cdk-local 0.149.5 → 0.149.7

package/dist/{local-studio-CV21zLBM.js → local-studio-U-gD2HSf.js}

@@ -1,4 +1,4 @@
-import { C as resolveConfiguredLogLevel, E as setEmbedConfig, S as getLogger, _ as describeCredentialLoadFailure, a as runDockerForeground, b as sanitizeServiceExceptionMessage, c as warnFinchArgvExposure, d as displayUntrustedValue, f as namesTheSameDirectory, g as describeAwsFailureForWarn, h as clampErrorName, i as getDockerCmd, l as absoluteAssemblyPathEscape, m as resolveAssemblyPath, n as finchSecretArgvRefusal, o as runDockerStreaming, p as renderAssemblyPathEscape, r as formatDockerLoginError, s as spawnStreaming, u as assemblyPathEscape, v as flattenToOneLine, w as getEmbedConfig, x as stringifyThrown, y as isAwsServiceException } from "./docker-cmd-B5yU__zC.js";
+import { C as stringifyThrown, E as getEmbedConfig, O as setEmbedConfig, S as sanitizeServiceExceptionMessage, T as resolveConfiguredLogLevel, _ as clampErrorName, a as isDockerClientEnvKey, b as flattenToOneLine, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as resolveAssemblyPath, h as renderAssemblyPathEscape, i as getDockerCmd, l as spawnStreaming, m as namesTheSameDirectory, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as describeAwsFailureForWarn, w as getLogger, x as isAwsServiceException, y as describeCredentialLoadFailure } from "./docker-cmd-leyvDn1u.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path$1 from "node:path";
@@ -6358,6 +6358,36 @@ function toFlagName(field) {
 	return "--" + field.replace(/([A-Z])/g, "-$1").toLowerCase();
 }
 
+//#endregion
+//#region src/utils/own-keys.ts
+/**
+* Write `key` as an OWN, ordinary data property of `target`.
+*
+* Plain assignment (`target[key] = value`) on an object literal routes the
+* key `__proto__` through `Object.prototype`'s `__proto__` accessor: a string
+* value is silently ignored and an object value REPLACES the target's
+* prototype. For maps keyed by user-supplied names (env vars, secrets) that
+* means a variable literally named `__proto__` vanishes without a warning
+* (issue #769). `Object.defineProperty` never consults the accessor, so the
+* key lands as an own property like any other.
+*
+* The descriptor matches what an ordinary assignment creates (writable,
+* enumerable, configurable), so `Object.keys` / `Object.entries` / spread /
+* `JSON.stringify` / `delete` treat the key exactly like its siblings.
+*
+* Readers of such a map must test membership with `Object.hasOwn`, never
+* `in` or a bare `map[key] !== undefined`: both see the inherited
+* `__proto__` accessor on a map that does not carry the key.
+*/
+function defineOwnKey(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
+}
+
 //#endregion
 //#region src/local/state-resolver.ts
 /**
@@ -7020,12 +7050,12 @@ function substituteEnvVarsFromState(templateEnv, contextOrResources) {
 	const context = isContext(contextOrResources) ? contextOrResources : { resources: contextOrResources };
 	for (const [key, value] of Object.entries(templateEnv)) {
 		if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-			env[key] = value;
+			defineOwnKey(env, key, value);
 			continue;
 		}
 		const { result, consumedSensitive } = resolveWithSensitivity(value, context);
 		if (result.kind === "literal") {
-			env[key] = result.value;
+			defineOwnKey(env, key, result.value);
 			audit.resolvedKeys.push(key);
 			if (consumedSensitive) audit.sensitiveKeys.push(key);
 		} else audit.unresolved.push({
@@ -7113,12 +7143,12 @@ async function substituteEnvVarsFromStateAsync(templateEnv, contextOrResources)
 	const context = isContext(contextOrResources) ? contextOrResources : { resources: contextOrResources };
 	for (const [key, value] of Object.entries(templateEnv)) {
 		if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-			env[key] = value;
+			defineOwnKey(env, key, value);
 			continue;
 		}
 		const { result, consumedSensitive } = await resolveWithSensitivityAsync(value, context);
 		if (result.kind === "literal") {
-			env[key] = result.value;
+			defineOwnKey(env, key, result.value);
 			audit.resolvedKeys.push(key);
 			if (consumedSensitive) audit.sensitiveKeys.push(key);
 		} else audit.unresolved.push({
@@ -7162,9 +7192,9 @@ function applyDeployedEnvFallback(resolvedEnv, unresolved, deployedEnv) {
 	const filled = [];
 	const stillUnresolved = [];
 	for (const item of unresolved) {
-		const deployedValue = deployedEnv[item.key];
+		const deployedValue = Object.hasOwn(deployedEnv, item.key) ? deployedEnv[item.key] : void 0;
 		if (deployedValue !== void 0) {
-			env[item.key] = deployedValue;
+			defineOwnKey(env, item.key, deployedValue);
 			filled.push(item.key);
 		} else stillUnresolved.push({
 			key: item.key,
@@ -7178,6 +7208,166 @@ function applyDeployedEnvFallback(resolvedEnv, unresolved, deployedEnv) {
 	};
 }
 
+//#endregion
+//#region src/local/ecr-uri.ts
+/**
+* Every ECR private-registry host form, read off the AWS-published `ecr`
+* endpoint list (https://docs.aws.amazon.com/general/latest/gr/ecr.html):
+*
+* - `<acct>.dkr.ecr.<region>.<partition suffix>` — the plain IPv4 endpoint.
+* - `<acct>.dkr.ecr-fips.<region>.<partition suffix>` — FIPS IPv4.
+* - `<acct>.dkr-ecr.<region>.on.aws` — dual-stack (IPv4 + IPv6).
+* - `<acct>.dkr-ecr-fips.<region>.on.aws` — dual-stack FIPS.
+*
+* Every form except the plain one is scoped to the `aws` and `aws-us-gov`
+* partitions, the only ones that endpoint list shows it in: both FIPS forms are
+* listed for `us-east-1` / `us-east-2` / `us-west-1` / `us-west-2` /
+* `us-gov-east-1` / `us-gov-west-1` only, and `on.aws` is the dual-stack DNS of
+* those two partitions (the others serve dual-stack under their own suffixes,
+* which are not listed here). A FIPS or dual-stack host in any other partition
+* is therefore not recognized and is pulled as a public image, as before issue
+* #760. The scope is by PARTITION, not by region: a commercial region AWS adds
+* later is accepted, and a login to an unserved region's FIPS host only fails,
+* because the suffix is still AWS-owned.
+*/
+const FIPS_AND_DUAL_STACK_PARTITIONS = ["aws", "aws-us-gov"];
+const ECR_REGISTRY_HOST_FORMS = [
+	{ labels: "dkr.ecr" },
+	{
+		labels: "dkr.ecr-fips",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	},
+	{
+		labels: "dkr-ecr",
+		fixedUrlSuffix: "on.aws",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	},
+	{
+		labels: "dkr-ecr-fips",
+		fixedUrlSuffix: "on.aws",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	}
+];
+const ECR_HOST_FORM_BY_LABELS = new Map(ECR_REGISTRY_HOST_FORMS.map((f) => [f.labels, f]));
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* `<acct>.<labels>.<region>.<suffix>/` — ANCHORED at the start, so nothing
+* (userinfo, a scheme, another host) can precede the account id, and ending at
+* the first `/`, so the captured suffix is the rest of the host.
+*
+* The labels alternation is built from {@link ECR_REGISTRY_HOST_FORMS},
+* ESCAPED (an unescaped `dkr.ecr` would match `dkrxecr`) and longest first, so
+* `dkr.ecr-fips` is tried before its own `dkr.ecr` prefix. The `i` flag makes
+* the labels case-insensitive, as DNS is; it is non-unicode, so it does NOT
+* treat U+212A (Kelvin sign) as `k`, and `\d` is ASCII-only.
+*/
+const ECR_URI_HOST_REGEX = new RegExp(`^(\\d{12})\\.(${[...ECR_REGISTRY_HOST_FORMS].sort((a, b) => b.labels.length - a.labels.length).map((f) => escapeRegExp(f.labels)).join("|")})\\.([^./]+)\\.([^/]+)/`, "i");
+/**
+* A region segment is ASCII alphanumerics plus `-`. Tested on the RAW capture,
+* BEFORE any case fold: `String.prototype.toLowerCase` folds U+212A onto an
+* ASCII `k`, so testing a folded value would admit `us-eKst-1` (Kelvin sign) as
+* the region `us-ekst-1` — a region the host does not name, which then seeds
+* the ECR client and the login endpoint. Today {@link REGION_SHAPE} also
+* refuses that input, because the fold is ASCII-only and the shape is ASCII
+* only, so this guard is DEFENSE IN DEPTH: it keeps the region safe if the fold
+* is ever widened to full Unicode folding.
+*/
+const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+/**
+* The SHAPE of an AWS region id, tested on the FOLDED region after the charset
+* guard above. One alternative per partition, transcribed from the
+* `regionRegex` of each partition in the AWS SDK / botocore `partitions.json`
+* (`\w+` written as `[a-z0-9]+`):
+*
+* - aws: `(us|eu|ap|sa|ca|me|af|il|mx)-X-N`
+* - aws-cn: `cn-X-N`; aws-us-gov: `us-gov-X-N`
+* - aws-iso / -b / -e / -f: `us-iso-X-N`, `us-isob-X-N`, `eu-isoe-X-N`,
+*   `us-isof-X-N`
+* - aws-eusc: `eusc-<cc>-X-N` — broader than upstream's `eusc-(de)-`, matching
+*   `PARTITION_TABLE`'s `eusc-` prefix so a future country is not refused here
+*   while the partition lookup accepts it.
+*
+* It refuses a label that is not a region — `s3`, `lambda-url`,
+* `s3-external-1`, `fips-us-east-1` — so `<acct>.dkr.ecr.s3.amazonaws.com` or
+* `<acct>.dkr-ecr.lambda-url.on.aws` never becomes a login target. Those hosts
+* are AWS-owned, but they are not registries, and only TLS would stop a token
+* sent there (an `insecure-registries` daemon setting turns that off).
+*/
+const REGION_SHAPE = /^(?:(?:us|eu|ap|sa|ca|me|af|il|mx)-[a-z0-9]+-[0-9]+|cn-[a-z0-9]+-[0-9]+|us-gov-[a-z0-9]+-[0-9]+|us-iso-[a-z0-9]+-[0-9]+|us-isob-[a-z0-9]+-[0-9]+|eu-isoe-[a-z0-9]+-[0-9]+|us-isof-[a-z0-9]+-[0-9]+|eusc-[a-z]+-[a-z0-9]+-[0-9]+)$/;
+/**
+* A URL suffix is a dotted name of ASCII alphanumerics and `-`, tested on the
+* raw capture like the region. Today it is DEFENSE IN DEPTH, not the load-
+* bearing check: the fold below is ASCII-only, so `cloud.adc-e.uK` (Kelvin
+* sign) never becomes the `aws-iso-e` suffix, and the exact-suffix comparison
+* already refuses a port (`:`), userinfo (`@`) or any look-alike. It keeps
+* the suffix safe if that fold is ever widened to full Unicode folding.
+*/
+const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
+/**
+* Lower-case ONLY `A`-`Z`. DNS case-insensitivity is ASCII-only, and a full
+* `toLowerCase` would fold U+212A onto `k` and hand the charset guards above an
+* already-ASCII string, defeating them.
+*/
+function foldAsciiUpperCase(value) {
+	return value.replace(/[A-Z]+/g, (run) => run.toLowerCase());
+}
+/** Docker's rule for "component 1 is a registry host, not a repository segment". */
+function isRegistryHostComponent(component) {
+	return component.includes(".") || component.includes(":") || component === "localhost";
+}
+/**
+* Lower-case the REGISTRY HOST of an image reference (ASCII letters only) and
+* leave the repository path and tag byte-identical.
+*
+* Docker's credential store is keyed on the hostname VERBATIM, so a login to
+* one spelling and a pull from another sends no credentials; every
+* docker-facing use of an ECR reference goes through this one spelling. The
+* path is not folded: docker requires it lower-case already, and rewriting it
+* would name a different image. A first component that is not a registry host
+* (`MyOrg/MyRepo:tag` is a Docker Hub path) is left alone for the same reason.
+*/
+function canonicalizeImageUriHost(imageUri) {
+	const slash = imageUri.indexOf("/");
+	if (slash < 0) return imageUri;
+	const host = imageUri.slice(0, slash);
+	if (!isRegistryHostComponent(host)) return imageUri;
+	return foldAsciiUpperCase(host) + imageUri.slice(slash);
+}
+/**
+* The ECR registry an image reference names, or `undefined` when its host is
+* not one of {@link ECR_REGISTRY_HOST_FORMS} with the suffix that form carries
+* for the region it names.
+*
+* The suffix check is what keeps a `docker login` from being pointed at a host
+* cdk-local does not own: `<acct>.dkr.ecr.<region>.example.com`, a look-alike
+* `amazonaws.com.evil.example`, a port or userinfo after the suffix, and a
+* form/suffix mispairing (`dkr-ecr` + `amazonaws.com`, `dkr.ecr` + `on.aws`,
+* an ISO region + `amazonaws.com`) are all refused.
+*/
+function parseEcrRegistryHost(imageUri) {
+	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	if (!m) return void 0;
+	const [, accountId, rawLabels, rawRegion, rawSuffix] = m;
+	if (!CANONICAL_REGION_SEGMENT.test(rawRegion)) return void 0;
+	if (!CANONICAL_URL_SUFFIX.test(rawSuffix)) return void 0;
+	const form = ECR_HOST_FORM_BY_LABELS.get(foldAsciiUpperCase(rawLabels));
+	if (!form) return void 0;
+	const region = foldAsciiUpperCase(rawRegion);
+	if (!REGION_SHAPE.test(region)) return void 0;
+	const suffix = foldAsciiUpperCase(rawSuffix);
+	const partition = derivePartitionAndUrlSuffix(region);
+	if (form.partitions && !form.partitions.includes(partition.partition)) return void 0;
+	if (suffix !== (form.fixedUrlSuffix ?? partition.urlSuffix)) return void 0;
+	return {
+		accountId,
+		region,
+		registryHost: `${accountId}.${form.labels}.${region}.${suffix}`,
+		form
+	};
+}
+
 //#endregion
 //#region src/local/ecs-task-resolver.ts
 var EcsTaskResolutionError = class EcsTaskResolutionError extends Error {
@@ -7523,13 +7713,13 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 		const value = e["Value"];
 		if (!key) continue;
 		if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-			environment[key] = String(value);
+			defineOwnKey(environment, key, String(value));
 			continue;
 		}
 		if (subContext) {
 			const { result: sub, consumedSensitive } = resolveWithSensitivity(value, subContext);
 			if (sub.kind === "literal") {
-				environment[key] = String(sub.value);
+				defineOwnKey(environment, key, String(sub.value));
 				if (consumedSensitive) sensitiveEnvKeys.push(key);
 				continue;
 			}
@@ -7692,9 +7882,10 @@ function buildSubstitutionContextFromImageContext(context) {
 * Parse the `Image` field of an ECS container definition.
 *
 * Three shapes:
-*   - `<account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` — same-account
-*     same-region ECR. Cross-account/region is hard-errored (matches
-*     `cdkl invoke`'s ECR-pull semantics).
+*   - `<account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` — ECR, in any
+*     host form `ECR_REGISTRY_HOST_FORMS` lists (FIPS / dual-stack too) and any
+*     partition. Pulled through `pullEcrImage` (cross-account / cross-region
+*     below).
 *   - `Fn::Sub` / `Fn::Join` / `Ref` referencing a `Code.fromAsset`-style
 *     CDK asset image. Surfaces `kind: 'cdk-asset'` with the optional
 *     asset hash so the runner can route through `docker-build.ts`.
@@ -7741,12 +7932,12 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 		if (substituted.includes("AWS::")) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image that references AWS pseudo parameters (${substituted}). ${getEmbedConfig().productName} could not resolve them: confirm AWS credentials are configured so STS GetCallerIdentity succeeds, and that --region / AWS_REGION names the target region. Workaround: build the image locally (ContainerImage.fromAsset) or pin a public image.`);
 		throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image with unresolved \${...} placeholders (${substituted}). ${getEmbedConfig().cliName} only resolves AWS pseudo parameters and same-stack AWS::ECR::Repository refs.`);
 	}
-	const ecrMatch = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\//.exec(substituted);
-	if (ecrMatch) return {
+	const ecrHost = parseEcrRegistryHost(substituted);
+	if (ecrHost) return {
 		kind: "ecr",
 		uri: substituted,
-		account: ecrMatch[1],
-		region: ecrMatch[2]
+		account: ecrHost.accountId,
+		region: ecrHost.region
 	};
 	return {
 		kind: "public",
@@ -7782,12 +7973,12 @@ function classifyResolvedImage(uri) {
 		if (hashMatch) out.assetHash = hashMatch[1];
 		return out;
 	}
-	const ecrMatch = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\//.exec(uri);
-	if (ecrMatch) return {
+	const ecrHost = parseEcrRegistryHost(uri);
+	if (ecrHost) return {
 		kind: "ecr",
 		uri,
-		account: ecrMatch[1],
-		region: ecrMatch[2]
+		account: ecrHost.accountId,
+		region: ecrHost.region
 	};
 	return {
 		kind: "public",
@@ -8046,11 +8237,11 @@ async function applyCrossStackResolverToTask(task, context) {
 			const value = e["Value"];
 			if (!key) continue;
 			if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") continue;
-			if (key in container.environment) continue;
+			if (Object.hasOwn(container.environment, key)) continue;
 			if (!isCrossStackIntrinsic(value)) continue;
 			const { result: sub, consumedSensitive } = await resolveWithSensitivityAsync(value, context);
 			if (sub.kind === "literal") {
-				container.environment[key] = String(sub.value);
+				defineOwnKey(container.environment, key, String(sub.value));
 				resolvedEnvKeys.add(key);
 				if (consumedSensitive && !container.sensitiveEnvKeys.includes(key)) container.sensitiveEnvKeys.push(key);
 			}
@@ -8805,49 +8996,27 @@ function buildDockerBuildCommand(source, tag, platformOverride) {
 //#endregion
 //#region src/local/ecr-puller.ts
 /**
-* ECR pull fallback for `cdkl invoke` / `cdkl start-api` /
-* `cdkl run-task`. When the image URI resolves to an ECR repo but
-* doesn't match any cdk.out asset (typical when invoking a stack
-* deployed elsewhere or sharing a centralized registry), cdk-local
-* authenticates against the target registry and runs `docker pull`.
-*
-* **Cross-account / cross-region** (#455):
-*   - Same-account, same-region: fast path. No STS hop. The default
-*     credential chain is used directly for `ecr:GetAuthorizationToken`.
-*   - `ecrRoleArn` is provided: `sts:AssumeRole` is issued via the
-*     default credential chain to obtain temporary credentials for the
-*     target account. The resulting credentials authenticate the ECR
-*     client (regardless of region — the ECR client is built for the
-*     URI's region, which can differ from the caller's profile region).
-*   - Cross-account, NO `ecrRoleArn`: cdk-local falls through to the
-*     default credential chain. This works when the caller has been
-*     granted cross-account `ecr:GetAuthorizationToken` +
-*     `ecr:BatchGetImage` permissions on the target repository via an
-*     IAM policy; otherwise AWS rejects the call with `AccessDenied`
-*     and the user is pointed at `--ecr-role-arn`.
-*
-* The `--no-pull` semantics (C3 in the design doc):
-*   - When NOT set: `ecrLogin` + `docker pull <uri>`.
-*   - When set: skip `docker pull`. If the image isn't in the local
-*     cache, the subsequent `docker run` will fail; we surface a clearer
-*     "image not in local cache" error here so the user knows to drop
-*     `--no-pull` or pre-pull manually.
-*/
-/** Regex matching the `<acct>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` shape. */
-const ECR_URI_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\/([^:]+):(.+)$/;
-/**
 * Parse an ECR image URI. Returns `undefined` for non-ECR URIs (typically:
 * Docker Hub, public.ecr.aws, gcr.io, ...) — those are user-managed
 * images we don't try to authenticate against.
+*
+* Recognizes every host form in `ECR_REGISTRY_HOST_FORMS` (plain, FIPS,
+* dual-stack, dual-stack FIPS) in every partition, each with the suffix that
+* form carries for its region (issue #760) — see `parseEcrRegistryHost`.
 */
 function parseEcrUri(imageUri) {
-	const m = ECR_URI_REGEX.exec(imageUri);
+	const host = parseEcrRegistryHost(imageUri);
+	if (!host) return void 0;
+	const canonicalUri = canonicalizeImageUriHost(imageUri);
+	const m = /^([^:]+):(.+)$/.exec(canonicalUri.slice(canonicalUri.indexOf("/") + 1));
 	if (!m) return void 0;
 	return {
-		accountId: m[1],
-		region: m[2],
-		repository: m[3],
-		tag: m[4]
+		accountId: host.accountId,
+		region: host.region,
+		repository: m[1],
+		tag: m[2],
+		canonicalUri,
+		registryHost: host.registryHost
 	};
 }
 /**
@@ -8887,17 +9056,20 @@ function isCredentialFresh(creds) {
 *
 * Auto-detects cross-account from `STS:GetCallerIdentity` and assumes
 * the supplied role when set. Returns the image URI the caller should
-* pass to `docker run` (same as the input — no rewriting).
+* pass to `docker run`: the input with its registry host ASCII-lower-cased
+* (`ParsedEcrUri.canonicalUri`), so the run names the same spelling the pull
+* and the login used; the repository path and tag are unchanged.
 */
 async function pullEcrImage(imageUri, options) {
 	const logger = getLogger().child("ecr-puller");
 	const parsed = parseEcrUri(imageUri);
 	if (!parsed) throw new LocalInvokeBuildError(`Image URI '${imageUri}' is not an ECR URI. ${getEmbedConfig().cliName} invoke v1 only authenticates against ECR for the deployed-image fallback path.`);
+	const canonicalUri = parsed.canonicalUri;
 	const callerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
 	if (options.skipPull) {
-		logger.info(`Skipping ECR pull (--no-pull). Verifying ${imageUri} is in local cache...`);
-		await verifyImageInLocalCache(imageUri);
-		return imageUri;
+		logger.info(`Skipping ECR pull (--no-pull). Verifying ${canonicalUri} is in local cache...`);
+		await verifyImageInLocalCache(canonicalUri);
+		return canonicalUri;
 	}
 	const callerIdentityKey = `${options.profile ?? "_noprofile"}|${callerRegion ?? "_unset"}`;
 	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
@@ -8940,17 +9112,21 @@ async function pullEcrImage(imageUri, options) {
 		...assumed ? { credentials: assumed } : options.profile ? { profile: options.profile } : {}
 	});
 	try {
-		await ecrLogin(ecr, parsed.accountId, parsed.region);
+		await ecrLogin(ecr, {
+			accountId: parsed.accountId,
+			region: parsed.region,
+			registryHost: parsed.registryHost
+		});
 	} finally {
 		ecr.destroy();
 	}
-	logger.info(`Pulling ${imageUri}...`);
+	logger.info(`Pulling ${canonicalUri}...`);
 	try {
-		await runDockerForeground(["pull", imageUri]);
+		await runDockerForeground(["pull", canonicalUri]);
 	} catch (err) {
-		throw new LocalInvokeBuildError(`docker pull ${imageUri} failed: ${err.message}`);
+		throw new LocalInvokeBuildError(`docker pull ${canonicalUri} failed: ${err.message}`);
 	}
-	return imageUri;
+	return canonicalUri;
 }
 /**
 * Assume the supplied role via the SDK default credential chain and
@@ -8991,16 +9167,29 @@ async function assumeRoleForEcr(roleArn, callerRegion, profile, logger) {
 * Authenticate the local docker daemon against the target ECR registry.
 * Self-contained in this module so the local-invoke path stays
 * independent of any full asset-publish path's larger surface area.
-*/
-async function ecrLogin(client, accountId, region) {
-	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region})`);
+*
+* The login endpoint is ALWAYS the host the PULL targets (issue #760):
+* docker's credential store is keyed on the hostname verbatim, so a login to
+* any other host leaves the pull with no credentials (`no basic auth
+* credentials`). `GetAuthorizationToken`'s `proxyEndpoint` is therefore NOT
+* used: it names the CALLER's default registry on the plain host, which is the
+* wrong host for a FIPS / dual-stack pull and the wrong ACCOUNT for a
+* cross-account pull made on the caller's own credentials (a repository policy
+* grant, no `--ecr-role-arn`). The token is principal-scoped, not host-scoped:
+* measured on real ECR, one token authenticates the plain, FIPS and dual-stack
+* hosts alike. The password reaches docker only over `--password-stdin`, never
+* argv.
+*/
+async function ecrLogin(client, target) {
+	const { accountId, region, registryHost } = target;
+	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region}, host=${registryHost})`);
 	const authData = (await client.send(new GetAuthorizationTokenCommand({})).catch((err) => {
 		throw new LocalInvokeBuildError(`ECR GetAuthorizationToken failed (account=${accountId}, region=${region}): ${describeAwsFailureForWarn(err, "ECR GetAuthorizationToken")}. Verify the credentials can call ecr:GetAuthorizationToken.`);
 	})).authorizationData?.[0];
 	if (!authData?.authorizationToken) throw new LocalInvokeBuildError("Failed to get ECR authorization token");
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError("ECR authorization token has unexpected shape (missing username/password)");
-	const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.amazonaws.com`;
+	const endpoint = `https://${registryHost}`;
 	try {
 		await runDockerStreaming([
 			"login",
@@ -9298,7 +9487,7 @@ async function runDetached(opts) {
 		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
 	}
 	const sensitiveKeys = opts.sensitiveEnvKeys && opts.sensitiveEnvKeys.size > 0 ? /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...opts.sensitiveEnvKeys]) : SENSITIVE_ENV_KEYS;
-	const passthroughEnv = appendEnvFlags(args, opts.env, sensitiveKeys);
+	const { passthrough: passthroughEnv, collisions } = appendEnvFlags(args, opts.env, sensitiveKeys);
 	if (opts.tmpfs) args.push("--tmpfs", `${opts.tmpfs.target}:rw,size=${opts.tmpfs.sizeMb}m`);
 	if (opts.workingDir) args.push("--workdir", opts.workingDir);
 	let entryPointTail = [];
@@ -9307,7 +9496,9 @@ async function runDetached(opts) {
 		entryPointTail = opts.entryPoint.slice(1);
 	}
 	args.push(opts.image, ...entryPointTail, ...opts.cmd);
-	getLogger().child("docker").debug(`${getDockerCmd()} ${redactAwsCredentialsInArgs(args).join(" ")}`);
+	const logger = getLogger().child("docker");
+	logger.debug(`${getDockerCmd()} ${redactAwsCredentialsInArgs(args).join(" ")}`);
+	if (collisions.length > 0) logger.warn(describeRefusedSensitiveEnvKeys(`Container for image ${displayUntrustedValue(opts.image)}`, collisions));
 	const forwardedKeys = Object.keys(passthroughEnv);
 	const refusal = finchSecretArgvRefusal(forwardedKeys.filter((k) => opts.sensitiveEnvKeys?.has(k)), `Container for image ${opts.image}`);
 	if (refusal !== void 0) throw new DockerRunnerError(refusal);
@@ -9432,37 +9623,72 @@ const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
 * shell history. Non-sensitive keys keep the inline `-e KEY=VALUE` form
 * (fine for non-secret config, and keeps `--debug` output readable).
 *
-* Returns the `{ KEY: value }` map of routed-through keys; the caller MUST
-* merge it into the spawned docker process's `env` (see
+* Returns `passthrough`, the `{ KEY: value }` map of routed-through keys; the
+* caller MUST merge it into the spawned docker process's `env` (see
 * {@link execEnvForSecrets}) so docker can resolve each passed-through
 * key. Values still appear in `docker inspect` Config.Env — that is
 * inherent to container env and matches production behavior.
 *
+* A sensitive key whose NAME is a variable the container client (or the
+* dynamic loader / a helper it execs) reads ({@link isDockerClientEnvKey}), or
+* that is MALFORMED ({@link isMalformedEnvKey}: empty, or containing `=` /
+* NUL), gets NO flag and no passthrough entry, and is returned in
+* `collisions` so the caller can warn by NAME (issue #772). Written into the
+* client's spawn env it would hijack the client (`DOCKER_HOST` redirects the
+* daemon, `PATH` / `LD_PRELOAD` choose what code runs); and a value-less
+* `-e KEY` the spawn env refuses to set would make docker resolve it against
+* its OWN environment, handing the container the HOST's value. A key
+* containing `=` is refused because the OS parses the environ entry's name as
+* everything before the first `=`, so `PATH=/tmp/evil:` would poison `PATH`
+* while slipping past the name denylist. A NON-sensitive key is container
+* env only (`-e KEY=VALUE` on the argv) and is unaffected.
+*
 * Unlike `--env-file`, this handles multi-line values (e.g. PEM secrets)
 * and needs no temp file on disk.
 */
 function appendEnvFlags(args, env, sensitiveKeys) {
 	const passthrough = {};
+	const collisions = [];
 	for (const [k, v] of Object.entries(env)) if (sensitiveKeys.has(k)) {
+		if (isMalformedEnvKey(k) || isDockerClientEnvKey(k)) {
+			collisions.push(k);
+			continue;
+		}
 		args.push("-e", k);
-		passthrough[k] = v;
+		defineOwnKey(passthrough, k, v);
 	} else args.push("-e", `${k}=${v}`);
-	return passthrough;
+	return {
+		passthrough,
+		collisions
+	};
+}
+/**
+* The warning for keys {@link appendEnvFlags} refused. Names each key
+* display-safe (a key is template-chosen) and never a value.
+*/
+function describeRefusedSensitiveEnvKeys(subject, keys) {
+	return `${subject}: sensitive env var(s) ${keys.map(displayUntrustedValue).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack that client; a malformed name cannot form a valid environment variable). Rename the variable if the container needs it.`;
 }
 /**
 * Build the `env` option for an `execFile` / `spawn` call that runs a
 * `docker run` whose args include passed-through sensitive keys (from
-* {@link appendEnvFlags}). Returns `{ env: {...process.env, ...passthrough} }`
-* so docker inherits the normal environment PLUS the sensitive values it
-* must resolve, or `{}` when there is nothing to pass through (preserving
-* the default inherited-environment behavior).
+* {@link appendEnvFlags}). Returns `{ env }`: a copy of `process.env` with the
+* accepted passthrough keys written onto it as own keys, so docker inherits
+* the normal environment PLUS the sensitive values it must resolve. Returns
+* `{}` when no key is left to pass through (preserving the default
+* inherited-environment behavior).
+*
+* The client's own variables stay authoritative: a passthrough key that names
+* one ({@link isDockerClientEnvKey}) or is malformed ({@link isMalformedEnvKey})
+* is never written (issue #772). {@link appendEnvFlags} already keeps such a
+* key out of `passthrough`; this is defence in depth for any other caller.
 */
 function execEnvForSecrets(passthrough) {
-	if (Object.keys(passthrough).length === 0) return {};
-	return { env: {
-		...process.env,
-		...passthrough
-	} };
+	const keys = Object.keys(passthrough).filter((k) => !isMalformedEnvKey(k) && !isDockerClientEnvKey(k));
+	if (keys.length === 0) return {};
+	const env = { ...process.env };
+	for (const k of keys) defineOwnKey(env, k, passthrough[k]);
+	return { env };
 }
 /**
 * Returns a copy of `args` with any `-e <KEY>=<value>` pair whose KEY is
@@ -17287,6 +17513,40 @@ function availableApiIdentifiers(routes) {
 //#endregion
 //#region src/local/env-resolver.ts
 /**
+* Resolve a Lambda function's `Properties.Environment.Variables` for
+* `cdkl invoke`.
+*
+* Per the issue scope, v1 supports **literal values only**. Intrinsic
+* functions (`Ref` / `Fn::GetAtt` / `Fn::Sub` / etc.) in env vars are
+* unresolvable without state — they would substitute to whatever the
+* deployed value is, and we have no source for that here. Each unresolved
+* key is recorded in `unresolved` so the caller can warn the user; the
+* variable is **dropped** rather than silently substituted with garbage
+* (a bad env var that "exists" is harder to debug than one that's missing).
+*
+* `--env-vars <file>` overrides match SAM's shape (D5), with the
+* additional CDK ergonomics that a function-specific entry can be keyed
+* by either the CloudFormation logical ID or the CDK display path
+* (`Metadata['aws:cdk:path']`):
+*
+*   {
+*     "Parameters":           { "GLOBAL_KEY": "value" },
+*     "MyHandlerLogicalId":   { "FUNCTION_KEY": "value" },
+*     "MyStack/MyHandler":    { "FUNCTION_KEY": "value" }
+*   }
+*
+* Override merge order (lowest to highest priority):
+*   1. Template literal env vars
+*   2. `Parameters` (global, applied to every invoke)
+*   3. Function-specific entries (logical-ID or display-path keyed)
+*      applied in JSON insertion order, so a later key wins on conflict.
+*      This matches SAM's apply-in-order semantics; pick one form per
+*      function to avoid surprises.
+*
+* The override file may also clear a variable by setting it to `null`
+* (matches SAM behavior).
+*/
+/**
 * Resolve Lambda env vars for local invocation.
 *
 * @param logicalId         The function's CloudFormation logical ID. Used
@@ -17310,7 +17570,7 @@ function availableApiIdentifiers(routes) {
 function resolveEnvVars$1(logicalId, displayPath, templateEnv, overrides) {
 	const resolved = {};
 	const unresolved = [];
-	if (templateEnv) for (const [key, value] of Object.entries(templateEnv)) if (isLiteralEnvValue(value)) resolved[key] = String(value);
+	if (templateEnv) for (const [key, value] of Object.entries(templateEnv)) if (isLiteralEnvValue(value)) defineOwnKey(resolved, key, String(value));
 	else unresolved.push(key);
 	if (overrides) {
 		applyEnvOverrideMap(resolved, overrides.Parameters);
@@ -17345,7 +17605,7 @@ function resolveEnvVars$1(logicalId, displayPath, templateEnv, overrides) {
 function applyEnvOverrideMap(acc, map) {
 	if (!map) return;
 	for (const [key, value] of Object.entries(map)) if (value === null) delete acc[key];
-	else if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") acc[key] = String(value);
+	else if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") defineOwnKey(acc, key, String(value));
 }
 /**
 * A value is "literal" iff it's a string / number / boolean. CFn intrinsic
@@ -23471,7 +23731,8 @@ async function createNetworkAndSidecar(args) {
 		if (credentials.sessionToken) sidecarEnv["AWS_SESSION_TOKEN"] = credentials.sessionToken;
 	}
 	if (cluster) sidecarEnv["CLUSTER"] = cluster;
-	const sidecarPassthroughEnv = appendEnvFlags(sidecarArgs, sidecarEnv, SENSITIVE_ENV_KEYS);
+	const { passthrough: sidecarPassthroughEnv, collisions: sidecarCollisions } = appendEnvFlags(sidecarArgs, sidecarEnv, SENSITIVE_ENV_KEYS);
+	if (sidecarCollisions.length > 0) logger.warn(describeRefusedSensitiveEnvKeys("Metadata sidecar", sidecarCollisions));
 	sidecarArgs.push(METADATA_ENDPOINT_IMAGE);
 	warnFinchArgvExposure(Object.keys(sidecarPassthroughEnv));
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
@@ -23786,7 +24047,7 @@ async function runEcsTask(task, options, state) {
 	const startOrder = topoSort(buildDependencyGraph(task.containers), task.containers);
 	const finchRefusals = [];
 	for (const c of task.containers) {
-		const refusal = finchSecretArgvRefusal([...c.secrets.map((s) => s.name), ...c.sensitiveEnvKeys], `Container '${c.name}'`);
+		const refusal = finchSecretArgvRefusal([...c.secrets.map((s) => s.name), ...c.sensitiveEnvKeys].filter((n) => !isMalformedEnvKey(n) && !isDockerClientEnvKey(n)), `Container '${c.name}'`);
 		if (refusal !== void 0) finchRefusals.push(refusal);
 	}
 	if (finchRefusals.length > 0) throw new EcsTaskRunnerError(finchRefusals.join("\n"));
@@ -23865,6 +24126,7 @@ async function runEcsTask(task, options, state) {
 			args: built.args,
 			sensitiveEnv: built.sensitiveEnv
 		});
+		if (built.collisions.length > 0) logger.warn(describeRefusedSensitiveEnvKeys(`Container ${displayUntrustedValue(container.name)}`, built.collisions));
 		for (const ep of built.publishedEndpoints) state.publishedEndpoints.push(ep);
 	}
 	const startedByName = /* @__PURE__ */ new Map();
@@ -24308,8 +24570,8 @@ function buildDockerRunArgs(opts) {
 		finalEnv["AWS_SHARED_CREDENTIALS_FILE"] = opts.profileCredentialsFile.containerPath;
 		finalEnv["AWS_PROFILE"] = opts.profileCredentialsFile.profileName;
 	}
-	Object.assign(finalEnv, container.environment);
-	for (const s of secrets) finalEnv[s.name] = s.value;
+	for (const [k, v] of Object.entries(container.environment)) defineOwnKey(finalEnv, k, v);
+	for (const s of secrets) defineOwnKey(finalEnv, s.name, s.value);
 	const overrides = opts.envOverrides;
 	if (overrides) {
 		applyEnvOverrideMap(finalEnv, overrides["Parameters"]);
@@ -24318,7 +24580,7 @@ function buildDockerRunArgs(opts) {
 	const sensitiveEnvKeys = new Set(SENSITIVE_ENV_KEYS);
 	for (const s of secrets) sensitiveEnvKeys.add(s.name);
 	for (const k of container.sensitiveEnvKeys) sensitiveEnvKeys.add(k);
-	const sensitiveEnv = appendEnvFlags(args, finalEnv, sensitiveEnvKeys);
+	const { passthrough: sensitiveEnv, collisions } = appendEnvFlags(args, finalEnv, sensitiveEnvKeys);
 	if (container.user) args.push("--user", container.user);
 	if (container.privileged) args.push("--privileged");
 	if (container.readonlyRootFilesystem) args.push("--read-only");
@@ -24341,6 +24603,7 @@ function buildDockerRunArgs(opts) {
 	return {
 		args,
 		sensitiveEnv,
+		collisions,
 		publishedEndpoints
 	};
 }
@@ -25514,7 +25777,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-leyvDn1u.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -25533,7 +25796,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-leyvDn1u.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -25548,7 +25811,7 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerRestartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-leyvDn1u.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["restart", containerId]);
 };
 let dockerRestartImpl = defaultDockerRestartImpl;
@@ -25588,7 +25851,7 @@ async function disconnectOldFromSharedNetwork(oldInstance) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-leyvDn1u.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -25765,7 +26028,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-leyvDn1u.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -25785,7 +26048,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-B5yU__zC.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-leyvDn1u.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -35092,7 +35355,7 @@ function resolveEnvVars(kind, values) {
 		const flat = {};
 		for (const row of value) {
 			const { left, right } = row ?? {};
-			if (nonEmptyStr(left)) flat[left.trim()] = typeof right === "string" ? right : "";
+			if (nonEmptyStr(left)) defineOwnKey(flat, left.trim(), typeof right === "string" ? right : "");
 		}
 		return Object.keys(flat).length > 0 ? { Parameters: flat } : void 0;
 	}
@@ -40920,4 +41183,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, resolveProfileCredentials as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, isProxyEnvConfigured as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildProxyClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, buildStsClientConfig as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-CV21zLBM.js.map
+//# sourceMappingURL=local-studio-U-gD2HSf.js.map