cdk-local 0.149.4 → 0.149.6

package/dist/{local-studio-Cdq8klwg.js → local-studio-CLk7iSNq.js}

@@ -1,4 +1,4 @@
-import { a as runDockerForeground, c as warnFinchArgvExposure, d as getEmbedConfig, i as getDockerCmd, l as getLogger, n as finchSecretArgvRefusal, o as runDockerStreaming, p as setEmbedConfig, r as formatDockerLoginError, s as spawnStreaming, u as resolveConfiguredLogLevel } from "./docker-cmd-SocNyC9q.js";
+import { C as resolveConfiguredLogLevel, E as setEmbedConfig, S as getLogger, _ as describeCredentialLoadFailure, a as runDockerForeground, b as sanitizeServiceExceptionMessage, c as warnFinchArgvExposure, d as displayUntrustedValue, f as namesTheSameDirectory, g as describeAwsFailureForWarn, h as clampErrorName, i as getDockerCmd, l as absoluteAssemblyPathEscape, m as resolveAssemblyPath, n as finchSecretArgvRefusal, o as runDockerStreaming, p as renderAssemblyPathEscape, r as formatDockerLoginError, s as spawnStreaming, u as assemblyPathEscape, v as flattenToOneLine, w as getEmbedConfig, x as stringifyThrown, y as isAwsServiceException } from "./docker-cmd-B5yU__zC.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path$1 from "node:path";
@@ -799,480 +799,6 @@ function buildStsClientConfig(args) {
 	};
 }
 
-//#endregion
-//#region src/local/credential-error.ts
-/**
-* Rendering an AWS SDK failure into a log line cdk-local is willing to print
-* at DEFAULT level (issues #564, #570).
-*
-* # Why a shared module
-*
-* Issue #564 settled the policy for one site — the credential-chain failure
-* in {@link file://./sigv4-verify.ts} — and #570 found the same shape at nine
-* more, spread across five `src/cli/commands/*.ts` files. Every one of them
-* relays a third-party error's `message` into a `logger.warn`, so they share
-* one question and must not grow nine answers to it.
-*
-* SCOPE, stated so a later sweep finds a decision rather than an oversight:
-* this module governs those nine plus sigv4-verify's one, and its
-* {@link flattenToOneLine} additionally covers every other wire-derived value
-* printed on those lines (the role ARN, on the failure AND success paths).
-*
-* Issue #579 extended it to the AWS SDK error relays elsewhere under
-* `src/local/**` (plus `local-studio.ts`'s image-context warn), so the policy
-* is no longer scoped to `src/cli/commands/**`:
-* `cfn-local-state-provider.ts` (`formatAwsErrorForWarn`, six callers),
-* `ssm-parameter-resolver.ts` (whose `formatSsmError` was DELETED rather than
-* fixed — it was a second spelling of the same forging vector),
-* `state-resolver.ts`, `cloudfront-kvs-client.ts`, `cloudfront-s3-origin.ts`,
-* `layer-arn-materializer.ts`, `ecr-puller.ts`, `ecs-secrets-resolver.ts` and
-* `httpv2-service-integration.ts`. Each was decided on the SAME two axes below
-* rather than rewritten mechanically, and a `catch` around a purely LOCAL
-* operation was left alone: `agentcore-s3-bundle.ts`'s unzip and
-* `layer-arn-materializer.ts`'s presigned-URL download / unzip see no
-* credential chain and no service response, so there is nothing here for them.
-*
-* The test is what a `catch` CAN SEE, and applying it by LOCATION instead is
-* how the sweep first got `agentcore-s3-bundle.ts` wrong. Its `try` does wrap
-* `unzipSync` and nothing else — but that made the S3 `GetObject` above it
-* UNCOVERED, not out of scope: it had no `catch` at all, so the raw SDK error
-* propagated to `withErrorHandling` -> `formatError`, which prints
-* `${error.name}: ${error.message}` unflattened and unclamped at DEFAULT
-* level, and the default credential chain is what a run without
-* `--assume-role` uses. "Outside that `catch`" is not "outside the sweep";
-* ask which populations reach the site, and if the answer is "nothing catches
-* it here", follow it to the frame that does.
-*
-* #579 also widened what LEVEL means, and the widening is the useful part:
-* `httpv2-service-integration.ts`'s relay is not a log line at all, it is a
-* served HTTP RESPONSE BODY — the widest reader in the sweep, since it needs
-* neither `--verbose` nor access to the terminal, and the studio capture proxy
-* records it onto the timeline besides. The axis is about READERS, not about
-* logs.
-*
-* TWO CALLING CONVENTIONS this imposes, both found by #579 rather than
-* anticipated here:
-*
-*   1. Render each failure ONCE. {@link describeAwsFailureForWarn} EMITS the
-*      `debug` line, so calling it twice for one error prints that line twice
-*      (`cfn-local-state-provider.ts`'s `load` did, having rendered the same
-*      failure for its warn and for `lastLoadError`).
-*   2. Re-raise cdk-local's OWN throws ABOVE the relay, with an identifiable
-*      class. The discriminator is positive, so a `catch` that also catches
-*      the caller's own `throw new Error('...')` withholds text cdk-local
-*      wrote itself — which is the diagnostic loss this file's
-*      {@link describeCredentialLoadFailure} note calls "a real diagnostic
-*      loss, accepted". #579 stopped accepting it where it was cheap not to:
-*      `layer-arn-materializer.ts`'s ARN-shape and missing-`Content.Location`
-*      guards became `LayerMaterializationError`s and are re-raised, and
-*      `httpv2-service-integration.ts`'s missing-RequestParameter 400 became a
-*      `ServiceIntegrationRequestError` so an actionable 400 body did not
-*      degrade into a class name and a character count.
-*
-* TWO CATCH-ALL relays remain outside it, and both are UNCOVERED. An earlier
-* revision of this note gave them opposite verdicts in adjacent paragraphs —
-* clearing one and rejecting the other on the same evidence — which was simply
-* wrong about the first, so both now read the same way:
-*
-*   - `cloudfront-server.ts:129`'s `Request handling failed: ${err.message}`.
-*     It is what makes `cloudfront-kvs-client.ts`'s throw a DEFAULT-level
-*     line, and for THAT sub-path the text arrives pre-sanitized — but it is a
-*     catch-all over the whole request pipeline, so an origin fetch, an
-*     edge-function invoke or an SDK error raised anywhere below it still
-*     reaches the line RAW.
-*   - `ecs-service-emulator.ts`'s `logger.error` at three sites (`:909`,
-*     `:1508`, `:1599`). One of them does carry
-*     `ecs-secrets-resolver.ts`'s `EcsSecretsResolutionError`, which this
-*     module sanitized on the way in — and reasoning from that to "the relay
-*     is safe" is the SAME generalisation the bullet above rejects. All three
-*     are catch-alls over a whole reload or replica roll, relaying
-*     `err instanceof Error ? err.message : String(err)`, and what they
-*     usually carry is docker CLI stderr, which is multi-line.
-*
-* So: one sub-path arriving pre-sanitized never clears a catch-all. Both need
-* the same per-occurrence call as everything else in this list. Neither is
-* done here — `cloudfront-server.ts` is out of this change's scope, and the
-* emulator's three are a different population (docker output, not SDK errors)
-* that wants the flattening half rather than the withholding half.
-*
-* # The two axes that decide it
-*
-* PROVENANCE alone says relay: a credential-chain error is about the
-* developer's own machine configuration, not something cdk-local fetched out
-* of a secret store (issue #555's criterion). Two further axes overrule it:
-*
-*   LEVEL — these are `warn`, so they print on a plain `cdkl start-api` /
-*   `cdkl invoke` run rather than only under `--verbose`, and `cdkl studio`
-*   mirrors a serve child's output into a log ring it serves over HTTP.
-*   Everybody sees a `warn`; only someone who asked sees a `debug`.
-*
-*   RECONSTRUCTION — what can reach the string is not a hint about a secret,
-*   it is the secret. `@aws-sdk/credential-provider-process` builds its
-*   failure as `new CredentialsProviderError(error.message)` where `error` is
-*   the rejection of `promisify(child_process.exec)`, i.e. Node's
-*   `Command failed: <command line>\n<stderr>`, and a passphrase written on a
-*   `credential_process` command line is an ordinary thing to have. (Verified
-*   at `@aws-sdk/credential-provider-process@3.972.{39,41,43}`
-*   `dist-cjs/index.js:56` in this repo's tree.)
-*
-* # Where these sites DIFFER from sigv4-verify's, and why the answer differs
-*
-* {@link file://./sigv4-verify.ts}'s `catch` wraps `client.config.credentials()`
-* and nothing else: credential-chain resolution, with no AWS operation
-* cdk-local asked for. Nothing actionable is lost by withholding all of it,
-* so that site withholds unconditionally and keeps the text at `debug`.
-*
-* The #570 sites wrap an SDK call cdk-local DID make — STS
-* `GetCallerIdentity` or `AssumeRole` — so two unrelated error populations
-* land in one `catch`:
-*
-*   1. the credential chain failed before the request went out, which is
-*      #564's population exactly, and
-*   2. STS answered with a modeled service exception — `ExpiredTokenException`,
-*      `AccessDenied` — whose message IS the diagnosis the user needs, and
-*      which never went near `credential_process`. (Spelled as the SDK
-*      spells them: `@aws-sdk/client-sts` models `ExpiredTokenException`
-*      (`dist-cjs/models/errors.js:6`), while `AccessDenied` is unmodeled and
-*      arrives as the wire code verbatim — which is exactly why the name is
-*      clamped rather than trusted.)
-*
-* Blanket-withholding would turn the single commonest failure of these
-* commands (`ExpiredTokenException: The security token included in the
-* request is expired`) into a class name and a character count. So the split
-* is by population, via {@link describeAwsFailureForWarn}.
-*
-* # The safe state is defined POSITIVELY
-*
-* The discriminator is not a deny-list of bad error shapes — #564 rejected
-* that reasoning for the `Command failed:` first line, and it loses the same
-* race here. It is the SDK's own structural test for "this came off the wire
-* as a modeled service error" ({@link isAwsServiceException}). Anything that
-* does not match — a chain failure, a socket error, a bare `throw 'x'` — is
-* withheld. An unrecognised shape therefore fails toward withholding.
-*
-* A hostile endpoint cannot steer the discriminator into disclosing MORE.
-* `$fault` / `$metadata` are set by the SDK from the HTTP response, not from
-* anything the body names, so forging `x-amzn-errortype:
-* CredentialsProviderError` only changes `err.name` — the response is still a
-* service response, so the error stays on the KEPT branch and its message is
-* still the sanitized, capped one the endpoint could have sent under any
-* other name. What the endpoint cannot do is move a `credential_process`
-* command line onto that branch: that text originates locally, inside a
-* `CredentialsProviderError` that never acquires `$fault`.
-*
-* # What this does NOT close
-*
-* A single-LINE forged string still reaches readers other than a human. It no
-* longer redirects the studio capture proxy: issue #578 anchored every
-* `cdkl studio` ready pattern to the start of the line, made the serve manager
-* skip a line carrying cdk-local's own `WARN: ` / `ERROR: ` decoration
-* outright, and bounded the resolved upstream to loopback — so a message
-* containing `Server listening on http://...` is neither read as a banner nor
-* usable as a destination. What remains is the reader this sanitizer was
-* always aimed at: a HUMAN scanning the log, for whom a forged-looking line is
-* still misleading text, which is why the flattening + capping stay.
-*/
-/**
-* Longest service-exception message relayed into a `warn` line, in
-* characters.
-*
-* A modeled STS error's message is WIRE-DERIVED — the SDK reads it out of the
-* response body — so its length is not cdk-local's to assume. Real ones run
-* to roughly 150 characters (`AccessDenied: User: arn:... is not authorized to
-* perform: sts:AssumeRole on resource: arn:...`), and the policy-quoting ones
-* are the longest, so the cap is set well above that: it exists to stop an
-* unbounded body from becoming an unbounded log line, not to trim ordinary
-* AWS text, which must survive intact or the branch buys nothing.
-*
-* Truncation is announced with the true length (see
-* {@link sanitizeServiceExceptionMessage}) so a capped line is never mistaken
-* for a complete one.
-*/
-const SERVICE_MESSAGE_MAX = 512;
-/**
-* Total stringification of a thrown value's message.
-*
-* `String(err)` is NOT total. That throw would escape the `catch` it is
-* called from and turn a warn-and-continue branch into a hard failure — a 500
-* from the SigV4 authorizer in #564's testing, and a dead `cdkl invoke` here.
-* One helper rather than an expression repeated per site, so the length
-* reported in a `warn` and the text printed at `debug` can never describe
-* different strings.
-*
-* CORRECTION to #564, measured on this repo's Node 24: `String(aSymbol)`
-* does NOT throw — it returns `'Symbol(x)'`, and it is template
-* INTERPOLATION (`` `${aSymbol}` ``) that raises
-* `TypeError: Cannot convert a Symbol value to a string`. Since both the old
-* code and this helper call `String()` explicitly, a `Symbol` throw was never
-* one of the reachable cases. The two that ARE reachable, both verified:
-* an object with a null prototype (`TypeError: Cannot convert object to
-* primitive value`, because it has no `toString`), and any value whose
-* `toString` / `Symbol.toPrimitive` throws — which a hostile or merely buggy
-* third-party error object is free to do.
-*
-* Named for what it does rather than for one caller: #564 shipped it as
-* `stringifyCredentialLoadFailure`, and #570 gave it a second population
-* (service exceptions) for which that name was simply wrong.
-*/
-function stringifyThrown(err) {
-	try {
-		return err instanceof Error ? String(err.message) : String(err);
-	} catch {
-		return "[unstringifiable throw]";
-	}
-}
-/**
-* The throwing class's name, clamped to something no input can forge.
-*
-* `err.name` is NOT input-independent, which is the whole reason this is a
-* function and not an interpolation. For an AWS service exception it is
-* WIRE-DERIVED: `@aws-sdk/core` builds it from the `x-amzn-errortype` header
-* / the body's `code` / `__type` through `sanitizeErrorCode`, which splits on
-* ',' ':' and '#' and does nothing else — no length cap, no newline stripping
-* (read at `@aws-sdk/core@3.974.13` `protocols/index.js:324`). Such an
-* exception reaches these call sites, because `credential-provider-ini` calls
-* the STS `roleAssumer` unwrapped and because the #570 sites invoke STS
-* directly. So a hostile or hijacked credential endpoint
-* (`AWS_CONTAINER_CREDENTIALS_FULL_URI`, a redirected IMDS) answering
-* `x-amzn-errortype: Foo\nWARN: signature verified` could FORGE log lines
-* into the `warn` stream — and into the studio ring served over HTTP.
-*
-* A bare identifier of at most 64 characters is what every real class name is
-* and what no injected value can be; anything else degrades to `'unknown'`,
-* which also covers a non-`Error` throw, so the field never names a class the
-* throw was not.
-*
-* Note the WRONG fix: `err.name.slice(0, 64)` keeps the newline, so the
-* forgery survives truncation.
-*/
-function clampErrorName(err) {
-	let rawKind;
-	try {
-		rawKind = err instanceof Error ? err.name : "unknown";
-	} catch {
-		return "unknown";
-	}
-	return typeof rawKind === "string" && /^[A-Za-z0-9_.-]{1,64}$/.test(rawKind) ? rawKind : "unknown";
-}
-/**
-* The thrown value's `code`, when it is a bare identifier, else `undefined`.
-*
-* This exists because withholding by class name alone is not discriminating
-* enough for the population that actually reaches the withheld branch most
-* often. `Region is missing`, `getaddrinfo ENOTFOUND sts.<region>.amazonaws.com`
-* and `connect ETIMEDOUT 169.254.169.254:80` all arrive as a plain `Error`, so
-* all three render as `Error; N-character message withheld` and the reader
-* cannot tell a misconfiguration from an unreachable endpoint.
-*
-* Node sets `code` on its system errors (`ENOTFOUND`, `ETIMEDOUT`,
-* `ECONNREFUSED`) and there it is a fixed enum chosen by the runtime. It is
-* NOT input-independent in general, though, and the earlier draft of this note
-* claimed it was: `@smithy/core`'s `decorateServiceException`
-* (`dist-cjs/submodules/client/index.js:795-802`) copies every key of the
-* PARSED RESPONSE BODY onto the exception, so an unmodeled error from a
-* hostile endpoint can carry a `code` of its choosing. The clamp is therefore
-* load-bearing rather than belt-and-braces, exactly as it is for
-* {@link clampErrorName}: what survives is at most 64 characters matching
-* `[A-Za-z0-9_.-]`, which cannot forge a line, and which is the same residue
-* the class name already accepts.
-*
-* `undefined` rather than `'unknown'` when there is none, so the caller can
-* omit the field entirely instead of printing a placeholder that says less
-* than nothing.
-*/
-function clampErrorCode(err) {
-	if (!err || typeof err !== "object") return void 0;
-	let raw;
-	try {
-		raw = err.code;
-	} catch {
-		return;
-	}
-	if (typeof raw !== "string") return void 0;
-	return /^[A-Za-z0-9_.-]{1,64}$/.test(raw) ? raw : void 0;
-}
-/**
-* Is `err` a modeled AWS service exception — i.e. did the SDK parse it out of
-* a service RESPONSE, rather than raise it while assembling the request?
-*
-* This is `ServiceException.isInstance`'s own structural test, reproduced
-* rather than imported: cdk-local loads `@aws-sdk/client-sts` lazily at every
-* one of these call sites (a dynamic `import()` inside the `try`), so taking
-* a static dependency on `@smithy/core` purely to type-test an error would
-* pull the SDK into the CLI's startup path. The structural form also keeps
-* working across the several `@smithy/core` copies pnpm resolves in this
-* tree, where an `instanceof` against one copy's class fails for an error
-* minted by another.
-*
-* The test is deliberately the SDK's and not a name list: a name list would
-* have to be extended for every new STS error code, and a missing entry would
-* fail toward DISCLOSING less, which is safe, but also toward hiding the
-* actionable message, which is the regression this split exists to avoid.
-*/
-function isAwsServiceException(err) {
-	if (!err || typeof err !== "object") return false;
-	const candidate = err;
-	try {
-		return Boolean(candidate.$metadata) && (candidate.$fault === "client" || candidate.$fault === "server");
-	} catch {
-		return false;
-	}
-}
-/**
-* Replace every character that could make one emitted line render as more than
-* one line, or render in an order it was not written in, with a space.
-*
-* Four Unicode categories, each measured rather than assumed (see the fixture
-* in `tests/unit/local/credential-error.test.ts`):
-*
-*   - `Cc` — the C0/C1 controls, which is `\n` / `\r` (a forged extra line in
-*     the studio ring) and `\x1b` (an ANSI escape in a terminal). U+0085 NEL
-*     lives here too.
-*   - `Cf` — the format characters, which is U+202E RIGHT-TO-LEFT OVERRIDE and
-*     friends: they forge how the REST of the line reads. The cost is that a
-*     ZWJ inside an emoji or an Indic cluster is replaced too; an AWS error
-*     message is ASCII, so that is a trade with no observed downside.
-*   - `Zl` / `Zp` — U+2028 and U+2029. Neither is in `Cc` or `Cf`, and both are
-*     forced line breaks in the studio UI's `<pre>`, so leaving them out would
-*     have left the forged-line case open in HTML while closing it in a
-*     terminal.
-*   - `Cs` — a LONE surrogate, which is not a character at all and breaks JSON
-*     encoding of the log event. With the `u` flag a well-formed pair is one
-*     code point and does NOT match, so emoji survive.
-*
-* Used by both branches of {@link describeAwsFailureForWarn} — the kept
-* message, and the `debug` line carrying the withheld one, because the `debug`
-* stream is the SAME studio ring under `--verbose`, so a text unsafe to put on
-* a line at `warn` is unsafe at `debug` — and, since issue #570's review
-* rounds, by every OTHER wire-derived value that lands on one of these lines:
-* `sigv4-verify`'s own `debug` line, and the role ARN at the four warn sites
-* plus the five `info` / `debug` sites that print an ARN resolved from a live
-* `GetFunctionConfiguration` / `GetAgentRuntime` response. The last group is
-* the more reachable one — it fires on SUCCESS.
-*/
-function flattenToOneLine(message) {
-	return message.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Cs}]/gu, " ");
-}
-/**
-* Render a wire-derived service message safe to put on one log line.
-*
-* Two properties, and both are about the LINE rather than about secrecy — the
-* message itself is already judged safe to print by the time this is called:
-*
-*   - No line breaks and no rendering-direction control, via
-*     {@link flattenToOneLine}.
-*   - Bounded length, with the true length named when it is exceeded. The
-*     suffix names the character count of the SANITIZED message rather than
-*     of the raw one, because the sanitized string is what the truncated
-*     prefix is a prefix OF; quoting the raw length would describe a string
-*     the reader can never see.
-*
-* The cut is made on CODE POINTS rather than UTF-16 units, so a truncation
-* landing inside an astral character cannot emit half of a surrogate pair. The
-* count in the suffix is the code-point count for the same reason: the prefix
-* and the number must describe the same string.
-*/
-function sanitizeServiceExceptionMessage(message) {
-	const points = [...flattenToOneLine(message)];
-	if (points.length <= SERVICE_MESSAGE_MAX) return points.join("");
-	return `${points.slice(0, SERVICE_MESSAGE_MAX).join("")}[... truncated; ${points.length}-character message]`;
-}
-/**
-* Describe a credential-chain failure for a default-level log line WITHOUT
-* relaying the chain's own message (issue #564).
-*
-* What is reported instead is input-INDEPENDENT: the clamped class name (see
-* {@link clampErrorName}), which is the same discriminator
-* `ecs-secrets-resolver.ts` reports for the JSON parse failure it must not
-* echo, plus the clamped {@link clampErrorCode} when the throw carries one.
-*
-* Withholding is NOT free, and the cost lands on cdk-local's own text as well
-* as on the SDK's. The worked example used to be `role-arn.ts`'s
-* `AssumeRole(<arn>) returned no usable credentials.`: a plain `Error` with no
-* `$fault`, so it was withheld like any other, and the note recorded that as a
-* real diagnostic loss accepted because the alternative — an allow-list of
-* messages that may print — is the deny-list this design rejects, wearing the
-* other sign. It also named the right fix: make cdk-local's own throws
-* IDENTIFIABLE rather than guess at their text.
-*
-* Issue #579 did that, for exactly this example. `role-arn.ts` now throws
-* `AssumeRoleFailure`, carrying a `detail` its relaying callers print verbatim
-* — and the same pattern closed the identical loss in
-* `layer-arn-materializer.ts`, `httpv2-service-integration.ts`,
-* `ecr-puller.ts`, `local-run-task.ts` and `ecs-service-emulator.ts`. The
-* general point stands and is what a new site should apply: the policy cannot
-* tell cdk-local's own sentence from a hostile endpoint's, so a `catch` that
-* can see both must make its own throws recognisable BEFORE the relay.
-*
-* The remaining ARN-length question — an ARN is structured, so the bound
-* belongs at the three resolution points rather than at the log line — is
-* tracked separately at
-* https://github.com/go-to-k/cdk-local/issues/607.
-*
-* The LENGTH is reported, unlike in `ecs-secrets-resolver.ts`, and the
-* difference is deliberate: there the user already knows which secret it is
-* and can read the value at its source, so a character count would be
-* disclosure buying nothing. Here the user cannot see the withheld message at
-* all, and the count is what separates a one-line
-* `Could not load credentials from any providers` (45 characters, measured
-* against `@aws-sdk/credential-provider-node@3.972.44` `dist-cjs/index.js:144`)
-* from a multi-hundred-character `Command failed:` dump — which is what tells
-* them whether their `credential_process` even ran.
-*
-* The count is a side channel, and a narrow one: against a KNOWN
-* `credential_process` template the number is `constant + len(passphrase)`, so
-* it yields the passphrase's LENGTH. That is accepted rather than overlooked.
-* It buys the one thing the user cannot otherwise see, the `Command failed:`
-* dump is not reachable on today's SDK versions anyway, and bucketing the
-* number would blur exactly the boilerplate-vs-dump distinction the field
-* exists for.
-*/
-function describeCredentialLoadFailure(err) {
-	const code = clampErrorCode(err);
-	return `${code === void 0 ? clampErrorName(err) : `${clampErrorName(err)} ${code}`}; ${stringifyThrown(err).length}-character message withheld, logged at debug level under --verbose`;
-}
-/**
-* Render an AWS SDK call failure for a `logger.warn` line, and emit the
-* withheld text at `debug` when it is withheld (issue #570).
-*
-* `operation` names the call for the `debug` line — e.g.
-* `'STS GetCallerIdentity'`. It is cdk-local's own literal at every call
-* site, never anything read off an error or a response.
-*
-* # Why this emits the `debug` line itself
-*
-* Because the alternative is nine call sites each free to withhold a message
-* and forget to print it anywhere. The pairing is the invariant — "withheld
-* at `warn`" is only acceptable while "in full at `debug`" holds — so it
-* lives in one function rather than in a convention nine sites must keep. A
-* tenth site gets it for free.
-*
-* The `debug` line fires ONLY on the withheld branch. On the service-exception
-* branch the `warn` already carries the message, and repeating it verbatim one
-* level down would say nothing the reader did not just read.
-*
-* It is FLATTENED (not capped). Flattened because the `debug` stream is not a
-* private channel: it is the same stdout `cdkl studio` mirrors into the log
-* ring it serves over HTTP, so a `\n` in the withheld text would forge a line
-* there exactly as it would at `warn`. Not capped, because being able to read
-* the whole withheld message is the entire reason the line exists — the
-* `warn`'s character count is what tells the reader how much they are about to
-* see. Note that this puts the full text into that ring for a
-* `--verbose` studio run; see `docs/troubleshooting.md`.
-*
-* ORDERING: the `debug` line is emitted when THIS function runs, which is
-* before the `warn` at every site — inline in the `warn`'s template at eight of
-* them, and a couple of statements earlier at the one that hoists the result
-* into a `const reason`. Either way it prints immediately ABOVE the `warn` that
-* refers to it under `--verbose`. Left as is: restructuring every call site to
-* log afterwards would buy an ordering nobody reads top-down anyway.
-*/
-function describeAwsFailureForWarn(err, operation) {
-	if (isAwsServiceException(err)) return `${clampErrorName(err)}: ${sanitizeServiceExceptionMessage(stringifyThrown(err))}`;
-	getLogger().debug(`${operation}: the AWS SDK's own failure message was: ${flattenToOneLine(stringifyThrown(err))}`);
-	return describeCredentialLoadFailure(err);
-}
-
 //#endregion
 //#region src/utils/role-arn.ts
 /**
@@ -1699,393 +1225,6 @@ function effectiveAssumeRoleArn(logicalId, opt) {
 	return opt.perLambda?.[logicalId] ?? opt.globalArn;
 }
 
-//#endregion
-//#region src/utils/assembly-path.ts
-/**
-* `true` when `candidate` names something strictly beneath `base`, both given
-* as already-resolved absolute paths.
-*
-* The `..` test is SEPARATOR-AWARE rather than a bare `startsWith('..')`,
-* which would also reject a legitimate sibling named `..foo`. The empty-string
-* case is `base` itself; callers decide whether that counts as an escape,
-* because an asset path legitimately names a DIRECTORY while a template path
-* does not.
-*/
-function isInside(base, candidate) {
-	const rel = relative(base, candidate);
-	if (rel === "" || rel === "..") return false;
-	if (rel.startsWith(`..${sep}`)) return false;
-	return !isAbsolute(rel);
-}
-/**
-* `realpath(3)`, or `undefined` for a path that does not fully resolve.
-*
-* `.native` is load-bearing and must not be simplified to `fs.realpathSync`.
-* The plain form is a JavaScript walker that folds `..` LEXICALLY, so it
-* disagrees with the kernel on a target carrying a `..` after a symlinked
-* component — answering `ENOENT` for a path the kernel resolves, and on a
-* case-insensitive filesystem (APFS by default) it can spin on the same shape.
-* `.native` is libuv's `realpath(3)` and throws the same
-* `ENOENT` / `ELOOP` / `EACCES`.
-*/
-function tryRealpath(p) {
-	try {
-		return realpathSync.native(p);
-	} catch {
-		return;
-	}
-}
-/** `fs.readlinkSync`, or `undefined` when `p` is not a symbolic link. */
-function tryReadlink(p) {
-	try {
-		return readlinkSync(p);
-	} catch {
-		return;
-	}
-}
-/**
-* Link follows before the walk gives up and reports the path as unresolvable.
-* It does NOT refuse: an exhausted budget answers `undefined`, which leaves
-* the symlink arm silent and the lexical verdict standing. Safe because the OS
-* gives up first (macOS caps at 32, `ELOOP`), so a chain that reaches this cap
-* is one nothing can open anyway.
-*/
-const MAX_LINK_HOPS = 40;
-/**
-* Unresolvable path COMPONENTS the climb walks before giving up. Bounds the
-* recursion below, which is one frame per component, so a pathological value
-* cannot raise a `RangeError` from inside {@link tryRealpath}'s own `try` (its
-* `catch` would swallow the crash into a silent `undefined`).
-*
-* KNOW THAT EXHAUSTING THIS FAILS OPEN, and why that is accepted rather than
-* unnoticed. Unlike {@link MAX_LINK_HOPS}, which has the OS's own `ELOOP` cap
-* behind it, nothing else stops a path of 1 001 absent components: the climb
-* gives up, the symlink arm goes silent, and a value that would land outside
-* reads as CONTAINED on the lexical verdict alone. It is not reachable in
-* effect — such a path cannot exist, so `cdkl invoke`'s `existsSync` refuses it
-* and `start-api`'s `docker run` fails to mount it — but that safety lives in
-* the CONSUMERS, not here. A consumer that neither checks existence nor mounts
-* would need its own answer.
-*/
-const MAX_PATH_COMPONENTS = 1e3;
-/**
-* Where `target` REALLY points, for a path that may not exist yet.
-*
-* `realpathSync` answers only for a path that fully resolves, and it throws
-* `ENOENT` for a DANGLING symbolic link exactly as it does for an absent file.
-* `cdkl start-api` resolves an asset path without an existence check, so an
-* absent or dangling component must not silence the symlink arm.
-*
-* Each unresolvable component is therefore handled by hand: climb to the
-* deepest ancestor that DOES resolve, then re-apply the remaining components,
-* following any symbolic link with `readlink` and re-resolving its target.
-* `undefined` means the walk could not resolve the path at all.
-*
-* For a path that FULLY RESOLVES the answer is the kernel's and is exact. For
-* one that does not exist yet this is a best-effort MODEL of kernel
-* resolution; the known edge is a `..` INSIDE an unresolvable link's target,
-* folded lexically here while the kernel folds it only after following each
-* preceding component. That edge is benign for THESE callers rather than in
-* general: it needs the target to be absent, and both consumers resolve the
-* path and then open or mount it, so the divergence is between this model and
-* a path nothing can reach. A caller that CREATED a file through such a path
-* would need an `lstat` of its own.
-*
-* `EACCES` is folded into "does not resolve" along with `ENOENT`, so a link
-* under a directory this process cannot traverse reads as contained. Same
-* bound: the consumer's own `existsSync` / mount runs as the same user and
-* fails identically.
-*/
-function resolveThroughLinks(target, hops = 0, climbs = 0) {
-	const direct = tryRealpath(target);
-	if (direct !== void 0) return direct;
-	if (hops >= MAX_LINK_HOPS) return void 0;
-	if (climbs >= MAX_PATH_COMPONENTS) return void 0;
-	const parent = dirname(target);
-	if (parent === target) return void 0;
-	const realParent = resolveThroughLinks(parent, hops, climbs + 1);
-	if (realParent === void 0) return void 0;
-	const link = tryReadlink(target);
-	if (link === void 0) return join(realParent, basename(target));
-	return resolveThroughLinks(resolve(realParent, link), hops + 1, climbs);
-}
-/**
-* Resolve an assembly-supplied `candidate` against `dir` and report whether
-* the result stays inside it.
-*
-* The lexical arm joins exactly the way the call sites used to (`path.join`,
-* NOT `path.resolve`), so the verdict is about the path the caller will
-* actually use. `join`'s handling of an absolute candidate makes this arm
-* strictly more permissive than a `resolve`-based one would be; an absolute
-* value is therefore answered by {@link absoluteAssemblyPathEscape} instead,
-* because this function structurally cannot.
-*
-* The SYMLINK arm exists because the lexical arm alone leaves an equivalent
-* hole: `cdk.out/link -> /etc` plus a candidate of `link/passwd` is lexically
-* contained and still reaches `/etc/passwd`. Both sides go through
-* {@link resolveThroughLinks}, so an assembly directory REACHED through a link
-* (macOS spells `/tmp` as `/private/tmp`) is unaffected.
-*
-* The verdict is about the assembly AS IT SITS ON DISK. It is NOT a defence
-* against a process rewriting that directory concurrently — the caller uses
-* the path after this returns.
-*/
-function resolveAssemblyPath(dir, candidate, options) {
-	const base = resolve(dir);
-	const bound = options?.containWithin === void 0 ? base : resolve(options.containWithin);
-	const joined = resolve(join(base, candidate));
-	if (!isInside(bound, joined)) return {
-		contained: false,
-		escape: "lexical",
-		path: joined
-	};
-	const realBound = resolveThroughLinks(bound);
-	if (realBound !== void 0) {
-		const realTarget = resolveThroughLinks(joined);
-		if (realTarget !== void 0 && !isInside(realBound, realTarget)) return {
-			contained: false,
-			escape: "symlink",
-			path: joined,
-			realPath: realTarget
-		};
-	}
-	return {
-		contained: true,
-		path: joined
-	};
-}
-/**
-* Whether an ALREADY-ABSOLUTE assembly-supplied path lies outside `bound`.
-*
-* {@link resolveAssemblyPath} cannot answer this, and the reason is structural
-* rather than an oversight: its lexical arm joins with `path.join`, which does
-* NOT honour a leading separator, so an absolute candidate is folded INTO the
-* directory and the verdict would describe a path no caller opens. A site that
-* HONOURS an absolute value needs the verdict about the value itself.
-*
-* The callers are `cdkl invoke`'s and `cdkl start-api`'s
-* `Metadata['aws:asset:path']` resolution. Those honour an absolute path
-* because `cdk synth --no-staging` emits one — CDK writes the asset's absolute
-* SOURCE directory under `aws:cdk:disable-asset-staging`, usually outside the
-* outdir — and they WARN rather than refuse when it leaves the bound, so this
-* returns a verdict rather than throwing. The asset-MANIFEST readers that
-* honour an absolute value take the same verdict: `'honour-warn'` (the
-* start-cloudfront origin) warns when the value is a folder inside the user's
-* project not under a credential or version-control directory, and refuses
-* otherwise, `'honour'` (the soft-reload
-* sources) refuses (#745).
-*
-* It lives HERE so the containment rule has one spelling: it reuses this
-* module's own {@link isInside} and {@link resolveThroughLinks}, symlink arm
-* included, rather than letting a caller re-spell `path.relative` and drift.
-*
-* `bound` itself is NOT an escape, unlike in {@link resolveAssemblyPath},
-* where an empty `path.relative` means "names the directory rather than a file
-* inside it". An asset path legitimately names a DIRECTORY, so a value equal
-* to the bound is inside it and reporting it as outside would be false.
-*
-* THE REAL PATHS DECIDE IN BOTH DIRECTIONS, which is the one place this
-* deliberately does more than {@link resolveAssemblyPath}'s lexical-first
-* ordering. The lexical verdict here is about a SPELLING, and two spellings of
-* the same directory are common rather than exotic: macOS resolves `/tmp` to
-* `/private/tmp` and `/var` to `/private/var`, and a user may symlink `cdk.out`
-* itself. With an outdir of `/tmp/cdk.out` and a `--no-staging` value of
-* `/private/tmp/cdk.out/src`, a lexical-only verdict cries "pointing outside
-* the assembly ... treat this assembly as untrusted" about an asset that is
-* plainly inside it — and this arm exists to make an UNEXPECTED path visible,
-* so a false alarm is the failure that costs it its meaning.
-*
-* Exonerating requires the kernel to answer for BOTH operands: an unresolvable
-* one leaves the lexical verdict standing, so the arm stays loud when it cannot
-* see. (`resolveAssemblyPath` cannot take the same shape: its verdict is about
-* a path built with `path.join`, and letting a real path overrule the lexical
-* `..` there would answer about a location the caller never opens.)
-*/
-function absoluteAssemblyPathEscape(bound, absolutePath) {
-	const resolvedBound = resolve(bound);
-	const target = resolve(absolutePath);
-	const lexicallyOutside = !isInside(resolvedBound, target) && target !== resolvedBound;
-	const realBound = resolveThroughLinks(resolvedBound);
-	const realTarget = resolveThroughLinks(target);
-	const reallyOutside = realBound === void 0 || realTarget === void 0 ? void 0 : !isInside(realBound, realTarget) && realTarget !== realBound;
-	if (lexicallyOutside) {
-		if (reallyOutside === false) return void 0;
-		return {
-			contained: false,
-			escape: "lexical",
-			path: target
-		};
-	}
-	if (reallyOutside === true) return {
-		contained: false,
-		escape: "symlink",
-		path: target,
-		realPath: realTarget
-	};
-}
-/**
-* Whether `candidate` names the SAME directory as `bound` — lexically, or
-* through a symbolic link on either side.
-*
-* An asset source legitimately names a DIRECTORY, so a value that resolves
-* onto the output directory itself is not an escape; but it hands the WHOLE
-* assembly to the sink, which is worth a line. A caller that re-spells this as
-* `resolve(a) === resolve(b)` misses every second spelling of the bound
-* (macOS `/tmp` vs `/private/tmp`, a symlinked `cdk.out`), and
-* {@link absoluteAssemblyPathEscape} exonerates exactly those spellings as
-* inside — so the equality beside it would stay silent for them.
-*
-* Conservative on failure: an unresolvable side answers from the lexical
-* comparison alone, so it can only say "not the same", never wrongly claim
-* identity.
-*/
-function namesTheSameDirectory(bound, candidate) {
-	const resolvedBound = resolve(bound);
-	const target = resolve(candidate);
-	if (target === resolvedBound) return true;
-	const realBound = resolveThroughLinks(resolvedBound);
-	const realTarget = resolveThroughLinks(target);
-	return realBound !== void 0 && realTarget !== void 0 && realBound === realTarget;
-}
-/**
-* The escape verdict for an assembly-supplied path WITHOUT throwing, taking
-* whichever arm the value's own shape calls for: {@link absoluteAssemblyPathEscape}
-* for an absolute value, {@link resolveAssemblyPath} for a relative one.
-*
-* For a caller that only WARNS and has many values to judge — the BuildKit
-* passthroughs in `src/assets/buildkit-passthrough-warnings.ts`. `base` is what
-* a relative value resolves against, `bound` what it must stay inside.
-* Returns `undefined` when the value is fine, including when it names `bound`
-* itself ({@link namesTheSameDirectory}).
-*/
-function assemblyPathEscape(base, bound, candidate) {
-	if (isAbsolute(candidate)) return absoluteAssemblyPathEscape(bound, candidate);
-	const resolved = resolveAssemblyPath(base, candidate, { containWithin: bound });
-	if (resolved.contained || namesTheSameDirectory(bound, resolved.path)) return void 0;
-	return resolved;
-}
-/**
-* The shared tail of a containment refusal: what the value resolved to, what
-* it escaped, and why that means the assembly is not CDK-generated. The call
-* site supplies its own subject ("Lambda 'X' has ... which ") and its own
-* error class. `action` completes "Refusing to ..." and is REQUIRED rather
-* than defaulted: a default is a branch no caller takes, so it can neither be
-* fenced nor be right for the next caller.
-*
-* `provenanceOverride` replaces that whole closing sentence for a caller that
-* does NOT refuse — the BuildKit passthrough warnings, where "Refusing to ..."
-* would be a false statement about a value that is forwarded anyway.
-*/
-function renderAssemblyPathEscape(escape, dir, action, provenanceOverride) {
-	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
-	const base = resolve(dir);
-	const realBase = resolveThroughLinks(base) ?? base;
-	const shownPath = displayUntrustedValue(escape.path);
-	const shownBase = displayUntrustedValue(base);
-	if (escape.escape === "symlink") {
-		if (escape.realPath === realBase) return `resolves to ${shownPath}, a symbolic link to the directory ${shownBase} itself rather than to a path inside it. ${provenance}`;
-		return `resolves to ${shownPath}, which leads through a symbolic link to ${displayUntrustedValue(escape.realPath)}, outside ${shownBase}. ${provenance}`;
-	}
-	if (escape.path === base) return `names the directory ${shownBase} itself rather than a path inside it. ${provenance}`;
-	return `resolves to ${shownPath}, outside ${shownBase}. ${provenance}`;
-}
-/**
-* A letter or digit that neither draws as a blank nor reads as a quote.
-* `\p{L}` alone admits both, so two classes are carved out: the
-* default-ignorables, which hold letters that draw as a blank (the Hangul
-* fillers U+3164 and U+FFA0), and the quote-shaped letters — the Spacing
-* Modifier Letters block (U+02BA reads as `"`, U+02BC as `'`) plus the ones
-* outside it (U+0374, U+0559, U+07F4-U+07F5, U+A78B-U+A78C, and the halfwidth
-* sound marks U+FF9E-U+FF9F). Not all of `\p{Lm}`: U+30FC is in it, and it is
-* an ordinary character of a Japanese directory name.
-*/
-const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Point}\u02b0-\u02ff\u0374\u0559\u07f4\u07f5\ua78b\ua78c\uff9e\uff9f])[\p{L}\p{N}]$`, "u");
-/**
-* A combining mark, which counts only DIRECTLY after a visible letter (or a
-* mark that itself counted): on a space or on punctuation it draws on its own,
-* and U+030B / U+030E there look like a quote.
-*/
-const COMBINING_MARK = /^\p{M}$/u;
-/**
-* A default-ignorable code point, which draws as NOTHING. Tested before the
-* mark rule, because some are combining marks (U+034F, U+17B4, U+180B, the
-* variation selectors U+FE00-U+FE0F and U+E0100-U+E01EF): after a letter they
-* would otherwise pass as bare, and `/home/me/.ss\u034fh` would print exactly
-* like `.ssh` while naming a different path. The host's classifier
-* (go-to-k/cdkd#3509) does not carve these out; this one does.
-*/
-const DEFAULT_IGNORABLE = /^\p{Default_Ignorable_Code_Point}$/u;
-/**
-* The ASCII a bare value may carry besides letters and digits. Everything else
-* — any whitespace, any quote, any other symbol — takes the boundary, which
-* costs a legitimate path nothing but a pair of quotes.
-*/
-const BARE_PUNCTUATION = /^[/\\._~+@:=-]$/;
-/**
-* Classify each code point: `bare` (allowed in a bare value), `shown` (shown
-* as itself inside the boundary), or `escaped`. An ALLOWLIST, because a
-* denylist has to enumerate every character that draws as a blank or reads as
-* a quote.
-*
-* Each test is ONE character and this walks the value — never `^(...)+$` over
-* the whole of it: alternatives that overlap under a quantifier backtrack
-* exponentially on a long value that fails near its end.
-*/
-function classify(chars) {
-	let afterLetter = false;
-	return chars.map((ch) => {
-		if (DEFAULT_IGNORABLE.test(ch)) {
-			afterLetter = false;
-			return "escaped";
-		}
-		if (COMBINING_MARK.test(ch)) return afterLetter ? "bare" : "escaped";
-		afterLetter = VISIBLE_LETTER.test(ch);
-		if (afterLetter || BARE_PUNCTUATION.test(ch)) return "bare";
-		return ch >= " " && ch <= "~" ? "shown" : "escaped";
-	});
-}
-/**
-* Render an untrusted value — a filesystem path, identifier or command an
-* assembly chose, or a key a request supplied — into cdk-local's own prose
-* (go-to-k/cdk-local#758; the host's `displayAssemblyPath`, go-to-k/cdkd#3509).
-* The caller writes NO quotes around the result.
-*
-* `sanitizeServiceExceptionMessage` alone is not enough inside quotes of ours:
-* it flattens control characters and passes `'`, so a value carrying one
-* closed the quote and wrote a clause of its own into the message. This keeps
-* a plain value bare and puts any other one inside a JSON string literal.
-* Inside it, `"` and `\` are escaped as JSON escapes them, and so is every
-* character that is neither printable ASCII nor a visible letter — a curly or
-* fullwidth quote that could pass for the boundary's own closing `"`, and a
-* blank that could pass for a space. The result stays valid JSON: `JSON.parse`
-* returns the sanitized value.
-*
-* A legitimate value with a space or any symbol outside `/ \ . _ ~ + @ : = -`
-* (`/Users/me/My Project/cdk.out`) renders quoted; a non-ASCII letter is
-* shown as itself, and a non-letter non-ASCII character (an emoji, `©`) as
-* its `\u` escape. A value the sanitizer ALTERED (a control character
-* flattened, an over-long value truncated) did not arrive plain, so it always
-* takes the boundary. The empty string renders as `""`.
-*
-* The sanitizer also CAPS the value at 512 code points, so a longer path
-* prints truncated (inside the boundary, with its true length named). That
-* is deliberate: an unbounded assembly-chosen value would otherwise make the
-* log line as long as the attacker likes, and a real path is far shorter.
-*/
-function displayUntrustedValue(value) {
-	const clean = sanitizeServiceExceptionMessage(value);
-	const chars = Array.from(clean);
-	const kinds = classify(chars);
-	if (clean === value && chars.length > 0 && kinds.every((k) => k === "bare")) return clean;
-	let body = "";
-	chars.forEach((ch, i) => {
-		if (ch === "\"" || ch === "\\") body += `\\${ch}`;
-		else if (kinds[i] !== "escaped") body += ch;
-		else for (let u = 0; u < ch.length; u++) body += `\\u${ch.charCodeAt(u).toString(16).padStart(4, "0")}`;
-	});
-	return `"${body}"`;
-}
-
 //#endregion
 //#region src/utils/error-handler.ts
 /**
@@ -8039,6 +7178,166 @@ function applyDeployedEnvFallback(resolvedEnv, unresolved, deployedEnv) {
 	};
 }
 
+//#endregion
+//#region src/local/ecr-uri.ts
+/**
+* Every ECR private-registry host form, read off the AWS-published `ecr`
+* endpoint list (https://docs.aws.amazon.com/general/latest/gr/ecr.html):
+*
+* - `<acct>.dkr.ecr.<region>.<partition suffix>` — the plain IPv4 endpoint.
+* - `<acct>.dkr.ecr-fips.<region>.<partition suffix>` — FIPS IPv4.
+* - `<acct>.dkr-ecr.<region>.on.aws` — dual-stack (IPv4 + IPv6).
+* - `<acct>.dkr-ecr-fips.<region>.on.aws` — dual-stack FIPS.
+*
+* Every form except the plain one is scoped to the `aws` and `aws-us-gov`
+* partitions, the only ones that endpoint list shows it in: both FIPS forms are
+* listed for `us-east-1` / `us-east-2` / `us-west-1` / `us-west-2` /
+* `us-gov-east-1` / `us-gov-west-1` only, and `on.aws` is the dual-stack DNS of
+* those two partitions (the others serve dual-stack under their own suffixes,
+* which are not listed here). A FIPS or dual-stack host in any other partition
+* is therefore not recognized and is pulled as a public image, as before issue
+* #760. The scope is by PARTITION, not by region: a commercial region AWS adds
+* later is accepted, and a login to an unserved region's FIPS host only fails,
+* because the suffix is still AWS-owned.
+*/
+const FIPS_AND_DUAL_STACK_PARTITIONS = ["aws", "aws-us-gov"];
+const ECR_REGISTRY_HOST_FORMS = [
+	{ labels: "dkr.ecr" },
+	{
+		labels: "dkr.ecr-fips",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	},
+	{
+		labels: "dkr-ecr",
+		fixedUrlSuffix: "on.aws",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	},
+	{
+		labels: "dkr-ecr-fips",
+		fixedUrlSuffix: "on.aws",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	}
+];
+const ECR_HOST_FORM_BY_LABELS = new Map(ECR_REGISTRY_HOST_FORMS.map((f) => [f.labels, f]));
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* `<acct>.<labels>.<region>.<suffix>/` — ANCHORED at the start, so nothing
+* (userinfo, a scheme, another host) can precede the account id, and ending at
+* the first `/`, so the captured suffix is the rest of the host.
+*
+* The labels alternation is built from {@link ECR_REGISTRY_HOST_FORMS},
+* ESCAPED (an unescaped `dkr.ecr` would match `dkrxecr`) and longest first, so
+* `dkr.ecr-fips` is tried before its own `dkr.ecr` prefix. The `i` flag makes
+* the labels case-insensitive, as DNS is; it is non-unicode, so it does NOT
+* treat U+212A (Kelvin sign) as `k`, and `\d` is ASCII-only.
+*/
+const ECR_URI_HOST_REGEX = new RegExp(`^(\\d{12})\\.(${[...ECR_REGISTRY_HOST_FORMS].sort((a, b) => b.labels.length - a.labels.length).map((f) => escapeRegExp(f.labels)).join("|")})\\.([^./]+)\\.([^/]+)/`, "i");
+/**
+* A region segment is ASCII alphanumerics plus `-`. Tested on the RAW capture,
+* BEFORE any case fold: `String.prototype.toLowerCase` folds U+212A onto an
+* ASCII `k`, so testing a folded value would admit `us-eKst-1` (Kelvin sign) as
+* the region `us-ekst-1` — a region the host does not name, which then seeds
+* the ECR client and the login endpoint. Today {@link REGION_SHAPE} also
+* refuses that input, because the fold is ASCII-only and the shape is ASCII
+* only, so this guard is DEFENSE IN DEPTH: it keeps the region safe if the fold
+* is ever widened to full Unicode folding.
+*/
+const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+/**
+* The SHAPE of an AWS region id, tested on the FOLDED region after the charset
+* guard above. One alternative per partition, transcribed from the
+* `regionRegex` of each partition in the AWS SDK / botocore `partitions.json`
+* (`\w+` written as `[a-z0-9]+`):
+*
+* - aws: `(us|eu|ap|sa|ca|me|af|il|mx)-X-N`
+* - aws-cn: `cn-X-N`; aws-us-gov: `us-gov-X-N`
+* - aws-iso / -b / -e / -f: `us-iso-X-N`, `us-isob-X-N`, `eu-isoe-X-N`,
+*   `us-isof-X-N`
+* - aws-eusc: `eusc-<cc>-X-N` — broader than upstream's `eusc-(de)-`, matching
+*   `PARTITION_TABLE`'s `eusc-` prefix so a future country is not refused here
+*   while the partition lookup accepts it.
+*
+* It refuses a label that is not a region — `s3`, `lambda-url`,
+* `s3-external-1`, `fips-us-east-1` — so `<acct>.dkr.ecr.s3.amazonaws.com` or
+* `<acct>.dkr-ecr.lambda-url.on.aws` never becomes a login target. Those hosts
+* are AWS-owned, but they are not registries, and only TLS would stop a token
+* sent there (an `insecure-registries` daemon setting turns that off).
+*/
+const REGION_SHAPE = /^(?:(?:us|eu|ap|sa|ca|me|af|il|mx)-[a-z0-9]+-[0-9]+|cn-[a-z0-9]+-[0-9]+|us-gov-[a-z0-9]+-[0-9]+|us-iso-[a-z0-9]+-[0-9]+|us-isob-[a-z0-9]+-[0-9]+|eu-isoe-[a-z0-9]+-[0-9]+|us-isof-[a-z0-9]+-[0-9]+|eusc-[a-z]+-[a-z0-9]+-[0-9]+)$/;
+/**
+* A URL suffix is a dotted name of ASCII alphanumerics and `-`, tested on the
+* raw capture like the region. Today it is DEFENSE IN DEPTH, not the load-
+* bearing check: the fold below is ASCII-only, so `cloud.adc-e.uK` (Kelvin
+* sign) never becomes the `aws-iso-e` suffix, and the exact-suffix comparison
+* already refuses a port (`:`), userinfo (`@`) or any look-alike. It keeps
+* the suffix safe if that fold is ever widened to full Unicode folding.
+*/
+const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
+/**
+* Lower-case ONLY `A`-`Z`. DNS case-insensitivity is ASCII-only, and a full
+* `toLowerCase` would fold U+212A onto `k` and hand the charset guards above an
+* already-ASCII string, defeating them.
+*/
+function foldAsciiUpperCase(value) {
+	return value.replace(/[A-Z]+/g, (run) => run.toLowerCase());
+}
+/** Docker's rule for "component 1 is a registry host, not a repository segment". */
+function isRegistryHostComponent(component) {
+	return component.includes(".") || component.includes(":") || component === "localhost";
+}
+/**
+* Lower-case the REGISTRY HOST of an image reference (ASCII letters only) and
+* leave the repository path and tag byte-identical.
+*
+* Docker's credential store is keyed on the hostname VERBATIM, so a login to
+* one spelling and a pull from another sends no credentials; every
+* docker-facing use of an ECR reference goes through this one spelling. The
+* path is not folded: docker requires it lower-case already, and rewriting it
+* would name a different image. A first component that is not a registry host
+* (`MyOrg/MyRepo:tag` is a Docker Hub path) is left alone for the same reason.
+*/
+function canonicalizeImageUriHost(imageUri) {
+	const slash = imageUri.indexOf("/");
+	if (slash < 0) return imageUri;
+	const host = imageUri.slice(0, slash);
+	if (!isRegistryHostComponent(host)) return imageUri;
+	return foldAsciiUpperCase(host) + imageUri.slice(slash);
+}
+/**
+* The ECR registry an image reference names, or `undefined` when its host is
+* not one of {@link ECR_REGISTRY_HOST_FORMS} with the suffix that form carries
+* for the region it names.
+*
+* The suffix check is what keeps a `docker login` from being pointed at a host
+* cdk-local does not own: `<acct>.dkr.ecr.<region>.example.com`, a look-alike
+* `amazonaws.com.evil.example`, a port or userinfo after the suffix, and a
+* form/suffix mispairing (`dkr-ecr` + `amazonaws.com`, `dkr.ecr` + `on.aws`,
+* an ISO region + `amazonaws.com`) are all refused.
+*/
+function parseEcrRegistryHost(imageUri) {
+	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	if (!m) return void 0;
+	const [, accountId, rawLabels, rawRegion, rawSuffix] = m;
+	if (!CANONICAL_REGION_SEGMENT.test(rawRegion)) return void 0;
+	if (!CANONICAL_URL_SUFFIX.test(rawSuffix)) return void 0;
+	const form = ECR_HOST_FORM_BY_LABELS.get(foldAsciiUpperCase(rawLabels));
+	if (!form) return void 0;
+	const region = foldAsciiUpperCase(rawRegion);
+	if (!REGION_SHAPE.test(region)) return void 0;
+	const suffix = foldAsciiUpperCase(rawSuffix);
+	const partition = derivePartitionAndUrlSuffix(region);
+	if (form.partitions && !form.partitions.includes(partition.partition)) return void 0;
+	if (suffix !== (form.fixedUrlSuffix ?? partition.urlSuffix)) return void 0;
+	return {
+		accountId,
+		region,
+		registryHost: `${accountId}.${form.labels}.${region}.${suffix}`,
+		form
+	};
+}
+
 //#endregion
 //#region src/local/ecs-task-resolver.ts
 var EcsTaskResolutionError = class EcsTaskResolutionError extends Error {
@@ -8553,9 +7852,10 @@ function buildSubstitutionContextFromImageContext(context) {
 * Parse the `Image` field of an ECS container definition.
 *
 * Three shapes:
-*   - `<account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` — same-account
-*     same-region ECR. Cross-account/region is hard-errored (matches
-*     `cdkl invoke`'s ECR-pull semantics).
+*   - `<account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` — ECR, in any
+*     host form `ECR_REGISTRY_HOST_FORMS` lists (FIPS / dual-stack too) and any
+*     partition. Pulled through `pullEcrImage` (cross-account / cross-region
+*     below).
 *   - `Fn::Sub` / `Fn::Join` / `Ref` referencing a `Code.fromAsset`-style
 *     CDK asset image. Surfaces `kind: 'cdk-asset'` with the optional
 *     asset hash so the runner can route through `docker-build.ts`.
@@ -8602,12 +7902,12 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 		if (substituted.includes("AWS::")) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image that references AWS pseudo parameters (${substituted}). ${getEmbedConfig().productName} could not resolve them: confirm AWS credentials are configured so STS GetCallerIdentity succeeds, and that --region / AWS_REGION names the target region. Workaround: build the image locally (ContainerImage.fromAsset) or pin a public image.`);
 		throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image with unresolved \${...} placeholders (${substituted}). ${getEmbedConfig().cliName} only resolves AWS pseudo parameters and same-stack AWS::ECR::Repository refs.`);
 	}
-	const ecrMatch = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\//.exec(substituted);
-	if (ecrMatch) return {
+	const ecrHost = parseEcrRegistryHost(substituted);
+	if (ecrHost) return {
 		kind: "ecr",
 		uri: substituted,
-		account: ecrMatch[1],
-		region: ecrMatch[2]
+		account: ecrHost.accountId,
+		region: ecrHost.region
 	};
 	return {
 		kind: "public",
@@ -8643,12 +7943,12 @@ function classifyResolvedImage(uri) {
 		if (hashMatch) out.assetHash = hashMatch[1];
 		return out;
 	}
-	const ecrMatch = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\//.exec(uri);
-	if (ecrMatch) return {
+	const ecrHost = parseEcrRegistryHost(uri);
+	if (ecrHost) return {
 		kind: "ecr",
 		uri,
-		account: ecrMatch[1],
-		region: ecrMatch[2]
+		account: ecrHost.accountId,
+		region: ecrHost.region
 	};
 	return {
 		kind: "public",
@@ -9603,7 +8903,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
 		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
-		logger.debug(`Building Docker image via executable: ${sanitizeServiceExceptionMessage(source.executable.join(" "))} (cwd=${displayUntrustedValue(cwd)})`);
+		logger.debug(`Building Docker image via executable: ${displayUntrustedValue(source.executable.join(" "))} (cwd=${displayUntrustedValue(cwd)})`);
 		warnManifestExecutable(cmd, source.executable, cwd);
 		let result;
 		try {
@@ -9613,7 +8913,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 			throw options.wrapError(e.stderr || e.message || String(err));
 		}
 		const tag = result.stdout.trim();
-		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${cmd} ${args.join(" ")}`);
+		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${displayUntrustedValue(cmd)}`);
 		return tag;
 	}
 	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (got: ${JSON.stringify(source)})`);
@@ -9622,7 +8922,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 	const contextDir = contextDirectory(source.directory, `send that directory to docker build as the context of an image ${getEmbedConfig().productName} then runs locally`);
 	buildArgs.push(".");
 	warnEscapingBuildKitPaths(source, contextDir, assetOutdir);
-	logger.debug(`${getDockerCmd()} ${buildArgs.join(" ")} (cwd=${contextDir})`);
+	logger.debug(`${getDockerCmd()} ${buildArgs.join(" ")} (cwd=${displayUntrustedValue(contextDir)})`);
 	try {
 		await runDockerStreaming(buildArgs, {
 			cwd: contextDir,
@@ -9666,49 +8966,27 @@ function buildDockerBuildCommand(source, tag, platformOverride) {
 //#endregion
 //#region src/local/ecr-puller.ts
 /**
-* ECR pull fallback for `cdkl invoke` / `cdkl start-api` /
-* `cdkl run-task`. When the image URI resolves to an ECR repo but
-* doesn't match any cdk.out asset (typical when invoking a stack
-* deployed elsewhere or sharing a centralized registry), cdk-local
-* authenticates against the target registry and runs `docker pull`.
-*
-* **Cross-account / cross-region** (#455):
-*   - Same-account, same-region: fast path. No STS hop. The default
-*     credential chain is used directly for `ecr:GetAuthorizationToken`.
-*   - `ecrRoleArn` is provided: `sts:AssumeRole` is issued via the
-*     default credential chain to obtain temporary credentials for the
-*     target account. The resulting credentials authenticate the ECR
-*     client (regardless of region — the ECR client is built for the
-*     URI's region, which can differ from the caller's profile region).
-*   - Cross-account, NO `ecrRoleArn`: cdk-local falls through to the
-*     default credential chain. This works when the caller has been
-*     granted cross-account `ecr:GetAuthorizationToken` +
-*     `ecr:BatchGetImage` permissions on the target repository via an
-*     IAM policy; otherwise AWS rejects the call with `AccessDenied`
-*     and the user is pointed at `--ecr-role-arn`.
-*
-* The `--no-pull` semantics (C3 in the design doc):
-*   - When NOT set: `ecrLogin` + `docker pull <uri>`.
-*   - When set: skip `docker pull`. If the image isn't in the local
-*     cache, the subsequent `docker run` will fail; we surface a clearer
-*     "image not in local cache" error here so the user knows to drop
-*     `--no-pull` or pre-pull manually.
-*/
-/** Regex matching the `<acct>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` shape. */
-const ECR_URI_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\/([^:]+):(.+)$/;
-/**
 * Parse an ECR image URI. Returns `undefined` for non-ECR URIs (typically:
 * Docker Hub, public.ecr.aws, gcr.io, ...) — those are user-managed
 * images we don't try to authenticate against.
+*
+* Recognizes every host form in `ECR_REGISTRY_HOST_FORMS` (plain, FIPS,
+* dual-stack, dual-stack FIPS) in every partition, each with the suffix that
+* form carries for its region (issue #760) — see `parseEcrRegistryHost`.
 */
 function parseEcrUri(imageUri) {
-	const m = ECR_URI_REGEX.exec(imageUri);
+	const host = parseEcrRegistryHost(imageUri);
+	if (!host) return void 0;
+	const canonicalUri = canonicalizeImageUriHost(imageUri);
+	const m = /^([^:]+):(.+)$/.exec(canonicalUri.slice(canonicalUri.indexOf("/") + 1));
 	if (!m) return void 0;
 	return {
-		accountId: m[1],
-		region: m[2],
-		repository: m[3],
-		tag: m[4]
+		accountId: host.accountId,
+		region: host.region,
+		repository: m[1],
+		tag: m[2],
+		canonicalUri,
+		registryHost: host.registryHost
 	};
 }
 /**
@@ -9748,17 +9026,20 @@ function isCredentialFresh(creds) {
 *
 * Auto-detects cross-account from `STS:GetCallerIdentity` and assumes
 * the supplied role when set. Returns the image URI the caller should
-* pass to `docker run` (same as the input — no rewriting).
+* pass to `docker run`: the input with its registry host ASCII-lower-cased
+* (`ParsedEcrUri.canonicalUri`), so the run names the same spelling the pull
+* and the login used; the repository path and tag are unchanged.
 */
 async function pullEcrImage(imageUri, options) {
 	const logger = getLogger().child("ecr-puller");
 	const parsed = parseEcrUri(imageUri);
 	if (!parsed) throw new LocalInvokeBuildError(`Image URI '${imageUri}' is not an ECR URI. ${getEmbedConfig().cliName} invoke v1 only authenticates against ECR for the deployed-image fallback path.`);
+	const canonicalUri = parsed.canonicalUri;
 	const callerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
 	if (options.skipPull) {
-		logger.info(`Skipping ECR pull (--no-pull). Verifying ${imageUri} is in local cache...`);
-		await verifyImageInLocalCache(imageUri);
-		return imageUri;
+		logger.info(`Skipping ECR pull (--no-pull). Verifying ${canonicalUri} is in local cache...`);
+		await verifyImageInLocalCache(canonicalUri);
+		return canonicalUri;
 	}
 	const callerIdentityKey = `${options.profile ?? "_noprofile"}|${callerRegion ?? "_unset"}`;
 	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
@@ -9801,17 +9082,21 @@ async function pullEcrImage(imageUri, options) {
 		...assumed ? { credentials: assumed } : options.profile ? { profile: options.profile } : {}
 	});
 	try {
-		await ecrLogin(ecr, parsed.accountId, parsed.region);
+		await ecrLogin(ecr, {
+			accountId: parsed.accountId,
+			region: parsed.region,
+			registryHost: parsed.registryHost
+		});
 	} finally {
 		ecr.destroy();
 	}
-	logger.info(`Pulling ${imageUri}...`);
+	logger.info(`Pulling ${canonicalUri}...`);
 	try {
-		await runDockerForeground(["pull", imageUri]);
+		await runDockerForeground(["pull", canonicalUri]);
 	} catch (err) {
-		throw new LocalInvokeBuildError(`docker pull ${imageUri} failed: ${err.message}`);
+		throw new LocalInvokeBuildError(`docker pull ${canonicalUri} failed: ${err.message}`);
 	}
-	return imageUri;
+	return canonicalUri;
 }
 /**
 * Assume the supplied role via the SDK default credential chain and
@@ -9852,16 +9137,29 @@ async function assumeRoleForEcr(roleArn, callerRegion, profile, logger) {
 * Authenticate the local docker daemon against the target ECR registry.
 * Self-contained in this module so the local-invoke path stays
 * independent of any full asset-publish path's larger surface area.
-*/
-async function ecrLogin(client, accountId, region) {
-	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region})`);
+*
+* The login endpoint is ALWAYS the host the PULL targets (issue #760):
+* docker's credential store is keyed on the hostname verbatim, so a login to
+* any other host leaves the pull with no credentials (`no basic auth
+* credentials`). `GetAuthorizationToken`'s `proxyEndpoint` is therefore NOT
+* used: it names the CALLER's default registry on the plain host, which is the
+* wrong host for a FIPS / dual-stack pull and the wrong ACCOUNT for a
+* cross-account pull made on the caller's own credentials (a repository policy
+* grant, no `--ecr-role-arn`). The token is principal-scoped, not host-scoped:
+* measured on real ECR, one token authenticates the plain, FIPS and dual-stack
+* hosts alike. The password reaches docker only over `--password-stdin`, never
+* argv.
+*/
+async function ecrLogin(client, target) {
+	const { accountId, region, registryHost } = target;
+	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region}, host=${registryHost})`);
 	const authData = (await client.send(new GetAuthorizationTokenCommand({})).catch((err) => {
 		throw new LocalInvokeBuildError(`ECR GetAuthorizationToken failed (account=${accountId}, region=${region}): ${describeAwsFailureForWarn(err, "ECR GetAuthorizationToken")}. Verify the credentials can call ecr:GetAuthorizationToken.`);
 	})).authorizationData?.[0];
 	if (!authData?.authorizationToken) throw new LocalInvokeBuildError("Failed to get ECR authorization token");
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError("ECR authorization token has unexpected shape (missing username/password)");
-	const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.amazonaws.com`;
+	const endpoint = `https://${registryHost}`;
 	try {
 		await runDockerStreaming([
 			"login",
@@ -9937,7 +9235,7 @@ async function buildContainerImage(asset, cdkOutDir, options) {
 	const actualTag = await buildDockerImage(asset, cdkOutDir, {
 		tag,
 		platform,
-		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for container Lambda asset (${sanitizeServiceExceptionMessage(asset.source.directory ?? asset.source.executable?.join(" ") ?? "")}): ${stderr}`),
+		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for container Lambda asset (${displayUntrustedValue(asset.source.directory ?? asset.source.executable?.[0] ?? "")}): ${stderr}`),
 		progressLabel: `Building container image (platform=${platform})`,
 		...options.assetOutdir !== void 0 && { assetOutdir: options.assetOutdir }
 	});
@@ -24950,7 +24248,7 @@ async function prepareOneImage(task, container, options) {
 				tag,
 				assetOutdir: assetPathDirs(task.stack).assetOutdir,
 				...options.platformOverride !== void 0 && { platform: options.platformOverride },
-				wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for ECS container '${container.name}' (${sanitizeServiceExceptionMessage(asset.source.directory ?? asset.source.executable?.join(" ") ?? "")}): ${stderr}`),
+				wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for ECS container '${container.name}' (${displayUntrustedValue(asset.source.directory ?? asset.source.executable?.[0] ?? "")}): ${stderr}`),
 				progressLabel: `Building container image for '${container.name}'`
 			});
 			if (actualTag !== tag) try {
@@ -26375,7 +25673,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -26394,7 +25692,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -26409,7 +25707,7 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerRestartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["restart", containerId]);
 };
 let dockerRestartImpl = defaultDockerRestartImpl;
@@ -26449,7 +25747,7 @@ async function disconnectOldFromSharedNetwork(oldInstance) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -26626,7 +25924,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -26646,7 +25944,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-SocNyC9q.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -41780,5 +41078,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, describeCredentialLoadFailure as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, resolveProfileCredentials as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, buildProxyClientConfig as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, isProxyEnvConfigured as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildStsClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, describeAwsFailureForWarn as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-Cdq8klwg.js.map
+export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, resolveProfileCredentials as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, isProxyEnvConfigured as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildProxyClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, buildStsClientConfig as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
+//# sourceMappingURL=local-studio-CLk7iSNq.js.map