cdk-local 0.147.8 → 0.147.10

package/dist/{local-studio-PCB6DpBn.js → local-studio-9eVA5PPS.js}

@@ -228,6 +228,395 @@ function buildStsClientConfig(args) {
 	};
 }
 
+//#endregion
+//#region src/local/credential-error.ts
+/**
+* Rendering an AWS SDK failure into a log line cdk-local is willing to print
+* at DEFAULT level (issues #564, #570).
+*
+* # Why a shared module
+*
+* Issue #564 settled the policy for one site — the credential-chain failure
+* in {@link file://./sigv4-verify.ts} — and #570 found the same shape at nine
+* more, spread across five `src/cli/commands/*.ts` files. Every one of them
+* relays a third-party error's `message` into a `logger.warn`, so they share
+* one question and must not grow nine answers to it.
+*
+* SCOPE, stated so a later sweep finds a decision rather than an oversight:
+* this module governs those nine plus sigv4-verify's one, and its
+* {@link flattenToOneLine} additionally covers every other wire-derived value
+* printed on those lines (the role ARN, on the failure AND success paths). It
+* does NOT yet govern the AWS SDK error relays elsewhere under
+* `src/local/**` — notably
+* `formatAwsErrorForWarn` (`cfn-local-state-provider.ts`, six warn sites and
+* one non-warn caller)
+* and `formatSsmError` (`ssm-parameter-resolver.ts`), which still print an
+* UNCLAMPED wire-derived `err.name`. Those are enumerated and tracked in
+* issue #579; they were left out here so a cross-cutting refactor of eight
+* more files would not share a review with the policy that justifies it.
+*
+* # The two axes that decide it
+*
+* PROVENANCE alone says relay: a credential-chain error is about the
+* developer's own machine configuration, not something cdk-local fetched out
+* of a secret store (issue #555's criterion). Two further axes overrule it:
+*
+*   LEVEL — these are `warn`, so they print on a plain `cdkl start-api` /
+*   `cdkl invoke` run rather than only under `--verbose`, and `cdkl studio`
+*   mirrors a serve child's output into a log ring it serves over HTTP.
+*   Everybody sees a `warn`; only someone who asked sees a `debug`.
+*
+*   RECONSTRUCTION — what can reach the string is not a hint about a secret,
+*   it is the secret. `@aws-sdk/credential-provider-process` builds its
+*   failure as `new CredentialsProviderError(error.message)` where `error` is
+*   the rejection of `promisify(child_process.exec)`, i.e. Node's
+*   `Command failed: <command line>\n<stderr>`, and a passphrase written on a
+*   `credential_process` command line is an ordinary thing to have. (Verified
+*   at `@aws-sdk/credential-provider-process@3.972.{39,41,43}`
+*   `dist-cjs/index.js:56` in this repo's tree.)
+*
+* # Where these sites DIFFER from sigv4-verify's, and why the answer differs
+*
+* {@link file://./sigv4-verify.ts}'s `catch` wraps `client.config.credentials()`
+* and nothing else: credential-chain resolution, with no AWS operation
+* cdk-local asked for. Nothing actionable is lost by withholding all of it,
+* so that site withholds unconditionally and keeps the text at `debug`.
+*
+* The #570 sites wrap an SDK call cdk-local DID make — STS
+* `GetCallerIdentity` or `AssumeRole` — so two unrelated error populations
+* land in one `catch`:
+*
+*   1. the credential chain failed before the request went out, which is
+*      #564's population exactly, and
+*   2. STS answered with a modeled service exception — `ExpiredTokenException`,
+*      `AccessDenied` — whose message IS the diagnosis the user needs, and
+*      which never went near `credential_process`. (Spelled as the SDK
+*      spells them: `@aws-sdk/client-sts` models `ExpiredTokenException`
+*      (`dist-cjs/models/errors.js:6`), while `AccessDenied` is unmodeled and
+*      arrives as the wire code verbatim — which is exactly why the name is
+*      clamped rather than trusted.)
+*
+* Blanket-withholding would turn the single commonest failure of these
+* commands (`ExpiredTokenException: The security token included in the
+* request is expired`) into a class name and a character count. So the split
+* is by population, via {@link describeAwsFailureForWarn}.
+*
+* # The safe state is defined POSITIVELY
+*
+* The discriminator is not a deny-list of bad error shapes — #564 rejected
+* that reasoning for the `Command failed:` first line, and it loses the same
+* race here. It is the SDK's own structural test for "this came off the wire
+* as a modeled service error" ({@link isAwsServiceException}). Anything that
+* does not match — a chain failure, a socket error, a bare `throw 'x'` — is
+* withheld. An unrecognised shape therefore fails toward withholding.
+*
+* A hostile endpoint cannot steer the discriminator into disclosing MORE.
+* `$fault` / `$metadata` are set by the SDK from the HTTP response, not from
+* anything the body names, so forging `x-amzn-errortype:
+* CredentialsProviderError` only changes `err.name` — the response is still a
+* service response, so the error stays on the KEPT branch and its message is
+* still the sanitized, capped one the endpoint could have sent under any
+* other name. What the endpoint cannot do is move a `credential_process`
+* command line onto that branch: that text originates locally, inside a
+* `CredentialsProviderError` that never acquires `$fault`.
+*
+* # What this does NOT close
+*
+* A single-LINE forged string still reaches readers other than a human.
+* `cdkl studio` matches every serve-child stdout line against an unanchored
+* ready-line regex and proxies to the URL it captures, so a message
+* containing `Server listening on http://...` can redirect the studio proxy.
+* That is not fixed here — the sanitizer bounds the line, it does not stop a
+* machine from reading it — and it predates this change (an ordinary handler
+* log line trips the same matcher). Tracked in issue #578.
+*/
+/**
+* Longest service-exception message relayed into a `warn` line, in
+* characters.
+*
+* A modeled STS error's message is WIRE-DERIVED — the SDK reads it out of the
+* response body — so its length is not cdk-local's to assume. Real ones run
+* to roughly 150 characters (`AccessDenied: User: arn:... is not authorized to
+* perform: sts:AssumeRole on resource: arn:...`), and the policy-quoting ones
+* are the longest, so the cap is set well above that: it exists to stop an
+* unbounded body from becoming an unbounded log line, not to trim ordinary
+* AWS text, which must survive intact or the branch buys nothing.
+*
+* Truncation is announced with the true length (see
+* {@link sanitizeServiceExceptionMessage}) so a capped line is never mistaken
+* for a complete one.
+*/
+const SERVICE_MESSAGE_MAX = 512;
+/**
+* Total stringification of a thrown value's message.
+*
+* `String(err)` is NOT total. That throw would escape the `catch` it is
+* called from and turn a warn-and-continue branch into a hard failure — a 500
+* from the SigV4 authorizer in #564's testing, and a dead `cdkl invoke` here.
+* One helper rather than an expression repeated per site, so the length
+* reported in a `warn` and the text printed at `debug` can never describe
+* different strings.
+*
+* CORRECTION to #564, measured on this repo's Node 24: `String(aSymbol)`
+* does NOT throw — it returns `'Symbol(x)'`, and it is template
+* INTERPOLATION (`` `${aSymbol}` ``) that raises
+* `TypeError: Cannot convert a Symbol value to a string`. Since both the old
+* code and this helper call `String()` explicitly, a `Symbol` throw was never
+* one of the reachable cases. The two that ARE reachable, both verified:
+* an object with a null prototype (`TypeError: Cannot convert object to
+* primitive value`, because it has no `toString`), and any value whose
+* `toString` / `Symbol.toPrimitive` throws — which a hostile or merely buggy
+* third-party error object is free to do.
+*
+* Named for what it does rather than for one caller: #564 shipped it as
+* `stringifyCredentialLoadFailure`, and #570 gave it a second population
+* (service exceptions) for which that name was simply wrong.
+*/
+function stringifyThrown(err) {
+	try {
+		return err instanceof Error ? String(err.message) : String(err);
+	} catch {
+		return "[unstringifiable throw]";
+	}
+}
+/**
+* The throwing class's name, clamped to something no input can forge.
+*
+* `err.name` is NOT input-independent, which is the whole reason this is a
+* function and not an interpolation. For an AWS service exception it is
+* WIRE-DERIVED: `@aws-sdk/core` builds it from the `x-amzn-errortype` header
+* / the body's `code` / `__type` through `sanitizeErrorCode`, which splits on
+* ',' ':' and '#' and does nothing else — no length cap, no newline stripping
+* (read at `@aws-sdk/core@3.974.13` `protocols/index.js:324`). Such an
+* exception reaches these call sites, because `credential-provider-ini` calls
+* the STS `roleAssumer` unwrapped and because the #570 sites invoke STS
+* directly. So a hostile or hijacked credential endpoint
+* (`AWS_CONTAINER_CREDENTIALS_FULL_URI`, a redirected IMDS) answering
+* `x-amzn-errortype: Foo\nWARN: signature verified` could FORGE log lines
+* into the `warn` stream — and into the studio ring served over HTTP.
+*
+* A bare identifier of at most 64 characters is what every real class name is
+* and what no injected value can be; anything else degrades to `'unknown'`,
+* which also covers a non-`Error` throw, so the field never names a class the
+* throw was not.
+*
+* Note the WRONG fix: `err.name.slice(0, 64)` keeps the newline, so the
+* forgery survives truncation.
+*/
+function clampErrorName(err) {
+	let rawKind;
+	try {
+		rawKind = err instanceof Error ? err.name : "unknown";
+	} catch {
+		return "unknown";
+	}
+	return typeof rawKind === "string" && /^[A-Za-z0-9_.-]{1,64}$/.test(rawKind) ? rawKind : "unknown";
+}
+/**
+* The thrown value's `code`, when it is a bare identifier, else `undefined`.
+*
+* This exists because withholding by class name alone is not discriminating
+* enough for the population that actually reaches the withheld branch most
+* often. `Region is missing`, `getaddrinfo ENOTFOUND sts.<region>.amazonaws.com`
+* and `connect ETIMEDOUT 169.254.169.254:80` all arrive as a plain `Error`, so
+* all three render as `Error; N-character message withheld` and the reader
+* cannot tell a misconfiguration from an unreachable endpoint.
+*
+* Node sets `code` on its system errors (`ENOTFOUND`, `ETIMEDOUT`,
+* `ECONNREFUSED`) and there it is a fixed enum chosen by the runtime. It is
+* NOT input-independent in general, though, and the earlier draft of this note
+* claimed it was: `@smithy/core`'s `decorateServiceException`
+* (`dist-cjs/submodules/client/index.js:795-802`) copies every key of the
+* PARSED RESPONSE BODY onto the exception, so an unmodeled error from a
+* hostile endpoint can carry a `code` of its choosing. The clamp is therefore
+* load-bearing rather than belt-and-braces, exactly as it is for
+* {@link clampErrorName}: what survives is at most 64 characters matching
+* `[A-Za-z0-9_.-]`, which cannot forge a line, and which is the same residue
+* the class name already accepts.
+*
+* `undefined` rather than `'unknown'` when there is none, so the caller can
+* omit the field entirely instead of printing a placeholder that says less
+* than nothing.
+*/
+function clampErrorCode(err) {
+	if (!err || typeof err !== "object") return void 0;
+	let raw;
+	try {
+		raw = err.code;
+	} catch {
+		return;
+	}
+	if (typeof raw !== "string") return void 0;
+	return /^[A-Za-z0-9_.-]{1,64}$/.test(raw) ? raw : void 0;
+}
+/**
+* Is `err` a modeled AWS service exception — i.e. did the SDK parse it out of
+* a service RESPONSE, rather than raise it while assembling the request?
+*
+* This is `ServiceException.isInstance`'s own structural test, reproduced
+* rather than imported: cdk-local loads `@aws-sdk/client-sts` lazily at every
+* one of these call sites (a dynamic `import()` inside the `try`), so taking
+* a static dependency on `@smithy/core` purely to type-test an error would
+* pull the SDK into the CLI's startup path. The structural form also keeps
+* working across the several `@smithy/core` copies pnpm resolves in this
+* tree, where an `instanceof` against one copy's class fails for an error
+* minted by another.
+*
+* The test is deliberately the SDK's and not a name list: a name list would
+* have to be extended for every new STS error code, and a missing entry would
+* fail toward DISCLOSING less, which is safe, but also toward hiding the
+* actionable message, which is the regression this split exists to avoid.
+*/
+function isAwsServiceException(err) {
+	if (!err || typeof err !== "object") return false;
+	const candidate = err;
+	try {
+		return Boolean(candidate.$metadata) && (candidate.$fault === "client" || candidate.$fault === "server");
+	} catch {
+		return false;
+	}
+}
+/**
+* Replace every character that could make one emitted line render as more than
+* one line, or render in an order it was not written in, with a space.
+*
+* Four Unicode categories, each measured rather than assumed (see the fixture
+* in `tests/unit/local/credential-error.test.ts`):
+*
+*   - `Cc` — the C0/C1 controls, which is `\n` / `\r` (a forged extra line in
+*     the studio ring) and `\x1b` (an ANSI escape in a terminal). U+0085 NEL
+*     lives here too.
+*   - `Cf` — the format characters, which is U+202E RIGHT-TO-LEFT OVERRIDE and
+*     friends: they forge how the REST of the line reads. The cost is that a
+*     ZWJ inside an emoji or an Indic cluster is replaced too; an AWS error
+*     message is ASCII, so that is a trade with no observed downside.
+*   - `Zl` / `Zp` — U+2028 and U+2029. Neither is in `Cc` or `Cf`, and both are
+*     forced line breaks in the studio UI's `<pre>`, so leaving them out would
+*     have left the forged-line case open in HTML while closing it in a
+*     terminal.
+*   - `Cs` — a LONE surrogate, which is not a character at all and breaks JSON
+*     encoding of the log event. With the `u` flag a well-formed pair is one
+*     code point and does NOT match, so emoji survive.
+*
+* Used by both branches of {@link describeAwsFailureForWarn} — the kept
+* message, and the `debug` line carrying the withheld one, because the `debug`
+* stream is the SAME studio ring under `--verbose`, so a text unsafe to put on
+* a line at `warn` is unsafe at `debug` — and, since issue #570's review
+* rounds, by every OTHER wire-derived value that lands on one of these lines:
+* `sigv4-verify`'s own `debug` line, and the role ARN at the four warn sites
+* plus the five `info` / `debug` sites that print an ARN resolved from a live
+* `GetFunctionConfiguration` / `GetAgentRuntime` response. The last group is
+* the more reachable one — it fires on SUCCESS.
+*/
+function flattenToOneLine(message) {
+	return message.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Cs}]/gu, " ");
+}
+/**
+* Render a wire-derived service message safe to put on one log line.
+*
+* Two properties, and both are about the LINE rather than about secrecy — the
+* message itself is already judged safe to print by the time this is called:
+*
+*   - No line breaks and no rendering-direction control, via
+*     {@link flattenToOneLine}.
+*   - Bounded length, with the true length named when it is exceeded. The
+*     suffix names the character count of the SANITIZED message rather than
+*     of the raw one, because the sanitized string is what the truncated
+*     prefix is a prefix OF; quoting the raw length would describe a string
+*     the reader can never see.
+*
+* The cut is made on CODE POINTS rather than UTF-16 units, so a truncation
+* landing inside an astral character cannot emit half of a surrogate pair. The
+* count in the suffix is the code-point count for the same reason: the prefix
+* and the number must describe the same string.
+*/
+function sanitizeServiceExceptionMessage(message) {
+	const points = [...flattenToOneLine(message)];
+	if (points.length <= SERVICE_MESSAGE_MAX) return points.join("");
+	return `${points.slice(0, SERVICE_MESSAGE_MAX).join("")}[... truncated; ${points.length}-character message]`;
+}
+/**
+* Describe a credential-chain failure for a default-level log line WITHOUT
+* relaying the chain's own message (issue #564).
+*
+* What is reported instead is input-INDEPENDENT: the clamped class name (see
+* {@link clampErrorName}), which is the same discriminator
+* `ecs-secrets-resolver.ts` reports for the JSON parse failure it must not
+* echo, plus the clamped {@link clampErrorCode} when the throw carries one.
+*
+* Withholding is NOT free, and the cost lands on cdk-local's own text as well
+* as on the SDK's: `role-arn.ts`'s
+* `AssumeRole(<arn>) returned no usable credentials.` is a plain `Error` with
+* no `$fault`, so it is withheld like any other. That is a real diagnostic
+* loss, accepted because the alternative — an allow-list of messages that may
+* print — is the deny-list this design rejects, wearing the other sign. The
+* fix is to make cdk-local's own throws identifiable rather than to guess at
+* their text; it is not done here, and is noted in issue #579.
+*
+* The LENGTH is reported, unlike in `ecs-secrets-resolver.ts`, and the
+* difference is deliberate: there the user already knows which secret it is
+* and can read the value at its source, so a character count would be
+* disclosure buying nothing. Here the user cannot see the withheld message at
+* all, and the count is what separates a one-line
+* `Could not load credentials from any providers` (45 characters, measured
+* against `@aws-sdk/credential-provider-node@3.972.44` `dist-cjs/index.js:144`)
+* from a multi-hundred-character `Command failed:` dump — which is what tells
+* them whether their `credential_process` even ran.
+*
+* The count is a side channel, and a narrow one: against a KNOWN
+* `credential_process` template the number is `constant + len(passphrase)`, so
+* it yields the passphrase's LENGTH. That is accepted rather than overlooked.
+* It buys the one thing the user cannot otherwise see, the `Command failed:`
+* dump is not reachable on today's SDK versions anyway, and bucketing the
+* number would blur exactly the boilerplate-vs-dump distinction the field
+* exists for.
+*/
+function describeCredentialLoadFailure(err) {
+	const code = clampErrorCode(err);
+	return `${code === void 0 ? clampErrorName(err) : `${clampErrorName(err)} ${code}`}; ${stringifyThrown(err).length}-character message withheld, logged at debug level under --verbose`;
+}
+/**
+* Render an AWS SDK call failure for a `logger.warn` line, and emit the
+* withheld text at `debug` when it is withheld (issue #570).
+*
+* `operation` names the call for the `debug` line — e.g.
+* `'STS GetCallerIdentity'`. It is cdk-local's own literal at every call
+* site, never anything read off an error or a response.
+*
+* # Why this emits the `debug` line itself
+*
+* Because the alternative is nine call sites each free to withhold a message
+* and forget to print it anywhere. The pairing is the invariant — "withheld
+* at `warn`" is only acceptable while "in full at `debug`" holds — so it
+* lives in one function rather than in a convention nine sites must keep. A
+* tenth site gets it for free.
+*
+* The `debug` line fires ONLY on the withheld branch. On the service-exception
+* branch the `warn` already carries the message, and repeating it verbatim one
+* level down would say nothing the reader did not just read.
+*
+* It is FLATTENED (not capped). Flattened because the `debug` stream is not a
+* private channel: it is the same stdout `cdkl studio` mirrors into the log
+* ring it serves over HTTP, so a `\n` in the withheld text would forge a line
+* there exactly as it would at `warn`. Not capped, because being able to read
+* the whole withheld message is the entire reason the line exists — the
+* `warn`'s character count is what tells the reader how much they are about to
+* see. Note that this puts the full text into that ring for a
+* `--verbose` studio run; see `docs/troubleshooting.md`.
+*
+* ORDERING: the `debug` line is emitted when THIS function runs, which is
+* before the `warn` at every site — inline in the `warn`'s template at eight of
+* them, and a couple of statements earlier at the one that hoists the result
+* into a `const reason`. Either way it prints immediately ABOVE the `warn` that
+* refers to it under `--verbose`. Left as is: restructuring every call site to
+* log afterwards would buy an ordering nobody reads top-down anyway.
+*/
+function describeAwsFailureForWarn(err, operation) {
+	if (isAwsServiceException(err)) return `${clampErrorName(err)}: ${sanitizeServiceExceptionMessage(stringifyThrown(err))}`;
+	getLogger().debug(`${operation}: the AWS SDK's own failure message was: ${flattenToOneLine(stringifyThrown(err))}`);
+	return describeCredentialLoadFailure(err);
+}
+
 //#endregion
 //#region src/utils/role-arn.ts
 /**
@@ -13421,7 +13810,8 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 	try {
 		local = await loadCredentials();
 	} catch (err) {
-		const reason = err instanceof Error ? err.message : String(err);
+		logger.debug(`AWS_IAM authorizer: the AWS credential chain's own failure message was: ${flattenToOneLine(stringifyThrown(err))}`);
+		const reason = describeCredentialLoadFailure(err);
 		const { sigV4StrictByDefault, sigV4OptFlag: optFlag } = getEmbedConfig();
 		if (opts.strict && !opts.oacFronted) {
 			logger.warn(sigV4StrictByDefault ? `AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified. cdk-local denies unverifiable IAM requests by default; pass ${optFlag} to warn-and-pass, or configure AWS credentials cdk-local can read.` : `AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified. ${optFlag} is set, so cdk-local denies unverifiable IAM requests; remove ${optFlag} to warn-and-pass (the default), or configure AWS credentials cdk-local can read.`);
@@ -13439,12 +13829,12 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 	}
 	if (local.accessKeyId.toLowerCase() !== parsed.credentialAccessKeyId.toLowerCase()) {
 		const warned = opts.warnedForeignIds;
-		const dedupKey = parsed.credentialAccessKeyId.toLowerCase();
+		const dedupKey = createHash("sha256").update(parsed.credentialAccessKeyId.toLowerCase()).digest("hex");
 		const { sigV4StrictByDefault, sigV4OptFlag: optFlag } = getEmbedConfig();
 		if (opts.strict && !opts.oacFronted) {
 			if (!warned || !warned.has(dedupKey)) {
 				logger.warn(sigV4StrictByDefault ? `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', which differs from the AWS credentials cdk-local resolved locally — SigV4 (HMAC / shared-secret) can only be verified with the signer's own credentials, never a federated / Cognito Identity Pool / cross-account signer's. cdk-local denies it by default; pass ${optFlag} to warn-and-pass, or sign the request with the same credentials cdk-local resolves locally.` : `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', which differs from the AWS credentials cdk-local resolved locally — SigV4 (HMAC / shared-secret) can only be verified with the signer's own credentials, never a federated / Cognito Identity Pool / cross-account signer's. ${optFlag} is set, so cdk-local denies it; remove ${optFlag} to warn-and-pass (the default), or sign the request with the same credentials cdk-local resolves locally.`);
-				warned?.add(dedupKey);
+				rememberWarnedForeignId(warned, dedupKey);
 			}
 			return {
 				allow: false,
@@ -13453,7 +13843,7 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 		}
 		if (!warned || !warned.has(dedupKey)) {
 			logger.warn(opts.oacFronted ? `AWS_IAM authorizer: Function URL is fronted by CloudFront OAC — in production CloudFront re-signs the origin request, so the local client's signature (access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}') cannot be verified. Passing through with unverified principalId 'unverified-foreign-identity'. Do NOT trust event.requestContext.authorizer.principalId in handler code.` : sigV4StrictByDefault ? `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', a federated / Cognito Identity Pool / cross-account signer cdk-local cannot verify locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it because AWS holds the secret). ${optFlag} is set; passing through with unverified principalId 'unverified-foreign-identity'. Do NOT trust event.requestContext.authorizer.principalId in handler code.` : `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', a federated / Cognito Identity Pool / cross-account signer cdk-local cannot verify locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it because AWS holds the secret). Passing through with unverified principalId 'unverified-foreign-identity' — cdk-local's default for unverifiable IAM requests; pass ${optFlag} to deny instead. Do NOT trust event.requestContext.authorizer.principalId in handler code.`);
-			warned?.add(dedupKey);
+			rememberWarnedForeignId(warned, dedupKey);
 		}
 		return {
 			allow: true,
@@ -13579,6 +13969,57 @@ function redactSignature(signature) {
 	return signature;
 }
 /**
+* How many distinct foreign access-key-ids {@link verifySigV4}'s warn-dedup
+* set retains (issue #561).
+*
+* The legitimate population is tiny — a session sees one federated / Cognito
+* Identity Pool / cross-account signer, occasionally a handful — so 256
+* leaves two orders of magnitude of headroom over any real use while holding
+* the set at 256 entries of exactly 64 hex characters whatever a caller
+* sends, because {@link verifySigV4} hashes the id before it becomes a key.
+*
+* `docs/local-emulation.md` states this number to users ("the 256 most
+* recently warned ids"); change both together.
+*/
+const FOREIGN_ID_DEDUP_MAX = 256;
+/**
+* Record that the foreign-access-key-id warning has been emitted for
+* `dedupKey`, evicting oldest-first so the set cannot grow without bound
+* (issue #561).
+*
+* # Why eviction, and not "stop warning past the cap"
+*
+* The set's only power is SUPPRESSION — an entry present means the warning
+* is skipped — so the two candidate policies differ in the DIRECTION they
+* fail. Evicting an entry can only ever cause a REPEAT warning, which is
+* precisely the un-deduped behaviour this code had before the dedup existed:
+* noisier, never quieter. Capping by refusing to warn once the set is full
+* would instead silence the (cap+1)-th distinct signer, and that signer is
+* every bit as likely to be the real federated identity the developer needs
+* told about as it is to be a prober's next value. A warning that never
+* arrives is a worse failure than a set that grows, so the bound is put
+* where it cannot suppress anything.
+*
+* `Set` iterates in insertion order, so `values().next()` is the oldest
+* entry and this is FIFO. It is a loop rather than a single `delete` so a
+* set handed in already over the cap is brought back under it.
+*
+* What this does NOT fix: a client looping over DISTINCT ids still draws one
+* warn line per probe. Distinct ids defeat the dedup whether or not the set
+* is bounded, and closing that half would need suppression — the direction
+* ruled out above. The bound here is on memory only.
+*/
+function rememberWarnedForeignId(warned, dedupKey) {
+	if (!warned) return;
+	if (warned.has(dedupKey)) return;
+	while (warned.size >= FOREIGN_ID_DEDUP_MAX) {
+		const oldest = warned.values().next();
+		if (oldest.done === true) break;
+		warned.delete(oldest.value);
+	}
+	warned.add(dedupKey);
+}
+/**
 * Parse `AWS4-HMAC-SHA256 Credential=..., SignedHeaders=..., Signature=...`.
 * Rejects every other shape (including legacy `AWS4-HMAC-SHA256-...`
 * variants and HTTP/1.0-style multi-line values).
@@ -16683,7 +17124,7 @@ function resolveStartApiAssumeRoleArn(args) {
 	if (stateBundle) {
 		const fromState = resolveExecutionRoleArnFromState(stateBundle.state, logicalId);
 		if (fromState) {
-			getLogger().info(`--assume-role: auto-resolved execution role for '${logicalId}' from state: ${fromState}`);
+			getLogger().info(`--assume-role: auto-resolved execution role for '${logicalId}' from state: ${flattenToOneLine(fromState)}`);
 			return fromState;
 		}
 	}
@@ -17497,6 +17938,11 @@ async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options,
 *
 * Region precedence: `--region` > `AWS_REGION` > `AWS_DEFAULT_REGION` >
 * the state record's region (returned by the active `LocalStateProvider`).
+*
+* Exported so the issue #570 site-level test can drive the STS failure
+* branch with a mocked STS client. A helper being correct says nothing about
+* whether a given site actually routes through it, so each of the nine
+* converted sites is driven separately.
 */
 async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	const logger = getLogger();
@@ -17514,7 +17960,7 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 			sts.destroy();
 		}
 	} catch (err) {
-		logger.warn(`--from-state: resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${err instanceof Error ? err.message : String(err)}. Substitution will be skipped for AWS::AccountId; affected env entries will be dropped with per-key warnings.`);
+		logger.warn(`--from-state: resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped for AWS::AccountId; affected env entries will be dropped with per-key warnings.`);
 	}
 	const partitionAndSuffix = region ? derivePartitionAndUrlSuffix(region) : void 0;
 	const bag = {
@@ -17909,6 +18355,15 @@ function envHasCrossStackIntrinsic(templateEnv) {
 	}
 	return false;
 }
+/**
+* Build the AWS pseudo-parameter bag (`${AWS::AccountId}` / `${AWS::Region}` /
+* partition / URL suffix) that `cdkl invoke`'s env-var substitution consumes.
+*
+* Exported so the issue #570 site-level test can drive the STS failure branch
+* with a mocked STS client -- the same reason `resolveLambdaContainerEnv`
+* below is exported. A helper being correct says nothing about whether a
+* given site actually routes through it.
+*/
 async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	const logger = getLogger();
 	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stackRegion;
@@ -17926,7 +18381,7 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 			sts.destroy();
 		}
 	} catch (err) {
-		logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${err instanceof Error ? err.message : String(err)}. Substitution will be skipped; affected env entries will be dropped with per-key warnings.`);
+		logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped; affected env entries will be dropped with per-key warnings.`);
 	}
 	const partitionAndSuffix = region ? derivePartitionAndUrlSuffix(region) : void 0;
 	const bag = {
@@ -18118,8 +18573,8 @@ async function resolveLambdaContainerEnv(lambda, options, profileCredentials, ex
 			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 			assumeSucceeded = true;
 		} catch (err) {
-			const reason = err instanceof Error ? err.message : String(err);
-			logger.warn(`--assume-role: STS AssumeRole(${resolvedAssumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
+			const reason = describeAwsFailureForWarn(err, "STS AssumeRole");
+			logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(resolvedAssumeRoleArn)}) failed: ${reason}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -18151,10 +18606,23 @@ function materializeInlineCode$1(handler, source, fileExtension) {
 	writeFileSync(filePath, source, "utf-8");
 	return dir;
 }
+/**
+* Suggest `--assume-role` when the deployed function's execution role is
+* known and the user did not ask for it.
+*
+* Exported for the issue #570 ARN-flatten test. This is the MOST reachable of
+* the sites that print a wire-derived ARN: its caller is guarded on
+* `options.assumeRole === undefined`, so it fires on a plain
+* `cdkl invoke --from-cfn-stack <fn>` with no role flag at all. The ARN comes
+* from the same `resolveExecutionRoleArnFromState` whose other readers are
+* flattened, `info` is a default level, and `cdkl studio` splits an invoke
+* child's stdout on `\n` and emits every line as its own ring entry -- so an
+* unflattened newline here is two entries, the second entirely attacker-chosen.
+*/
 function suggestAssumeRoleFromState(state, logicalId) {
 	const logger = getLogger();
 	const roleArn = resolveExecutionRoleArnFromState(state, logicalId);
-	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${roleArn}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
+	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${flattenToOneLine(roleArn)}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
 }
 /**
 * Resolve the role ARN to assume for a Lambda invoke, honoring the three
@@ -18185,14 +18653,14 @@ async function resolveAssumeRoleArnForLambda(assumeRole, stateForRoleHint, state
 	}
 	const fromState = resolveExecutionRoleArnFromState(stateForRoleHint, lambdaLogicalId);
 	if (fromState) {
-		logger.info(`--assume-role: auto-resolved execution role from state: ${fromState}`);
+		logger.info(`--assume-role: auto-resolved execution role from state: ${flattenToOneLine(fromState)}`);
 		return fromState;
 	}
 	const fnPhysicalId = stateForRoleHint.resources[lambdaLogicalId]?.physicalId;
 	if (stateProvider?.resolveLambdaExecutionRoleArn && fnPhysicalId) {
 		const liveArn = await stateProvider.resolveLambdaExecutionRoleArn(fnPhysicalId);
 		if (liveArn) {
-			logger.info(`--assume-role: auto-resolved execution role from GetFunctionConfiguration: ${liveArn}`);
+			logger.info(`--assume-role: auto-resolved execution role from GetFunctionConfiguration: ${flattenToOneLine(liveArn)}`);
 			return liveArn;
 		}
 	}
@@ -19758,6 +20226,11 @@ async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, por
 *
 * Throws a {@link CdkLocalError} when none are available — `--sigv4` cannot
 * proceed without credentials, unlike the unsigned path.
+*
+* Exported so the issue #570 site-level test can drive the STS failure
+* branch with a mocked STS client -- the same reason
+* `applyAgentCoreCredentialEnv` below is exported. A helper being correct
+* says nothing about whether a given site actually routes through it.
 */
 async function resolveHostCredentialsForSigV4(options, resolved, loaded, region, stateProvider) {
 	const logger = getLogger();
@@ -19765,7 +20238,7 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region,
 	if (assumeRoleArn) try {
 		return await assumeAgentCoreExecutionRole(assumeRoleArn, region, options.profile);
 	} catch (err) {
-		logger.warn(`--assume-role: STS AssumeRole(${assumeRoleArn}) failed for --sigv4 signing: ${err instanceof Error ? err.message : String(err)}. Falling back to ${options.profile ? `--profile ${options.profile}` : "shell credentials"}.`);
+		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for --sigv4 signing: ${describeAwsFailureForWarn(err, "STS AssumeRole (--sigv4 signing)")}. Falling back to ${options.profile ? `--profile ${options.profile}` : "shell credentials"}.`);
 	}
 	if (options.profile) {
 		const creds = await resolveProfileCredentials(options.profile);
@@ -19868,6 +20341,11 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 * or resolved from `--from-cfn-stack` state for the bare form) yields STS temp
 * creds for the download; otherwise `--profile` / the default chain is used.
 * The region is `--region` / `--stack-region` / env / the stack's region.
+*
+* Exported so the issue #570 site-level test can drive the STS failure
+* branch with a mocked STS client -- the same reason
+* `applyAgentCoreCredentialEnv` below is exported. A helper being correct
+* says nothing about whether a given site actually routes through it.
 */
 async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options, architecture, loaded, stateProvider) {
 	const logger = getLogger();
@@ -19883,7 +20361,7 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 	if (assumeRoleArn) try {
 		credentials = await assumeAgentCoreExecutionRole(assumeRoleArn, region, options.profile);
 	} catch (err) {
-		logger.warn(`--assume-role: STS AssumeRole(${assumeRoleArn}) failed for the fromS3 bundle download: ${err instanceof Error ? err.message : String(err)}. Falling back to ${options.profile ? `--profile ${options.profile}` : "the default credentials"}.`);
+		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for the fromS3 bundle download: ${describeAwsFailureForWarn(err, "STS AssumeRole (fromS3 bundle download)")}. Falling back to ${options.profile ? `--profile ${options.profile}` : "the default credentials"}.`);
 	}
 	const bundle = await downloadAndExtractS3Bundle(location, {
 		...region !== void 0 && { region },
@@ -20022,7 +20500,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 	try {
 		accountId = await resolveCallerAccountId$2(region, options.profile);
 	} catch (err) {
-		logger.warn(`--from-cfn-stack: STS GetCallerIdentity failed: ${err instanceof Error ? err.message : String(err)}. A same-stack ECR image URI referencing \${AWS::AccountId} may not resolve.`);
+		logger.warn(`--from-cfn-stack: STS GetCallerIdentity failed: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity")}. A same-stack ECR image URI referencing \${AWS::AccountId} may not resolve.`);
 	}
 	const context = {};
 	const pseudo = derivePseudoParametersFromRegion(region, accountId);
@@ -20081,7 +20559,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 			assumeSucceeded = true;
 		} catch (err) {
-			logger.warn(`--assume-role: STS AssumeRole(${args.assumeRoleArn}) failed: ${err instanceof Error ? err.message : String(err)}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(args.assumeRoleArn)}) failed: ${describeAwsFailureForWarn(err, "STS AssumeRole")}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -20112,14 +20590,14 @@ async function resolveAssumeRoleArn(options, resolved, loaded, stateProvider) {
 	if (loaded) {
 		const fromState = resolveExecutionRoleArnFromState(loaded, resolved.logicalId, "RoleArn");
 		if (fromState) {
-			getLogger().debug(`--assume-role: resolved RoleArn from state: ${fromState}`);
+			getLogger().debug(`--assume-role: resolved RoleArn from state: ${flattenToOneLine(fromState)}`);
 			return fromState;
 		}
 		const runtimePhysicalId = loaded.resources[resolved.logicalId]?.physicalId;
 		if (stateProvider?.resolveAgentCoreRuntimeRoleArn && runtimePhysicalId) {
 			const liveArn = await stateProvider.resolveAgentCoreRuntimeRoleArn(runtimePhysicalId);
 			if (liveArn) {
-				getLogger().info(`--assume-role: auto-resolved execution role from GetAgentRuntime: ${liveArn}`);
+				getLogger().info(`--assume-role: auto-resolved execution role from GetAgentRuntime: ${flattenToOneLine(liveArn)}`);
 				return liveArn;
 			}
 		}
@@ -27079,7 +27557,7 @@ async function buildEcsImageResolutionContext$1(target, stacks, options, statePr
 		try {
 			accountId = await resolveCallerAccountId$1(region, options.profile);
 		} catch (err) {
-			logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${err instanceof Error ? err.message : String(err)}. Substitution will be skipped; affected env / secret entries will be dropped with per-key warnings.`);
+			logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped; affected env / secret entries will be dropped with per-key warnings.`);
 		}
 		const partitionAndSuffix = region ? derivePartitionAndUrlSuffix(region) : void 0;
 		ctx.pseudoParameters = {
@@ -27642,7 +28120,7 @@ async function buildEcsImageResolutionContext(candidate, stateProvider, options)
 		try {
 			accountId = await resolveCallerAccountId(region, options.profile);
 		} catch (err) {
-			logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${err instanceof Error ? err.message : String(err)}. Substitution will be skipped; affected env / secret entries will be dropped with per-key warnings.`);
+			logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped; affected env / secret entries will be dropped with per-key warnings.`);
 		}
 		const partitionAndSuffix = region ? derivePartitionAndUrlSuffix(region) : void 0;
 		ctx.pseudoParameters = {
@@ -37953,5 +38431,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, resolveProfileCredentials as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, buildStsClientConfig as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-PCB6DpBn.js.map
+export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, describeCredentialLoadFailure as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, resolveProfileCredentials as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildStsClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, describeAwsFailureForWarn as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
+//# sourceMappingURL=local-studio-9eVA5PPS.js.map