksUrl, Qt as listPinnedTargets, R as parseOriginOverrides, Rn as createFileWatcher, Rr as buildContainerImage, Rt as parseMaxTasks, S as StudioEventBus, Si as pickAgentCoreCandidateStack, Sn as waitForAgentCoreHttpReady, Sr as selectIntegrationResponse, Ti as formatStateRemedy, Tn as SUPPORTED_CODE_RUNTIMES, Tr as HOST_DOCKER_INTERNAL_GATEWAY, Tt as isApplicationLoadBalancer, U as resolveDeployedKvsArnByName, Un as availableApiIdentifiers, Ut as ImageOverrideError, V as resolveKvsModulesForDistribution, Vn as materializeLayerFromArn, Vr as resolveRuntimeImage, Vt as resolveSharedSidecarCredentials, W as resolveDeployedOriginBucket, Wn as filterRoutesByApiIdentifier, Wt as buildImageOverrideTag, X as serveFromStaticOrigin, Xn as resolveServiceIntegrationParameters, Xt as describePinnedImageUri, Y as resolveErrorResponseCandidates, Yn as resolveSelectionExpression, Yt as runImageOverrideBuilds, Z as serveLambdaUrlOrigin, Zn as defaultCredentialsLoader, Zt as isLocalCdkAssetImage, _ as filterStudioTargetGroups, _i as AGENTCORE_AGUI_PROTOCOL, _n as parseSseForJsonRpc, _r as applyAuthorizerOverlay, _t as createCloudFrontModule, an as attachContainerLogStreamer, ar as computeRequestIdentityHash, at as describeS3OriginDomain, b as renderStudioHtml, bi as AGENTCORE_RUNTIME_TYPE, bn as AGENTCORE_SESSION_ID_HEADER, br as evaluateResponseParameters, bt as addAlbSpecificOptions, c as startStudioProxy, ci as discoverWebSocketApis, cn as bridgeAgentCoreWs, cr as invokeTokenAuthorizer, ct as pickFunctionUrlLogicalIdFromOrigin, d as createStudioDispatcher, di as parseSelectionExpressionPath, dn as A2A_PATH, dr as buildCorsConfigByApiId, dt as pickTargetFunctionLogicalId, en as CloudMapRegistry, er as createJwksCache, et as buildEdgeRequestEvent, f as filterStudioCustomResources, fi as webSocketApiMatchesIdentifier, fn as a2aInvokeOnce, fr as buildCorsConfigFromCloudFrontChain, ft as resolveCloudFrontDistribution, g as annotatePinnedEcsTargets, gi as AGENTCORE_A2A_PROTOCOL, gn as mcpInvokeOnce, gr as translateLambdaResponse, gt as stripCloudFrontImport, h as annotateEcsTaskPinnedTargets, hi as resolveLambdaArnIntrinsic, hn as MCP_PROTOCOL_VERSION, hr as matchRoute, ht as runViewerResponse, i as coerceStopRequest, ii as resolveSingleTarget, in as getContainerNetworkIp, ir as buildMethodArn, it as CLOUDFRONT_DISTRIBUTION_TYPE, j as attachAgentCoreWsBridge, jn as addInvokeSpecificOptions, jr as buildMgmtEndpointEnvUrl, k as selectServeInboundAuth, ki as buildStsClientConfig, kn as toCmdArgv, kr as bufferToBody, kt as serviceStrategy, l as relayServeRequest, li as discoverWebSocketApisOrThrow, ln as invokeAgentCoreWs, lr as attachAuthorizers, lt as pickKvsLogicalIdFromArn, m as annotateAlbPinnedBackingServices, mi as pickRefLogicalId, mn as MCP_PATH, mr as matchPreflight, mt as runViewerRequest, n as coerceRunRequest, nn as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, nr as verifyJwtAuthorizer, nt as edgeHeadersToHttp, o as resolveServeBaseUrl, on as addInvokeAgentCoreSpecificOptions, or as evaluateCachedLambdaPolicy, ot as extractKvsAssociations, p as isCustomResourceLambdaTarget, pi as discoverRoutes, pn as MCP_CONTAINER_PORT, pr as isFunctionUrlOacFronted, pt as compileCloudFrontFunction, q as matchBehavior, qn as readMtlsMaterialsFromDisk, qt as parseImageOverrideFlags, r as coerceServeRequest, ri as resolveWatchConfig, rn as setShadowReadyTimeoutMs, rr as verifyJwtViaDiscovery, rt as httpHeadersToEdge, s as createStudioServeManager, si as availableWebSocketApiIdentifiers, sr as invokeRequestAuthorizer, st as isCloudFrontDistribution, t as addStudioSpecificOptions, tn as DEFAULT_SHADOW_READY_TIMEOUT_MS, tr as verifyCognitoJwt, tt as buildEdgeResponseEvent, u as reinvoke, ui as filterWebSocketApisByIdentifiers, un as A2A_CONTAINER_PORT, ur as applyCorsResponseHeaders, ut as pickLambdaEdgeFunctionLogicalId, v as startStudioServer, vi as AGENTCORE_HTTP_PROTOCOL, vn as AGENTCORE_SIGV4_SERVICE, vr as buildHttpApiV2Event, vt as createLocalFileKvsDataSource, wi as derivePseudoParametersFromRegion, wn as downloadAndExtractS3Bundle, wr as VtlEvaluationError, wt as resolveAlbTarget, x as createStudioStore, xi as AgentCoreResolutionError, xn as invokeAgentCore, xr as pickResponseTemplate, xt as albStrategy, y as toStudioTargetGroups, yi as AGENTCORE_MCP_PROTOCOL, yn as signAgentCoreInvocation, yr as buildRestV1Event, yt as createUnboundCloudFrontModule, z as resolveCloudFrontTarget, zn as attachStageContext, zr as resolveRuntimeCodeMountPath, zt as parseRestartPolicy } from "./local-studio-BBtUAVNy.js";
+import { $ as applyEdgeResponseResult, $n as buildJwksUrlFromIssuer, $t as buildCloudMapIndex, A as startAgentCoreHttpServer, Ai as resolveProfileCredentials, An as classifySourceChange, Ar as ConnectionRegistry, At as addRunTaskSpecificOptions, B as idFromArn, Bn as buildStageMap, Br as resolveRuntimeFileExtension, Bt as resolveEcsAssumeRoleOption, C as addListSpecificOptions, Ci as resolveAgentCoreTarget, Cn as waitForAgentCorePing, Cr as tryParseStatus, Ct as parseLbPortOverrides, Di as tryResolveImageFnJoin, Dn as computeCodeImageTag, Dr as probeHostGatewaySupport, Dt as addStartServiceSpecificOptions, E as addStartAgentCoreSpecificOptions, Ei as substituteImagePlaceholders, En as buildAgentCoreCodeImage, Er as HOST_GATEWAY_MIN_VERSION, Et as resolveAlbFrontDoor, Fn as createWatchPredicates, Fr as buildDisconnectEvent, Ft as addImageOverrideOptions, G as classifyS3Error, Gn as filterRoutesByApiIdentifiers, Gt as enforceImageOverrideOrphans, H as createDeployedKvsDataSource, Hn as resolveEnvVars, Hr as EcsTaskResolutionError, Ht as runEcsServiceEmulator, I as normalizeKvsFileKeys, In as resolveApiTargetSubset, Ir as buildMessageEvent, It as buildEcsImageResolutionContext, J as startCloudFrontServer, Jn as startApiServer, Jt as resolveImageOverrides, K as createS3OriginReader, Kn as groupRoutesByServer, Kt as mergeForService, L as parseKvsFileOverrides, Ln as createAuthorizerCache, Lr as architectureToPlatform, Lt as ecsClusterOption, M as startAgentCoreWsBridge, Mr as handleConnectionsRequest, Mt as MAX_TASKS_SUBNET_RANGE_CAP, N as LocalStartCloudFrontError, Nn as addStartApiSpecificOptions, Nr as parseConnectionsPath, Nt as addCommonEcsServiceOptions, O as buildAgentCoreServeAuthCheck, Oi as LocalInvokeBuildError, On as renderCodeDockerfile, Or as resolveHostGatewayExtraHosts, P as addStartCloudFrontSpecificOptions, Pr as buildConnectEvent, Pt as addEcsAssumeRoleOptions, Q as applyEdgeRequestResult, Qn as buildCognitoJwksUrl, Qt as listPinnedTargets, R as parseOriginOverrides, Rn as createFileWatcher, Rr as buildContainerImage, Rt as parseMaxTasks, S as StudioEventBus, Si as pickAgentCoreCandidateStack, Sn as waitForAgentCoreHttpReady, Sr as selectIntegrationResponse, Ti as formatStateRemedy, Tn as SUPPORTED_CODE_RUNTIMES, Tr as HOST_DOCKER_INTERNAL_GATEWAY, Tt as isApplicationLoadBalancer, U as resolveDeployedKvsArnByName, Un as availableApiIdentifiers, Ut as ImageOverrideError, V as resolveKvsModulesForDistribution, Vn as materializeLayerFromArn, Vr as resolveRuntimeImage, Vt as resolveSharedSidecarCredentials, W as resolveDeployedOriginBucket, Wn as filterRoutesByApiIdentifier, Wt as buildImageOverrideTag, X as serveFromStaticOrigin, Xn as resolveServiceIntegrationParameters, Xt as describePinnedImageUri, Y as resolveErrorResponseCandidates, Yn as resolveSelectionExpression, Yt as runImageOverrideBuilds, Z as serveLambdaUrlOrigin, Zn as defaultCredentialsLoader, Zt as isLocalCdkAssetImage, _ as filterStudioTargetGroups, _i as AGENTCORE_AGUI_PROTOCOL, _n as parseSseForJsonRpc, _r as applyAuthorizerOverlay, _t as createCloudFrontModule, an as attachContainerLogStreamer, ar as computeRequestIdentityHash, at as describeS3OriginDomain, b as renderStudioHtml, bi as AGENTCORE_RUNTIME_TYPE, bn as AGENTCORE_SESSION_ID_HEADER, br as evaluateResponseParameters, bt as addAlbSpecificOptions, c as startStudioProxy, ci as discoverWebSocketApis, cn as bridgeAgentCoreWs, cr as invokeTokenAuthorizer, ct as pickFunctionUrlLogicalIdFromOrigin, d as createStudioDispatcher, di as parseSelectionExpressionPath, dn as A2A_PATH, dr as buildCorsConfigByApiId, dt as pickTargetFunctionLogicalId, en as CloudMapRegistry, er as createJwksCache, et as buildEdgeRequestEvent, f as filterStudioCustomResources, fi as webSocketApiMatchesIdentifier, fn as a2aInvokeOnce, fr as buildCorsConfigFromCloudFrontChain, ft as resolveCloudFrontDistribution, g as annotatePinnedEcsTargets, gi as AGENTCORE_A2A_PROTOCOL, gn as mcpInvokeOnce, gr as translateLambdaResponse, gt as stripCloudFrontImport, h as annotateEcsTaskPinnedTargets, hi as resolveLambdaArnIntrinsic, hn as MCP_PROTOCOL_VERSION, hr as matchRoute, ht as runViewerResponse, i as coerceStopRequest, ii as resolveSingleTarget, in as getContainerNetworkIp, ir as buildMethodArn, it as CLOUDFRONT_DISTRIBUTION_TYPE, j as attachAgentCoreWsBridge, jn as addInvokeSpecificOptions, jr as buildMgmtEndpointEnvUrl, k as selectServeInboundAuth, ki as buildStsClientConfig, kn as toCmdArgv, kr as bufferToBody, kt as serviceStrategy, l as relayServeRequest, li as discoverWebSocketApisOrThrow, ln as invokeAgentCoreWs, lr as attachAuthorizers, lt as pickKvsLogicalIdFromArn, m as annotateAlbPinnedBackingServices, mi as pickRefLogicalId, mn as MCP_PATH, mr as matchPreflight, mt as runViewerRequest, n as coerceRunRequest, nn as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, nr as verifyJwtAuthorizer, nt as edgeHeadersToHttp, o as resolveServeBaseUrl, on as addInvokeAgentCoreSpecificOptions, or as evaluateCachedLambdaPolicy, ot as extractKvsAssociations, p as isCustomResourceLambdaTarget, pi as discoverRoutes, pn as MCP_CONTAINER_PORT, pr as isFunctionUrlOacFronted, pt as compileCloudFrontFunction, q as matchBehavior, qn as readMtlsMaterialsFromDisk, qt as parseImageOverrideFlags, r as coerceServeRequest, ri as resolveWatchConfig, rn as setShadowReadyTimeoutMs, rr as verifyJwtViaDiscovery, rt as httpHeadersToEdge, s as createStudioServeManager, si as availableWebSocketApiIdentifiers, sr as invokeRequestAuthorizer, st as isCloudFrontDistribution, t as addStudioSpecificOptions, tn as DEFAULT_SHADOW_READY_TIMEOUT_MS, tr as verifyCognitoJwt, tt as buildEdgeResponseEvent, u as reinvoke, ui as filterWebSocketApisByIdentifiers, un as A2A_CONTAINER_PORT, ur as applyCorsResponseHeaders, ut as pickLambdaEdgeFunctionLogicalId, v as startStudioServer, vi as AGENTCORE_HTTP_PROTOCOL, vn as AGENTCORE_SIGV4_SERVICE, vr as buildHttpApiV2Event, vt as createLocalFileKvsDataSource, wi as derivePseudoParametersFromRegion, wn as downloadAndExtractS3Bundle, wr as VtlEvaluationError, wt as resolveAlbTarget, x as createStudioStore, xi as AgentCoreResolutionError, xn as invokeAgentCore, xr as pickResponseTemplate, xt as albStrategy, y as toStudioTargetGroups, yi as AGENTCORE_MCP_PROTOCOL, yn as signAgentCoreInvocation, yr as buildRestV1Event, yt as createUnboundCloudFrontModule, z as resolveCloudFrontTarget, zn as attachStageContext, zr as resolveRuntimeCodeMountPath, zt as parseRestartPolicy } from "./local-studio-xigfWo5b.js";
 
 export { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_HTTP_PROTOCOL, AGENTCORE_MCP_PROTOCOL, AGENTCORE_RUNTIME_TYPE, AGENTCORE_SESSION_ID_HEADER, AGENTCORE_SIGV4_SERVICE, AgentCoreResolutionError, CLOUDFRONT_DISTRIBUTION_TYPE, CloudMapRegistry, ConnectionRegistry, DEFAULT_SHADOW_READY_TIMEOUT_MS, EcsTaskResolutionError, HOST_DOCKER_INTERNAL_GATEWAY, HOST_GATEWAY_MIN_VERSION, ImageOverrideError, LocalInvokeBuildError, LocalStartCloudFrontError, MAX_TASKS_SUBNET_RANGE_CAP, MCP_CONTAINER_PORT, MCP_PATH, MCP_PROTOCOL_VERSION, SOFT_RELOAD_COMPLETION_LOG_SUFFIX, SUPPORTED_CODE_RUNTIMES, StudioEventBus, VtlEvaluationError, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addEcsAssumeRoleOptions, addImageOverrideOptions, addInvokeAgentCoreSpecificOptions, addInvokeSpecificOptions, addListSpecificOptions, addRunTaskSpecificOptions, addStartAgentCoreSpecificOptions, addStartApiSpecificOptions, addStartCloudFrontSpecificOptions, addStartServiceSpecificOptions, addStudioSpecificOptions, albStrategy, annotateAlbPinnedBackingServices, annotateEcsTaskPinnedTargets, annotatePinnedEcsTargets, applyAuthorizerOverlay, applyCorsResponseHeaders, applyEdgeRequestResult, applyEdgeResponseResult, architectureToPlatform, attachAgentCoreWsBridge, attachAuthorizers, attachContainerLogStreamer, attachStageContext, availableApiIdentifiers, availableWebSocketApiIdentifiers, bridgeAgentCoreWs, bufferToBody, buildAgentCoreCodeImage, buildAgentCoreServeAuthCheck, buildCloudMapIndex, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildEcsImageResolutionContext, buildEdgeRequestEvent, buildEdgeResponseEvent, buildHttpApiV2Event, buildImageOverrideTag, buildJwksUrlFromIssuer, buildMessageEvent, buildMethodArn, buildMgmtEndpointEnvUrl, buildRestV1Event, buildStageMap, buildStsClientConfig, classifyS3Error, classifySourceChange, coerceRunRequest, coerceServeRequest, coerceStopRequest, compileCloudFrontFunction, computeCodeImageTag, computeRequestIdentityHash, createAuthorizerCache, createCloudFrontModule, createDeployedKvsDataSource, createFileWatcher, createJwksCache, createLocalFileKvsDataSource, createS3OriginReader, createStudioDispatcher, createStudioServeManager, createStudioStore, createUnboundCloudFrontModule, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describePinnedImageUri, describeS3OriginDomain, discoverRoutes, discoverWebSocketApis, discoverWebSocketApisOrThrow, downloadAndExtractS3Bundle, ecsClusterOption, edgeHeadersToHttp, enforceImageOverrideOrphans, evaluateCachedLambdaPolicy, evaluateResponseParameters, extractKvsAssociations, filterRoutesByApiIdentifier, filterRoutesByApiIdentifiers, filterStudioCustomResources, filterStudioTargetGroups, filterWebSocketApisByIdentifiers, formatStateRemedy, getContainerNetworkIp, groupRoutesByServer, handleConnectionsRequest, httpHeadersToEdge, idFromArn, invokeAgentCore, invokeAgentCoreWs, invokeRequestAuthorizer, invokeTokenAuthorizer, isApplicationLoadBalancer, isCloudFrontDistribution, isCustomResourceLambdaTarget, isFunctionUrlOacFronted, isLocalCdkAssetImage, listPinnedTargets, matchBehavior, matchPreflight, matchRoute, materializeLayerFromArn, mcpInvokeOnce, mergeForService, normalizeKvsFileKeys, parseConnectionsPath, parseImageOverrideFlags, parseKvsFileOverrides, parseLbPortOverrides, parseMaxTasks, parseOriginOverrides, parseRestartPolicy, parseSelectionExpressionPath, parseSseForJsonRpc, pickAgentCoreCandidateStack, pickFunctionUrlLogicalIdFromOrigin, pickKvsLogicalIdFromArn, pickLambdaEdgeFunctionLogicalId, pickRefLogicalId, pickResponseTemplate, pickTargetFunctionLogicalId, probeHostGatewaySupport, readMtlsMaterialsFromDisk, reinvoke, relayServeRequest, renderCodeDockerfile, renderStudioHtml, resolveAgentCoreTarget, resolveAlbFrontDoor, resolveAlbTarget, resolveApiTargetSubset, resolveCloudFrontDistribution, resolveCloudFrontTarget, resolveDeployedKvsArnByName, resolveDeployedOriginBucket, resolveEcsAssumeRoleOption, resolveEnvVars, resolveErrorResponseCandidates, resolveHostGatewayExtraHosts, resolveImageOverrides, resolveKvsModulesForDistribution, resolveLambdaArnIntrinsic, resolveProfileCredentials, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSelectionExpression, resolveServeBaseUrl, resolveServiceIntegrationParameters, resolveSharedSidecarCredentials, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, runImageOverrideBuilds, runViewerRequest, runViewerResponse, selectIntegrationResponse, selectServeInboundAuth, serveFromStaticOrigin, serveLambdaUrlOrigin, serviceStrategy, setShadowReadyTimeoutMs, signAgentCoreInvocation, startAgentCoreHttpServer, startAgentCoreWsBridge, startApiServer, startCloudFrontServer, startStudioProxy, startStudioServer, stripCloudFrontImport, substituteImagePlaceholders, toCmdArgv, toStudioTargetGroups, translateLambdaResponse, tryParseStatus, tryResolveImageFnJoin, verifyCognitoJwt, verifyJwtAuthorizer, verifyJwtViaDiscovery, waitForAgentCoreHttpReady, waitForAgentCorePing, webSocketApiMatchesIdentifier };

package/dist/{local-studio-BBtUAVNy.js → local-studio-xigfWo5b.js}

@@ -9785,6 +9785,32 @@ function buildVtlInput(body, headers, querystring, pathParams) {
 * Minimal JSONPath evaluator. Supports `$`, `$.field`, `$.field.sub`,
 * `$.array[index]`. Unsupported syntax throws so the user sees a clear
 * pointer to the gap.
+*
+* The five throws below quote the offending expression, and `vtlFailure` in
+* `rest-v1-integrations.ts` copies that message into the 502 response body.
+* Issue #555 reviewed that and DELIBERATELY LEFT it — do not re-raise it as
+* an echo of caller request data. Two reasons, and the second is the one
+* that settles it:
+*
+*   1. `expr` is normally the developer's own template text — the literal
+*      inside `$input.json('$.foo')`. It becomes caller-controllable only
+*      when a template deliberately routes a request value into the
+*      expression, e.g. `$input.json($input.params('p'))`.
+*   2. Even then, the 502 goes back to the CALLER WHO SUPPLIED that value,
+*      so it discloses nothing that caller did not already send. (Note the
+*      `template` field `vtlFailure` puts beside `reason` is the template
+*      SOURCE, not its render — so in that case this message is the one
+*      place the value appears, and the argument has to rest on the
+*      recipient rather than on the value being present anyway.)
+*      Withholding it would cost the developer the only pointer they have
+*      to the unsupported syntax.
+*
+* The difference from `$util.parseJson`'s catch above is the SIZE of what
+* would be echoed, not its provenance: there the withheld material is the
+* whole request body, which on a login endpoint is the caller's password,
+* while here it is one path expression out of the developer's template.
+* Both are the caller's own data returned to the caller; only one of them
+* is worth withholding.
 */
 function applyJsonPath(root, expr) {
 	const trimmed = expr.trim();
@@ -13355,14 +13381,14 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 		};
 	}
 	if (parsed.algorithm !== "AWS4-HMAC-SHA256") {
-		logger.info(`AWS_IAM authorizer: rejecting request — unsupported Authorization algorithm '${parsed.algorithm}'. Expected 'AWS4-HMAC-SHA256'.`);
+		logger.info(`AWS_IAM authorizer: rejecting request — unsupported Authorization algorithm '${redactAuthorizationSegment(parsed.algorithm)}'. Expected 'AWS4-HMAC-SHA256'.`);
 		return {
 			allow: false,
 			identityHash: void 0
 		};
 	}
 	if (parsed.credentialTerminator !== "aws4_request") {
-		logger.info(`AWS_IAM authorizer: rejecting request — invalid credential-scope terminator '${parsed.credentialTerminator}'. Expected 'aws4_request' (the last '/' segment of the Credential= value).`);
+		logger.info(`AWS_IAM authorizer: rejecting request — invalid credential-scope terminator '${redactAuthorizationSegment(parsed.credentialTerminator)}'. Expected 'aws4_request' (the last '/' segment of the Credential= value).`);
 		return {
 			allow: false,
 			identityHash: void 0
@@ -13377,7 +13403,7 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 		};
 	}
 	if (!validateAmzDateMatchesCredentialDate(amzDate, parsed.credentialDate)) {
-		logger.info(`AWS_IAM authorizer: rejecting request — x-amz-date '${amzDate}' does not match credential-scope date '${parsed.credentialDate}'. The 'YYYYMMDD' prefix of x-amz-date must equal the date segment of Credential=<AKID>/<YYYYMMDD>/...`);
+		logger.info(`AWS_IAM authorizer: rejecting request — x-amz-date / date '${boundTimestampHeader(amzDate)}' does not match credential-scope date '${parsed.credentialDate}'. The 'YYYYMMDD' prefix of x-amz-date must equal the date segment of Credential=<AKID>/<YYYYMMDD>/...`);
 		return {
 			allow: false,
 			identityHash: void 0
@@ -13385,7 +13411,7 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 	}
 	const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
 	if (amzDateOutsideSkew(amzDate, now)) {
-		logger.info(`AWS_IAM authorizer: rejecting request — x-amz-date '${amzDate}' is outside the 15-minute clock-skew window (local now=${now.toISOString()}). Re-sign the request with the current time or sync the local clock.`);
+		logger.info(`AWS_IAM authorizer: rejecting request — x-amz-date / date '${boundTimestampHeader(amzDate)}' is outside the 15-minute clock-skew window (local now=${now.toISOString()}). Re-sign the request with the current time or sync the local clock.`);
 		return {
 			allow: false,
 			identityHash: void 0
@@ -13395,7 +13421,8 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 	try {
 		local = await loadCredentials();
 	} catch (err) {
-		const reason = err instanceof Error ? err.message : String(err);
+		logger.debug(`AWS_IAM authorizer: the AWS credential chain's own failure message was: ${stringifyCredentialLoadFailure(err)}`);
+		const reason = describeCredentialLoadFailure(err);
 		const { sigV4StrictByDefault, sigV4OptFlag: optFlag } = getEmbedConfig();
 		if (opts.strict && !opts.oacFronted) {
 			logger.warn(sigV4StrictByDefault ? `AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified. cdk-local denies unverifiable IAM requests by default; pass ${optFlag} to warn-and-pass, or configure AWS credentials cdk-local can read.` : `AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified. ${optFlag} is set, so cdk-local denies unverifiable IAM requests; remove ${optFlag} to warn-and-pass (the default), or configure AWS credentials cdk-local can read.`);
@@ -13413,12 +13440,12 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 	}
 	if (local.accessKeyId.toLowerCase() !== parsed.credentialAccessKeyId.toLowerCase()) {
 		const warned = opts.warnedForeignIds;
-		const dedupKey = parsed.credentialAccessKeyId.toLowerCase();
+		const dedupKey = createHash("sha256").update(parsed.credentialAccessKeyId.toLowerCase()).digest("hex");
 		const { sigV4StrictByDefault, sigV4OptFlag: optFlag } = getEmbedConfig();
 		if (opts.strict && !opts.oacFronted) {
 			if (!warned || !warned.has(dedupKey)) {
-				logger.warn(sigV4StrictByDefault ? `AWS_IAM authorizer: request signed with access-key-id '${parsed.credentialAccessKeyId}', which differs from the AWS credentials cdk-local resolved locally — SigV4 (HMAC / shared-secret) can only be verified with the signer's own credentials, never a federated / Cognito Identity Pool / cross-account signer's. cdk-local denies it by default; pass ${optFlag} to warn-and-pass, or sign the request with the same credentials cdk-local resolves locally.` : `AWS_IAM authorizer: request signed with access-key-id '${parsed.credentialAccessKeyId}', which differs from the AWS credentials cdk-local resolved locally — SigV4 (HMAC / shared-secret) can only be verified with the signer's own credentials, never a federated / Cognito Identity Pool / cross-account signer's. ${optFlag} is set, so cdk-local denies it; remove ${optFlag} to warn-and-pass (the default), or sign the request with the same credentials cdk-local resolves locally.`);
-				warned?.add(dedupKey);
+				logger.warn(sigV4StrictByDefault ? `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', which differs from the AWS credentials cdk-local resolved locally — SigV4 (HMAC / shared-secret) can only be verified with the signer's own credentials, never a federated / Cognito Identity Pool / cross-account signer's. cdk-local denies it by default; pass ${optFlag} to warn-and-pass, or sign the request with the same credentials cdk-local resolves locally.` : `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', which differs from the AWS credentials cdk-local resolved locally — SigV4 (HMAC / shared-secret) can only be verified with the signer's own credentials, never a federated / Cognito Identity Pool / cross-account signer's. ${optFlag} is set, so cdk-local denies it; remove ${optFlag} to warn-and-pass (the default), or sign the request with the same credentials cdk-local resolves locally.`);
+				rememberWarnedForeignId(warned, dedupKey);
 			}
 			return {
 				allow: false,
@@ -13426,8 +13453,8 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 			};
 		}
 		if (!warned || !warned.has(dedupKey)) {
-			logger.warn(opts.oacFronted ? `AWS_IAM authorizer: Function URL is fronted by CloudFront OAC — in production CloudFront re-signs the origin request, so the local client's signature (access-key-id '${parsed.credentialAccessKeyId}') cannot be verified. Passing through with unverified principalId 'unverified-foreign-identity'. Do NOT trust event.requestContext.authorizer.principalId in handler code.` : sigV4StrictByDefault ? `AWS_IAM authorizer: request signed with access-key-id '${parsed.credentialAccessKeyId}', a federated / Cognito Identity Pool / cross-account signer cdk-local cannot verify locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it because AWS holds the secret). ${optFlag} is set; passing through with unverified principalId 'unverified-foreign-identity'. Do NOT trust event.requestContext.authorizer.principalId in handler code.` : `AWS_IAM authorizer: request signed with access-key-id '${parsed.credentialAccessKeyId}', a federated / Cognito Identity Pool / cross-account signer cdk-local cannot verify locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it because AWS holds the secret). Passing through with unverified principalId 'unverified-foreign-identity' — cdk-local's default for unverifiable IAM requests; pass ${optFlag} to deny instead. Do NOT trust event.requestContext.authorizer.principalId in handler code.`);
-			warned?.add(dedupKey);
+			logger.warn(opts.oacFronted ? `AWS_IAM authorizer: Function URL is fronted by CloudFront OAC — in production CloudFront re-signs the origin request, so the local client's signature (access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}') cannot be verified. Passing through with unverified principalId 'unverified-foreign-identity'. Do NOT trust event.requestContext.authorizer.principalId in handler code.` : sigV4StrictByDefault ? `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', a federated / Cognito Identity Pool / cross-account signer cdk-local cannot verify locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it because AWS holds the secret). ${optFlag} is set; passing through with unverified principalId 'unverified-foreign-identity'. Do NOT trust event.requestContext.authorizer.principalId in handler code.` : `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', a federated / Cognito Identity Pool / cross-account signer cdk-local cannot verify locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it because AWS holds the secret). Passing through with unverified principalId 'unverified-foreign-identity' — cdk-local's default for unverifiable IAM requests; pass ${optFlag} to deny instead. Do NOT trust event.requestContext.authorizer.principalId in handler code.`);
+			rememberWarnedForeignId(warned, dedupKey);
 		}
 		return {
 			allow: true,
@@ -13435,9 +13462,8 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 			identityHash: buildIdentityHash([parsed.signature])
 		};
 	}
-	const recomputed = computeSignature(req, parsed, local.secretAccessKey, amzDate);
-	if (!constantTimeEqual(recomputed, parsed.signature)) {
-		logger.info(`AWS_IAM authorizer: rejecting request — Signature= mismatch (recomputed '${recomputed}', got '${parsed.signature}'). The request was signed with the expected access-key-id but the HMAC does not verify — check the SignedHeaders list, request body, and canonical-request normalization on the signer side.`);
+	if (!constantTimeEqual(computeSignature(req, parsed, local.secretAccessKey, amzDate), parsed.signature)) {
+		logger.info(`AWS_IAM authorizer: rejecting request — Signature= mismatch (got '${redactSignature(parsed.signature)}'; the recomputed signature is withheld, because it is a valid signature for this request under your local credentials). The request was signed with the expected access-key-id but the HMAC does not verify — check the SignedHeaders list, request body, and canonical-request normalization on the signer side.`);
 		return {
 			allow: false,
 			identityHash: void 0
@@ -13450,6 +13476,215 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 	};
 }
 /**
+* Upper bound on how much of an `Authorization`-header segment a rejection
+* message may quote.
+*
+* 32 clears every value these messages legitimately name, with room to
+* spare: `AWS4-HMAC-SHA256` is 16 characters, the longest real algorithm
+* spelling this parser rejects (`AWS4-ECDSA-P256-SHA256-PAYLOAD`) is 30,
+* `aws4_request` is 12, a `YYYYMMDD` date is 8, and an access-key id is 20.
+* The ceiling is what fixes it at 32 rather than higher: an AWS SECRET
+* access key is 40 characters, and pasting one into `AWS_ACCESS_KEY_ID` is
+* the one way a developer's own secret reaches this header — so the bound
+* has to sit below 40 for that paste to be withheld rather than quoted.
+*/
+const AUTH_SEGMENT_QUOTE_MAX = 32;
+/**
+* Quote one caller-supplied `Authorization`-header segment for a rejection
+* message, or withhold it when it cannot be a segment.
+*
+* Issue #555. These messages are `info` and `warn`, not `debug`, so they
+* print on a plain `cdkl start-api` run rather than only under `--verbose`
+* — a different population from a verbose-gated diagnostic, and the reason
+* the auth-header sites were the ones worth changing. What each names is a
+* POSITION in the header, and a position holds only its own short token
+* while the header's delimiters sit where the parser expects them. Drop a
+* single comma —
+* `Credential=AKID/20260101/us-east-1/execute-api/aws4_request Signature=<hex>, SignedHeaders=host, Signature=abcd`
+* — and `Credential=`'s value absorbs the parameter that should have
+* followed it, so the credential-scope split hands its LAST segment the
+* `Signature=` component and the terminator message prints it at default
+* level. (A header delimited by spaces throughout never reaches that
+* message: it yields a single parameter, so the parse throws `missing
+* SignedHeaders` first.)
+*
+* So a quote is allowed only for input that could still BE one segment: no
+* whitespace, no `=`, no longer than {@link AUTH_SEGMENT_QUOTE_MAX}. Any of
+* those failing means the parse boundary was elsewhere and the value is
+* unrelated header material of unknown extent, reported by shape instead.
+* Every genuine typo (`aws3_request`, `AWS4-HMAC-SHA512`) stays quoted in
+* full — the actionability issue #246 added these messages for — while the
+* sweep-in case degrades to a character count.
+*
+* The offered `Signature=` value has its own predicate,
+* {@link redactSignature}: a real signature is 64 characters, so this bound
+* would withhold every legitimate one.
+*/
+function redactAuthorizationSegment(segment) {
+	if (segment.length > AUTH_SEGMENT_QUOTE_MAX || /[\s=]/.test(segment)) return `<withheld: ${segment.length} characters of unparsed header material>`;
+	return segment;
+}
+/**
+* Bound on the `x-amz-date` / `date` echo. Every legal spelling is far
+* below it. Measured on Node 24: RFC 1123 `Mon, 02 Jan 2006 15:04:05 GMT`
+* is 29 characters; `new Date().toString()` runs 45 to 76 depending on the
+* zone name (55 on the machine this was written on, 76 for
+* `Australia/Eucla`) across all 418 zones `Intl.supportedValuesOf` lists;
+* and the longest spelling `Date` was observed to PARSE,
+* `Wednesday, December 31, 2025 00:00:00 GMT+0000 (Coordinated Universal
+* Time)`, is 75. So nothing actionable is ever withheld.
+*/
+const TIMESTAMP_HEADER_QUOTE_MAX = 200;
+/**
+* Bound the `x-amz-date` / `date` echo by LENGTH ONLY.
+*
+* Issue #555 reviewed this site and deliberately did NOT route it through
+* {@link redactAuthorizationSegment}. It is not an `Authorization` segment:
+* `pickHeader` reads the whole header, so no delimiter mistake can sweep a
+* `Signature=` component into it, and what lands here is whatever the
+* CALLER put in their own timestamp header. More to the point, a SHAPE
+* bound would withhold exactly the case the message exists for — the value
+* reaching the mismatch branch is usually a perfectly valid timestamp that
+* simply disagrees with the credential scope, and the legal spellings carry
+* spaces and run long (see {@link TIMESTAMP_HEADER_QUOTE_MAX}). A
+* whitespace clause or a 32-character cap withholds all of them.
+*
+* "No shape bound" is not "no bound", though. The value is unbounded caller
+* input printed at `info`, and `cdkl studio` mirrors these lines into a log
+* ring it serves over HTTP, so a length cap costs nothing and ends the
+* flood. Do not tighten it into a shape check.
+*/
+function boundTimestampHeader(value) {
+	if (value.length > TIMESTAMP_HEADER_QUOTE_MAX) return `<withheld: ${value.length} characters, too long to be a timestamp>`;
+	return value;
+}
+/**
+* Quote the caller's OFFERED `Signature=` value, or withhold it when that
+* field swept in material which is not a signature.
+*
+* `Signature=` is the LAST parameter of the header, which makes it a sweep
+* position exactly like the credential-scope terminator: a header ending
+* `..., Signature=<hex> X-Anything=foo` parses to a `signature` of
+* `<hex> x-anything=foo`. A real SigV4 signature is lowercase hex and
+* EXACTLY 64 characters; the predicate accepts 1 to 64 rather than exactly
+* 64 only so that a short but otherwise plausible value still shows (a
+* truncated paste is worth seeing). Either way it quotes every legitimate
+* value — the one issue #246 needs the user to compare — and withholds
+* anything a mis-delimited split swept in.
+*
+* This covers the OFFERED signature only. The RECOMPUTED one is never
+* printed; the mismatch message in {@link verifySigV4} says why.
+*/
+function redactSignature(signature) {
+	if (!/^[0-9a-f]{1,64}$/.test(signature)) return `<withheld: ${signature.length} characters that are not a signature>`;
+	return signature;
+}
+/**
+* Describe a credential-chain failure for a default-level log line WITHOUT
+* relaying the chain's own message (issue #564).
+*
+* The message is withheld because of what a credential-chain error CAN
+* carry: `@aws-sdk/credential-provider-process` copies the rejection of
+* `promisify(child_process.exec)` — Node's
+* `Command failed: <command line>\n<stderr>` — into the error it throws, so
+* a passphrase on a `credential_process` command line is already inside a
+* chain error object. On the SDK versions this repo resolves today that
+* object does not actually reach the caller (the chain swallows it and ends
+* on a generic message), which makes this defense in depth rather than a
+* live disclosure. The measurement, and the full reasoning for withholding
+* at `warn` while keeping the text at `debug`, are at the call site in
+* {@link verifySigV4}.
+*
+* What is reported instead is input-INDEPENDENT: `err.name` is set by the
+* throwing class rather than derived from anything the loader read, which is
+* the property that makes quoting it safe, and is the same discriminator
+* `ecs-secrets-resolver.ts` reports for the JSON parse failure it must not
+* echo. `'unknown'` rather than a guessed class name for a non-`Error`
+* throw, so the field never names a class the throw was not -- and the same
+* `'unknown'` for a `name` that is not a bare identifier, so the guarantee
+* does not rest on every provider following the convention.
+*
+* The LENGTH is reported, unlike in `ecs-secrets-resolver.ts`, and the
+* difference is deliberate: there the user already knows which secret it is
+* and can read the value at its source, so a character count would be
+* disclosure buying nothing. Here the user cannot see the withheld message
+* at all, and the count is what separates a one-line
+* `Could not load credentials from any providers` from a multi-hundred-
+* character `Command failed:` dump — which is what tells them whether their
+* `credential_process` even ran. It is the same choice
+* {@link redactAuthorizationSegment} makes when it withholds.
+*
+* The count is a side channel, and a narrow one: against a KNOWN
+* `credential_process` template the number is `constant + len(passphrase)`,
+* so it yields the passphrase's LENGTH. That is accepted rather than
+* overlooked. It buys the one thing the user cannot otherwise see, the
+* `Command failed:` dump is not reachable today anyway (see the call site),
+* and bucketing the number would blur exactly the boilerplate-vs-dump
+* distinction the field exists for.
+*/
+function stringifyCredentialLoadFailure(err) {
+	try {
+		return err instanceof Error ? String(err.message) : String(err);
+	} catch {
+		return "[unstringifiable throw]";
+	}
+}
+function describeCredentialLoadFailure(err) {
+	const rawKind = err instanceof Error ? err.name : "unknown";
+	return `${/^[A-Za-z0-9_.-]{1,64}$/.test(rawKind) ? rawKind : "unknown"}; ${stringifyCredentialLoadFailure(err).length}-character message withheld, logged at debug level under --verbose`;
+}
+/**
+* How many distinct foreign access-key-ids {@link verifySigV4}'s warn-dedup
+* set retains (issue #561).
+*
+* The legitimate population is tiny — a session sees one federated / Cognito
+* Identity Pool / cross-account signer, occasionally a handful — so 256
+* leaves two orders of magnitude of headroom over any real use while holding
+* the set at 256 entries of exactly 64 hex characters whatever a caller
+* sends, because {@link verifySigV4} hashes the id before it becomes a key.
+*
+* `docs/local-emulation.md` states this number to users ("the 256 most
+* recently warned ids"); change both together.
+*/
+const FOREIGN_ID_DEDUP_MAX = 256;
+/**
+* Record that the foreign-access-key-id warning has been emitted for
+* `dedupKey`, evicting oldest-first so the set cannot grow without bound
+* (issue #561).
+*
+* # Why eviction, and not "stop warning past the cap"
+*
+* The set's only power is SUPPRESSION — an entry present means the warning
+* is skipped — so the two candidate policies differ in the DIRECTION they
+* fail. Evicting an entry can only ever cause a REPEAT warning, which is
+* precisely the un-deduped behaviour this code had before the dedup existed:
+* noisier, never quieter. Capping by refusing to warn once the set is full
+* would instead silence the (cap+1)-th distinct signer, and that signer is
+* every bit as likely to be the real federated identity the developer needs
+* told about as it is to be a prober's next value. A warning that never
+* arrives is a worse failure than a set that grows, so the bound is put
+* where it cannot suppress anything.
+*
+* `Set` iterates in insertion order, so `values().next()` is the oldest
+* entry and this is FIFO. It is a loop rather than a single `delete` so a
+* set handed in already over the cap is brought back under it.
+*
+* What this does NOT fix: a client looping over DISTINCT ids still draws one
+* warn line per probe. Distinct ids defeat the dedup whether or not the set
+* is bounded, and closing that half would need suppression — the direction
+* ruled out above. The bound here is on memory only.
+*/
+function rememberWarnedForeignId(warned, dedupKey) {
+	if (!warned) return;
+	if (warned.has(dedupKey)) return;
+	while (warned.size >= FOREIGN_ID_DEDUP_MAX) {
+		const oldest = warned.values().next();
+		if (oldest.done === true) break;
+		warned.delete(oldest.value);
+	}
+	warned.add(dedupKey);
+}
+/**
 * Parse `AWS4-HMAC-SHA256 Credential=..., SignedHeaders=..., Signature=...`.
 * Rejects every other shape (including legacy `AWS4-HMAC-SHA256-...`
 * variants and HTTP/1.0-style multi-line values).
@@ -13460,9 +13695,12 @@ function parseAuthorizationHeader(value) {
 	const algorithm = value.slice(0, spaceIdx).trim();
 	const parts = value.slice(spaceIdx + 1).trim().split(",").map((s) => s.trim());
 	const fields = {};
-	for (const part of parts) {
+	for (const [i, part] of parts.entries()) {
 		const eq = part.indexOf("=");
-		if (eq < 0) throw new Error(`malformed parameter '${part}'`);
+		if (eq < 0) {
+			const detail = part.length === 0 ? "empty, stray comma?" : `${part.length} characters, no '='`;
+			throw new Error(`malformed parameter ${i + 1} of ${parts.length} (${detail})`);
+		}
 		const key = part.slice(0, eq).trim();
 		fields[key] = part.slice(eq + 1).trim();
 	}
@@ -13473,9 +13711,9 @@ function parseAuthorizationHeader(value) {
 	if (!signedHeaders) throw new Error("missing SignedHeaders");
 	if (!signature) throw new Error("missing Signature");
 	const credParts = credential.split("/");
-	if (credParts.length !== 5) throw new Error(`malformed Credential '${credential}' (expected 5 slash-separated segments)`);
+	if (credParts.length !== 5) throw new Error(`malformed Credential: expected 5 slash-separated segments, got ${credParts.length}`);
 	const [accessKeyId, date, region, service, terminator] = credParts;
-	if (!/^[0-9]{8}$/.test(date)) throw new Error(`malformed credential date '${date}' (expected YYYYMMDD)`);
+	if (!/^[0-9]{8}$/.test(date)) throw new Error(`malformed credential date '${redactAuthorizationSegment(date)}' (expected YYYYMMDD)`);
 	return {
 		algorithm,
 		credentialAccessKeyId: accessKeyId,
@@ -37822,4 +38060,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, resolveProfileCredentials as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, buildStsClientConfig as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-BBtUAVNy.js.map
+//# sourceMappingURL=local-studio-xigfWo5b.js.map