cdk-local 0.149.1 → 0.149.3

package/README.md

@@ -144,7 +144,7 @@ cdkl invoke --from-cfn-stack --stack-region eu-west-1   # cross-region CFn clien
 cdkl invoke --from-cfn-stack --assume-role              # auto-assume deployed execution role
 ```
 
-Substitutes `Ref` / `Fn::ImportValue` / `Fn::GetStackOutput` in env vars with the deployed physical IDs / exports, decrypts `AWS::SSM::Parameter::Value` entries (kept off the `docker run` argv), and resolves same-stack ECR `ContainerUri` to the deployed image. `Fn::GetAtt` in the Lambda's own env is recovered from the deployed function's resolved `Environment.Variables` via `lambda:GetFunctionConfiguration`. Full resolution rules: [docs/cli-reference.md#cloudformation-driven-env-recovery---from-cfn-stack](docs/cli-reference.md#cloudformation-driven-env-recovery---from-cfn-stack).
+Substitutes `Ref` / `Fn::ImportValue` / `Fn::GetStackOutput` in env vars with the deployed physical IDs / exports, decrypts `AWS::SSM::Parameter::Value` entries (kept off the `docker run` argv; under `CDK_DOCKER=finch` on macOS / Windows they are refused unless you opt in, see [docs/local-emulation.md#finch-on-macos-and-windows](docs/local-emulation.md#finch-on-macos-and-windows)), and resolves same-stack ECR `ContainerUri` to the deployed image. `Fn::GetAtt` in the Lambda's own env is recovered from the deployed function's resolved `Environment.Variables` via `lambda:GetFunctionConfiguration`. Full resolution rules: [docs/cli-reference.md#cloudformation-driven-env-recovery---from-cfn-stack](docs/cli-reference.md#cloudformation-driven-env-recovery---from-cfn-stack).
 
 ## Corporate proxy — `HTTPS_PROXY` / `NO_PROXY`
 

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, St as createLocalStartAlbCommand, a as createLocalStudioCommand, jt as createLocalRunTaskCommand, sn as createLocalInvokeAgentCoreCommand, w as createLocalListCommand } from "./local-studio-D8cHeCcp.js";
+import { D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, St as createLocalStartAlbCommand, a as createLocalStudioCommand, jt as createLocalRunTaskCommand, sn as createLocalInvokeAgentCoreCommand, w as createLocalListCommand } from "./local-studio-BbLfdSy4.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.149.1");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.149.3");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalInvokeAgentCoreCommand());
 program.addCommand(createLocalStartApiCommand());

package/dist/{docker-cmd-DLX1TqVw.js → docker-cmd-SocNyC9q.js}

@@ -246,12 +246,16 @@ function getLogger() {
 //#endregion
 //#region src/utils/docker-cmd.ts
 var docker_cmd_exports = /* @__PURE__ */ __exportAll({
+	allowSecretsOnArgvEnvName: () => allowSecretsOnArgvEnvName,
+	finchSecretArgvRefusal: () => finchSecretArgvRefusal,
 	formatDockerLoginError: () => formatDockerLoginError,
 	getDockerCmd: () => getDockerCmd,
+	isFinchVmClient: () => isFinchVmClient,
 	runDockerForeground: () => runDockerForeground,
 	runDockerStreaming: () => runDockerStreaming,
 	spawnForeground: () => spawnForeground,
-	spawnStreaming: () => spawnStreaming
+	spawnStreaming: () => spawnStreaming,
+	warnFinchArgvExposure: () => warnFinchArgvExposure
 });
 /**
 * Shared helpers for invoking the docker-compatible CLI binary across cdk-local.
@@ -282,6 +286,86 @@ function getDockerCmd() {
 	return override && override.length > 0 ? override : "docker";
 }
 /**
+* Is the container client finch running its Lima VM (macOS / Windows)? There
+* the value-less `-e KEY` form (`appendEnvFlags` in `local/docker-runner.ts`)
+* does NOT keep a value off the process command line (issue #749): finch's
+* `handleEnv` resolves each bare `KEY` against its own environment and
+* re-emits `-e KEY=<value>` on the argv of the `limactl shell finch sudo -E
+* nerdctl ...` child it starts, and `--env-file` is read on the host and
+* re-emitted the same way (runfinch/finch `cmd/finch/nerdctl_remote.go`,
+* `handleEnv` / `handleEnvFile`). Its `passedEnvs` list also puts
+* `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` from its
+* environment on that argv for every command. finch on Linux passes the argv
+* to nerdctl unchanged and is NOT matched.
+*
+* Detection is by the BASENAME of the resolved binary (`finch`, `finch.exe`,
+* any case): a wrapper script or a symlink under another name is not
+* recognised, and neither is Lima's own `nerdctl.lima`.
+*/
+function isFinchVmClient(cmd = getDockerCmd(), platform = process.platform) {
+	if (platform !== "darwin" && platform !== "win32") return false;
+	const base = (cmd.split(/[\\/]/).pop() ?? "").toLowerCase();
+	return base === "finch" || base === "finch.exe";
+}
+/**
+* The env var that accepts, while it is set, that a container client puts
+* secret VALUES on a process command line ({@link finchSecretArgvRefusal}):
+* `<envPrefix>_ALLOW_SECRETS_ON_ARGV`, so `CDKL_ALLOW_SECRETS_ON_ARGV` for
+* `cdkl` and the embedding host's own prefix otherwise. Only `1` or `true`
+* (any case) opts in.
+*/
+function allowSecretsOnArgvEnvName() {
+	return `${getEmbedConfig().envPrefix}_ALLOW_SECRETS_ON_ARGV`;
+}
+function secretsOnArgvAllowed() {
+	const v = process.env[allowSecretsOnArgvEnvName()];
+	return v !== void 0 && ["1", "true"].includes(v.trim().toLowerCase());
+}
+const MESSAGE_UNSAFE_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g;
+/**
+* Render template- or state-sourced text (an env var name, a container name,
+* an image URI) for a message: control and line-separator characters are
+* escaped as `\uXXXX` so a hostile value cannot drive the terminal or forge a
+* log line. Plain text renders unchanged.
+*/
+function escapeForMessage(text) {
+	return text.replace(MESSAGE_UNSAFE_CHARS, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/**
+* The refusal text when template-sourced secrets (ECS `Secrets`, decrypted
+* `SecureString` values) would be forwarded under {@link isFinchVmClient}, or
+* `undefined` when they may be forwarded: another client, no such secret, or
+* {@link allowSecretsOnArgvEnvName} set. The caller throws it in its own error
+* class BEFORE any `docker run`. The AWS credential set is not refused here
+* but warned about by {@link warnFinchArgvExposure}: forwarding it is what puts
+* credentials that are not in this process's own environment (`--assume-role`,
+* `--profile`, the metadata sidecar's) on that argv, and the warning makes that
+* visible while keeping finch usable for containers that need AWS access. Names
+* only, never a value. `subject` is context such as the container name; it is
+* escaped like the names.
+*/
+function finchSecretArgvRefusal(secretNames, subject) {
+	if (secretNames.length === 0 || !isFinchVmClient() || secretsOnArgvAllowed()) return void 0;
+	const names = [...new Set(secretNames)];
+	return `${escapeForMessage(subject)}: refusing to forward secret(s) ${names.map(escapeForMessage).join(", ")} under CDK_DOCKER=finch on macOS / Windows. finch turns each value-less '-e KEY' into '-e KEY=<value>' on the command line of the limactl process it starts, where other local processes can read the plaintext. Use a container client that keeps the value off the command line (for example the default 'docker', by unsetting CDK_DOCKER), or set ${allowSecretsOnArgvEnvName()}=1 to accept that exposure while it stays set.`;
+}
+/** Key sets already warned about by {@link warnFinchArgvExposure} in this process. */
+const finchArgvWarned = /* @__PURE__ */ new Set();
+/**
+* Warn, once per process per distinct key set, that under
+* {@link isFinchVmClient} the values of `keys` (the sensitive env about to be
+* forwarded as value-less `-e KEY`) reach the `limactl` command line. Names
+* only, never a value.
+*/
+function warnFinchArgvExposure(keys) {
+	if (keys.length === 0 || !isFinchVmClient()) return;
+	const names = [...new Set(keys)].sort();
+	const latch = JSON.stringify(names);
+	if (finchArgvWarned.has(latch)) return;
+	finchArgvWarned.add(latch);
+	getLogger().warn(`CDK_DOCKER=finch on macOS / Windows puts the values of ${names.map(escapeForMessage).join(", ")} on the command line of the limactl process it starts (finch turns a value-less '-e KEY' into '-e KEY=<value>'), where other local processes can read them. The default 'docker' client keeps them off the command line.`);
+}
+/**
 * Spawn a docker-compatible CLI binary (resolved via `getDockerCmd`) with
 * streaming I/O. Collects stdout/stderr in memory and resolves with both
 * on exit code 0; rejects with a `SpawnError` carrying both streams on any
@@ -472,5 +556,5 @@ function mergeEnv(overrides) {
 }
 
 //#endregion
-export { runDockerStreaming as a, resolveConfiguredLogLevel as c, setEmbedConfig as d, runDockerForeground as i, getEmbedConfig as l, formatDockerLoginError as n, spawnStreaming as o, getDockerCmd as r, getLogger as s, docker_cmd_exports as t, resetEmbedConfig as u };
-//# sourceMappingURL=docker-cmd-DLX1TqVw.js.map
+export { runDockerForeground as a, warnFinchArgvExposure as c, getEmbedConfig as d, resetEmbedConfig as f, getDockerCmd as i, getLogger as l, finchSecretArgvRefusal as n, runDockerStreaming as o, setEmbedConfig as p, formatDockerLoginError as r, spawnStreaming as s, docker_cmd_exports as t, resolveConfiguredLogLevel as u };
+//# sourceMappingURL=docker-cmd-SocNyC9q.js.map

package/dist/docker-cmd-SocNyC9q.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-cmd-SocNyC9q.js","names":["createSpinner"],"sources":["../src/local/embed-config.ts","../src/utils/logger.ts","../src/utils/docker-cmd.ts"],"sourcesContent":["/**\n * Embed-time branding configuration.\n *\n * cdk-local hardcodes its own branding (`cdkl` binary, `cdk-local`\n * product name, `cdkl-*` Docker / AWS resource names, `/cdk-local-aws`\n * credential bind-mount) into user-visible error messages and resource\n * identifiers. A host that embeds cdk-local's Commander factories (e.g.\n * cdkd, whose binary is `cdkd` and whose subcommand group is\n * `cdkd local`) passes a {@link CdkLocalEmbedConfig} so those strings\n * read in the host's own branding instead.\n *\n * The four command factories call {@link setEmbedConfig} before building\n * their Commander option tree, so both construction-time strings (option\n * descriptions / defaults) and action-time strings (errors, resource\n * names) read the resolved config via {@link getEmbedConfig}. When no\n * config is supplied every field falls back to cdk-local's own defaults,\n * leaving native `cdkl` behavior byte-identical.\n */\nexport interface CdkLocalEmbedConfig {\n  /**\n   * Command prefix for subcommand references in user-facing strings, e.g.\n   * `${cliName} invoke` / `${cliName} start-api`. Default `'cdkl'`; cdkd\n   * passes `'cdkd local'`.\n   */\n  cliName?: string;\n  /**\n   * Bare executable / process name for standalone references, e.g.\n   * `${binaryName} is exiting` / `${binaryName} could not determine ...`,\n   * the local request id, and the hyphen-free Cognito user-pool\n   * placeholder id. Default `'cdkl'`; cdkd passes `'cdkd'`.\n   */\n  binaryName?: string;\n  /**\n   * Product name for prose references, e.g. `${productName} supports ...`.\n   * Also seeds the profile-credentials tmpdir prefix. Default\n   * `'cdk-local'`; cdkd passes `'cdkd'`.\n   */\n  productName?: string;\n  /**\n   * Prefix for generated Docker / AWS resource identifiers — container,\n   * volume, network, image-tag, tmpdir names, STS `RoleSessionName`s, and\n   * the example Cloud Map namespace. Default `'cdkl'`; cdkd passes\n   * `'cdkd-local'`.\n   */\n  resourceNamePrefix?: string;\n  /**\n   * Container directory the host AWS shared-credentials file is\n   * bind-mounted under. Default `'/cdk-local-aws'`; cdkd passes\n   * `'/cdkd-aws'`.\n   */\n  awsBindMountPath?: string;\n  /**\n   * Prefix for the environment variables this CLI reads — `${envPrefix}_APP`\n   * (the `--app` fallback) and `${envPrefix}_ROLE_ARN` (the `--role-arn`\n   * fallback). Default `'CDKL'`; cdkd passes `'CDKD'`.\n   */\n  envPrefix?: string;\n  /**\n   * Whether this host fails-closed by default on unverifiable AWS_IAM SigV4\n   * requests. cdk-local's default is warn-and-pass (`false`); a host like\n   * cdkd that ships fail-closed-by-default passes `true`. Drives the polarity\n   * of the SigV4 warn-message advice (whether the strictness flag reads as an\n   * opt-IN or opt-OUT). Default `false`.\n   */\n  sigV4StrictByDefault?: boolean;\n  /**\n   * The CLI flag a user toggles to change SigV4 strictness. With\n   * `sigV4StrictByDefault: false` it is an opt-IN flag (`'--strict-sigv4'`,\n   * the default); with `sigV4StrictByDefault: true` it is the host's opt-OUT\n   * flag (cdkd passes `'--allow-unverified-sigv4'`). Default `'--strict-sigv4'`.\n   */\n  sigV4OptFlag?: string;\n}\n\nexport interface ResolvedEmbedConfig {\n  cliName: string;\n  binaryName: string;\n  productName: string;\n  resourceNamePrefix: string;\n  awsBindMountPath: string;\n  envPrefix: string;\n  sigV4StrictByDefault: boolean;\n  sigV4OptFlag: string;\n}\n\nconst DEFAULTS: ResolvedEmbedConfig = {\n  cliName: 'cdkl',\n  binaryName: 'cdkl',\n  productName: 'cdk-local',\n  resourceNamePrefix: 'cdkl',\n  awsBindMountPath: '/cdk-local-aws',\n  envPrefix: 'CDKL',\n  sigV4StrictByDefault: false,\n  sigV4OptFlag: '--strict-sigv4',\n};\n\nlet current: ResolvedEmbedConfig = DEFAULTS;\n\n/**\n * Resolve and install the active embed config. Called once per command\n * factory with the host's overrides (or `undefined` for native cdkl\n * behavior). Idempotent: re-calling with the same overrides is a no-op,\n * which is why all four factories may safely set the same config.\n */\nexport function setEmbedConfig(config?: CdkLocalEmbedConfig): void {\n  current = {\n    cliName: config?.cliName ?? DEFAULTS.cliName,\n    binaryName: config?.binaryName ?? DEFAULTS.binaryName,\n    productName: config?.productName ?? DEFAULTS.productName,\n    resourceNamePrefix: config?.resourceNamePrefix ?? DEFAULTS.resourceNamePrefix,\n    awsBindMountPath: config?.awsBindMountPath ?? DEFAULTS.awsBindMountPath,\n    envPrefix: config?.envPrefix ?? DEFAULTS.envPrefix,\n    sigV4StrictByDefault: config?.sigV4StrictByDefault ?? DEFAULTS.sigV4StrictByDefault,\n    sigV4OptFlag: config?.sigV4OptFlag ?? DEFAULTS.sigV4OptFlag,\n  };\n}\n\n/** The active resolved embed config. */\nexport function getEmbedConfig(): ResolvedEmbedConfig {\n  return current;\n}\n\n/** Restore cdk-local defaults. Primarily a test-isolation helper. */\nexport function resetEmbedConfig(): void {\n  current = DEFAULTS;\n}\n","/**\n * Logger interface and console implementation for cdk-local.\n *\n * A minimal `Logger` / `LogLevel` interface with a `ConsoleLogger`\n * (`getLogger()` / `setLogger()` exports, `child(prefix)` for prefixed\n * sub-loggers). cdk-local invokes a single Lambda / API / task at a time,\n * so there is no parallel multi-stack output to interleave — a plain\n * console logger with no output buffer or live progress renderer suffices.\n */\n\nexport type LogLevel = 'debug' | 'info' | 'warn' | 'error';\n\nexport interface Logger {\n  debug(message: string, ...args: unknown[]): void;\n  info(message: string, ...args: unknown[]): void;\n  warn(message: string, ...args: unknown[]): void;\n  error(message: string, ...args: unknown[]): void;\n  setLevel(level: LogLevel): void;\n  getLevel(): LogLevel;\n  child(prefix: string): Logger;\n}\n\n/**\n * ANSI color codes\n *\n * Kept internal — `ConsoleLogger.formatMessage` references these for the\n * verbose/compact mode level prefixes.\n */\nconst colors = {\n  reset: '\\x1b[0m',\n  bright: '\\x1b[1m',\n  dim: '\\x1b[2m',\n  red: '\\x1b[31m',\n  green: '\\x1b[32m',\n  yellow: '\\x1b[33m',\n  blue: '\\x1b[34m',\n  cyan: '\\x1b[36m',\n  gray: '\\x1b[90m',\n} as const;\n\nfunction formatTimestamp(): string {\n  const now = new Date();\n  return now.toISOString();\n}\n\n/**\n * Resolve whether ANSI color should be emitted by default.\n *\n * Color is appropriate for an interactive terminal but is noise (literal\n * `\\x1b[31m...` escapes) when the output is a pipe — e.g. when `cdkl studio`\n * spawns `cdkl invoke` / a serve command as a child and captures its output to\n * render in the browser, where the raw escapes leak as visible text. So the\n * default tracks the stdout TTY-ness, with the two standard env overrides:\n *\n * - `NO_COLOR` (any non-empty value) forces colors OFF (https://no-color.org).\n * - `FORCE_COLOR` (non-empty, not `'0'` / `'false'`) forces colors ON, even\n *   when not a TTY (the convention many CLIs honor for CI / log capture).\n * - otherwise: on when `process.stdout.isTTY`.\n *\n * We gate on `process.stdout.isTTY` even though warn / error go to stderr via\n * `console.error` / `console.warn`. In the case this fix targets — a piped\n * child (e.g. studio) — NEITHER stdout nor stderr is a TTY, so gating on stdout\n * still yields colorless output. Tracking stdout matches common CLI tooling and\n * keeps a single, predictable signal; an explicit `useColors` argument (passed\n * by child loggers) always overrides this default.\n */\nexport function resolveDefaultUseColors(): boolean {\n  const noColor = process.env['NO_COLOR'];\n  if (noColor !== undefined && noColor !== '') {\n    return false;\n  }\n  const forceColor = process.env['FORCE_COLOR'];\n  if (\n    forceColor !== undefined &&\n    forceColor !== '' &&\n    forceColor !== '0' &&\n    forceColor !== 'false'\n  ) {\n    return true;\n  }\n  return !!process.stdout.isTTY;\n}\n\n/**\n * Console logger implementation\n *\n * Supports two output modes:\n * - verbose (debug level): timestamps, module prefixes, all details\n * - compact (info level): clean output without timestamps or prefixes\n */\nexport class ConsoleLogger implements Logger {\n  private level: LogLevel;\n  private useColors: boolean;\n\n  constructor(level: LogLevel = 'info', useColors: boolean = resolveDefaultUseColors()) {\n    this.level = level;\n    this.useColors = useColors;\n  }\n\n  private shouldLog(level: LogLevel): boolean {\n    const levels: LogLevel[] = ['debug', 'info', 'warn', 'error'];\n    const currentLevelIndex = levels.indexOf(this.level);\n    const messageLevelIndex = levels.indexOf(level);\n    return messageLevelIndex >= currentLevelIndex;\n  }\n\n  private formatMessage(level: LogLevel, message: string, ...args: unknown[]): string {\n    const formattedArgs = args.length > 0 ? ' ' + args.map((a) => JSON.stringify(a)).join(' ') : '';\n\n    if (this.level === 'debug') {\n      const timestamp = formatTimestamp();\n      const levelStr = level.toUpperCase().padEnd(5);\n\n      if (this.useColors) {\n        const levelColorMap: Record<LogLevel, string> = {\n          debug: colors.gray,\n          info: colors.blue,\n          warn: colors.yellow,\n          error: colors.red,\n        };\n        const levelColor = levelColorMap[level];\n\n        return `${colors.dim}${timestamp}${colors.reset} ${levelColor}${levelStr}${colors.reset} ${message}${formattedArgs}`;\n      }\n\n      return `${timestamp} ${levelStr} ${message}${formattedArgs}`;\n    }\n\n    // Compact mode (info level) prefixes warn / error with an UPPERCASE level\n    // tag so the severity is legible even when ANSI color is stripped — a\n    // piped / redirected CLI run, `NO_COLOR`, or the `cdkl studio` serve child\n    // (captured over a pipe, so colorless). Color, when available, still wraps\n    // the whole line. info stays prefix-less so the common-case progress output\n    // is unchanged. The prefix is the one severity signal that survives a pipe,\n    // and studio's LOG panel re-colors off it (studio-ui).\n    if (level === 'error') {\n      const line = `ERROR: ${message}${formattedArgs}`;\n      return this.useColors ? `${colors.red}${line}${colors.reset}` : line;\n    }\n    if (level === 'warn') {\n      const line = `WARN: ${message}${formattedArgs}`;\n      return this.useColors ? `${colors.yellow}${line}${colors.reset}` : line;\n    }\n\n    return `${message}${formattedArgs}`;\n  }\n\n  private emit(level: LogLevel, formatted: string): void {\n    // `cdkl studio` sets `CDKL_LOG_STREAM=stdout` on its spawned serve children\n    // (issue #403) so EVERY level routes to stdout instead of the default\n    // warn/error -> stderr split. studio captures a child's stdout and stderr\n    // via two separate OS pipes, and Node does NOT guarantee cross-pipe\n    // delivery order — a warn written just before a stdout banner can surface\n    // AFTER it in the studio LOG panel (e.g. the pinned-image WARN landing\n    // below \"Press ^C to shut down.\"). Emitting one stream preserves emission\n    // order for that consumer. Direct CLI use never sets the var, so the\n    // warn/error -> stderr split is unchanged there.\n    if (process.env['CDKL_LOG_STREAM'] === 'stdout') {\n      console.log(formatted);\n      return;\n    }\n    if (level === 'error') console.error(formatted);\n    else if (level === 'warn') console.warn(formatted);\n    else if (level === 'info') console.info(formatted);\n    else console.debug(formatted);\n  }\n\n  debug(message: string, ...args: unknown[]): void {\n    if (this.shouldLog('debug')) {\n      this.emit('debug', this.formatMessage('debug', message, ...args));\n    }\n  }\n\n  info(message: string, ...args: unknown[]): void {\n    if (this.shouldLog('info')) {\n      this.emit('info', this.formatMessage('info', message, ...args));\n    }\n  }\n\n  warn(message: string, ...args: unknown[]): void {\n    if (this.shouldLog('warn')) {\n      this.emit('warn', this.formatMessage('warn', message, ...args));\n    }\n  }\n\n  error(message: string, ...args: unknown[]): void {\n    if (this.shouldLog('error')) {\n      this.emit('error', this.formatMessage('error', message, ...args));\n    }\n  }\n\n  setLevel(level: LogLevel): void {\n    this.level = level;\n  }\n\n  getLevel(): LogLevel {\n    return this.level;\n  }\n\n  child(prefix: string): ChildLogger {\n    return new ChildLogger(prefix, this.useColors);\n  }\n}\n\n/**\n * Child logger that always syncs level from global logger\n */\nclass ChildLogger extends ConsoleLogger {\n  private readonly prefix: string;\n\n  constructor(prefix: string, useColors: boolean) {\n    super('info', useColors);\n    this.prefix = prefix;\n  }\n\n  private syncLevel(): void {\n    if (globalLogger) {\n      this.setLevel(globalLogger.getLevel());\n    }\n  }\n\n  override debug(message: string, ...args: unknown[]): void {\n    this.syncLevel();\n    super.debug(`[${this.prefix}] ${message}`, ...args);\n  }\n\n  override info(message: string, ...args: unknown[]): void {\n    this.syncLevel();\n    const msg = this.getLevel() === 'debug' ? `[${this.prefix}] ${message}` : message;\n    super.info(msg, ...args);\n  }\n\n  override warn(message: string, ...args: unknown[]): void {\n    this.syncLevel();\n    const msg = this.getLevel() === 'debug' ? `[${this.prefix}] ${message}` : message;\n    super.warn(msg, ...args);\n  }\n\n  override error(message: string, ...args: unknown[]): void {\n    this.syncLevel();\n    const msg = this.getLevel() === 'debug' ? `[${this.prefix}] ${message}` : message;\n    super.error(msg, ...args);\n  }\n}\n\n/**\n * Resolve the initial log level from the `CDKL_LOG_LEVEL` env var, falling\n * back to `'info'`. This is primarily an internal contract: `cdkl studio`\n * spawns its single-shot `cdkl invoke` child with `CDKL_LOG_LEVEL=warn` so\n * cdk-local's OWN synth / orchestration progress (toolkit \"Successfully\n * synthesized to ...\", asset-bundling lines, info-level status) is silenced\n * in the child — leaving the studio LOGS panel showing only the Lambda\n * container's runtime logs (which stream straight from `docker logs` and are\n * unaffected by this level) plus the response. `--verbose` still overrides to\n * `debug` at the command layer. An invalid value is ignored.\n */\nexport function resolveConfiguredLogLevel(): LogLevel {\n  const env = process.env['CDKL_LOG_LEVEL'];\n  if (env === 'debug' || env === 'info' || env === 'warn' || env === 'error') {\n    return env;\n  }\n  return 'info';\n}\n\nlet globalLogger: ConsoleLogger | null = null;\n\nexport function getLogger(): ConsoleLogger {\n  if (!globalLogger) {\n    globalLogger = new ConsoleLogger(resolveConfiguredLogLevel());\n  }\n  return globalLogger;\n}\n\nexport function setLogger(logger: ConsoleLogger): void {\n  globalLogger = logger;\n}\n","import { spawn } from 'node:child_process';\nimport { spinner as createSpinner } from '@clack/prompts';\nimport { getLogger } from './logger.js';\nimport { getEmbedConfig } from '../local/embed-config.js';\n\n/**\n * Shared helpers for invoking the docker-compatible CLI binary across cdk-local.\n *\n * Two parity decisions with `aws-cdk-cli`'s `cdk-assets-lib`:\n *   1. `CDK_DOCKER` env var swaps the binary so podman / finch users can\n *      run cdk-local without code changes (`CDK_DOCKER=podman cdkl invoke`).\n *   2. `runDockerStreaming` uses streaming spawn rather than `execFile`'s\n *      buffered `maxBuffer` ceiling. BuildKit's progress output can run to\n *      tens of MB on multi-stage builds with `# syntax=docker/dockerfile:1`\n *      frontend downloads + heredoc / `RUN --mount=...` features; the 50 MB\n *      `execFile` ceiling cdk-local used to set silently killed those builds\n *      with `ERR_CHILD_PROCESS_STDIO_MAXBUFFER`.\n *\n * Output handling: stdout/stderr are collected in memory unconditionally so\n * `runDockerStreaming` can return them to the caller for error wrapping.\n * When the logger is at debug level (i.e. the user passed `--verbose`),\n * the chunks are ALSO mirrored to `process.stdout` / `process.stderr` so\n * the user sees live build progress.\n */\n\n/**\n * Return the docker-compatible CLI binary to invoke. Matches CDK CLI:\n * `CDK_DOCKER` env var overrides the default `docker` so users on\n * podman / finch / nerdctl can swap without changing cdk-local code.\n */\nexport function getDockerCmd(): string {\n  const override = process.env['CDK_DOCKER'];\n  return override && override.length > 0 ? override : 'docker';\n}\n\n/**\n * Is the container client finch running its Lima VM (macOS / Windows)? There\n * the value-less `-e KEY` form (`appendEnvFlags` in `local/docker-runner.ts`)\n * does NOT keep a value off the process command line (issue #749): finch's\n * `handleEnv` resolves each bare `KEY` against its own environment and\n * re-emits `-e KEY=<value>` on the argv of the `limactl shell finch sudo -E\n * nerdctl ...` child it starts, and `--env-file` is read on the host and\n * re-emitted the same way (runfinch/finch `cmd/finch/nerdctl_remote.go`,\n * `handleEnv` / `handleEnvFile`). Its `passedEnvs` list also puts\n * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` from its\n * environment on that argv for every command. finch on Linux passes the argv\n * to nerdctl unchanged and is NOT matched.\n *\n * Detection is by the BASENAME of the resolved binary (`finch`, `finch.exe`,\n * any case): a wrapper script or a symlink under another name is not\n * recognised, and neither is Lima's own `nerdctl.lima`.\n */\nexport function isFinchVmClient(\n  cmd: string = getDockerCmd(),\n  platform: NodeJS.Platform = process.platform\n): boolean {\n  if (platform !== 'darwin' && platform !== 'win32') return false;\n  const base = (cmd.split(/[\\\\/]/).pop() ?? '').toLowerCase();\n  return base === 'finch' || base === 'finch.exe';\n}\n\n/**\n * The env var that accepts, while it is set, that a container client puts\n * secret VALUES on a process command line ({@link finchSecretArgvRefusal}):\n * `<envPrefix>_ALLOW_SECRETS_ON_ARGV`, so `CDKL_ALLOW_SECRETS_ON_ARGV` for\n * `cdkl` and the embedding host's own prefix otherwise. Only `1` or `true`\n * (any case) opts in.\n */\nexport function allowSecretsOnArgvEnvName(): string {\n  return `${getEmbedConfig().envPrefix}_ALLOW_SECRETS_ON_ARGV`;\n}\n\nfunction secretsOnArgvAllowed(): boolean {\n  const v = process.env[allowSecretsOnArgvEnvName()];\n  return v !== undefined && ['1', 'true'].includes(v.trim().toLowerCase());\n}\n\n// eslint-disable-next-line no-control-regex -- the control characters are exactly what is escaped.\nconst MESSAGE_UNSAFE_CHARS = /[\\u0000-\\u001f\\u007f-\\u009f\\u2028\\u2029]/g;\n\n/**\n * Render template- or state-sourced text (an env var name, a container name,\n * an image URI) for a message: control and line-separator characters are\n * escaped as `\\uXXXX` so a hostile value cannot drive the terminal or forge a\n * log line. Plain text renders unchanged.\n */\nfunction escapeForMessage(text: string): string {\n  return text.replace(\n    MESSAGE_UNSAFE_CHARS,\n    (c) => `\\\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`\n  );\n}\n\n/**\n * The refusal text when template-sourced secrets (ECS `Secrets`, decrypted\n * `SecureString` values) would be forwarded under {@link isFinchVmClient}, or\n * `undefined` when they may be forwarded: another client, no such secret, or\n * {@link allowSecretsOnArgvEnvName} set. The caller throws it in its own error\n * class BEFORE any `docker run`. The AWS credential set is not refused here\n * but warned about by {@link warnFinchArgvExposure}: forwarding it is what puts\n * credentials that are not in this process's own environment (`--assume-role`,\n * `--profile`, the metadata sidecar's) on that argv, and the warning makes that\n * visible while keeping finch usable for containers that need AWS access. Names\n * only, never a value. `subject` is context such as the container name; it is\n * escaped like the names.\n */\nexport function finchSecretArgvRefusal(\n  secretNames: readonly string[],\n  subject: string\n): string | undefined {\n  if (secretNames.length === 0 || !isFinchVmClient() || secretsOnArgvAllowed()) return undefined;\n  const names = [...new Set(secretNames)];\n  return (\n    `${escapeForMessage(subject)}: refusing to forward secret(s) ${names.map(escapeForMessage).join(', ')} ` +\n    `under CDK_DOCKER=finch on macOS / Windows. finch turns each value-less '-e KEY' into ` +\n    `'-e KEY=<value>' on the command line of the limactl process it starts, where other local ` +\n    `processes can read the plaintext. Use a container client that keeps the value off the command ` +\n    `line (for example the default 'docker', by unsetting CDK_DOCKER), or set ` +\n    `${allowSecretsOnArgvEnvName()}=1 to accept that exposure while it stays set.`\n  );\n}\n\n/** Key sets already warned about by {@link warnFinchArgvExposure} in this process. */\nconst finchArgvWarned = new Set<string>();\n\n/** Test-only: forget which key sets {@link warnFinchArgvExposure} warned about. */\nexport function resetFinchArgvWarningsForTest(): void {\n  finchArgvWarned.clear();\n}\n\n/**\n * Warn, once per process per distinct key set, that under\n * {@link isFinchVmClient} the values of `keys` (the sensitive env about to be\n * forwarded as value-less `-e KEY`) reach the `limactl` command line. Names\n * only, never a value.\n */\nexport function warnFinchArgvExposure(keys: readonly string[]): void {\n  if (keys.length === 0 || !isFinchVmClient()) return;\n  const names = [...new Set(keys)].sort();\n  const latch = JSON.stringify(names);\n  if (finchArgvWarned.has(latch)) return;\n  finchArgvWarned.add(latch);\n  getLogger().warn(\n    `CDK_DOCKER=finch on macOS / Windows puts the values of ${names.map(escapeForMessage).join(', ')} ` +\n      `on the command line of the limactl process it starts (finch turns a value-less '-e KEY' into ` +\n      `'-e KEY=<value>'), where other local processes can read them. The default 'docker' client ` +\n      `keeps them off the command line.`\n  );\n}\n\nexport interface SpawnResult {\n  stdout: string;\n  stderr: string;\n}\n\nexport interface SpawnError extends Error {\n  /** Captured stderr at the time of failure. */\n  stderr: string;\n  /** Captured stdout at the time of failure. */\n  stdout: string;\n  /** Process exit code (null when the process was killed by signal). */\n  exitCode: number | null;\n}\n\nexport interface RunDockerOptions {\n  /** Optional working directory for the subprocess. */\n  cwd?: string;\n  /**\n   * Additional environment variables to set. Merged on top of `process.env`\n   * (so the user's `DOCKER_BUILDKIT=1` and friends propagate through).\n   */\n  env?: Record<string, string | undefined>;\n  /** When set, written to stdin (used by `docker login --password-stdin`). */\n  input?: string;\n  /**\n   * When true, mirror stdout/stderr chunks to `process.stdout` / `process.stderr`\n   * as they arrive. Useful for `docker pull` / `docker build` where live\n   * progress is desirable. Defaults to \"true when the logger is at debug\n   * level\" — matches the existing `--verbose` UX.\n   */\n  streamLive?: boolean;\n  /**\n   * When set, show an interactive {@link createSpinner | clack spinner}\n   * with this label for the duration of the spawn — so a long-running\n   * `docker build` / `docker pull` against a real-world image doesn't\n   * look like cdk-local hung. The spinner only renders when:\n   *\n   *   - `streamLive` is false (live BuildKit output already shows motion;\n   *     overlaying a spinner on top would visually clash and the line\n   *     overwriting would mangle the build log), AND\n   *   - `process.stdout` is a TTY (non-TTY callers such as integ-test\n   *     fixtures or CI runs already log linearly; a spinner there would\n   *     emit raw ANSI escapes into the captured log).\n   *\n   * In either skipped case the spawn proceeds as if `progressLabel` were\n   * undefined — the caller's pre-spawn `logger.info(...)` \"Building X...\"\n   * line continues to be the only progress signal, which is the\n   * pre-spinner behavior and matches what scripts / CI expect.\n   *\n   * On exit code 0 the spinner stops with the same label and a check\n   * mark; on non-zero exit it stops with an error mark before the\n   * rejection propagates, so the caller's `try {} catch {}` wrap still\n   * sees a clean spinner-less stderr.\n   *\n   * Concurrency: each `@clack/prompts` spinner instance registers its own\n   * `SIGINT` / `SIGTERM` / `exit` / `uncaughtExceptionMonitor` /\n   * `unhandledRejection` listeners against `process`. Callers must\n   * serialize concurrent spinner-bearing `spawnStreaming` invocations on\n   * the same `process.stdout` — two simultaneous spinners overwrite each\n   * other's frame line AND accumulate listeners (Node trips its default\n   * 10-listener warning at ~3 concurrent spinners). Every cdk-local call\n   * site as of this PR is strictly sequential\n   * (`runImageOverrideBuilds` for-of, `prepareImages` for-of, ECS\n   * Lambda asset builds are one-per-invoke); the future parallel-build\n   * path should either drop the label or memoize a single shared spinner.\n   */\n  progressLabel?: string;\n}\n\n/**\n * Spawn a docker-compatible CLI binary (resolved via `getDockerCmd`) with\n * streaming I/O. Collects stdout/stderr in memory and resolves with both\n * on exit code 0; rejects with a `SpawnError` carrying both streams on any\n * non-zero exit so the caller can wrap with its own error class without\n * losing the upstream output.\n *\n * No `maxBuffer` ceiling: BuildKit progress output frequently exceeds the\n * `child_process.execFile` default of 1 MB (cdk-local previously bumped to 50 MB\n * but BuildKit + frontend pulls can still exceed that on first-time builds).\n */\nexport async function runDockerStreaming(\n  args: string[],\n  options: RunDockerOptions = {}\n): Promise<SpawnResult> {\n  return spawnStreaming(getDockerCmd(), args, options);\n}\n\n/**\n * Generic streaming spawn — used by `runDockerStreaming` AND by the\n * `executable` source mode in `docker-build.ts` (which runs an arbitrary\n * user-supplied build command, not docker).\n */\nexport async function spawnStreaming(\n  cmd: string,\n  args: string[],\n  options: RunDockerOptions = {}\n): Promise<SpawnResult> {\n  const streamLive = options.streamLive ?? getLogger().getLevel() === 'debug';\n  const env = options.env ? mergeEnv(options.env) : undefined;\n  const spin = startProgressSpinner(options.progressLabel, streamLive);\n\n  return new Promise<SpawnResult>((resolve, reject) => {\n    // Defensive: a synchronous throw from `spawn` (e.g. Node's\n    // `ERR_INVALID_ARG_TYPE` on a non-string `cmd`) bypasses the close /\n    // error handlers below — without this try/catch the spinner would be\n    // left animating until process exit. Today unreachable\n    // (`getDockerCmd()` always returns a string + all call-site `args`\n    // are `string[]`), but the wrap is free defense-in-depth on a\n    // process-launch helper.\n    let child;\n    try {\n      child = spawn(cmd, args, {\n        cwd: options.cwd,\n        env,\n        stdio: [options.input ? 'pipe' : 'ignore', 'pipe', 'pipe'],\n      });\n    } catch (err) {\n      stopProgressSpinner(spin, options.progressLabel);\n      reject(err as Error);\n      return;\n    }\n\n    const stdoutChunks: Buffer[] = [];\n    const stderrChunks: Buffer[] = [];\n\n    child.stdout!.on('data', (chunk: Buffer) => {\n      stdoutChunks.push(chunk);\n      if (streamLive) process.stdout.write(chunk);\n    });\n    child.stderr!.on('data', (chunk: Buffer) => {\n      stderrChunks.push(chunk);\n      if (streamLive) process.stderr.write(chunk);\n    });\n\n    child.once('error', (err: NodeJS.ErrnoException) => {\n      stopProgressSpinner(spin, options.progressLabel);\n      if (err.code === 'ENOENT') {\n        const usingOverride = process.env['CDK_DOCKER'] === cmd && cmd !== 'docker';\n        reject(\n          new Error(\n            usingOverride\n              ? `Failed to find and execute '${cmd}' (resolved via CDK_DOCKER). ` +\n                  `Install '${cmd}' or unset CDK_DOCKER to fall back to 'docker'.`\n              : `Failed to find and execute '${cmd}'. Install Docker (or set the ` +\n                  `'CDK_DOCKER' environment variable to a compatible binary such as podman / finch).`\n          )\n        );\n      } else {\n        reject(err);\n      }\n    });\n\n    child.once('close', (code) => {\n      const stdout = Buffer.concat(stdoutChunks).toString('utf-8');\n      const stderr = Buffer.concat(stderrChunks).toString('utf-8');\n      if (code === 0) {\n        stopProgressSpinner(spin, options.progressLabel);\n        resolve({ stdout, stderr });\n      } else {\n        stopProgressSpinner(spin, options.progressLabel);\n        const message =\n          stderr.trim() || stdout.trim() || `${cmd} ${args[0] ?? ''} exited with code ${code}`;\n        const err = new Error(message) as SpawnError;\n        err.stderr = stderr;\n        err.stdout = stdout;\n        err.exitCode = code;\n        reject(err);\n      }\n    });\n\n    if (options.input !== undefined) {\n      // Defensive: when spawn() fails (e.g. ENOENT race), the synchronous\n      // write below could emit a stream 'error' event before the close /\n      // error handlers above fire. Without a listener, Node escalates that\n      // to \"Unhandled 'error' event\" on some versions. cdk-local's only `input`\n      // call site is `docker login --password-stdin` with short payloads\n      // that complete well within the syscall, so this is unlikely to fire\n      // in practice — but the no-op listener is free.\n      child.stdin!.on('error', () => {\n        /* surfaced via the outer error/close handlers above */\n      });\n      child.stdin!.write(options.input);\n      child.stdin!.end();\n    }\n  });\n}\n\ntype ClackSpinner = ReturnType<typeof createSpinner>;\n\n/**\n * Start an interactive clack spinner for the spawn, but only when the\n * current shell would actually render it (TTY) and the caller isn't\n * already streaming live output. Returns `undefined` when either\n * precondition fails — `stopProgressSpinner` then is a no-op.\n *\n * Test seam: the integration with `@clack/prompts` is mocked in\n * `tests/unit/utils/docker-cmd-progress-spinner.test.ts`.\n */\nfunction startProgressSpinner(\n  label: string | undefined,\n  streamLive: boolean\n): ClackSpinner | undefined {\n  if (label === undefined || streamLive || process.stdout.isTTY !== true) return undefined;\n  const spin = createSpinner();\n  spin.start(label);\n  return spin;\n}\n\nfunction stopProgressSpinner(spin: ClackSpinner | undefined, label: string | undefined): void {\n  // `@clack/prompts`' `spinner().stop(message?)` only takes the message at\n  // the TS-level signature (the runtime impl ignores the optional `code`\n  // second arg, hard-coding success), so we mirror its public API. The\n  // upstream caller's wrapped error / rejection still surfaces the\n  // failure detail; the spinner's only job here is to stop animating\n  // cleanly so the error stderr renders on its own fresh line.\n  if (spin === undefined) return;\n  spin.stop(label ?? '');\n}\n\n/**\n * Spawn a docker-compatible CLI binary (resolved via `getDockerCmd`) attached\n * to the parent process's stdio so the user sees live output (`docker pull`\n * layer progress, `docker login` interactive prompts that should never fire\n * with `--password-stdin` but still safe to inherit, etc.). Resolves on exit\n * code 0; rejects with a plain `Error` carrying the exit code on any non-zero\n * exit, so the caller can wrap with its own error class.\n *\n * Differs from {@link runDockerStreaming} in two ways:\n *   1. `stdio: 'inherit'` — output is NOT captured, so terminal control codes\n *      (color, progress bar overwrites) flow through unchanged. This is the\n *      load-bearing reason for the split: `docker pull`'s progress bars only\n *      animate properly when stdout is a real TTY connected to the parent.\n *   2. No `input` / `streamLive` options — inherit-mode has nothing to\n *      capture and nothing to mirror.\n *\n * Used by the `--verbose`-mode `docker pull` plumbing in `docker-runner.ts`\n * and `ecr-puller.ts` (visible layer progress). Non-verbose pulls go through\n * {@link runDockerStreaming} so stderr can be folded into the error message.\n */\nexport async function runDockerForeground(\n  args: string[],\n  options: ForegroundOptions = {}\n): Promise<void> {\n  return spawnForeground(getDockerCmd(), args, options);\n}\n\nexport interface ForegroundOptions {\n  /** Optional working directory for the subprocess. */\n  cwd?: string;\n  /**\n   * Additional environment variables to set. Merged on top of `process.env`\n   * (same semantics as {@link RunDockerOptions.env}).\n   */\n  env?: Record<string, string | undefined>;\n}\n\n/**\n * Foreground (stdio-inherit) spawn — the inherit-mode counterpart to\n * {@link spawnStreaming}. Used by {@link runDockerForeground} for docker-CLI\n * subprocesses.\n *\n * The ENOENT branch crafts a docker-specific install hint (\"Install Docker\n * (or set CDK_DOCKER ...)\"), so non-docker callers reusing this helper\n * would see a misleading error on missing-binary failures. Keep the binary\n * docker-shaped, or update the ENOENT message before adding a non-docker\n * call site.\n */\nexport async function spawnForeground(\n  cmd: string,\n  args: string[],\n  options: ForegroundOptions = {}\n): Promise<void> {\n  const env = options.env ? mergeEnv(options.env) : undefined;\n  return new Promise<void>((resolve, reject) => {\n    const child = spawn(cmd, args, {\n      cwd: options.cwd,\n      env,\n      stdio: 'inherit',\n    });\n    child.once('error', (err: NodeJS.ErrnoException) => {\n      if (err.code === 'ENOENT') {\n        const usingOverride = process.env['CDK_DOCKER'] === cmd && cmd !== 'docker';\n        reject(\n          new Error(\n            usingOverride\n              ? `Failed to find and execute '${cmd}' (resolved via CDK_DOCKER). ` +\n                  `Install '${cmd}' or unset CDK_DOCKER to fall back to 'docker'.`\n              : `Failed to find and execute '${cmd}'. Install Docker (or set the ` +\n                  `'CDK_DOCKER' environment variable to a compatible binary such as podman / finch).`\n          )\n        );\n      } else {\n        reject(new Error(`${cmd} failed: ${err.message}`));\n      }\n    });\n    child.once('close', (code) => {\n      if (code === 0) {\n        resolve();\n      } else {\n        reject(new Error(`${cmd} exited with code ${code}`));\n      }\n    });\n  });\n}\n\n/**\n * Format the stderr from a failed `docker login` so the surfaced cdk-local\n * error gives the user an actionable workaround when the underlying\n * failure is a credential-helper persistence bug (which has nothing to\n * do with cdk-local, AWS, or IAM perms — the docker CLI itself fails to\n * save the auth token to the platform's credential store). The most\n * common shape is `osxkeychain` on macOS rejecting an overwrite for\n * an existing entry, but `wincred` (Windows), `pass` (Linux), and\n * `secretservice` (Linux) hit the same class of `Error saving\n * credentials` failure, so the rewritten message stays platform-\n * agnostic — `docker logout <endpoint>` is the correct recovery on\n * every backend.\n *\n * Detected docker / docker-credential-* output patterns:\n *   - `error storing credentials - err: exit status 1, out: \\`The\n *     specified item already exists in the keychain.\\`` (osxkeychain)\n *   - `Error saving credentials: ...` (any backend)\n *\n * Non-matching failures (genuine IAM / network / endpoint problems)\n * pass through with just the stderr trimmed — the original message\n * stays load-bearing for diagnosis.\n */\nexport function formatDockerLoginError(stderr: string, endpoint: string): string {\n  const trimmed = stderr.trim();\n  const isCredentialHelperFailure =\n    trimmed.includes('already exists in the keychain') ||\n    trimmed.includes('Error saving credentials');\n  if (isCredentialHelperFailure) {\n    return (\n      `docker's credential helper (osxkeychain on macOS / wincred on Windows / pass / secretservice on Linux) ` +\n      `failed to persist the ECR auth token. The \"already exists in the keychain\" / \"Error saving credentials\" ` +\n      `output is a known docker-credential-helpers issue — unrelated to ${getEmbedConfig().productName}, AWS credentials, or IAM perms. ` +\n      `Quick fix: run \\`docker logout ${endpoint}\\` to clear the stale entry, then retry the ${getEmbedConfig().productName} command. ` +\n      `Permanent fix: edit ~/.docker/config.json and remove (or empty) the platform-specific \"credsStore\" entry ` +\n      `(e.g. \"osxkeychain\" → \"\" or \"desktop\" on macOS Docker Desktop). ` +\n      `Original docker stderr: ${trimmed}`\n    );\n  }\n  return trimmed;\n}\n\nfunction mergeEnv(overrides: Record<string, string | undefined>): NodeJS.ProcessEnv {\n  const merged: NodeJS.ProcessEnv = { ...process.env };\n  for (const [k, v] of Object.entries(overrides)) {\n    if (v === undefined) {\n      delete merged[k];\n    } else {\n      merged[k] = v;\n    }\n  }\n  return merged;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqFA,MAAM,WAAgC;CACpC,SAAS;CACT,YAAY;CACZ,aAAa;CACb,oBAAoB;CACpB,kBAAkB;CAClB,WAAW;CACX,sBAAsB;CACtB,cAAc;AAChB;AAEA,IAAI,UAA+B;;;;;;;AAQnC,SAAgB,eAAe,QAAoC;CACjE,UAAU;EACR,SAAS,QAAQ,WAAW,SAAS;EACrC,YAAY,QAAQ,cAAc,SAAS;EAC3C,aAAa,QAAQ,eAAe,SAAS;EAC7C,oBAAoB,QAAQ,sBAAsB,SAAS;EAC3D,kBAAkB,QAAQ,oBAAoB,SAAS;EACvD,WAAW,QAAQ,aAAa,SAAS;EACzC,sBAAsB,QAAQ,wBAAwB,SAAS;EAC/D,cAAc,QAAQ,gBAAgB,SAAS;CACjD;AACF;;AAGA,SAAgB,iBAAsC;CACpD,OAAO;AACT;;AAGA,SAAgB,mBAAyB;CACvC,UAAU;AACZ;;;;;;;;;;ACjGA,MAAM,SAAS;CACb,OAAO;CACP,QAAQ;CACR,KAAK;CACL,KAAK;CACL,OAAO;CACP,QAAQ;CACR,MAAM;CACN,MAAM;CACN,MAAM;AACR;AAEA,SAAS,kBAA0B;CAEjC,wBAAO,IADS,KACP,EAAC,CAAC,YAAY;AACzB;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAgB,0BAAmC;CACjD,MAAM,UAAU,QAAQ,IAAI;CAC5B,IAAI,YAAY,UAAa,YAAY,IACvC,OAAO;CAET,MAAM,aAAa,QAAQ,IAAI;CAC/B,IACE,eAAe,UACf,eAAe,MACf,eAAe,OACf,eAAe,SAEf,OAAO;CAET,OAAO,CAAC,CAAC,QAAQ,OAAO;AAC1B;;;;;;;;AASA,IAAa,gBAAb,MAA6C;CAC3C,AAAQ;CACR,AAAQ;CAER,YAAY,QAAkB,QAAQ,YAAqB,wBAAwB,GAAG;EACpF,KAAK,QAAQ;EACb,KAAK,YAAY;CACnB;CAEA,AAAQ,UAAU,OAA0B;EAC1C,MAAM,SAAqB;GAAC;GAAS;GAAQ;GAAQ;EAAO;EAC5D,MAAM,oBAAoB,OAAO,QAAQ,KAAK,KAAK;EAEnD,OAD0B,OAAO,QAAQ,KAClB,KAAK;CAC9B;CAEA,AAAQ,cAAc,OAAiB,SAAiB,GAAG,MAAyB;EAClF,MAAM,gBAAgB,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI;EAE7F,IAAI,KAAK,UAAU,SAAS;GAC1B,MAAM,YAAY,gBAAgB;GAClC,MAAM,WAAW,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC;GAE7C,IAAI,KAAK,WAAW;IAOlB,MAAM,aAAa;KALjB,OAAO,OAAO;KACd,MAAM,OAAO;KACb,MAAM,OAAO;KACb,OAAO,OAAO;IAEe,EAAE;IAEjC,OAAO,GAAG,OAAO,MAAM,YAAY,OAAO,MAAM,GAAG,aAAa,WAAW,OAAO,MAAM,GAAG,UAAU;GACvG;GAEA,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU;EAC/C;EASA,IAAI,UAAU,SAAS;GACrB,MAAM,OAAO,UAAU,UAAU;GACjC,OAAO,KAAK,YAAY,GAAG,OAAO,MAAM,OAAO,OAAO,UAAU;EAClE;EACA,IAAI,UAAU,QAAQ;GACpB,MAAM,OAAO,SAAS,UAAU;GAChC,OAAO,KAAK,YAAY,GAAG,OAAO,SAAS,OAAO,OAAO,UAAU;EACrE;EAEA,OAAO,GAAG,UAAU;CACtB;CAEA,AAAQ,KAAK,OAAiB,WAAyB;EAUrD,IAAI,QAAQ,IAAI,uBAAuB,UAAU;GAC/C,QAAQ,IAAI,SAAS;GACrB;EACF;EACA,IAAI,UAAU,SAAS,QAAQ,MAAM,SAAS;OACzC,IAAI,UAAU,QAAQ,QAAQ,KAAK,SAAS;OAC5C,IAAI,UAAU,QAAQ,QAAQ,KAAK,SAAS;OAC5C,QAAQ,MAAM,SAAS;CAC9B;CAEA,MAAM,SAAiB,GAAG,MAAuB;EAC/C,IAAI,KAAK,UAAU,OAAO,GACxB,KAAK,KAAK,SAAS,KAAK,cAAc,SAAS,SAAS,GAAG,IAAI,CAAC;CAEpE;CAEA,KAAK,SAAiB,GAAG,MAAuB;EAC9C,IAAI,KAAK,UAAU,MAAM,GACvB,KAAK,KAAK,QAAQ,KAAK,cAAc,QAAQ,SAAS,GAAG,IAAI,CAAC;CAElE;CAEA,KAAK,SAAiB,GAAG,MAAuB;EAC9C,IAAI,KAAK,UAAU,MAAM,GACvB,KAAK,KAAK,QAAQ,KAAK,cAAc,QAAQ,SAAS,GAAG,IAAI,CAAC;CAElE;CAEA,MAAM,SAAiB,GAAG,MAAuB;EAC/C,IAAI,KAAK,UAAU,OAAO,GACxB,KAAK,KAAK,SAAS,KAAK,cAAc,SAAS,SAAS,GAAG,IAAI,CAAC;CAEpE;CAEA,SAAS,OAAuB;EAC9B,KAAK,QAAQ;CACf;CAEA,WAAqB;EACnB,OAAO,KAAK;CACd;CAEA,MAAM,QAA6B;EACjC,OAAO,IAAI,YAAY,QAAQ,KAAK,SAAS;CAC/C;AACF;;;;AAKA,IAAM,cAAN,cAA0B,cAAc;CACtC,AAAiB;CAEjB,YAAY,QAAgB,WAAoB;EAC9C,MAAM,QAAQ,SAAS;EACvB,KAAK,SAAS;CAChB;CAEA,AAAQ,YAAkB;EACxB,IAAI,cACF,KAAK,SAAS,aAAa,SAAS,CAAC;CAEzC;CAEA,AAAS,MAAM,SAAiB,GAAG,MAAuB;EACxD,KAAK,UAAU;EACf,MAAM,MAAM,IAAI,KAAK,OAAO,IAAI,WAAW,GAAG,IAAI;CACpD;CAEA,AAAS,KAAK,SAAiB,GAAG,MAAuB;EACvD,KAAK,UAAU;EACf,MAAM,MAAM,KAAK,SAAS,MAAM,UAAU,IAAI,KAAK,OAAO,IAAI,YAAY;EAC1E,MAAM,KAAK,KAAK,GAAG,IAAI;CACzB;CAEA,AAAS,KAAK,SAAiB,GAAG,MAAuB;EACvD,KAAK,UAAU;EACf,MAAM,MAAM,KAAK,SAAS,MAAM,UAAU,IAAI,KAAK,OAAO,IAAI,YAAY;EAC1E,MAAM,KAAK,KAAK,GAAG,IAAI;CACzB;CAEA,AAAS,MAAM,SAAiB,GAAG,MAAuB;EACxD,KAAK,UAAU;EACf,MAAM,MAAM,KAAK,SAAS,MAAM,UAAU,IAAI,KAAK,OAAO,IAAI,YAAY;EAC1E,MAAM,MAAM,KAAK,GAAG,IAAI;CAC1B;AACF;;;;;;;;;;;;AAaA,SAAgB,4BAAsC;CACpD,MAAM,MAAM,QAAQ,IAAI;CACxB,IAAI,QAAQ,WAAW,QAAQ,UAAU,QAAQ,UAAU,QAAQ,SACjE,OAAO;CAET,OAAO;AACT;AAEA,IAAI,eAAqC;AAEzC,SAAgB,YAA2B;CACzC,IAAI,CAAC,cACH,eAAe,IAAI,cAAc,0BAA0B,CAAC;CAE9D,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACjPA,SAAgB,eAAuB;CACrC,MAAM,WAAW,QAAQ,IAAI;CAC7B,OAAO,YAAY,SAAS,SAAS,IAAI,WAAW;AACtD;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,gBACd,MAAc,aAAa,GAC3B,WAA4B,QAAQ,UAC3B;CACT,IAAI,aAAa,YAAY,aAAa,SAAS,OAAO;CAC1D,MAAM,QAAQ,IAAI,MAAM,OAAO,CAAC,CAAC,IAAI,KAAK,GAAE,CAAE,YAAY;CAC1D,OAAO,SAAS,WAAW,SAAS;AACtC;;;;;;;;AASA,SAAgB,4BAAoC;CAClD,OAAO,GAAG,eAAe,CAAC,CAAC,UAAU;AACvC;AAEA,SAAS,uBAAgC;CACvC,MAAM,IAAI,QAAQ,IAAI,0BAA0B;CAChD,OAAO,MAAM,UAAa,CAAC,KAAK,MAAM,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC;AACzE;AAGA,MAAM,uBAAuB;;;;;;;AAQ7B,SAAS,iBAAiB,MAAsB;CAC9C,OAAO,KAAK,QACV,uBACC,MAAM,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,GAC3D;AACF;;;;;;;;;;;;;;AAeA,SAAgB,uBACd,aACA,SACoB;CACpB,IAAI,YAAY,WAAW,KAAK,CAAC,gBAAgB,KAAK,qBAAqB,GAAG,OAAO;CACrF,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,WAAW,CAAC;CACtC,OACE,GAAG,iBAAiB,OAAO,EAAE,kCAAkC,MAAM,IAAI,gBAAgB,CAAC,CAAC,KAAK,IAAI,EAAE,wVAKnG,0BAA0B,EAAE;AAEnC;;AAGA,MAAM,kCAAkB,IAAI,IAAY;;;;;;;AAaxC,SAAgB,sBAAsB,MAA+B;CACnE,IAAI,KAAK,WAAW,KAAK,CAAC,gBAAgB,GAAG;CAC7C,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK;CACtC,MAAM,QAAQ,KAAK,UAAU,KAAK;CAClC,IAAI,gBAAgB,IAAI,KAAK,GAAG;CAChC,gBAAgB,IAAI,KAAK;CACzB,UAAU,CAAC,CAAC,KACV,0DAA0D,MAAM,IAAI,gBAAgB,CAAC,CAAC,KAAK,IAAI,EAAE,yNAInG;AACF;;;;;;;;;;;;AAkFA,eAAsB,mBACpB,MACA,UAA4B,CAAC,GACP;CACtB,OAAO,eAAe,aAAa,GAAG,MAAM,OAAO;AACrD;;;;;;AAOA,eAAsB,eACpB,KACA,MACA,UAA4B,CAAC,GACP;CACtB,MAAM,aAAa,QAAQ,cAAc,UAAU,CAAC,CAAC,SAAS,MAAM;CACpE,MAAM,MAAM,QAAQ,MAAM,SAAS,QAAQ,GAAG,IAAI;CAClD,MAAM,OAAO,qBAAqB,QAAQ,eAAe,UAAU;CAEnE,OAAO,IAAI,SAAsB,SAAS,WAAW;EAQnD,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,KAAK,MAAM;IACvB,KAAK,QAAQ;IACb;IACA,OAAO;KAAC,QAAQ,QAAQ,SAAS;KAAU;KAAQ;IAAM;GAC3D,CAAC;EACH,SAAS,KAAK;GACZ,oBAAoB,MAAM,QAAQ,aAAa;GAC/C,OAAO,GAAY;GACnB;EACF;EAEA,MAAM,eAAyB,CAAC;EAChC,MAAM,eAAyB,CAAC;EAEhC,MAAM,OAAQ,GAAG,SAAS,UAAkB;GAC1C,aAAa,KAAK,KAAK;GACvB,IAAI,YAAY,QAAQ,OAAO,MAAM,KAAK;EAC5C,CAAC;EACD,MAAM,OAAQ,GAAG,SAAS,UAAkB;GAC1C,aAAa,KAAK,KAAK;GACvB,IAAI,YAAY,QAAQ,OAAO,MAAM,KAAK;EAC5C,CAAC;EAED,MAAM,KAAK,UAAU,QAA+B;GAClD,oBAAoB,MAAM,QAAQ,aAAa;GAC/C,IAAI,IAAI,SAAS,UAAU;IACzB,MAAM,gBAAgB,QAAQ,IAAI,kBAAkB,OAAO,QAAQ;IACnE,uBACE,IAAI,MACF,gBACI,+BAA+B,IAAI,wCACrB,IAAI,mDAClB,+BAA+B,IAAI,gHAEzC,CACF;GACF,OACE,OAAO,GAAG;EAEd,CAAC;EAED,MAAM,KAAK,UAAU,SAAS;GAC5B,MAAM,SAAS,OAAO,OAAO,YAAY,CAAC,CAAC,SAAS,OAAO;GAC3D,MAAM,SAAS,OAAO,OAAO,YAAY,CAAC,CAAC,SAAS,OAAO;GAC3D,IAAI,SAAS,GAAG;IACd,oBAAoB,MAAM,QAAQ,aAAa;IAC/C,QAAQ;KAAE;KAAQ;IAAO,CAAC;GAC5B,OAAO;IACL,oBAAoB,MAAM,QAAQ,aAAa;IAC/C,MAAM,UACJ,OAAO,KAAK,KAAK,OAAO,KAAK,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM,GAAG,oBAAoB;IAChF,MAAM,MAAM,IAAI,MAAM,OAAO;IAC7B,IAAI,SAAS;IACb,IAAI,SAAS;IACb,IAAI,WAAW;IACf,OAAO,GAAG;GACZ;EACF,CAAC;EAED,IAAI,QAAQ,UAAU,QAAW;GAQ/B,MAAM,MAAO,GAAG,eAAe,CAE/B,CAAC;GACD,MAAM,MAAO,MAAM,QAAQ,KAAK;GAChC,MAAM,MAAO,IAAI;EACnB;CACF,CAAC;AACH;;;;;;;;;;AAaA,SAAS,qBACP,OACA,YAC0B;CAC1B,IAAI,UAAU,UAAa,cAAc,QAAQ,OAAO,UAAU,MAAM,OAAO;CAC/E,MAAM,OAAOA,QAAc;CAC3B,KAAK,MAAM,KAAK;CAChB,OAAO;AACT;AAEA,SAAS,oBAAoB,MAAgC,OAAiC;CAO5F,IAAI,SAAS,QAAW;CACxB,KAAK,KAAK,SAAS,EAAE;AACvB;;;;;;;;;;;;;;;;;;;;;AAsBA,eAAsB,oBACpB,MACA,UAA6B,CAAC,GACf;CACf,OAAO,gBAAgB,aAAa,GAAG,MAAM,OAAO;AACtD;;;;;;;;;;;;AAuBA,eAAsB,gBACpB,KACA,MACA,UAA6B,CAAC,GACf;CACf,MAAM,MAAM,QAAQ,MAAM,SAAS,QAAQ,GAAG,IAAI;CAClD,OAAO,IAAI,SAAe,SAAS,WAAW;EAC5C,MAAM,QAAQ,MAAM,KAAK,MAAM;GAC7B,KAAK,QAAQ;GACb;GACA,OAAO;EACT,CAAC;EACD,MAAM,KAAK,UAAU,QAA+B;GAClD,IAAI,IAAI,SAAS,UAAU;IACzB,MAAM,gBAAgB,QAAQ,IAAI,kBAAkB,OAAO,QAAQ;IACnE,uBACE,IAAI,MACF,gBACI,+BAA+B,IAAI,wCACrB,IAAI,mDAClB,+BAA+B,IAAI,gHAEzC,CACF;GACF,OACE,uBAAO,IAAI,MAAM,GAAG,IAAI,WAAW,IAAI,SAAS,CAAC;EAErD,CAAC;EACD,MAAM,KAAK,UAAU,SAAS;GAC5B,IAAI,SAAS,GACX,QAAQ;QAER,uBAAO,IAAI,MAAM,GAAG,IAAI,oBAAoB,MAAM,CAAC;EAEvD,CAAC;CACH,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,uBAAuB,QAAgB,UAA0B;CAC/E,MAAM,UAAU,OAAO,KAAK;CAI5B,IAFE,QAAQ,SAAS,gCAAgC,KACjD,QAAQ,SAAS,0BAA0B,GAE3C,OACE,mRAEoE,eAAe,CAAC,CAAC,YAAY,kEAC/D,SAAS,8CAA8C,eAAe,CAAC,CAAC,YAAY,6MAG3F;CAG/B,OAAO;AACT;AAEA,SAAS,SAAS,WAAkE;CAClF,MAAM,SAA4B,EAAE,GAAG,QAAQ,IAAI;CACnD,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,SAAS,GAC3C,IAAI,MAAM,QACR,OAAO,OAAO;MAEd,OAAO,KAAK;CAGhB,OAAO;AACT"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { d as setEmbedConfig, l as getEmbedConfig, u as resetEmbedConfig } from "./docker-cmd-DLX1TqVw.js";
-import { $r as resolveCfnStackName, D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Gr as substituteEnvVarsFromState, Jr as createLocalStateProvider, Kr as substituteEnvVarsFromStateAsync, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, Qr as resolveCfnRegion, St as createLocalStartAlbCommand, T as formatTargetListing, Ur as substituteAgainstState, Wr as substituteAgainstStateAsync, Xr as rejectExplicitCfnStackWithMultipleStacks, Yr as isCfnFlagPresent, Zr as resolveCfnFallbackRegion, a as createLocalStudioCommand, ai as countTargets, ei as CfnLocalStateProvider, jt as createLocalRunTaskCommand, ni as resolveSsmParameters, oi as listTargets, qr as LocalStateSourceError, sn as createLocalInvokeAgentCoreCommand, ti as collectSsmParameterRefs, w as createLocalListCommand } from "./local-studio-D8cHeCcp.js";
+import { d as getEmbedConfig, f as resetEmbedConfig, p as setEmbedConfig } from "./docker-cmd-SocNyC9q.js";
+import { $r as resolveCfnStackName, D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Gr as substituteEnvVarsFromState, Jr as createLocalStateProvider, Kr as substituteEnvVarsFromStateAsync, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, Qr as resolveCfnRegion, St as createLocalStartAlbCommand, T as formatTargetListing, Ur as substituteAgainstState, Wr as substituteAgainstStateAsync, Xr as rejectExplicitCfnStackWithMultipleStacks, Yr as isCfnFlagPresent, Zr as resolveCfnFallbackRegion, a as createLocalStudioCommand, ai as countTargets, ei as CfnLocalStateProvider, jt as createLocalRunTaskCommand, ni as resolveSsmParameters, oi as listTargets, qr as LocalStateSourceError, sn as createLocalInvokeAgentCoreCommand, ti as collectSsmParameterRefs, w as createLocalListCommand } from "./local-studio-BbLfdSy4.js";
 
 export { CfnLocalStateProvider, LocalStateSourceError, collectSsmParameterRefs, countTargets, createLocalInvokeAgentCoreCommand, createLocalInvokeCommand, createLocalListCommand, createLocalRunTaskCommand, createLocalStartAgentCoreCommand, createLocalStartAlbCommand, createLocalStartApiCommand, createLocalStartCloudFrontCommand, createLocalStartServiceCommand, createLocalStateProvider, createLocalStudioCommand, formatTargetListing, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resetEmbedConfig, resolveCfnFallbackRegion, resolveCfnRegion, resolveCfnStackName, resolveSsmParameters, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync };

package/dist/internal.d.ts

@@ -568,6 +568,8 @@ interface StaticOriginResult {
 }
 declare function serveFromStaticOrigin(input: {
   localDirs: readonly string[];
+  containLinks?: boolean;
+  hideDotfilesIn?: readonly string[];
   uri: string;
   defaultRootObject?: string;
   customErrorResponses?: readonly ResolvedCustomErrorResponse[];
@@ -603,6 +605,8 @@ type ResolvedOrigin = {
   kind: 's3';
   originId: string;
   localDirs: string[];
+  hideDotfilesIn?: string[];
+  fromAssembly?: boolean;
 } | {
   kind: 's3-unresolved';
   originId: string;
@@ -1237,6 +1241,7 @@ declare function downloadAndExtractS3Bundle(location: S3BundleLocation, options?
 interface BuildContainerImageOptions {
   architecture: 'x86_64' | 'arm64';
   noBuild?: boolean;
+  assetOutdir?: string;
 }
 declare function buildContainerImage(asset: {
   source: DockerImageAssetSource;

package/dist/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","names":[],"sources":["../src/local/file-watcher.ts","../src/local/source-change-classifier.ts","../src/local/agentcore-resolver.ts","../src/local/agentcore-sigv4-sign.ts","../src/local/agentcore-client.ts","../src/local/agentcore-mcp-client.ts","../src/local/agentcore-a2a-client.ts","../src/local/env-resolver.ts","../src/types/assets.ts","../src/local/container-pool.ts","../src/local/vtl-engine.ts","../src/local/cors-handler.ts","../src/local/authorizer-cache.ts","../src/local/cognito-jwt.ts","../src/local/sigv4-verify.ts","../src/local/http-server.ts","../src/local/ecs-service-resolver.ts","../src/local/cloud-map-registry.ts","../src/local/cloud-map-resolver.ts","../src/local/cloudfront-kvs.ts","../src/local/cloudfront-function-runtime.ts","../src/local/cloudfront-static-origin.ts","../src/local/cloudfront-resolver.ts","../src/local/cloudfront-s3-origin.ts","../src/local/front-door-tls.ts","../src/local/cloudfront-server.ts","../src/local/agentcore-serve-auth.ts","../src/local/agentcore-http-server.ts","../src/local/studio-store.ts","../src/local/studio-server.ts","../src/local/studio-request-relay.ts","../src/local/intrinsic-utils.ts","../src/local/intrinsic-lambda-arn.ts","../src/local/parameter-mapping.ts","../src/local/api-gateway-response.ts","../src/local/docker-inspect.ts","../src/local/route-matcher.ts","../src/local/api-gateway-event.ts","../src/local/lambda-authorizer.ts","../src/local/stage-resolver.ts","../src/local/runtime-image.ts","../src/local/websocket-event.ts","../src/local/websocket-mgmt-api.ts","../src/local/websocket-body.ts","../src/local/docker-version.ts","../src/local/api-server-grouping.ts","../src/local/layer-arn-materializer.ts","../src/local/credential-error.ts","../src/local/agentcore-code-build.ts","../src/local/agentcore-ws-bridge.ts","../src/local/agentcore-s3-bundle.ts","../src/local/docker-image-builder.ts","../src/local/image-pin-detector.ts","../src/local/target-picker.ts","../src/local/image-override-engine.ts","../src/local/container-log-streamer.ts","../src/local/cloudfront-edge-event.ts","../src/local/cloudfront-kvs-client.ts","../src/local/cloudfront-kvs-binding.ts","../src/local/cloudfront-distribution-config.ts","../src/local/cloudfront-lambda-origin.ts","../src/local/studio-custom-resource-filter.ts","../src/local/studio-ui.ts","../src/local/studio-reinvoke.ts"],"mappings":";;;;;;UAwBiB;EAEf,SAAS;;UAGM;EAEf;EAWA,WAAW;EAEX;EAOA;EASA,WAAW;EAWX,iBAAiB;;iBAkBH,kBAAkB,SAAS,qBAAqB;;;UCxC/C;EASf;EAMA;EASA;EAUA;;KAGU;EAEN;EAEA;;EAGA;EAEA;EAEA;;iBAqIU,qBACd,iCACA,KAAK,iCACJ;;;cCtNU;cAYA;cACA;cACA;cACA;UAmBI;EAEf,OAAO;EAEP;EAEA,UAAU;EAaV;EAOA,eAAe;EAOf,sBAAsB;EAMtB;EAEA;EAOA,gBAAgB;;UAaD;EACf;EACA;EACA;EACA;EACA,eAAe;;UAgBA;EACf;EACA;EACA;EACA;;UA0Be;EACf;EACA;EACA;EACA;IACE;IACA;IACA;IACA;;;cAIS,iCAAiC;EAC5C,YAAY;;iBAkBE,uBACd,gBACA,QAAQ,aACR,eAAe,yBACd;iBA+Ba,4BACd,gBACA,QAAQ,cACP;;;cCrNU;UAGI;EACf;EACA;EACA;;UAGe;EACf,aAAa;EACb;EACA;EACA;EAEA;EAQA,eAAe;EAEf;EAEA;EAEA;;UAQe;EAEf;EAEA;EAEA;EAEA;;iBAOoB,wBACpB,MAAM,iCACL,QAAQ;;;cCjDE;UAEI;EAEf;EAEA;EAMA;EAMA;;iBAcoB,qBACpB,cACA,cACA,qBACC;iBA0EmB,0BACpB,cACA,cACA,cACA,qBACC;UAoDc;EAEf;EAEA;EAMA;EAQA,oBAAoB;EASpB,WAAW;;iBAYS,gBACpB,cACA,cACA,gBACA,SAAS,yBACR,QAAQ;;;cCrNE;cAEA;cAEA;UAMI;EACf;EACA;;UAGe;EAEf;EAEA;;UAGe;EAMf;EAEA;EAEA,mBAAmB;;iBASC,cACpB,cACA,cACA,SAAS,mBACT,UAAS,mBACR,QAAQ;iBAkKK,mBAAmB,cAAc;;;cCpNpC;cAEA;UAGI;EACf;EACA;;UAGe;EAEf;EAEA;;UAGe;EAMf;EAMA;EAEA,mBAAmB;;iBAQC,cACpB,cACA,cACA,SAAS,mBACT,UAAS,mBACR,QAAQ;;;UC7BM;EAEf,UAAU;EAEV;;UAGe;EAEf,aAAa;GAKZ,iCAAiC;;iBAwBpB,eACd,mBACA,iCACA,aAAa,qCACb,YAAY,kBACX;;;UCXc;EAKf;EAOA;EAEA;EAEA;EAEA,kBAAkB;EAElB,sBAAsB;EAEtB;EAEA,qBAAqB;EAErB;EAEA;EAEA;EAEA,YAAY;EAEZ,UAAU;EAEV;;UAOe;EAMf;EAKA,SAAS;;;;UCpFM;EACf;EACA;EACA;EACA;EACA;EAEA;;UAwMe;EAMf,QAAQ,oBAAoB,QAAQ;EAEpC,QAAQ,QAAQ;EAEhB,WAAW;;;;cChHA,2BAA2B;EACtC,YAAY;;;;UCtEG;EACf;EACA;EACA;EACA;EACA;EACA;;iBAsBc,uBAAuB,UAAU,yBAAyB,YAAY;iBA4GtE,mCACd,UAAU,yBACT,YAAY;iBAuGC,wBACd,UAAU,wBACV;UA+Je;EACf;EACA,SAAS;;iBAUK,eACd;EAAO;EAAgB,SAAS;GAChC,QAAQ,aACP;iBAqGa,yBACd,KAAK,gBACL,kCACA,mBAAmB,YAAY,aAC/B;;;UC9jBe;EAcf;EAKA;EAMA,UAAU;EASV;;UAQe;EAMf,IAAI,6BAA6B,uBAAuB;EAIxD,IACE,6BACA,sBACA,oBACA,QAAQ;EAGV;EAEA;;iBAQc,sBAAsB;EAAQ;IAA4B;;;UC5DhE;EAER;EAEA;EAEA;EAEA;EAEA;EAEA;;UAGQ;EAER,OAAO,YAAY;EAEnB;EAEA;;UAQe;EACf,cAAc,kBAAkB,QAAQ;EAExC,KAAK,kBAAkB;EACvB;;KAoBU,WAAW;iBA+DP,gBACd;EACE,aACE,gBACG;IAAU;IAAa;IAAgB,YAAY;;EACxD;EACA;EAEA;IAED;iBA6Fa,oBAAoB,gBAAgB;iBAQpC,uBAAuB;iBAsCjB,iBACpB,YAAY,2BACZ,yCACA,WAAW,WACX;EAAQ;EAAoB,WAAW;IACtC,QAAQ;EAA2B;EAAkC;;iBAiFlD,oBACpB,YAAY,eACZ,yCACA,WAAW,WACX;EAAQ;EAAoB,WAAW;IACtC,QAAQ;EAA2B;EAAkC;;UA8BvD;EAEf;EAEA;EAEA;EAKA;EAEA,wBAAwB;;UAST;EACf;EACA;EACA;EACA;;iBAkBoB,sBACpB,YAAY,wBACZ,yCACA,WAAW,WACX;EACE;EACA,WAAW;EACX,aACE,gBACG;IAAU;IAAa;IAAgB,YAAY;;IAEzD,QAAQ;EAA2B;EAAkC;;;;UC/XvD;EACf;EACA;EACA;;KAQU,0BAA0B,QAAQ;iBAU9B,4BAA4B;;;UCA3B;EACf,iBAAiB;EACjB,MAAM;EACN,mBAAmB,YAAY;;UAGhB;EAEf,OAAO;EAEP;EAEA;EAEA;EAEA,kBAAkB;EAElB,YAAY;EAaZ,eAAe;EAgBf,OAAO;EAQP,yBAAyB;EAUzB,wBAAwB;EASxB;EAWA;EAiBA,eAAe,KAAK,iBAAiB,KAAK,mBAAmB;;UAc9C;EACf,OAAO;EACP,SAAS;EACT,QAAQ;;UAGO;EAEf;EAEA;EAKA;EAEA,QAAQ;EAKR,aAAa;EAQb,iBAAiB,MAAM,gBAAgB;EAEvC,sBAAsB;;iBAQF,eAAe,MAAM,wBAAwB,QAAQ;iBAygD3D,0BAA0B;EACxC;EACA;EACA;IACE;;;UC3uDa;EASf;EAMA,UAAU;IAER;IAOA;IAOA;IAEA,eAAe;MAAgB;MAAkB;;;;UAWpC;EAEf;EAEA;EAEA;;UAGe;EAEf,OAAO;EAEP;EAEA,UAAU;EAOV;EAeA;EAEA;EAgBA;EAMA,MAAM;EAMN,iBAAiB;EAQjB,mBAAmB,cAAc;EAMjC;;;;UC7He;EAEf;EAEA;EAEA;;UAIe;WAEN;WAEA;;UAgBM;EACf;EACA;EACA,WAAW,cAAc;EAEzB;;cAmBW;mBAEM;mBAYA;EAcjB,SACE,mBACA,uBACA,UAAU,qBACT;EAmCH,cAAc,eAAe;EA6B7B,WAAW,QAAQ;EAenB,kBAAkB;EAmBlB,OAAO,mBAAmB,wBAAwB,cAAc;EAahE,YAAY,gBAAgB,cAAc;EAsB1C,kBAAkB;EAiClB,QAAQ,cAAc;EA0BtB;;;;UCpSe;EAEf;EAEA;;UAGe;EAEf;EAEA;EAEA;EAEA;EASA,YAAY;IAAgB;IAAmB;;;UAUhC;EAEf,uBAAuB,YAAY;EAEnC,kBAAkB,YAAY;EAE9B,qBAAqB,YAAY;EAMjC;;iBAcc,mBAAmB,OAAO,YAAY;;;UCpDrC;WAEN;WAMA;EAET,SAAS,cAAc;;UAIR;EAOf,IAAI,aAAa;IAAY;MAA+B;EAE5D,OAAO,cAAc;EAErB,QAAQ;EAER,SAAS;;UAIM;EAOf,IAAI,iBAAiB;;iBAIP,uBAAuB,kBAAkB,kBAAkB;iBAe3D,8BAA8B,4BAA4B;iBA2G1D,6BAA6B;EAC3C;EACA;IACE;;;UC1Ga;EACf;EAEA,aAAa;IAAQ;;;UAIN;EACf;EACA;EACA,aAAa,eAAe;EAC5B,SAAS,eAAe;EACxB,SAAS,eAAe;;UAIT;EACf;EACA;EACA,SAAS,eAAe;EACxB,UAAU,eAAe;EACzB;IAAkB;IAA8B;;;UAIjC;EACf;EACA;IACE;IACA;IACA;IACA;;EAEF;IAAU;;EACV,SAAS;;UAIM,8BAA8B;EAC7C,UAAU;;UASK;EAKf;EAMA;;UAIe;EAEf;EAEA;EAOA,QAAQ,GAAG;EAOX;EAMA,kBAAkB;EAQlB,mBAAmB;;iBAuBL,sBAAsB;EAAiB;EAAc;;iBAWrD,0BACd,mBACA,cACA,kBACC;KAqGS;EACN;EAAkB,SAAS;;EAC3B;EAAkB,UAAU;;iBAQZ,iBACpB,IAAI,4BACJ,OAAO,uBACN,QAAQ;iBAgBW,kBACpB,IAAI,4BACJ,OAAO,wBACN,QAAQ;;;UCpVM;EACf;EACA;EACA;;UAIe;EACf;EACA,SAAS;EACT,MAAM;;iBAUQ,sBAAsB;EACpC;EACA;EACA;EACA,gCAAgC;IAC9B;UAgCa;EAEf;EAEA;;iBAWc,+BACd,gCAAgC,gCAC/B;;;UCjEc,mCAAmC;UAGnC;EAEf;EAEA;;UAIe;EACf,gBAAgB;EAChB,gBAAgB;EAChB,iBAAiB;EACjB,iBAAiB;;UAIF;EAKf;EAEA;EAEA;EAEA,gBAAgB;EAEhB,iBAAiB;EASjB,aAAa;EASb,OAAO;;KAIG;EACN;EAAY;EAAkB;;EAa9B;EACA;EACA;EACA;EACA;;EAcA;EACA;EACA;;EASA;EACA;EACA;EACA;;EAEA;EAAgB;EAAkB;;UAGvB;EAEf;EAEA;EAEA;EAEA,WAAW;EAEX,SAAS,YAAY;EAErB,sBAAsB;;cAGX;iBAaG,8BAA8B;EAC5C,OAAO;EACP;EACA,kBAAkB;IAChB;iBAqEY,uBACd,gBAAgB,0BACf;iBAsBa,wBAAwB;iBA2JxB,gCACd,gBACA,UAAU;iBAmGI,uBAAuB;EACrC;EACA;;iBA0Kc,mCAAmC;iBAsBnC,4BAA4B;iBA8C5B,yBAAyB,UAAU;;;UCptBlC;EACf;EACA;EACA;;KAIU;EACN;EAAe,MAAM;;EACrB;;EACA;;EACA;EAAe;;KAQT,mBAAmB,gBAAgB,QAAQ;UAEtC;EAEf;EAEA,cAAc;EAQd;EAEA,cAAc;;UAIC;GACd;IACC;IACA;IACA,gCAAgC;MAC9B,QAAQ;EAOZ,SAAS;EAET;;iBAQc,qBACd,oBACA,UAAS,wBACR;iBAyLa,gBAAgB,eAAe;;;UC9Q9B;EACf,SAAS;EACT,QAAQ;;;;KC4BE,sBAAsB,aAAa,OAAO,4BAA4B;UAkBjE;EAEf;EAEA;EAEA;EAEA,OAAO,cAAc;EAErB,SAAS;;UAGM;EACf,cAAc;EACd;EACA;EAEA,MAAM;EAON,iBAAiB;EAOjB,eAAe;EASf,kBAAkB,YAAY;;iBAIV,sBACpB,SAAS,+BACR,QAAQ;iBAugBK,cACd,oBAAoB,oBACpB,cACC;;;UCxmBc;EAEf;EAEA;EAEA;EAKA;;KAQU,2BACV,SAAS,wBACN,QAAQ;UAGI;EAKf;EAKA;EAEA,YAAY;EAEZ,WAAW;;iBAqBG,6BACd,YAAY,wBACZ,OAAM,sCACL;UA4Dc;EAEf,YAAY;EAEZ;EAEA;;iBAYc,uBACd,UAAU,KAAK,4CACf;EAAW;EAAsB;GACjC,sBACA,wBAAuB,+BACtB;;;UC9Gc;EAEf;EAEA;;KAWU,6BAA6B;EACvC;EACA;EACA,MAAM;EACN;MACI,QAAQ;UAQG;EAEf;EAEA;EAEA;EAEA;EAKA;EAEA;EAMA,SAAS;EAKT;EAUA,YAAY;EAQZ,cAAc;;UAGC;EAEf;EAKA;EAEA;EAQA,iBAAiB;EAEjB,SAAS;;iBA+HK,yBACd,QAAQ,4BACP,QAAQ;;;UC1QM;EAEf;EAEA;EAMA;;UAIe;EAEf,aAAa;EAEb,MAAM;;UAIS;EAEf;EAEA;;UAUe;EAEf,eAAe;EAKf,aAAa,eAAe,OAAO,2BAA2B;EAQ9D,oBAAoB,eAAe;EAEnC,aAAa,eAAe;EAE5B;;iBAQc,kBACd,KAAK,gBACL,UAAS,qBACR;;;UC1Dc;EAEf;EAEA;EAEA;EAOA;EAUA;EAcA;EAaA;IAA0B;IAAY;;EAQtC;EAMA;;UAIe;EAEf;EAEA;EACA,SAAS;;iBAUK,qBAAqB,SAAS,gBAAgB;iBAuE9C,yBACd,QAAQ,qBACR,WAAW;iBAgCG,6BACd,QAAQ,qBACR,WAAW;iBA6BG,iCACd,QAAQ,qBACR,uBAAuB,UAAU;EAAmB;EAAY;;iBAkClD,yBACd,QAAQ,qBACR,8BACC;UAUc;EAEf;EAEA;EAEA,KAAK;EAEL,cAAc;EAOd;EAEA;EAEA;EAKA;EAUA,SAAS,kBAAkB;EAK3B,UAAU,kBAAkB;EAO5B,kBAAkB,kBAAkB;EAOpC,cAAc,kBAAkB;EAMhC;EAOA,QAAQ;EAOR;EAOA,eAAe,kBAAkB;;UAIlB;EAEf;EAEA;EAEA,aAAa;EAQb,aAAa,QAAQ,qBAAqB;;iBAWtB,kBACpB,SAAS,sBACR,QAAQ;;;UCnXM;EAEf;EAEA;EAEA;EAEA,UAAU;EAEV;EAEA;EAEA;;UAIe;EACf;EACA,SAAS;EAET;EAEA;EAEA;;iBAoBoB,kBACpB,OAAO,mBACP,iBAAgB,OAChB,uBACC,QAAQ;;;iBChEK,iBAAiB;;;KCmCrB;EACN;EAAkB;;EAClB;EAAqB;;iBAuBX,0BAA0B,iBAAiB;;;UCpB1C;EAEf,SAAS,SAAS;EAElB,aAAa,SAAS;EAEtB,gBAAgB,SAAS;EAEzB;EAEA;EAEA,SAAS,SAAS;EAElB,gBAAgB,SAAS;EAoBzB,aAAa,SAAS;;KASZ;EACN;EAAY,UAAU;;EACtB;EAAe;;iBAQL,oCACd,YAAY,SAAS,0BACrB,KAAK,0BACJ;iBAkCa,2BAA2B,eAAe,KAAK;;;UCnH9C;EACf;EAMA,SAAS;EAET;EAEA,MAAM;;iBAgBQ,wBACd,kBACA,uBACC;;;iBChCmB,sBACpB,qBACA,sBACC;;;UCHc;EACf,OAAO;EACP,gBAAgB;;iBAQF,WACd,gBACA,qBACA,iBAAiB,oBAChB;;;UC5Bc;EAEf;EAKA;EAMA,SAAS;EAET,MAAM;EAEN;EAwBA,aAAa;;UAQE;EACf,OAAO;EACP,gBAAgB;EAEhB;;iBA+Bc,oBACd,KAAK,qBACL,KAAK,qBACL;EAAQ,YAAY;IACnB;iBA4Ea,iBACd,KAAK,qBACL,KAAK,qBACL;EAAQ,YAAY;IACnB;KAiFS;EACN;EAAwB;EAAsB,UAAU;;EACxD;EAAwB;EAAsB,UAAU;;EACxD;EAAyB,QAAQ;;EACjC;EAAqB,QAAQ;EAAyB;;iBAY5C,uBACd,OAAO,yBACP,SAAS,yBACR;;;UCxPc;EAEf;EAEA,SAAS;EAET,uBAAuB;EAEvB,gBAAgB;EAEhB;EAEA;EAEA;;UAGe;EAEf,MAAM;EAEN;EAMA;EAEA;EAEA;;iBAWc,eAAe;EAC7B;EACA;EACA;EACA;EACA;EACA;;iBAoBoB,sBACpB,YAAY,uBACZ,SAAS,8BACT,KAAK,8BACJ,QAAQ;EAA2B;;iBAyBhB,wBACpB,YAAY,yBACZ,SAAS,8BACT,KAAK,8BACJ,QAAQ;EAA2B;;iBAyEtB,2BACd,YAAY,yBACZ,SAAS;EACN;EAAsB;;iBAmRX,2BACd,QAAQ,wBACR,oBACC;;;UC7bc;EAEf;EAEA;EAEA;EAEA,WAAW;;iBAgCG,cACd,UAAU,wBACV,yBACC,YAAY;iBA4HC,mBACd,QAAQ,mBACR,UAAU,YAAY;;;iBCjHR,oBAAoB;iBAgBpB,4BAA4B;iBA6E5B,4BAA4B;;;UC3I3B;EAEf,SAAS;EAET;EAEA,wBAAwB;EAExB,kCAAkC;EAElC;EAEA;;UAQe;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;;;UAKa;EAEf,UAAU;EAEV,oBAAoB;EAEpB,wBAAwB;EAExB,kCAAkC;EAElC,gBAAgB,8BAA8B;EAE9C;EAEA;;iBAqDc,kBAAkB;EAChC;EACA;EACA;EACA,UAAU;IACR;iBA6BY,kBAAkB;EAChC;EACA;EACA;EACA,UAAU;EACV;EACA;EASA;IACE;iBA4BY,qBAAqB;EACnC;EACA;EACA;EACA,UAAU;EACV;EACA;IACE;;;UC/Ma;EAEf;EAEA,QAAQ;EAER;EAEA;EAEA;;cAOW;mBACM;EAEjB,SAAS,OAAO;EAIhB,WAAW,uBAAuB;EAMlC,IAAI,uBAAuB;EAI3B;EASA,QAAQ;EAIR;;iBA4Bc,qBAAqB;EACnC;;iBA0Bc,wBAAwB,cAAc,cAAc;iBAkE9C,yBAAyB;EAC7C,KAAK;EACL,KAAK;EACL,UAAU;IACR;;;iBC7LY,aACd,KAAK,SAAS,cAAc,UAC5B;EACG;EAAc;;;;cCJN,0BAA0B;UAEtB;EACf;EACA;EACA;;UAmCe;EAEf;EAEA,QAAQ;EAMR;;iBAqBoB,2BAA2B,QAAQ;cA+B5C;EAAgC;EAAc;;iBA2BrC,gCAAgC;EAAU;EAAc;;;;UCnH7D;WAmBN;WAEA;WAEA;WAMA;WAEA,iBAAiB;;iBAgBZ,oBAAoB,iBAAiB,kBAAkB;iBAqGvD,4BACd,iBAAiB,iBACjB,qBACC;iBAqBa,6BACd,iBAAiB,iBACjB,iCACC;iBAkCa,wBAAwB,iBAAiB;;;UC3LxC;EAQf;EAMA,uBAAuB,gBAAgB,cAAc,mBAAmB;EAKxE,oBAAoB,mBAAmB;EAOvC,YAAY,yBAAyB,QAAQ;;UAG9B;EACf;EACA;EACA;;UAOe;EAEf,KAAK,eAAe;IAAU;MAAY;;;EAC1C;;UAGe;EAEf,KAAK,eAAe;IAClB;MACE;MACA;MACA;;;EAGJ;;iBAsDoB,wBACpB,OAAO,wBACP,UAAS,0BACR;;;iBCoSa,8BAA8B;iBA0C9B,0BAA0B,cAAc;;;cCvc3C;UAEI;EAEf;EAEA;EAEA;EAEA;EAEA;;iBAQoB,wBACpB,SAAS,iCACR;iBAkEa,qBAAqB,cAAc,sBAAsB;iBAqEzD,UAAU,sBAAsB;iBAqChC,oBACd,mBACA,iBACA,sBACA;;;UCtNe;EAEf;EAQA;EAEA;EAEA;EAMA;EAEA;EAEA;EAEA,uBAAuB;;UAGR;EAEf;EAEA;EAEA,SAAS;;UAiBM;EAEf;EAEA,SAAS;;iBAeK,wBACd,YAAY,QACZ,QAAQ,KAAK,kDACZ;iBAwEa,uBACd,QAAQ,gCACP,QAAQ;;;UCzJM;EACf;EACA;EACA;;UAIe;EACf;EACA;EACA;;UAGe;EAEf;EAEA;EAEA,cAAc;EAEd,eAAe,UAAU,qBAAqB,QAAQ;;UAGvC;EAEf;EAEA,eAAe;;iBAQK,2BACpB,UAAU,kBACV,UAAS,0BACR,QAAQ;;;UCxCM;EAEf;EAeA;;iBAYoB,oBACpB;EAAS,QAAQ;GACjB,mBACA,SAAS,6BACR;iBAuDa,uBAAuB;;;iBChDvB,qBAAqB,SAAS;iBAgB9B,uBAAuB,SAAS;UAY/B;EAEf;EAOA;;iBA0Bc,kBACd,kBAAkB;EAAW;EAAgB,SAAS;KACrD;;;UCqDO;EAER,SAAS;EAET;EAEA;EAEA,iBAAiB;;iBAyBG,oBACpB,8BACA,QAAQ,gBACP;;;UCpIc;EAEf;EAEA;EAQA,WAAW;EAKX,cAAc;EAKd;;KAIU,mBAAmB,YAAY;cAO9B,2BAA2B;EACtC,YAAY,iBAAiB,QAAQ;;UActB;EACf,WAAW;EACX,cAAc;EACd;;UAiBe;EACf,WAAW;EACX,cAAc;EACd;;UAiBe;EAEf,UAAU;EAOV;EACA,SAAS;EAOT,YAAY,YAAY;;iBAyDV,wBAAwB;EACtC;EACA;EACA;EAMA;IACE;iBAqOkB,sBAAsB;EAC1C,UAAU;EAMV,eAAe;EAOf,eAAe;EAOf;EAKA;EAMA;IACE,QAAQ;iBA2SI,gBACd,uBACA,SAAS,sBACT,YAAY,oBAAoB;EAC7B,WAAW;EAAqB,cAAc;EAAqB;;iBAgFxD,sBAAsB,uBAAuB,OAAO;iBAqE9C,uBACpB,WAAW,mBACV,QAAQ;iBA2FK,4BACd,UAAU,uBACV,mBAAmB;;;iBCn/BL,2BAA2B,gBAAgB;;;KC3B/C,cAAc,eAAe;EAAQ;EAAa;;KAGlD;UAOK;EACf;EACA;EACA;EACA;EACA,SAAS;EACT;IACE;IACA;IACA;IACA;;;UAKa;EACf;EACA;EACA,SAAS;EACT;EACA;;UAIe;EACf;EACA;EACA,WAAW;EACX;;UAIe;EACf,SAAS;IACP;MAAM,QAAQ;MAAY,SAAS;MAAa,WAAW;;;;UAK9C;EACf;EACA;EACA;EACA;EAEA,SAAS;EAET,OAAO;;iBAIO,kBAAkB,SAAS,2BAA2B;iBAetD,kBAAkB,SAAS;EACzC,SAAS;EACT;;iBAmCc,sBAAsB;EACpC;EACA,QAAQ,KAAK;EACb,SAAS;EACT;IACE;iBAcY,uBAAuB;EACrC;EACA,QAAQ,KAAK;EACb,SAAS;EACT;IAAY;IAAoB,SAAS;;IACvC;UAoEa;EACf;EACA,SAAS;EACT;EACA,MAAM;;iBAgCQ,uBACd,iBACA,MAAM;EAEF;EAAkB,SAAS;;EAC3B;EAAkB,UAAU;;iBAalB,wBACd,iBACA;EAAQ;EAAoB,SAAS;GACrC,YAAY,SACX;;;UCtQc;EACf;EACA;EACA;;UAqBe;EAEf;EAEA;EAEA;EAEA,cAAc;;iBASA,4BACd,SAAS,qCACR;iBAkDmB,4BACpB,cACA;EAAW;EAAiB,cAAc;IACzC;EAAU;EAAa;;;;UCnGT;EAEf;EAEA;;UAGe;EAMf,WAAW;EAMX,sBAAsB,yBAAyB,QAAQ;EAEvD;EAEA,cAAc;;iBAUM,iCACpB,cAAc,sBACd,SAAS,2BACR;EAAU;;iBA+EG,UAAU;;;UCtHT;EACf;EACA;EACA;;UAGe;EAEf;EAEA;EAEA,cAAc;EAKd,cAAc,2BAA2B,QAAQ;IAAQ;IAAa;;;iBASlD,4BACpB,SAAS,qCACR;;;UCzBc;EACf;EAEA;EAEA;EACA,SAAS;EACT,MAAM;EACN;;UAIe;EACf;EAEA,SAAS;EAET;EACA,MAAM;;iBAQc,qBAAqB;EACzC,SAAS,OAAO,4BAA4B;EAC5C;EACA;EACA,SAAS;IACP,QAAQ;;;iBCOI,6BAA6B,OAAO;UAMnC;EAMf;;iBAkBc,4BACd,QAAQ,qBACR,OAAM,qCACL;;;iBCgjFa,iBAAiB,kBAAkB;;;UC3oFlC;EAEf;EAEA;;UAIe;EAEf,OAAO;EAEP,YAAY;;iBA4BQ,SAAS,OAAO,eAAe,MAAM,eAAe,QAAQ"}
+{"version":3,"file":"internal.d.ts","names":[],"sources":["../src/local/file-watcher.ts","../src/local/source-change-classifier.ts","../src/local/agentcore-resolver.ts","../src/local/agentcore-sigv4-sign.ts","../src/local/agentcore-client.ts","../src/local/agentcore-mcp-client.ts","../src/local/agentcore-a2a-client.ts","../src/local/env-resolver.ts","../src/types/assets.ts","../src/local/container-pool.ts","../src/local/vtl-engine.ts","../src/local/cors-handler.ts","../src/local/authorizer-cache.ts","../src/local/cognito-jwt.ts","../src/local/sigv4-verify.ts","../src/local/http-server.ts","../src/local/ecs-service-resolver.ts","../src/local/cloud-map-registry.ts","../src/local/cloud-map-resolver.ts","../src/local/cloudfront-kvs.ts","../src/local/cloudfront-function-runtime.ts","../src/local/cloudfront-static-origin.ts","../src/local/cloudfront-resolver.ts","../src/local/cloudfront-s3-origin.ts","../src/local/front-door-tls.ts","../src/local/cloudfront-server.ts","../src/local/agentcore-serve-auth.ts","../src/local/agentcore-http-server.ts","../src/local/studio-store.ts","../src/local/studio-server.ts","../src/local/studio-request-relay.ts","../src/local/intrinsic-utils.ts","../src/local/intrinsic-lambda-arn.ts","../src/local/parameter-mapping.ts","../src/local/api-gateway-response.ts","../src/local/docker-inspect.ts","../src/local/route-matcher.ts","../src/local/api-gateway-event.ts","../src/local/lambda-authorizer.ts","../src/local/stage-resolver.ts","../src/local/runtime-image.ts","../src/local/websocket-event.ts","../src/local/websocket-mgmt-api.ts","../src/local/websocket-body.ts","../src/local/docker-version.ts","../src/local/api-server-grouping.ts","../src/local/layer-arn-materializer.ts","../src/local/credential-error.ts","../src/local/agentcore-code-build.ts","../src/local/agentcore-ws-bridge.ts","../src/local/agentcore-s3-bundle.ts","../src/local/docker-image-builder.ts","../src/local/image-pin-detector.ts","../src/local/target-picker.ts","../src/local/image-override-engine.ts","../src/local/container-log-streamer.ts","../src/local/cloudfront-edge-event.ts","../src/local/cloudfront-kvs-client.ts","../src/local/cloudfront-kvs-binding.ts","../src/local/cloudfront-distribution-config.ts","../src/local/cloudfront-lambda-origin.ts","../src/local/studio-custom-resource-filter.ts","../src/local/studio-ui.ts","../src/local/studio-reinvoke.ts"],"mappings":";;;;;;UAwBiB;EAEf,SAAS;;UAGM;EAEf;EAWA,WAAW;EAEX;EAOA;EASA,WAAW;EAWX,iBAAiB;;iBAkBH,kBAAkB,SAAS,qBAAqB;;;UCxC/C;EASf;EAMA;EASA;EAUA;;KAGU;EAEN;EAEA;;EAGA;EAEA;EAEA;;iBAqIU,qBACd,iCACA,KAAK,iCACJ;;;cCtNU;cAYA;cACA;cACA;cACA;UAmBI;EAEf,OAAO;EAEP;EAEA,UAAU;EAaV;EAOA,eAAe;EAOf,sBAAsB;EAMtB;EAEA;EAOA,gBAAgB;;UAaD;EACf;EACA;EACA;EACA;EACA,eAAe;;UAgBA;EACf;EACA;EACA;EACA;;UA0Be;EACf;EACA;EACA;EACA;IACE;IACA;IACA;IACA;;;cAIS,iCAAiC;EAC5C,YAAY;;iBAkBE,uBACd,gBACA,QAAQ,aACR,eAAe,yBACd;iBA+Ba,4BACd,gBACA,QAAQ,cACP;;;cCrNU;UAGI;EACf;EACA;EACA;;UAGe;EACf,aAAa;EACb;EACA;EACA;EAEA;EAQA,eAAe;EAEf;EAEA;EAEA;;UAQe;EAEf;EAEA;EAEA;EAEA;;iBAOoB,wBACpB,MAAM,iCACL,QAAQ;;;cCjDE;UAEI;EAEf;EAEA;EAMA;EAMA;;iBAcoB,qBACpB,cACA,cACA,qBACC;iBA0EmB,0BACpB,cACA,cACA,cACA,qBACC;UAoDc;EAEf;EAEA;EAMA;EAQA,oBAAoB;EASpB,WAAW;;iBAYS,gBACpB,cACA,cACA,gBACA,SAAS,yBACR,QAAQ;;;cCrNE;cAEA;cAEA;UAMI;EACf;EACA;;UAGe;EAEf;EAEA;;UAGe;EAMf;EAEA;EAEA,mBAAmB;;iBASC,cACpB,cACA,cACA,SAAS,mBACT,UAAS,mBACR,QAAQ;iBAkKK,mBAAmB,cAAc;;;cCpNpC;cAEA;UAGI;EACf;EACA;;UAGe;EAEf;EAEA;;UAGe;EAMf;EAMA;EAEA,mBAAmB;;iBAQC,cACpB,cACA,cACA,SAAS,mBACT,UAAS,mBACR,QAAQ;;;UC7BM;EAEf,UAAU;EAEV;;UAGe;EAEf,aAAa;GAKZ,iCAAiC;;iBAwBpB,eACd,mBACA,iCACA,aAAa,qCACb,YAAY,kBACX;;;UCXc;EAKf;EAOA;EAEA;EAEA;EAEA,kBAAkB;EAElB,sBAAsB;EAEtB;EAEA,qBAAqB;EAErB;EAEA;EAEA;EAEA,YAAY;EAEZ,UAAU;EAEV;;UAOe;EAMf;EAKA,SAAS;;;;UCpFM;EACf;EACA;EACA;EACA;EACA;EAEA;;UAwMe;EAMf,QAAQ,oBAAoB,QAAQ;EAEpC,QAAQ,QAAQ;EAEhB,WAAW;;;;cChHA,2BAA2B;EACtC,YAAY;;;;UCtEG;EACf;EACA;EACA;EACA;EACA;EACA;;iBAsBc,uBAAuB,UAAU,yBAAyB,YAAY;iBA4GtE,mCACd,UAAU,yBACT,YAAY;iBAuGC,wBACd,UAAU,wBACV;UA+Je;EACf;EACA,SAAS;;iBAUK,eACd;EAAO;EAAgB,SAAS;GAChC,QAAQ,aACP;iBAqGa,yBACd,KAAK,gBACL,kCACA,mBAAmB,YAAY,aAC/B;;;UC9jBe;EAcf;EAKA;EAMA,UAAU;EASV;;UAQe;EAMf,IAAI,6BAA6B,uBAAuB;EAIxD,IACE,6BACA,sBACA,oBACA,QAAQ;EAGV;EAEA;;iBAQc,sBAAsB;EAAQ;IAA4B;;;UC5DhE;EAER;EAEA;EAEA;EAEA;EAEA;EAEA;;UAGQ;EAER,OAAO,YAAY;EAEnB;EAEA;;UAQe;EACf,cAAc,kBAAkB,QAAQ;EAExC,KAAK,kBAAkB;EACvB;;KAoBU,WAAW;iBA+DP,gBACd;EACE,aACE,gBACG;IAAU;IAAa;IAAgB,YAAY;;EACxD;EACA;EAEA;IAED;iBA6Fa,oBAAoB,gBAAgB;iBAQpC,uBAAuB;iBAsCjB,iBACpB,YAAY,2BACZ,yCACA,WAAW,WACX;EAAQ;EAAoB,WAAW;IACtC,QAAQ;EAA2B;EAAkC;;iBAiFlD,oBACpB,YAAY,eACZ,yCACA,WAAW,WACX;EAAQ;EAAoB,WAAW;IACtC,QAAQ;EAA2B;EAAkC;;UA8BvD;EAEf;EAEA;EAEA;EAKA;EAEA,wBAAwB;;UAST;EACf;EACA;EACA;EACA;;iBAkBoB,sBACpB,YAAY,wBACZ,yCACA,WAAW,WACX;EACE;EACA,WAAW;EACX,aACE,gBACG;IAAU;IAAa;IAAgB,YAAY;;IAEzD,QAAQ;EAA2B;EAAkC;;;;UC/XvD;EACf;EACA;EACA;;KAQU,0BAA0B,QAAQ;iBAU9B,4BAA4B;;;UCA3B;EACf,iBAAiB;EACjB,MAAM;EACN,mBAAmB,YAAY;;UAGhB;EAEf,OAAO;EAEP;EAEA;EAEA;EAEA,kBAAkB;EAElB,YAAY;EAaZ,eAAe;EAgBf,OAAO;EAQP,yBAAyB;EAUzB,wBAAwB;EASxB;EAWA;EAiBA,eAAe,KAAK,iBAAiB,KAAK,mBAAmB;;UAc9C;EACf,OAAO;EACP,SAAS;EACT,QAAQ;;UAGO;EAEf;EAEA;EAKA;EAEA,QAAQ;EAKR,aAAa;EAQb,iBAAiB,MAAM,gBAAgB;EAEvC,sBAAsB;;iBAQF,eAAe,MAAM,wBAAwB,QAAQ;iBAygD3D,0BAA0B;EACxC;EACA;EACA;IACE;;;UC3uDa;EASf;EAMA,UAAU;IAER;IAOA;IAOA;IAEA,eAAe;MAAgB;MAAkB;;;;UAWpC;EAEf;EAEA;EAEA;;UAGe;EAEf,OAAO;EAEP;EAEA,UAAU;EAOV;EAeA;EAEA;EAgBA;EAMA,MAAM;EAMN,iBAAiB;EAQjB,mBAAmB,cAAc;EAMjC;;;;UC7He;EAEf;EAEA;EAEA;;UAIe;WAEN;WAEA;;UAgBM;EACf;EACA;EACA,WAAW,cAAc;EAEzB;;cAmBW;mBAEM;mBAYA;EAcjB,SACE,mBACA,uBACA,UAAU,qBACT;EAmCH,cAAc,eAAe;EA6B7B,WAAW,QAAQ;EAenB,kBAAkB;EAmBlB,OAAO,mBAAmB,wBAAwB,cAAc;EAahE,YAAY,gBAAgB,cAAc;EAsB1C,kBAAkB;EAiClB,QAAQ,cAAc;EA0BtB;;;;UCpSe;EAEf;EAEA;;UAGe;EAEf;EAEA;EAEA;EAEA;EASA,YAAY;IAAgB;IAAmB;;;UAUhC;EAEf,uBAAuB,YAAY;EAEnC,kBAAkB,YAAY;EAE9B,qBAAqB,YAAY;EAMjC;;iBAcc,mBAAmB,OAAO,YAAY;;;UCpDrC;WAEN;WAMA;EAET,SAAS,cAAc;;UAIR;EAOf,IAAI,aAAa;IAAY;MAA+B;EAE5D,OAAO,cAAc;EAErB,QAAQ;EAER,SAAS;;UAIM;EAOf,IAAI,iBAAiB;;iBAIP,uBAAuB,kBAAkB,kBAAkB;iBAe3D,8BAA8B,4BAA4B;iBA2G1D,6BAA6B;EAC3C;EACA;IACE;;;UC1Ga;EACf;EAEA,aAAa;IAAQ;;;UAIN;EACf;EACA;EACA,aAAa,eAAe;EAC5B,SAAS,eAAe;EACxB,SAAS,eAAe;;UAIT;EACf;EACA;EACA,SAAS,eAAe;EACxB,UAAU,eAAe;EACzB;IAAkB;IAA8B;;;UAIjC;EACf;EACA;IACE;IACA;IACA;IACA;;EAEF;IAAU;;EACV,SAAS;;UAIM,8BAA8B;EAC7C,UAAU;;UASK;EAKf;EAMA;;UAIe;EAEf;EAEA;EAOA,QAAQ,GAAG;EAOX;EAMA,kBAAkB;EAQlB,mBAAmB;;iBAuBL,sBAAsB;EAAiB;EAAc;;iBAWrD,0BACd,mBACA,cACA,kBACC;KAqGS;EACN;EAAkB,SAAS;;EAC3B;EAAkB,UAAU;;iBAQZ,iBACpB,IAAI,4BACJ,OAAO,uBACN,QAAQ;iBAgBW,kBACpB,IAAI,4BACJ,OAAO,wBACN,QAAQ;;;UClVM;EACf;EACA;EACA;;UAIe;EACf;EACA,SAAS;EACT,MAAM;;iBAUQ,sBAAsB;EACpC;EAMA;EAMA;EACA;EACA;EACA,gCAAgC;IAC9B;UAkCa;EAEf;EAEA;;iBAWc,+BACd,gCAAgC,gCAC/B;;;UC7Ec,mCAAmC;UAGnC;EAEf;EAEA;;UAIe;EACf,gBAAgB;EAChB,gBAAgB;EAChB,iBAAiB;EACjB,iBAAiB;;UAIF;EAKf;EAEA;EAEA;EAEA,gBAAgB;EAEhB,iBAAiB;EASjB,aAAa;EASb,OAAO;;KAIG;EAEN;EACA;EACA;EAQA;EAQA;;EAcA;EACA;EACA;EACA;EACA;;EAcA;EACA;EACA;;EASA;EACA;EACA;EACA;;EAEA;EAAgB;EAAkB;;UAGvB;EAEf;EAEA;EAEA;EAEA,WAAW;EAEX,SAAS,YAAY;EAErB,sBAAsB;;cAGX;iBAaG,8BAA8B;EAC5C,OAAO;EACP;EACA,kBAAkB;IAChB;iBAqEY,uBACd,gBAAgB,0BACf;iBAsBa,wBAAwB;iBA2JxB,gCACd,gBACA,UAAU;iBA6GI,uBAAuB;EACrC;EACA;;iBAkMc,mCAAmC;iBAsBnC,4BAA4B;iBA8C5B,yBAAyB,UAAU;;;UC9wBlC;EACf;EACA;EACA;;KAIU;EACN;EAAe,MAAM;;EACrB;;EACA;;EACA;EAAe;;KAQT,mBAAmB,gBAAgB,QAAQ;UAEtC;EAEf;EAEA,cAAc;EAQd;EAEA,cAAc;;UAIC;GACd;IACC;IACA;IACA,gCAAgC;MAC9B,QAAQ;EAOZ,SAAS;EAET;;iBAQc,qBACd,oBACA,UAAS,wBACR;iBAyLa,gBAAgB,eAAe;;;UC9Q9B;EACf,SAAS;EACT,QAAQ;;;;KC4BE,sBAAsB,aAAa,OAAO,4BAA4B;UAkBjE;EAEf;EAEA;EAEA;EAEA,OAAO,cAAc;EAErB,SAAS;;UAGM;EACf,cAAc;EACd;EACA;EAEA,MAAM;EAON,iBAAiB;EAOjB,eAAe;EASf,kBAAkB,YAAY;;iBAIV,sBACpB,SAAS,+BACR,QAAQ;iBAygBK,cACd,oBAAoB,oBACpB,cACC;;;UC1mBc;EAEf;EAEA;EAEA;EAKA;;KAQU,2BACV,SAAS,wBACN,QAAQ;UAGI;EAKf;EAKA;EAEA,YAAY;EAEZ,WAAW;;iBAqBG,6BACd,YAAY,wBACZ,OAAM,sCACL;UA4Dc;EAEf,YAAY;EAEZ;EAEA;;iBAYc,uBACd,UAAU,KAAK,4CACf;EAAW;EAAsB;GACjC,sBACA,wBAAuB,+BACtB;;;UC9Gc;EAEf;EAEA;;KAWU,6BAA6B;EACvC;EACA;EACA,MAAM;EACN;MACI,QAAQ;UAQG;EAEf;EAEA;EAEA;EAEA;EAKA;EAEA;EAMA,SAAS;EAKT;EAUA,YAAY;EAQZ,cAAc;;UAGC;EAEf;EAKA;EAEA;EAQA,iBAAiB;EAEjB,SAAS;;iBA+HK,yBACd,QAAQ,4BACP,QAAQ;;;UC1QM;EAEf;EAEA;EAMA;;UAIe;EAEf,aAAa;EAEb,MAAM;;UAIS;EAEf;EAEA;;UAUe;EAEf,eAAe;EAKf,aAAa,eAAe,OAAO,2BAA2B;EAQ9D,oBAAoB,eAAe;EAEnC,aAAa,eAAe;EAE5B;;iBAQc,kBACd,KAAK,gBACL,UAAS,qBACR;;;UC1Dc;EAEf;EAEA;EAEA;EAOA;EAUA;EAcA;EAaA;IAA0B;IAAY;;EAQtC;EAMA;;UAIe;EAEf;EAEA;EACA,SAAS;;iBAUK,qBAAqB,SAAS,gBAAgB;iBAuE9C,yBACd,QAAQ,qBACR,WAAW;iBAgCG,6BACd,QAAQ,qBACR,WAAW;iBA6BG,iCACd,QAAQ,qBACR,uBAAuB,UAAU;EAAmB;EAAY;;iBAkClD,yBACd,QAAQ,qBACR,8BACC;UAUc;EAEf;EAEA;EAEA,KAAK;EAEL,cAAc;EAOd;EAEA;EAEA;EAKA;EAUA,SAAS,kBAAkB;EAK3B,UAAU,kBAAkB;EAO5B,kBAAkB,kBAAkB;EAOpC,cAAc,kBAAkB;EAMhC;EAOA,QAAQ;EAOR;EAOA,eAAe,kBAAkB;;UAIlB;EAEf;EAEA;EAEA,aAAa;EAQb,aAAa,QAAQ,qBAAqB;;iBAWtB,kBACpB,SAAS,sBACR,QAAQ;;;UCnXM;EAEf;EAEA;EAEA;EAEA,UAAU;EAEV;EAEA;EAEA;;UAIe;EACf;EACA,SAAS;EAET;EAEA;EAEA;;iBAoBoB,kBACpB,OAAO,mBACP,iBAAgB,OAChB,uBACC,QAAQ;;;iBChEK,iBAAiB;;;KCmCrB;EACN;EAAkB;;EAClB;EAAqB;;iBAuBX,0BAA0B,iBAAiB;;;UCpB1C;EAEf,SAAS,SAAS;EAElB,aAAa,SAAS;EAEtB,gBAAgB,SAAS;EAEzB;EAEA;EAEA,SAAS,SAAS;EAElB,gBAAgB,SAAS;EAoBzB,aAAa,SAAS;;KASZ;EACN;EAAY,UAAU;;EACtB;EAAe;;iBAQL,oCACd,YAAY,SAAS,0BACrB,KAAK,0BACJ;iBAkCa,2BAA2B,eAAe,KAAK;;;UCnH9C;EACf;EAMA,SAAS;EAET;EAEA,MAAM;;iBAgBQ,wBACd,kBACA,uBACC;;;iBChCmB,sBACpB,qBACA,sBACC;;;UCHc;EACf,OAAO;EACP,gBAAgB;;iBAQF,WACd,gBACA,qBACA,iBAAiB,oBAChB;;;UC5Bc;EAEf;EAKA;EAMA,SAAS;EAET,MAAM;EAEN;EAwBA,aAAa;;UAQE;EACf,OAAO;EACP,gBAAgB;EAEhB;;iBA+Bc,oBACd,KAAK,qBACL,KAAK,qBACL;EAAQ,YAAY;IACnB;iBA4Ea,iBACd,KAAK,qBACL,KAAK,qBACL;EAAQ,YAAY;IACnB;KAiFS;EACN;EAAwB;EAAsB,UAAU;;EACxD;EAAwB;EAAsB,UAAU;;EACxD;EAAyB,QAAQ;;EACjC;EAAqB,QAAQ;EAAyB;;iBAY5C,uBACd,OAAO,yBACP,SAAS,yBACR;;;UCxPc;EAEf;EAEA,SAAS;EAET,uBAAuB;EAEvB,gBAAgB;EAEhB;EAEA;EAEA;;UAGe;EAEf,MAAM;EAEN;EAMA;EAEA;EAEA;;iBAWc,eAAe;EAC7B;EACA;EACA;EACA;EACA;EACA;;iBAoBoB,sBACpB,YAAY,uBACZ,SAAS,8BACT,KAAK,8BACJ,QAAQ;EAA2B;;iBAyBhB,wBACpB,YAAY,yBACZ,SAAS,8BACT,KAAK,8BACJ,QAAQ;EAA2B;;iBAyEtB,2BACd,YAAY,yBACZ,SAAS;EACN;EAAsB;;iBAmRX,2BACd,QAAQ,wBACR,oBACC;;;UC7bc;EAEf;EAEA;EAEA;EAEA,WAAW;;iBAgCG,cACd,UAAU,wBACV,yBACC,YAAY;iBA4HC,mBACd,QAAQ,mBACR,UAAU,YAAY;;;iBCjHR,oBAAoB;iBAgBpB,4BAA4B;iBA6E5B,4BAA4B;;;UC3I3B;EAEf,SAAS;EAET;EAEA,wBAAwB;EAExB,kCAAkC;EAElC;EAEA;;UAQe;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;;;UAKa;EAEf,UAAU;EAEV,oBAAoB;EAEpB,wBAAwB;EAExB,kCAAkC;EAElC,gBAAgB,8BAA8B;EAE9C;EAEA;;iBAqDc,kBAAkB;EAChC;EACA;EACA;EACA,UAAU;IACR;iBA6BY,kBAAkB;EAChC;EACA;EACA;EACA,UAAU;EACV;EACA;EASA;IACE;iBA4BY,qBAAqB;EACnC;EACA;EACA;EACA,UAAU;EACV;EACA;IACE;;;UC/Ma;EAEf;EAEA,QAAQ;EAER;EAEA;EAEA;;cAOW;mBACM;EAEjB,SAAS,OAAO;EAIhB,WAAW,uBAAuB;EAMlC,IAAI,uBAAuB;EAI3B;EASA,QAAQ;EAIR;;iBA4Bc,qBAAqB;EACnC;;iBA0Bc,wBAAwB,cAAc,cAAc;iBAkE9C,yBAAyB;EAC7C,KAAK;EACL,KAAK;EACL,UAAU;IACR;;;iBC7LY,aACd,KAAK,SAAS,cAAc,UAC5B;EACG;EAAc;;;;cCJN,0BAA0B;UAEtB;EACf;EACA;EACA;;UAmCe;EAEf;EAEA,QAAQ;EAMR;;iBAqBoB,2BAA2B,QAAQ;cA+B5C;EAAgC;EAAc;;iBA2BrC,gCAAgC;EAAU;EAAc;;;;UCnH7D;WAmBN;WAEA;WAEA;WAMA;WAEA,iBAAiB;;iBAgBZ,oBAAoB,iBAAiB,kBAAkB;iBAqGvD,4BACd,iBAAiB,iBACjB,qBACC;iBAqBa,6BACd,iBAAiB,iBACjB,iCACC;iBAkCa,wBAAwB,iBAAiB;;;UC3LxC;EAQf;EAMA,uBAAuB,gBAAgB,cAAc,mBAAmB;EAKxE,oBAAoB,mBAAmB;EAOvC,YAAY,yBAAyB,QAAQ;;UAG9B;EACf;EACA;EACA;;UAOe;EAEf,KAAK,eAAe;IAAU;MAAY;;;EAC1C;;UAGe;EAEf,KAAK,eAAe;IAClB;MACE;MACA;MACA;;;EAGJ;;iBAsDoB,wBACpB,OAAO,wBACP,UAAS,0BACR;;;iBCoSa,8BAA8B;iBA0C9B,0BAA0B,cAAc;;;cCtc3C;UAEI;EAEf;EAEA;EAEA;EAEA;EAEA;;iBAQoB,wBACpB,SAAS,iCACR;iBAkEa,qBAAqB,cAAc,sBAAsB;iBAqEzD,UAAU,sBAAsB;iBAqChC,oBACd,mBACA,iBACA,sBACA;;;UCvNe;EAEf;EAQA;EAEA;EAEA;EAMA;EAEA;EAEA;EAEA,uBAAuB;;UAGR;EAEf;EAEA;EAEA,SAAS;;UAiBM;EAEf;EAEA,SAAS;;iBAeK,wBACd,YAAY,QACZ,QAAQ,KAAK,kDACZ;iBAwEa,uBACd,QAAQ,gCACP,QAAQ;;;UCzJM;EACf;EACA;EACA;;UAIe;EACf;EACA;EACA;;UAGe;EAEf;EAEA;EAEA,cAAc;EAEd,eAAe,UAAU,qBAAqB,QAAQ;;UAGvC;EAEf;EAEA,eAAe;;iBAQK,2BACpB,UAAU,kBACV,UAAS,0BACR,QAAQ;;;UCvCM;EAEf;EAeA;EAOA;;iBAYoB,oBACpB;EAAS,QAAQ;GACjB,mBACA,SAAS,6BACR;iBAyDa,uBAAuB;;;iBC1DvB,qBAAqB,SAAS;iBAgB9B,uBAAuB,SAAS;UAY/B;EAEf;EAOA;;iBA0Bc,kBACd,kBAAkB;EAAW;EAAgB,SAAS;KACrD;;;UCqDO;EAER,SAAS;EAET;EAEA;EAEA,iBAAiB;;iBAyBG,oBACpB,8BACA,QAAQ,gBACP;;;UCpIc;EAEf;EAEA;EAQA,WAAW;EAKX,cAAc;EAKd;;KAIU,mBAAmB,YAAY;cAO9B,2BAA2B;EACtC,YAAY,iBAAiB,QAAQ;;UActB;EACf,WAAW;EACX,cAAc;EACd;;UAiBe;EACf,WAAW;EACX,cAAc;EACd;;UAiBe;EAEf,UAAU;EAOV;EACA,SAAS;EAOT,YAAY,YAAY;;iBAyDV,wBAAwB;EACtC;EACA;EACA;EAMA;IACE;iBAqOkB,sBAAsB;EAC1C,UAAU;EAMV,eAAe;EAOf,eAAe;EAOf;EAKA;EAMA;IACE,QAAQ;iBA2SI,gBACd,uBACA,SAAS,sBACT,YAAY,oBAAoB;EAC7B,WAAW;EAAqB,cAAc;EAAqB;;iBAgFxD,sBAAsB,uBAAuB,OAAO;iBAqE9C,uBACpB,WAAW,mBACV,QAAQ;iBA2FK,4BACd,UAAU,uBACV,mBAAmB;;;iBCn/BL,2BAA2B,gBAAgB;;;KC3B/C,cAAc,eAAe;EAAQ;EAAa;;KAGlD;UAOK;EACf;EACA;EACA;EACA;EACA,SAAS;EACT;IACE;IACA;IACA;IACA;;;UAKa;EACf;EACA;EACA,SAAS;EACT;EACA;;UAIe;EACf;EACA;EACA,WAAW;EACX;;UAIe;EACf,SAAS;IACP;MAAM,QAAQ;MAAY,SAAS;MAAa,WAAW;;;;UAK9C;EACf;EACA;EACA;EACA;EAEA,SAAS;EAET,OAAO;;iBAIO,kBAAkB,SAAS,2BAA2B;iBAetD,kBAAkB,SAAS;EACzC,SAAS;EACT;;iBAmCc,sBAAsB;EACpC;EACA,QAAQ,KAAK;EACb,SAAS;EACT;IACE;iBAcY,uBAAuB;EACrC;EACA,QAAQ,KAAK;EACb,SAAS;EACT;IAAY;IAAoB,SAAS;;IACvC;UAoEa;EACf;EACA,SAAS;EACT;EACA,MAAM;;iBAgCQ,uBACd,iBACA,MAAM;EAEF;EAAkB,SAAS;;EAC3B;EAAkB,UAAU;;iBAalB,wBACd,iBACA;EAAQ;EAAoB,SAAS;GACrC,YAAY,SACX;;;UCtQc;EACf;EACA;EACA;;UAqBe;EAEf;EAEA;EAEA;EAEA,cAAc;;iBASA,4BACd,SAAS,qCACR;iBAkDmB,4BACpB,cACA;EAAW;EAAiB,cAAc;IACzC;EAAU;EAAa;;;;UCnGT;EAEf;EAEA;;UAGe;EAMf,WAAW;EAMX,sBAAsB,yBAAyB,QAAQ;EAEvD;EAEA,cAAc;;iBAUM,iCACpB,cAAc,sBACd,SAAS,2BACR;EAAU;;iBA+EG,UAAU;;;UCtHT;EACf;EACA;EACA;;UAGe;EAEf;EAEA;EAEA,cAAc;EAKd,cAAc,2BAA2B,QAAQ;IAAQ;IAAa;;;iBASlD,4BACpB,SAAS,qCACR;;;UCzBc;EACf;EAEA;EAEA;EACA,SAAS;EACT,MAAM;EACN;;UAIe;EACf;EAEA,SAAS;EAET;EACA,MAAM;;iBAQc,qBAAqB;EACzC,SAAS,OAAO,4BAA4B;EAC5C;EACA;EACA,SAAS;IACP,QAAQ;;;iBCOI,6BAA6B,OAAO;UAMnC;EAMf;;iBAkBc,4BACd,QAAQ,qBACR,OAAM,qCACL;;;iBCgjFa,iBAAiB,kBAAkB;;;UC3oFlC;EAEf;EAEA;;UAIe;EAEf,OAAO;EAEP,YAAY;;iBA4BQ,SAAS,OAAO,eAAe,MAAM,eAAe,QAAQ"}

package/dist/internal.js

@@ -1,3 +1,3 @@
-import { $ as applyEdgeResponseResult, $n as buildJwksUrlFromIssuer, $t as buildCloudMapIndex, A as startAgentCoreHttpServer, Ai as describeCredentialLoadFailure, An as classifySourceChange, Ar as ConnectionRegistry, At as addRunTaskSpecificOptions, B as idFromArn, Bn as buildStageMap, Br as resolveRuntimeFileExtension, Bt as resolveEcsAssumeRoleOption, C as addListSpecificOptions, Ci as resolveAgentCoreTarget, Cn as waitForAgentCorePing, Cr as tryParseStatus, Ct as parseLbPortOverrides, Di as tryResolveImageFnJoin, Dn as computeCodeImageTag, Dr as probeHostGatewaySupport, Dt as addStartServiceSpecificOptions, E as addStartAgentCoreSpecificOptions, Ei as substituteImagePlaceholders, En as buildAgentCoreCodeImage, Er as HOST_GATEWAY_MIN_VERSION, Et as resolveAlbFrontDoor, Fn as createWatchPredicates, Fr as buildDisconnectEvent, Ft as addImageOverrideOptions, G as classifyS3Error, Gn as filterRoutesByApiIdentifiers, Gt as enforceImageOverrideOrphans, H as createDeployedKvsDataSource, Hn as resolveEnvVars, Hr as EcsTaskResolutionError, Ht as runEcsServiceEmulator, I as normalizeKvsFileKeys, In as resolveApiTargetSubset, Ir as buildMessageEvent, It as buildEcsImageResolutionContext, J as startCloudFrontServer, Jn as startApiServer, Jt as resolveImageOverrides, K as createS3OriginReader, Kn as groupRoutesByServer, Kt as mergeForService, L as parseKvsFileOverrides, Ln as createAuthorizerCache, Lr as architectureToPlatform, Lt as ecsClusterOption, M as startAgentCoreWsBridge, Mi as resolveProfileCredentials, Mr as handleConnectionsRequest, Mt as MAX_TASKS_SUBNET_RANGE_CAP, N as LocalStartCloudFrontError, Ni as buildProxyClientConfig, Nn as addStartApiSpecificOptions, Nr as parseConnectionsPath, Nt as addCommonEcsServiceOptions, O as buildAgentCoreServeAuthCheck, Oi as LocalInvokeBuildError, On as renderCodeDockerfile, Or as resolveHostGatewayExtraHosts, P as addStartCloudFrontSpecificOptions, Pi as isProxyEnvConfigured, Pr as buildConnectEvent, Pt as addEcsAssumeRoleOptions, Q as applyEdgeRequestResult, Qn as buildCognitoJwksUrl, Qt as listPinnedTargets, R as parseOriginOverrides, Rn as createFileWatcher, Rr as buildContainerImage, Rt as parseMaxTasks, S as StudioEventBus, Si as pickAgentCoreCandidateStack, Sn as waitForAgentCoreHttpReady, Sr as selectIntegrationResponse, Ti as formatStateRemedy, Tn as SUPPORTED_CODE_RUNTIMES, Tr as HOST_DOCKER_INTERNAL_GATEWAY, Tt as isApplicationLoadBalancer, U as resolveDeployedKvsArnByName, Un as availableApiIdentifiers, Ut as ImageOverrideError, V as resolveKvsModulesForDistribution, Vn as materializeLayerFromArn, Vr as resolveRuntimeImage, Vt as resolveSharedSidecarCredentials, W as resolveDeployedOriginBucket, Wn as filterRoutesByApiIdentifier, Wt as buildImageOverrideTag, X as serveFromStaticOrigin, Xn as resolveServiceIntegrationParameters, Xt as describePinnedImageUri, Y as resolveErrorResponseCandidates, Yn as resolveSelectionExpression, Yt as runImageOverrideBuilds, Z as serveLambdaUrlOrigin, Zn as defaultCredentialsLoader, Zt as isLocalCdkAssetImage, _ as filterStudioTargetGroups, _i as AGENTCORE_AGUI_PROTOCOL, _n as parseSseForJsonRpc, _r as applyAuthorizerOverlay, _t as createCloudFrontModule, an as attachContainerLogStreamer, ar as computeRequestIdentityHash, at as describeS3OriginDomain, b as renderStudioHtml, bi as AGENTCORE_RUNTIME_TYPE, bn as AGENTCORE_SESSION_ID_HEADER, br as evaluateResponseParameters, bt as addAlbSpecificOptions, c as startStudioProxy, ci as discoverWebSocketApis, cn as bridgeAgentCoreWs, cr as invokeTokenAuthorizer, ct as pickFunctionUrlLogicalIdFromOrigin, d as createStudioDispatcher, di as parseSelectionExpressionPath, dn as A2A_PATH, dr as buildCorsConfigByApiId, dt as pickTargetFunctionLogicalId, en as CloudMapRegistry, er as createJwksCache, et as buildEdgeRequestEvent, f as filterStudioCustomResources, fi as webSocketApiMatchesIdentifier, fn as a2aInvokeOnce, fr as buildCorsConfigFromCloudFrontChain, ft as resolveCloudFrontDistribution, g as annotatePinnedEcsTargets, gi as AGENTCORE_A2A_PROTOCOL, gn as mcpInvokeOnce, gr as translateLambdaResponse, gt as stripCloudFrontImport, h as annotateEcsTaskPinnedTargets, hi as resolveLambdaArnIntrinsic, hn as MCP_PROTOCOL_VERSION, hr as matchRoute, ht as runViewerResponse, i as coerceStopRequest, ii as resolveSingleTarget, in as getContainerNetworkIp, ir as buildMethodArn, it as CLOUDFRONT_DISTRIBUTION_TYPE, j as attachAgentCoreWsBridge, ji as buildStsClientConfig, jn as addInvokeSpecificOptions, jr as buildMgmtEndpointEnvUrl, k as selectServeInboundAuth, ki as describeAwsFailureForWarn, kn as toCmdArgv, kr as bufferToBody, kt as serviceStrategy, l as relayServeRequest, li as discoverWebSocketApisOrThrow, ln as invokeAgentCoreWs, lr as attachAuthorizers, lt as pickKvsLogicalIdFromArn, m as annotateAlbPinnedBackingServices, mi as pickRefLogicalId, mn as MCP_PATH, mr as matchPreflight, mt as runViewerRequest, n as coerceRunRequest, nn as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, nr as verifyJwtAuthorizer, nt as edgeHeadersToHttp, o as resolveServeBaseUrl, on as addInvokeAgentCoreSpecificOptions, or as evaluateCachedLambdaPolicy, ot as extractKvsAssociations, p as isCustomResourceLambdaTarget, pi as discoverRoutes, pn as MCP_CONTAINER_PORT, pr as isFunctionUrlOacFronted, pt as compileCloudFrontFunction, q as matchBehavior, qn as readMtlsMaterialsFromDisk, qt as parseImageOverrideFlags, r as coerceServeRequest, ri as resolveWatchConfig, rn as setShadowReadyTimeoutMs, rr as verifyJwtViaDiscovery, rt as httpHeadersToEdge, s as createStudioServeManager, si as availableWebSocketApiIdentifiers, sr as invokeRequestAuthorizer, st as isCloudFrontDistribution, t as addStudioSpecificOptions, tn as DEFAULT_SHADOW_READY_TIMEOUT_MS, tr as verifyCognitoJwt, tt as buildEdgeResponseEvent, u as reinvoke, ui as filterWebSocketApisByIdentifiers, un as A2A_CONTAINER_PORT, ur as applyCorsResponseHeaders, ut as pickLambdaEdgeFunctionLogicalId, v as startStudioServer, vi as AGENTCORE_HTTP_PROTOCOL, vn as AGENTCORE_SIGV4_SERVICE, vr as buildHttpApiV2Event, vt as createLocalFileKvsDataSource, wi as derivePseudoParametersFromRegion, wn as downloadAndExtractS3Bundle, wr as VtlEvaluationError, wt as resolveAlbTarget, x as createStudioStore, xi as AgentCoreResolutionError, xn as invokeAgentCore, xr as pickResponseTemplate, xt as albStrategy, y as toStudioTargetGroups, yi as AGENTCORE_MCP_PROTOCOL, yn as signAgentCoreInvocation, yr as buildRestV1Event, yt as createUnboundCloudFrontModule, z as resolveCloudFrontTarget, zn as attachStageContext, zr as resolveRuntimeCodeMountPath, zt as parseRestartPolicy } from "./local-studio-D8cHeCcp.js";
+import { $ as applyEdgeResponseResult, $n as buildJwksUrlFromIssuer, $t as buildCloudMapIndex, A as startAgentCoreHttpServer, Ai as describeCredentialLoadFailure, An as classifySourceChange, Ar as ConnectionRegistry, At as addRunTaskSpecificOptions, B as idFromArn, Bn as buildStageMap, Br as resolveRuntimeFileExtension, Bt as resolveEcsAssumeRoleOption, C as addListSpecificOptions, Ci as resolveAgentCoreTarget, Cn as waitForAgentCorePing, Cr as tryParseStatus, Ct as parseLbPortOverrides, Di as tryResolveImageFnJoin, Dn as computeCodeImageTag, Dr as probeHostGatewaySupport, Dt as addStartServiceSpecificOptions, E as addStartAgentCoreSpecificOptions, Ei as substituteImagePlaceholders, En as buildAgentCoreCodeImage, Er as HOST_GATEWAY_MIN_VERSION, Et as resolveAlbFrontDoor, Fn as createWatchPredicates, Fr as buildDisconnectEvent, Ft as addImageOverrideOptions, G as classifyS3Error, Gn as filterRoutesByApiIdentifiers, Gt as enforceImageOverrideOrphans, H as createDeployedKvsDataSource, Hn as resolveEnvVars, Hr as EcsTaskResolutionError, Ht as runEcsServiceEmulator, I as normalizeKvsFileKeys, In as resolveApiTargetSubset, Ir as buildMessageEvent, It as buildEcsImageResolutionContext, J as startCloudFrontServer, Jn as startApiServer, Jt as resolveImageOverrides, K as createS3OriginReader, Kn as groupRoutesByServer, Kt as mergeForService, L as parseKvsFileOverrides, Ln as createAuthorizerCache, Lr as architectureToPlatform, Lt as ecsClusterOption, M as startAgentCoreWsBridge, Mi as resolveProfileCredentials, Mr as handleConnectionsRequest, Mt as MAX_TASKS_SUBNET_RANGE_CAP, N as LocalStartCloudFrontError, Ni as buildProxyClientConfig, Nn as addStartApiSpecificOptions, Nr as parseConnectionsPath, Nt as addCommonEcsServiceOptions, O as buildAgentCoreServeAuthCheck, Oi as LocalInvokeBuildError, On as renderCodeDockerfile, Or as resolveHostGatewayExtraHosts, P as addStartCloudFrontSpecificOptions, Pi as isProxyEnvConfigured, Pr as buildConnectEvent, Pt as addEcsAssumeRoleOptions, Q as applyEdgeRequestResult, Qn as buildCognitoJwksUrl, Qt as listPinnedTargets, R as parseOriginOverrides, Rn as createFileWatcher, Rr as buildContainerImage, Rt as parseMaxTasks, S as StudioEventBus, Si as pickAgentCoreCandidateStack, Sn as waitForAgentCoreHttpReady, Sr as selectIntegrationResponse, Ti as formatStateRemedy, Tn as SUPPORTED_CODE_RUNTIMES, Tr as HOST_DOCKER_INTERNAL_GATEWAY, Tt as isApplicationLoadBalancer, U as resolveDeployedKvsArnByName, Un as availableApiIdentifiers, Ut as ImageOverrideError, V as resolveKvsModulesForDistribution, Vn as materializeLayerFromArn, Vr as resolveRuntimeImage, Vt as resolveSharedSidecarCredentials, W as resolveDeployedOriginBucket, Wn as filterRoutesByApiIdentifier, Wt as buildImageOverrideTag, X as serveFromStaticOrigin, Xn as resolveServiceIntegrationParameters, Xt as describePinnedImageUri, Y as resolveErrorResponseCandidates, Yn as resolveSelectionExpression, Yt as runImageOverrideBuilds, Z as serveLambdaUrlOrigin, Zn as defaultCredentialsLoader, Zt as isLocalCdkAssetImage, _ as filterStudioTargetGroups, _i as AGENTCORE_AGUI_PROTOCOL, _n as parseSseForJsonRpc, _r as applyAuthorizerOverlay, _t as createCloudFrontModule, an as attachContainerLogStreamer, ar as computeRequestIdentityHash, at as describeS3OriginDomain, b as renderStudioHtml, bi as AGENTCORE_RUNTIME_TYPE, bn as AGENTCORE_SESSION_ID_HEADER, br as evaluateResponseParameters, bt as addAlbSpecificOptions, c as startStudioProxy, ci as discoverWebSocketApis, cn as bridgeAgentCoreWs, cr as invokeTokenAuthorizer, ct as pickFunctionUrlLogicalIdFromOrigin, d as createStudioDispatcher, di as parseSelectionExpressionPath, dn as A2A_PATH, dr as buildCorsConfigByApiId, dt as pickTargetFunctionLogicalId, en as CloudMapRegistry, er as createJwksCache, et as buildEdgeRequestEvent, f as filterStudioCustomResources, fi as webSocketApiMatchesIdentifier, fn as a2aInvokeOnce, fr as buildCorsConfigFromCloudFrontChain, ft as resolveCloudFrontDistribution, g as annotatePinnedEcsTargets, gi as AGENTCORE_A2A_PROTOCOL, gn as mcpInvokeOnce, gr as translateLambdaResponse, gt as stripCloudFrontImport, h as annotateEcsTaskPinnedTargets, hi as resolveLambdaArnIntrinsic, hn as MCP_PROTOCOL_VERSION, hr as matchRoute, ht as runViewerResponse, i as coerceStopRequest, ii as resolveSingleTarget, in as getContainerNetworkIp, ir as buildMethodArn, it as CLOUDFRONT_DISTRIBUTION_TYPE, j as attachAgentCoreWsBridge, ji as buildStsClientConfig, jn as addInvokeSpecificOptions, jr as buildMgmtEndpointEnvUrl, k as selectServeInboundAuth, ki as describeAwsFailureForWarn, kn as toCmdArgv, kr as bufferToBody, kt as serviceStrategy, l as relayServeRequest, li as discoverWebSocketApisOrThrow, ln as invokeAgentCoreWs, lr as attachAuthorizers, lt as pickKvsLogicalIdFromArn, m as annotateAlbPinnedBackingServices, mi as pickRefLogicalId, mn as MCP_PATH, mr as matchPreflight, mt as runViewerRequest, n as coerceRunRequest, nn as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, nr as verifyJwtAuthorizer, nt as edgeHeadersToHttp, o as resolveServeBaseUrl, on as addInvokeAgentCoreSpecificOptions, or as evaluateCachedLambdaPolicy, ot as extractKvsAssociations, p as isCustomResourceLambdaTarget, pi as discoverRoutes, pn as MCP_CONTAINER_PORT, pr as isFunctionUrlOacFronted, pt as compileCloudFrontFunction, q as matchBehavior, qn as readMtlsMaterialsFromDisk, qt as parseImageOverrideFlags, r as coerceServeRequest, ri as resolveWatchConfig, rn as setShadowReadyTimeoutMs, rr as verifyJwtViaDiscovery, rt as httpHeadersToEdge, s as createStudioServeManager, si as availableWebSocketApiIdentifiers, sr as invokeRequestAuthorizer, st as isCloudFrontDistribution, t as addStudioSpecificOptions, tn as DEFAULT_SHADOW_READY_TIMEOUT_MS, tr as verifyCognitoJwt, tt as buildEdgeResponseEvent, u as reinvoke, ui as filterWebSocketApisByIdentifiers, un as A2A_CONTAINER_PORT, ur as applyCorsResponseHeaders, ut as pickLambdaEdgeFunctionLogicalId, v as startStudioServer, vi as AGENTCORE_HTTP_PROTOCOL, vn as AGENTCORE_SIGV4_SERVICE, vr as buildHttpApiV2Event, vt as createLocalFileKvsDataSource, wi as derivePseudoParametersFromRegion, wn as downloadAndExtractS3Bundle, wr as VtlEvaluationError, wt as resolveAlbTarget, x as createStudioStore, xi as AgentCoreResolutionError, xn as invokeAgentCore, xr as pickResponseTemplate, xt as albStrategy, y as toStudioTargetGroups, yi as AGENTCORE_MCP_PROTOCOL, yn as signAgentCoreInvocation, yr as buildRestV1Event, yt as createUnboundCloudFrontModule, z as resolveCloudFrontTarget, zn as attachStageContext, zr as resolveRuntimeCodeMountPath, zt as parseRestartPolicy } from "./local-studio-BbLfdSy4.js";
 
 export { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_HTTP_PROTOCOL, AGENTCORE_MCP_PROTOCOL, AGENTCORE_RUNTIME_TYPE, AGENTCORE_SESSION_ID_HEADER, AGENTCORE_SIGV4_SERVICE, AgentCoreResolutionError, CLOUDFRONT_DISTRIBUTION_TYPE, CloudMapRegistry, ConnectionRegistry, DEFAULT_SHADOW_READY_TIMEOUT_MS, EcsTaskResolutionError, HOST_DOCKER_INTERNAL_GATEWAY, HOST_GATEWAY_MIN_VERSION, ImageOverrideError, LocalInvokeBuildError, LocalStartCloudFrontError, MAX_TASKS_SUBNET_RANGE_CAP, MCP_CONTAINER_PORT, MCP_PATH, MCP_PROTOCOL_VERSION, SOFT_RELOAD_COMPLETION_LOG_SUFFIX, SUPPORTED_CODE_RUNTIMES, StudioEventBus, VtlEvaluationError, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addEcsAssumeRoleOptions, addImageOverrideOptions, addInvokeAgentCoreSpecificOptions, addInvokeSpecificOptions, addListSpecificOptions, addRunTaskSpecificOptions, addStartAgentCoreSpecificOptions, addStartApiSpecificOptions, addStartCloudFrontSpecificOptions, addStartServiceSpecificOptions, addStudioSpecificOptions, albStrategy, annotateAlbPinnedBackingServices, annotateEcsTaskPinnedTargets, annotatePinnedEcsTargets, applyAuthorizerOverlay, applyCorsResponseHeaders, applyEdgeRequestResult, applyEdgeResponseResult, architectureToPlatform, attachAgentCoreWsBridge, attachAuthorizers, attachContainerLogStreamer, attachStageContext, availableApiIdentifiers, availableWebSocketApiIdentifiers, bridgeAgentCoreWs, bufferToBody, buildAgentCoreCodeImage, buildAgentCoreServeAuthCheck, buildCloudMapIndex, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildEcsImageResolutionContext, buildEdgeRequestEvent, buildEdgeResponseEvent, buildHttpApiV2Event, buildImageOverrideTag, buildJwksUrlFromIssuer, buildMessageEvent, buildMethodArn, buildMgmtEndpointEnvUrl, buildProxyClientConfig, buildRestV1Event, buildStageMap, buildStsClientConfig, classifyS3Error, classifySourceChange, coerceRunRequest, coerceServeRequest, coerceStopRequest, compileCloudFrontFunction, computeCodeImageTag, computeRequestIdentityHash, createAuthorizerCache, createCloudFrontModule, createDeployedKvsDataSource, createFileWatcher, createJwksCache, createLocalFileKvsDataSource, createS3OriginReader, createStudioDispatcher, createStudioServeManager, createStudioStore, createUnboundCloudFrontModule, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describeAwsFailureForWarn, describeCredentialLoadFailure, describePinnedImageUri, describeS3OriginDomain, discoverRoutes, discoverWebSocketApis, discoverWebSocketApisOrThrow, downloadAndExtractS3Bundle, ecsClusterOption, edgeHeadersToHttp, enforceImageOverrideOrphans, evaluateCachedLambdaPolicy, evaluateResponseParameters, extractKvsAssociations, filterRoutesByApiIdentifier, filterRoutesByApiIdentifiers, filterStudioCustomResources, filterStudioTargetGroups, filterWebSocketApisByIdentifiers, formatStateRemedy, getContainerNetworkIp, groupRoutesByServer, handleConnectionsRequest, httpHeadersToEdge, idFromArn, invokeAgentCore, invokeAgentCoreWs, invokeRequestAuthorizer, invokeTokenAuthorizer, isApplicationLoadBalancer, isCloudFrontDistribution, isCustomResourceLambdaTarget, isFunctionUrlOacFronted, isLocalCdkAssetImage, isProxyEnvConfigured, listPinnedTargets, matchBehavior, matchPreflight, matchRoute, materializeLayerFromArn, mcpInvokeOnce, mergeForService, normalizeKvsFileKeys, parseConnectionsPath, parseImageOverrideFlags, parseKvsFileOverrides, parseLbPortOverrides, parseMaxTasks, parseOriginOverrides, parseRestartPolicy, parseSelectionExpressionPath, parseSseForJsonRpc, pickAgentCoreCandidateStack, pickFunctionUrlLogicalIdFromOrigin, pickKvsLogicalIdFromArn, pickLambdaEdgeFunctionLogicalId, pickRefLogicalId, pickResponseTemplate, pickTargetFunctionLogicalId, probeHostGatewaySupport, readMtlsMaterialsFromDisk, reinvoke, relayServeRequest, renderCodeDockerfile, renderStudioHtml, resolveAgentCoreTarget, resolveAlbFrontDoor, resolveAlbTarget, resolveApiTargetSubset, resolveCloudFrontDistribution, resolveCloudFrontTarget, resolveDeployedKvsArnByName, resolveDeployedOriginBucket, resolveEcsAssumeRoleOption, resolveEnvVars, resolveErrorResponseCandidates, resolveHostGatewayExtraHosts, resolveImageOverrides, resolveKvsModulesForDistribution, resolveLambdaArnIntrinsic, resolveProfileCredentials, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSelectionExpression, resolveServeBaseUrl, resolveServiceIntegrationParameters, resolveSharedSidecarCredentials, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, runImageOverrideBuilds, runViewerRequest, runViewerResponse, selectIntegrationResponse, selectServeInboundAuth, serveFromStaticOrigin, serveLambdaUrlOrigin, serviceStrategy, setShadowReadyTimeoutMs, signAgentCoreInvocation, startAgentCoreHttpServer, startAgentCoreWsBridge, startApiServer, startCloudFrontServer, startStudioProxy, startStudioServer, stripCloudFrontImport, substituteImagePlaceholders, toCmdArgv, toStudioTargetGroups, translateLambdaResponse, tryParseStatus, tryResolveImageFnJoin, verifyCognitoJwt, verifyJwtAuthorizer, verifyJwtViaDiscovery, waitForAgentCoreHttpReady, waitForAgentCorePing, webSocketApiMatchesIdentifier };