cdk-local 0.149.7 → 0.149.9

package/dist/docker-cmd-leyvDn1u.js

@@ -1,1659 +0,0 @@
-import { readlinkSync, realpathSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { spinner } from "@clack/prompts";
-import { spawn } from "node:child_process";
-
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) {
-		__defProp(target, name, {
-			get: all[name],
-			enumerable: true
-		});
-	}
-	if (!no_symbols) {
-		__defProp(target, Symbol.toStringTag, { value: "Module" });
-	}
-	return target;
-};
-
-//#endregion
-//#region src/local/embed-config.ts
-const DEFAULTS = {
-	cliName: "cdkl",
-	binaryName: "cdkl",
-	productName: "cdk-local",
-	resourceNamePrefix: "cdkl",
-	awsBindMountPath: "/cdk-local-aws",
-	envPrefix: "CDKL",
-	sigV4StrictByDefault: false,
-	sigV4OptFlag: "--strict-sigv4"
-};
-let current = DEFAULTS;
-/**
-* Resolve and install the active embed config. Called once per command
-* factory with the host's overrides (or `undefined` for native cdkl
-* behavior). Idempotent: re-calling with the same overrides is a no-op,
-* which is why all four factories may safely set the same config.
-*/
-function setEmbedConfig(config) {
-	current = {
-		cliName: config?.cliName ?? DEFAULTS.cliName,
-		binaryName: config?.binaryName ?? DEFAULTS.binaryName,
-		productName: config?.productName ?? DEFAULTS.productName,
-		resourceNamePrefix: config?.resourceNamePrefix ?? DEFAULTS.resourceNamePrefix,
-		awsBindMountPath: config?.awsBindMountPath ?? DEFAULTS.awsBindMountPath,
-		envPrefix: config?.envPrefix ?? DEFAULTS.envPrefix,
-		sigV4StrictByDefault: config?.sigV4StrictByDefault ?? DEFAULTS.sigV4StrictByDefault,
-		sigV4OptFlag: config?.sigV4OptFlag ?? DEFAULTS.sigV4OptFlag
-	};
-}
-/** The active resolved embed config. */
-function getEmbedConfig() {
-	return current;
-}
-/** Restore cdk-local defaults. Primarily a test-isolation helper. */
-function resetEmbedConfig() {
-	current = DEFAULTS;
-}
-
-//#endregion
-//#region src/utils/logger.ts
-/**
-* ANSI color codes
-*
-* Kept internal — `ConsoleLogger.formatMessage` references these for the
-* verbose/compact mode level prefixes.
-*/
-const colors = {
-	reset: "\x1B[0m",
-	bright: "\x1B[1m",
-	dim: "\x1B[2m",
-	red: "\x1B[31m",
-	green: "\x1B[32m",
-	yellow: "\x1B[33m",
-	blue: "\x1B[34m",
-	cyan: "\x1B[36m",
-	gray: "\x1B[90m"
-};
-function formatTimestamp() {
-	return (/* @__PURE__ */ new Date()).toISOString();
-}
-/**
-* Resolve whether ANSI color should be emitted by default.
-*
-* Color is appropriate for an interactive terminal but is noise (literal
-* `\x1b[31m...` escapes) when the output is a pipe — e.g. when `cdkl studio`
-* spawns `cdkl invoke` / a serve command as a child and captures its output to
-* render in the browser, where the raw escapes leak as visible text. So the
-* default tracks the stdout TTY-ness, with the two standard env overrides:
-*
-* - `NO_COLOR` (any non-empty value) forces colors OFF (https://no-color.org).
-* - `FORCE_COLOR` (non-empty, not `'0'` / `'false'`) forces colors ON, even
-*   when not a TTY (the convention many CLIs honor for CI / log capture).
-* - otherwise: on when `process.stdout.isTTY`.
-*
-* We gate on `process.stdout.isTTY` even though warn / error go to stderr via
-* `console.error` / `console.warn`. In the case this fix targets — a piped
-* child (e.g. studio) — NEITHER stdout nor stderr is a TTY, so gating on stdout
-* still yields colorless output. Tracking stdout matches common CLI tooling and
-* keeps a single, predictable signal; an explicit `useColors` argument (passed
-* by child loggers) always overrides this default.
-*/
-function resolveDefaultUseColors() {
-	const noColor = process.env["NO_COLOR"];
-	if (noColor !== void 0 && noColor !== "") return false;
-	const forceColor = process.env["FORCE_COLOR"];
-	if (forceColor !== void 0 && forceColor !== "" && forceColor !== "0" && forceColor !== "false") return true;
-	return !!process.stdout.isTTY;
-}
-/**
-* Console logger implementation
-*
-* Supports two output modes:
-* - verbose (debug level): timestamps, module prefixes, all details
-* - compact (info level): clean output without timestamps or prefixes
-*/
-var ConsoleLogger = class {
-	level;
-	useColors;
-	constructor(level = "info", useColors = resolveDefaultUseColors()) {
-		this.level = level;
-		this.useColors = useColors;
-	}
-	shouldLog(level) {
-		const levels = [
-			"debug",
-			"info",
-			"warn",
-			"error"
-		];
-		const currentLevelIndex = levels.indexOf(this.level);
-		return levels.indexOf(level) >= currentLevelIndex;
-	}
-	formatMessage(level, message, ...args) {
-		const formattedArgs = args.length > 0 ? " " + args.map((a) => JSON.stringify(a)).join(" ") : "";
-		if (this.level === "debug") {
-			const timestamp = formatTimestamp();
-			const levelStr = level.toUpperCase().padEnd(5);
-			if (this.useColors) {
-				const levelColor = {
-					debug: colors.gray,
-					info: colors.blue,
-					warn: colors.yellow,
-					error: colors.red
-				}[level];
-				return `${colors.dim}${timestamp}${colors.reset} ${levelColor}${levelStr}${colors.reset} ${message}${formattedArgs}`;
-			}
-			return `${timestamp} ${levelStr} ${message}${formattedArgs}`;
-		}
-		if (level === "error") {
-			const line = `ERROR: ${message}${formattedArgs}`;
-			return this.useColors ? `${colors.red}${line}${colors.reset}` : line;
-		}
-		if (level === "warn") {
-			const line = `WARN: ${message}${formattedArgs}`;
-			return this.useColors ? `${colors.yellow}${line}${colors.reset}` : line;
-		}
-		return `${message}${formattedArgs}`;
-	}
-	emit(level, formatted) {
-		if (process.env["CDKL_LOG_STREAM"] === "stdout") {
-			console.log(formatted);
-			return;
-		}
-		if (level === "error") console.error(formatted);
-		else if (level === "warn") console.warn(formatted);
-		else if (level === "info") console.info(formatted);
-		else console.debug(formatted);
-	}
-	debug(message, ...args) {
-		if (this.shouldLog("debug")) this.emit("debug", this.formatMessage("debug", message, ...args));
-	}
-	info(message, ...args) {
-		if (this.shouldLog("info")) this.emit("info", this.formatMessage("info", message, ...args));
-	}
-	warn(message, ...args) {
-		if (this.shouldLog("warn")) this.emit("warn", this.formatMessage("warn", message, ...args));
-	}
-	error(message, ...args) {
-		if (this.shouldLog("error")) this.emit("error", this.formatMessage("error", message, ...args));
-	}
-	setLevel(level) {
-		this.level = level;
-	}
-	getLevel() {
-		return this.level;
-	}
-	child(prefix) {
-		return new ChildLogger(prefix, this.useColors);
-	}
-};
-/**
-* Child logger that always syncs level from global logger
-*/
-var ChildLogger = class extends ConsoleLogger {
-	prefix;
-	constructor(prefix, useColors) {
-		super("info", useColors);
-		this.prefix = prefix;
-	}
-	syncLevel() {
-		if (globalLogger) this.setLevel(globalLogger.getLevel());
-	}
-	debug(message, ...args) {
-		this.syncLevel();
-		super.debug(`[${this.prefix}] ${message}`, ...args);
-	}
-	info(message, ...args) {
-		this.syncLevel();
-		const msg = this.getLevel() === "debug" ? `[${this.prefix}] ${message}` : message;
-		super.info(msg, ...args);
-	}
-	warn(message, ...args) {
-		this.syncLevel();
-		const msg = this.getLevel() === "debug" ? `[${this.prefix}] ${message}` : message;
-		super.warn(msg, ...args);
-	}
-	error(message, ...args) {
-		this.syncLevel();
-		const msg = this.getLevel() === "debug" ? `[${this.prefix}] ${message}` : message;
-		super.error(msg, ...args);
-	}
-};
-/**
-* Resolve the initial log level from the `CDKL_LOG_LEVEL` env var, falling
-* back to `'info'`. This is primarily an internal contract: `cdkl studio`
-* spawns its single-shot `cdkl invoke` child with `CDKL_LOG_LEVEL=warn` so
-* cdk-local's OWN synth / orchestration progress (toolkit "Successfully
-* synthesized to ...", asset-bundling lines, info-level status) is silenced
-* in the child — leaving the studio LOGS panel showing only the Lambda
-* container's runtime logs (which stream straight from `docker logs` and are
-* unaffected by this level) plus the response. `--verbose` still overrides to
-* `debug` at the command layer. An invalid value is ignored.
-*/
-function resolveConfiguredLogLevel() {
-	const env = process.env["CDKL_LOG_LEVEL"];
-	if (env === "debug" || env === "info" || env === "warn" || env === "error") return env;
-	return "info";
-}
-let globalLogger = null;
-function getLogger() {
-	if (!globalLogger) globalLogger = new ConsoleLogger(resolveConfiguredLogLevel());
-	return globalLogger;
-}
-
-//#endregion
-//#region src/local/credential-error.ts
-/**
-* Rendering an AWS SDK failure into a log line cdk-local is willing to print
-* at DEFAULT level (issues #564, #570).
-*
-* # Why a shared module
-*
-* Issue #564 settled the policy for one site — the credential-chain failure
-* in {@link file://./sigv4-verify.ts} — and #570 found the same shape at nine
-* more, spread across five `src/cli/commands/*.ts` files. Every one of them
-* relays a third-party error's `message` into a `logger.warn`, so they share
-* one question and must not grow nine answers to it.
-*
-* SCOPE, stated so a later sweep finds a decision rather than an oversight:
-* this module governs those nine plus sigv4-verify's one, and its
-* {@link flattenToOneLine} additionally covers every other wire-derived value
-* printed on those lines (the role ARN, on the failure AND success paths).
-*
-* Issue #579 extended it to the AWS SDK error relays elsewhere under
-* `src/local/**` (plus `local-studio.ts`'s image-context warn), so the policy
-* is no longer scoped to `src/cli/commands/**`:
-* `cfn-local-state-provider.ts` (`formatAwsErrorForWarn`, six callers),
-* `ssm-parameter-resolver.ts` (whose `formatSsmError` was DELETED rather than
-* fixed — it was a second spelling of the same forging vector),
-* `state-resolver.ts`, `cloudfront-kvs-client.ts`, `cloudfront-s3-origin.ts`,
-* `layer-arn-materializer.ts`, `ecr-puller.ts`, `ecs-secrets-resolver.ts` and
-* `httpv2-service-integration.ts`. Each was decided on the SAME two axes below
-* rather than rewritten mechanically, and a `catch` around a purely LOCAL
-* operation was left alone: `agentcore-s3-bundle.ts`'s unzip and
-* `layer-arn-materializer.ts`'s presigned-URL download / unzip see no
-* credential chain and no service response, so there is nothing here for them.
-*
-* The test is what a `catch` CAN SEE, and applying it by LOCATION instead is
-* how the sweep first got `agentcore-s3-bundle.ts` wrong. Its `try` does wrap
-* `unzipSync` and nothing else — but that made the S3 `GetObject` above it
-* UNCOVERED, not out of scope: it had no `catch` at all, so the raw SDK error
-* propagated to `withErrorHandling` -> `formatError`, which prints
-* `${error.name}: ${error.message}` unflattened and unclamped at DEFAULT
-* level, and the default credential chain is what a run without
-* `--assume-role` uses. "Outside that `catch`" is not "outside the sweep";
-* ask which populations reach the site, and if the answer is "nothing catches
-* it here", follow it to the frame that does.
-*
-* #579 also widened what LEVEL means, and the widening is the useful part:
-* `httpv2-service-integration.ts`'s relay is not a log line at all, it is a
-* served HTTP RESPONSE BODY — the widest reader in the sweep, since it needs
-* neither `--verbose` nor access to the terminal, and the studio capture proxy
-* records it onto the timeline besides. The axis is about READERS, not about
-* logs.
-*
-* TWO CALLING CONVENTIONS this imposes, both found by #579 rather than
-* anticipated here:
-*
-*   1. Render each failure ONCE. {@link describeAwsFailureForWarn} EMITS the
-*      `debug` line, so calling it twice for one error prints that line twice
-*      (`cfn-local-state-provider.ts`'s `load` did, having rendered the same
-*      failure for its warn and for `lastLoadError`).
-*   2. Re-raise cdk-local's OWN throws ABOVE the relay, with an identifiable
-*      class. The discriminator is positive, so a `catch` that also catches
-*      the caller's own `throw new Error('...')` withholds text cdk-local
-*      wrote itself — which is the diagnostic loss this file's
-*      {@link describeCredentialLoadFailure} note calls "a real diagnostic
-*      loss, accepted". #579 stopped accepting it where it was cheap not to:
-*      `layer-arn-materializer.ts`'s ARN-shape and missing-`Content.Location`
-*      guards became `LayerMaterializationError`s and are re-raised, and
-*      `httpv2-service-integration.ts`'s missing-RequestParameter 400 became a
-*      `ServiceIntegrationRequestError` so an actionable 400 body did not
-*      degrade into a class name and a character count.
-*
-* TWO CATCH-ALL relays remain outside it, and both are UNCOVERED. An earlier
-* revision of this note gave them opposite verdicts in adjacent paragraphs —
-* clearing one and rejecting the other on the same evidence — which was simply
-* wrong about the first, so both now read the same way:
-*
-*   - `cloudfront-server.ts:129`'s `Request handling failed: ${err.message}`.
-*     It is what makes `cloudfront-kvs-client.ts`'s throw a DEFAULT-level
-*     line, and for THAT sub-path the text arrives pre-sanitized — but it is a
-*     catch-all over the whole request pipeline, so an origin fetch, an
-*     edge-function invoke or an SDK error raised anywhere below it still
-*     reaches the line RAW.
-*   - `ecs-service-emulator.ts`'s `logger.error` at three sites (`:909`,
-*     `:1508`, `:1599`). One of them does carry
-*     `ecs-secrets-resolver.ts`'s `EcsSecretsResolutionError`, which this
-*     module sanitized on the way in — and reasoning from that to "the relay
-*     is safe" is the SAME generalisation the bullet above rejects. All three
-*     are catch-alls over a whole reload or replica roll, relaying
-*     `err instanceof Error ? err.message : String(err)`, and what they
-*     usually carry is docker CLI stderr, which is multi-line.
-*
-* So: one sub-path arriving pre-sanitized never clears a catch-all. Both need
-* the same per-occurrence call as everything else in this list. Neither is
-* done here — `cloudfront-server.ts` is out of this change's scope, and the
-* emulator's three are a different population (docker output, not SDK errors)
-* that wants the flattening half rather than the withholding half.
-*
-* # The two axes that decide it
-*
-* PROVENANCE alone says relay: a credential-chain error is about the
-* developer's own machine configuration, not something cdk-local fetched out
-* of a secret store (issue #555's criterion). Two further axes overrule it:
-*
-*   LEVEL — these are `warn`, so they print on a plain `cdkl start-api` /
-*   `cdkl invoke` run rather than only under `--verbose`, and `cdkl studio`
-*   mirrors a serve child's output into a log ring it serves over HTTP.
-*   Everybody sees a `warn`; only someone who asked sees a `debug`.
-*
-*   RECONSTRUCTION — what can reach the string is not a hint about a secret,
-*   it is the secret. `@aws-sdk/credential-provider-process` builds its
-*   failure as `new CredentialsProviderError(error.message)` where `error` is
-*   the rejection of `promisify(child_process.exec)`, i.e. Node's
-*   `Command failed: <command line>\n<stderr>`, and a passphrase written on a
-*   `credential_process` command line is an ordinary thing to have. (Verified
-*   at `@aws-sdk/credential-provider-process@3.972.{39,41,43}`
-*   `dist-cjs/index.js:56` in this repo's tree.)
-*
-* # Where these sites DIFFER from sigv4-verify's, and why the answer differs
-*
-* {@link file://./sigv4-verify.ts}'s `catch` wraps `client.config.credentials()`
-* and nothing else: credential-chain resolution, with no AWS operation
-* cdk-local asked for. Nothing actionable is lost by withholding all of it,
-* so that site withholds unconditionally and keeps the text at `debug`.
-*
-* The #570 sites wrap an SDK call cdk-local DID make — STS
-* `GetCallerIdentity` or `AssumeRole` — so two unrelated error populations
-* land in one `catch`:
-*
-*   1. the credential chain failed before the request went out, which is
-*      #564's population exactly, and
-*   2. STS answered with a modeled service exception — `ExpiredTokenException`,
-*      `AccessDenied` — whose message IS the diagnosis the user needs, and
-*      which never went near `credential_process`. (Spelled as the SDK
-*      spells them: `@aws-sdk/client-sts` models `ExpiredTokenException`
-*      (`dist-cjs/models/errors.js:6`), while `AccessDenied` is unmodeled and
-*      arrives as the wire code verbatim — which is exactly why the name is
-*      clamped rather than trusted.)
-*
-* Blanket-withholding would turn the single commonest failure of these
-* commands (`ExpiredTokenException: The security token included in the
-* request is expired`) into a class name and a character count. So the split
-* is by population, via {@link describeAwsFailureForWarn}.
-*
-* # The safe state is defined POSITIVELY
-*
-* The discriminator is not a deny-list of bad error shapes — #564 rejected
-* that reasoning for the `Command failed:` first line, and it loses the same
-* race here. It is the SDK's own structural test for "this came off the wire
-* as a modeled service error" ({@link isAwsServiceException}). Anything that
-* does not match — a chain failure, a socket error, a bare `throw 'x'` — is
-* withheld. An unrecognised shape therefore fails toward withholding.
-*
-* A hostile endpoint cannot steer the discriminator into disclosing MORE.
-* `$fault` / `$metadata` are set by the SDK from the HTTP response, not from
-* anything the body names, so forging `x-amzn-errortype:
-* CredentialsProviderError` only changes `err.name` — the response is still a
-* service response, so the error stays on the KEPT branch and its message is
-* still the sanitized, capped one the endpoint could have sent under any
-* other name. What the endpoint cannot do is move a `credential_process`
-* command line onto that branch: that text originates locally, inside a
-* `CredentialsProviderError` that never acquires `$fault`.
-*
-* # What this does NOT close
-*
-* A single-LINE forged string still reaches readers other than a human. It no
-* longer redirects the studio capture proxy: issue #578 anchored every
-* `cdkl studio` ready pattern to the start of the line, made the serve manager
-* skip a line carrying cdk-local's own `WARN: ` / `ERROR: ` decoration
-* outright, and bounded the resolved upstream to loopback — so a message
-* containing `Server listening on http://...` is neither read as a banner nor
-* usable as a destination. What remains is the reader this sanitizer was
-* always aimed at: a HUMAN scanning the log, for whom a forged-looking line is
-* still misleading text, which is why the flattening + capping stay.
-*/
-/**
-* Longest service-exception message relayed into a `warn` line, in
-* characters.
-*
-* A modeled STS error's message is WIRE-DERIVED — the SDK reads it out of the
-* response body — so its length is not cdk-local's to assume. Real ones run
-* to roughly 150 characters (`AccessDenied: User: arn:... is not authorized to
-* perform: sts:AssumeRole on resource: arn:...`), and the policy-quoting ones
-* are the longest, so the cap is set well above that: it exists to stop an
-* unbounded body from becoming an unbounded log line, not to trim ordinary
-* AWS text, which must survive intact or the branch buys nothing.
-*
-* Truncation is announced with the true length (see
-* {@link sanitizeServiceExceptionMessage}) so a capped line is never mistaken
-* for a complete one.
-*/
-const SERVICE_MESSAGE_MAX = 512;
-/**
-* Total stringification of a thrown value's message.
-*
-* `String(err)` is NOT total. That throw would escape the `catch` it is
-* called from and turn a warn-and-continue branch into a hard failure — a 500
-* from the SigV4 authorizer in #564's testing, and a dead `cdkl invoke` here.
-* One helper rather than an expression repeated per site, so the length
-* reported in a `warn` and the text printed at `debug` can never describe
-* different strings.
-*
-* CORRECTION to #564, measured on this repo's Node 24: `String(aSymbol)`
-* does NOT throw — it returns `'Symbol(x)'`, and it is template
-* INTERPOLATION (`` `${aSymbol}` ``) that raises
-* `TypeError: Cannot convert a Symbol value to a string`. Since both the old
-* code and this helper call `String()` explicitly, a `Symbol` throw was never
-* one of the reachable cases. The two that ARE reachable, both verified:
-* an object with a null prototype (`TypeError: Cannot convert object to
-* primitive value`, because it has no `toString`), and any value whose
-* `toString` / `Symbol.toPrimitive` throws — which a hostile or merely buggy
-* third-party error object is free to do.
-*
-* Named for what it does rather than for one caller: #564 shipped it as
-* `stringifyCredentialLoadFailure`, and #570 gave it a second population
-* (service exceptions) for which that name was simply wrong.
-*/
-function stringifyThrown(err) {
-	try {
-		return err instanceof Error ? String(err.message) : String(err);
-	} catch {
-		return "[unstringifiable throw]";
-	}
-}
-/**
-* The throwing class's name, clamped to something no input can forge.
-*
-* `err.name` is NOT input-independent, which is the whole reason this is a
-* function and not an interpolation. For an AWS service exception it is
-* WIRE-DERIVED: `@aws-sdk/core` builds it from the `x-amzn-errortype` header
-* / the body's `code` / `__type` through `sanitizeErrorCode`, which splits on
-* ',' ':' and '#' and does nothing else — no length cap, no newline stripping
-* (read at `@aws-sdk/core@3.974.13` `protocols/index.js:324`). Such an
-* exception reaches these call sites, because `credential-provider-ini` calls
-* the STS `roleAssumer` unwrapped and because the #570 sites invoke STS
-* directly. So a hostile or hijacked credential endpoint
-* (`AWS_CONTAINER_CREDENTIALS_FULL_URI`, a redirected IMDS) answering
-* `x-amzn-errortype: Foo\nWARN: signature verified` could FORGE log lines
-* into the `warn` stream — and into the studio ring served over HTTP.
-*
-* A bare identifier of at most 64 characters is what every real class name is
-* and what no injected value can be; anything else degrades to `'unknown'`,
-* which also covers a non-`Error` throw, so the field never names a class the
-* throw was not.
-*
-* Note the WRONG fix: `err.name.slice(0, 64)` keeps the newline, so the
-* forgery survives truncation.
-*/
-function clampErrorName(err) {
-	let rawKind;
-	try {
-		rawKind = err instanceof Error ? err.name : "unknown";
-	} catch {
-		return "unknown";
-	}
-	return typeof rawKind === "string" && /^[A-Za-z0-9_.-]{1,64}$/.test(rawKind) ? rawKind : "unknown";
-}
-/**
-* The thrown value's `code`, when it is a bare identifier, else `undefined`.
-*
-* This exists because withholding by class name alone is not discriminating
-* enough for the population that actually reaches the withheld branch most
-* often. `Region is missing`, `getaddrinfo ENOTFOUND sts.<region>.amazonaws.com`
-* and `connect ETIMEDOUT 169.254.169.254:80` all arrive as a plain `Error`, so
-* all three render as `Error; N-character message withheld` and the reader
-* cannot tell a misconfiguration from an unreachable endpoint.
-*
-* Node sets `code` on its system errors (`ENOTFOUND`, `ETIMEDOUT`,
-* `ECONNREFUSED`) and there it is a fixed enum chosen by the runtime. It is
-* NOT input-independent in general, though, and the earlier draft of this note
-* claimed it was: `@smithy/core`'s `decorateServiceException`
-* (`dist-cjs/submodules/client/index.js:795-802`) copies every key of the
-* PARSED RESPONSE BODY onto the exception, so an unmodeled error from a
-* hostile endpoint can carry a `code` of its choosing. The clamp is therefore
-* load-bearing rather than belt-and-braces, exactly as it is for
-* {@link clampErrorName}: what survives is at most 64 characters matching
-* `[A-Za-z0-9_.-]`, which cannot forge a line, and which is the same residue
-* the class name already accepts.
-*
-* `undefined` rather than `'unknown'` when there is none, so the caller can
-* omit the field entirely instead of printing a placeholder that says less
-* than nothing.
-*/
-function clampErrorCode(err) {
-	if (!err || typeof err !== "object") return void 0;
-	let raw;
-	try {
-		raw = err.code;
-	} catch {
-		return;
-	}
-	if (typeof raw !== "string") return void 0;
-	return /^[A-Za-z0-9_.-]{1,64}$/.test(raw) ? raw : void 0;
-}
-/**
-* Is `err` a modeled AWS service exception — i.e. did the SDK parse it out of
-* a service RESPONSE, rather than raise it while assembling the request?
-*
-* This is `ServiceException.isInstance`'s own structural test, reproduced
-* rather than imported: cdk-local loads `@aws-sdk/client-sts` lazily at every
-* one of these call sites (a dynamic `import()` inside the `try`), so taking
-* a static dependency on `@smithy/core` purely to type-test an error would
-* pull the SDK into the CLI's startup path. The structural form also keeps
-* working across the several `@smithy/core` copies pnpm resolves in this
-* tree, where an `instanceof` against one copy's class fails for an error
-* minted by another.
-*
-* The test is deliberately the SDK's and not a name list: a name list would
-* have to be extended for every new STS error code, and a missing entry would
-* fail toward DISCLOSING less, which is safe, but also toward hiding the
-* actionable message, which is the regression this split exists to avoid.
-*/
-function isAwsServiceException(err) {
-	if (!err || typeof err !== "object") return false;
-	const candidate = err;
-	try {
-		return Boolean(candidate.$metadata) && (candidate.$fault === "client" || candidate.$fault === "server");
-	} catch {
-		return false;
-	}
-}
-/**
-* Replace every character that could make one emitted line render as more than
-* one line, or render in an order it was not written in, with a space.
-*
-* Four Unicode categories, each measured rather than assumed (see the fixture
-* in `tests/unit/local/credential-error.test.ts`):
-*
-*   - `Cc` — the C0/C1 controls, which is `\n` / `\r` (a forged extra line in
-*     the studio ring) and `\x1b` (an ANSI escape in a terminal). U+0085 NEL
-*     lives here too.
-*   - `Cf` — the format characters, which is U+202E RIGHT-TO-LEFT OVERRIDE and
-*     friends: they forge how the REST of the line reads. The cost is that a
-*     ZWJ inside an emoji or an Indic cluster is replaced too; an AWS error
-*     message is ASCII, so that is a trade with no observed downside.
-*   - `Zl` / `Zp` — U+2028 and U+2029. Neither is in `Cc` or `Cf`, and both are
-*     forced line breaks in the studio UI's `<pre>`, so leaving them out would
-*     have left the forged-line case open in HTML while closing it in a
-*     terminal.
-*   - `Cs` — a LONE surrogate, which is not a character at all and breaks JSON
-*     encoding of the log event. With the `u` flag a well-formed pair is one
-*     code point and does NOT match, so emoji survive.
-*
-* Used by both branches of {@link describeAwsFailureForWarn} — the kept
-* message, and the `debug` line carrying the withheld one, because the `debug`
-* stream is the SAME studio ring under `--verbose`, so a text unsafe to put on
-* a line at `warn` is unsafe at `debug` — and, since issue #570's review
-* rounds, by every OTHER wire-derived value that lands on one of these lines:
-* `sigv4-verify`'s own `debug` line, and the role ARN at the four warn sites
-* plus the five `info` / `debug` sites that print an ARN resolved from a live
-* `GetFunctionConfiguration` / `GetAgentRuntime` response. The last group is
-* the more reachable one — it fires on SUCCESS.
-*/
-function flattenToOneLine(message) {
-	return message.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Cs}]/gu, " ");
-}
-/**
-* Render a wire-derived service message safe to put on one log line.
-*
-* Two properties, and both are about the LINE rather than about secrecy — the
-* message itself is already judged safe to print by the time this is called:
-*
-*   - No line breaks and no rendering-direction control, via
-*     {@link flattenToOneLine}.
-*   - Bounded length, with the true length named when it is exceeded. The
-*     suffix names the character count of the SANITIZED message rather than
-*     of the raw one, because the sanitized string is what the truncated
-*     prefix is a prefix OF; quoting the raw length would describe a string
-*     the reader can never see.
-*
-* The cut is made on CODE POINTS rather than UTF-16 units, so a truncation
-* landing inside an astral character cannot emit half of a surrogate pair. The
-* count in the suffix is the code-point count for the same reason: the prefix
-* and the number must describe the same string.
-*/
-function sanitizeServiceExceptionMessage(message) {
-	const points = [...flattenToOneLine(message)];
-	if (points.length <= SERVICE_MESSAGE_MAX) return points.join("");
-	return `${points.slice(0, SERVICE_MESSAGE_MAX).join("")}[... truncated; ${points.length}-character message]`;
-}
-/**
-* Describe a credential-chain failure for a default-level log line WITHOUT
-* relaying the chain's own message (issue #564).
-*
-* What is reported instead is input-INDEPENDENT: the clamped class name (see
-* {@link clampErrorName}), which is the same discriminator
-* `ecs-secrets-resolver.ts` reports for the JSON parse failure it must not
-* echo, plus the clamped {@link clampErrorCode} when the throw carries one.
-*
-* Withholding is NOT free, and the cost lands on cdk-local's own text as well
-* as on the SDK's. The worked example used to be `role-arn.ts`'s
-* `AssumeRole(<arn>) returned no usable credentials.`: a plain `Error` with no
-* `$fault`, so it was withheld like any other, and the note recorded that as a
-* real diagnostic loss accepted because the alternative — an allow-list of
-* messages that may print — is the deny-list this design rejects, wearing the
-* other sign. It also named the right fix: make cdk-local's own throws
-* IDENTIFIABLE rather than guess at their text.
-*
-* Issue #579 did that, for exactly this example. `role-arn.ts` now throws
-* `AssumeRoleFailure`, carrying a `detail` its relaying callers print verbatim
-* — and the same pattern closed the identical loss in
-* `layer-arn-materializer.ts`, `httpv2-service-integration.ts`,
-* `ecr-puller.ts`, `local-run-task.ts` and `ecs-service-emulator.ts`. The
-* general point stands and is what a new site should apply: the policy cannot
-* tell cdk-local's own sentence from a hostile endpoint's, so a `catch` that
-* can see both must make its own throws recognisable BEFORE the relay.
-*
-* The remaining ARN-length question — an ARN is structured, so the bound
-* belongs at the three resolution points rather than at the log line — is
-* tracked separately at
-* https://github.com/go-to-k/cdk-local/issues/607.
-*
-* The LENGTH is reported, unlike in `ecs-secrets-resolver.ts`, and the
-* difference is deliberate: there the user already knows which secret it is
-* and can read the value at its source, so a character count would be
-* disclosure buying nothing. Here the user cannot see the withheld message at
-* all, and the count is what separates a one-line
-* `Could not load credentials from any providers` (45 characters, measured
-* against `@aws-sdk/credential-provider-node@3.972.44` `dist-cjs/index.js:144`)
-* from a multi-hundred-character `Command failed:` dump — which is what tells
-* them whether their `credential_process` even ran.
-*
-* The count is a side channel, and a narrow one: against a KNOWN
-* `credential_process` template the number is `constant + len(passphrase)`, so
-* it yields the passphrase's LENGTH. That is accepted rather than overlooked.
-* It buys the one thing the user cannot otherwise see, the `Command failed:`
-* dump is not reachable on today's SDK versions anyway, and bucketing the
-* number would blur exactly the boilerplate-vs-dump distinction the field
-* exists for.
-*/
-function describeCredentialLoadFailure(err) {
-	const code = clampErrorCode(err);
-	return `${code === void 0 ? clampErrorName(err) : `${clampErrorName(err)} ${code}`}; ${stringifyThrown(err).length}-character message withheld, logged at debug level under --verbose`;
-}
-/**
-* Render an AWS SDK call failure for a `logger.warn` line, and emit the
-* withheld text at `debug` when it is withheld (issue #570).
-*
-* `operation` names the call for the `debug` line — e.g.
-* `'STS GetCallerIdentity'`. It is cdk-local's own literal at every call
-* site, never anything read off an error or a response.
-*
-* # Why this emits the `debug` line itself
-*
-* Because the alternative is nine call sites each free to withhold a message
-* and forget to print it anywhere. The pairing is the invariant — "withheld
-* at `warn`" is only acceptable while "in full at `debug`" holds — so it
-* lives in one function rather than in a convention nine sites must keep. A
-* tenth site gets it for free.
-*
-* The `debug` line fires ONLY on the withheld branch. On the service-exception
-* branch the `warn` already carries the message, and repeating it verbatim one
-* level down would say nothing the reader did not just read.
-*
-* It is FLATTENED (not capped). Flattened because the `debug` stream is not a
-* private channel: it is the same stdout `cdkl studio` mirrors into the log
-* ring it serves over HTTP, so a `\n` in the withheld text would forge a line
-* there exactly as it would at `warn`. Not capped, because being able to read
-* the whole withheld message is the entire reason the line exists — the
-* `warn`'s character count is what tells the reader how much they are about to
-* see. Note that this puts the full text into that ring for a
-* `--verbose` studio run; see `docs/troubleshooting.md`.
-*
-* ORDERING: the `debug` line is emitted when THIS function runs, which is
-* before the `warn` at every site — inline in the `warn`'s template at eight of
-* them, and a couple of statements earlier at the one that hoists the result
-* into a `const reason`. Either way it prints immediately ABOVE the `warn` that
-* refers to it under `--verbose`. Left as is: restructuring every call site to
-* log afterwards would buy an ordering nobody reads top-down anyway.
-*/
-function describeAwsFailureForWarn(err, operation) {
-	if (isAwsServiceException(err)) return `${clampErrorName(err)}: ${sanitizeServiceExceptionMessage(stringifyThrown(err))}`;
-	getLogger().debug(`${operation}: the AWS SDK's own failure message was: ${flattenToOneLine(stringifyThrown(err))}`);
-	return describeCredentialLoadFailure(err);
-}
-
-//#endregion
-//#region src/utils/assembly-path.ts
-/**
-* `true` when `candidate` names something strictly beneath `base`, both given
-* as already-resolved absolute paths.
-*
-* The `..` test is SEPARATOR-AWARE rather than a bare `startsWith('..')`,
-* which would also reject a legitimate sibling named `..foo`. The empty-string
-* case is `base` itself; callers decide whether that counts as an escape,
-* because an asset path legitimately names a DIRECTORY while a template path
-* does not.
-*/
-function isInside(base, candidate) {
-	const rel = relative(base, candidate);
-	if (rel === "" || rel === "..") return false;
-	if (rel.startsWith(`..${sep}`)) return false;
-	return !isAbsolute(rel);
-}
-/**
-* `realpath(3)`, or `undefined` for a path that does not fully resolve.
-*
-* `.native` is load-bearing and must not be simplified to `fs.realpathSync`.
-* The plain form is a JavaScript walker that folds `..` LEXICALLY, so it
-* disagrees with the kernel on a target carrying a `..` after a symlinked
-* component — answering `ENOENT` for a path the kernel resolves, and on a
-* case-insensitive filesystem (APFS by default) it can spin on the same shape.
-* `.native` is libuv's `realpath(3)` and throws the same
-* `ENOENT` / `ELOOP` / `EACCES`.
-*/
-function tryRealpath(p) {
-	try {
-		return realpathSync.native(p);
-	} catch {
-		return;
-	}
-}
-/** `fs.readlinkSync`, or `undefined` when `p` is not a symbolic link. */
-function tryReadlink(p) {
-	try {
-		return readlinkSync(p);
-	} catch {
-		return;
-	}
-}
-/**
-* Link follows before the walk gives up and reports the path as unresolvable.
-* It does NOT refuse: an exhausted budget answers `undefined`, which leaves
-* the symlink arm silent and the lexical verdict standing. Safe because the OS
-* gives up first (macOS caps at 32, `ELOOP`), so a chain that reaches this cap
-* is one nothing can open anyway.
-*/
-const MAX_LINK_HOPS = 40;
-/**
-* Unresolvable path COMPONENTS the climb walks before giving up. Bounds the
-* recursion below, which is one frame per component, so a pathological value
-* cannot raise a `RangeError` from inside {@link tryRealpath}'s own `try` (its
-* `catch` would swallow the crash into a silent `undefined`).
-*
-* KNOW THAT EXHAUSTING THIS FAILS OPEN, and why that is accepted rather than
-* unnoticed. Unlike {@link MAX_LINK_HOPS}, which has the OS's own `ELOOP` cap
-* behind it, nothing else stops a path of 1 001 absent components: the climb
-* gives up, the symlink arm goes silent, and a value that would land outside
-* reads as CONTAINED on the lexical verdict alone. It is not reachable in
-* effect — such a path cannot exist, so `cdkl invoke`'s `existsSync` refuses it
-* and `start-api`'s `docker run` fails to mount it — but that safety lives in
-* the CONSUMERS, not here. A consumer that neither checks existence nor mounts
-* would need its own answer.
-*/
-const MAX_PATH_COMPONENTS = 1e3;
-/**
-* Where `target` REALLY points, for a path that may not exist yet.
-*
-* `realpathSync` answers only for a path that fully resolves, and it throws
-* `ENOENT` for a DANGLING symbolic link exactly as it does for an absent file.
-* `cdkl start-api` resolves an asset path without an existence check, so an
-* absent or dangling component must not silence the symlink arm.
-*
-* Each unresolvable component is therefore handled by hand: climb to the
-* deepest ancestor that DOES resolve, then re-apply the remaining components,
-* following any symbolic link with `readlink` and re-resolving its target.
-* `undefined` means the walk could not resolve the path at all.
-*
-* For a path that FULLY RESOLVES the answer is the kernel's and is exact. For
-* one that does not exist yet this is a best-effort MODEL of kernel
-* resolution; the known edge is a `..` INSIDE an unresolvable link's target,
-* folded lexically here while the kernel folds it only after following each
-* preceding component. That edge is benign for THESE callers rather than in
-* general: it needs the target to be absent, and both consumers resolve the
-* path and then open or mount it, so the divergence is between this model and
-* a path nothing can reach. A caller that CREATED a file through such a path
-* would need an `lstat` of its own.
-*
-* `EACCES` is folded into "does not resolve" along with `ENOENT`, so a link
-* under a directory this process cannot traverse reads as contained. Same
-* bound: the consumer's own `existsSync` / mount runs as the same user and
-* fails identically.
-*/
-function resolveThroughLinks(target, hops = 0, climbs = 0) {
-	const direct = tryRealpath(target);
-	if (direct !== void 0) return direct;
-	if (hops >= MAX_LINK_HOPS) return void 0;
-	if (climbs >= MAX_PATH_COMPONENTS) return void 0;
-	const parent = dirname(target);
-	if (parent === target) return void 0;
-	const realParent = resolveThroughLinks(parent, hops, climbs + 1);
-	if (realParent === void 0) return void 0;
-	const link = tryReadlink(target);
-	if (link === void 0) return join(realParent, basename(target));
-	return resolveThroughLinks(resolve(realParent, link), hops + 1, climbs);
-}
-/**
-* Resolve an assembly-supplied `candidate` against `dir` and report whether
-* the result stays inside it.
-*
-* The lexical arm joins exactly the way the call sites used to (`path.join`,
-* NOT `path.resolve`), so the verdict is about the path the caller will
-* actually use. `join`'s handling of an absolute candidate makes this arm
-* strictly more permissive than a `resolve`-based one would be; an absolute
-* value is therefore answered by {@link absoluteAssemblyPathEscape} instead,
-* because this function structurally cannot.
-*
-* The SYMLINK arm exists because the lexical arm alone leaves an equivalent
-* hole: `cdk.out/link -> /etc` plus a candidate of `link/passwd` is lexically
-* contained and still reaches `/etc/passwd`. Both sides go through
-* {@link resolveThroughLinks}, so an assembly directory REACHED through a link
-* (macOS spells `/tmp` as `/private/tmp`) is unaffected.
-*
-* The verdict is about the assembly AS IT SITS ON DISK. It is NOT a defence
-* against a process rewriting that directory concurrently — the caller uses
-* the path after this returns.
-*/
-function resolveAssemblyPath(dir, candidate, options) {
-	const base = resolve(dir);
-	const bound = options?.containWithin === void 0 ? base : resolve(options.containWithin);
-	const joined = resolve(join(base, candidate));
-	if (!isInside(bound, joined)) return {
-		contained: false,
-		escape: "lexical",
-		path: joined
-	};
-	const realBound = resolveThroughLinks(bound);
-	if (realBound !== void 0) {
-		const realTarget = resolveThroughLinks(joined);
-		if (realTarget !== void 0 && !isInside(realBound, realTarget)) return {
-			contained: false,
-			escape: "symlink",
-			path: joined,
-			realPath: realTarget
-		};
-	}
-	return {
-		contained: true,
-		path: joined
-	};
-}
-/**
-* Whether an ALREADY-ABSOLUTE assembly-supplied path lies outside `bound`.
-*
-* {@link resolveAssemblyPath} cannot answer this, and the reason is structural
-* rather than an oversight: its lexical arm joins with `path.join`, which does
-* NOT honour a leading separator, so an absolute candidate is folded INTO the
-* directory and the verdict would describe a path no caller opens. A site that
-* HONOURS an absolute value needs the verdict about the value itself.
-*
-* The callers are `cdkl invoke`'s and `cdkl start-api`'s
-* `Metadata['aws:asset:path']` resolution. Those honour an absolute path
-* because `cdk synth --no-staging` emits one — CDK writes the asset's absolute
-* SOURCE directory under `aws:cdk:disable-asset-staging`, usually outside the
-* outdir — and they WARN rather than refuse when it leaves the bound, so this
-* returns a verdict rather than throwing. The asset-MANIFEST readers that
-* honour an absolute value take the same verdict: `'honour-warn'` (the
-* start-cloudfront origin) warns when the value is a folder inside the user's
-* project not under a credential or version-control directory, and refuses
-* otherwise, `'honour'` (the soft-reload
-* sources) refuses (#745).
-*
-* It lives HERE so the containment rule has one spelling: it reuses this
-* module's own {@link isInside} and {@link resolveThroughLinks}, symlink arm
-* included, rather than letting a caller re-spell `path.relative` and drift.
-*
-* `bound` itself is NOT an escape, unlike in {@link resolveAssemblyPath},
-* where an empty `path.relative` means "names the directory rather than a file
-* inside it". An asset path legitimately names a DIRECTORY, so a value equal
-* to the bound is inside it and reporting it as outside would be false.
-*
-* THE REAL PATHS DECIDE IN BOTH DIRECTIONS, which is the one place this
-* deliberately does more than {@link resolveAssemblyPath}'s lexical-first
-* ordering. The lexical verdict here is about a SPELLING, and two spellings of
-* the same directory are common rather than exotic: macOS resolves `/tmp` to
-* `/private/tmp` and `/var` to `/private/var`, and a user may symlink `cdk.out`
-* itself. With an outdir of `/tmp/cdk.out` and a `--no-staging` value of
-* `/private/tmp/cdk.out/src`, a lexical-only verdict cries "pointing outside
-* the assembly ... treat this assembly as untrusted" about an asset that is
-* plainly inside it — and this arm exists to make an UNEXPECTED path visible,
-* so a false alarm is the failure that costs it its meaning.
-*
-* Exonerating requires the kernel to answer for BOTH operands: an unresolvable
-* one leaves the lexical verdict standing, so the arm stays loud when it cannot
-* see. (`resolveAssemblyPath` cannot take the same shape: its verdict is about
-* a path built with `path.join`, and letting a real path overrule the lexical
-* `..` there would answer about a location the caller never opens.)
-*/
-function absoluteAssemblyPathEscape(bound, absolutePath) {
-	const resolvedBound = resolve(bound);
-	const target = resolve(absolutePath);
-	const lexicallyOutside = !isInside(resolvedBound, target) && target !== resolvedBound;
-	const realBound = resolveThroughLinks(resolvedBound);
-	const realTarget = resolveThroughLinks(target);
-	const reallyOutside = realBound === void 0 || realTarget === void 0 ? void 0 : !isInside(realBound, realTarget) && realTarget !== realBound;
-	if (lexicallyOutside) {
-		if (reallyOutside === false) return void 0;
-		return {
-			contained: false,
-			escape: "lexical",
-			path: target
-		};
-	}
-	if (reallyOutside === true) return {
-		contained: false,
-		escape: "symlink",
-		path: target,
-		realPath: realTarget
-	};
-}
-/**
-* Whether `candidate` names the SAME directory as `bound` — lexically, or
-* through a symbolic link on either side.
-*
-* An asset source legitimately names a DIRECTORY, so a value that resolves
-* onto the output directory itself is not an escape; but it hands the WHOLE
-* assembly to the sink, which is worth a line. A caller that re-spells this as
-* `resolve(a) === resolve(b)` misses every second spelling of the bound
-* (macOS `/tmp` vs `/private/tmp`, a symlinked `cdk.out`), and
-* {@link absoluteAssemblyPathEscape} exonerates exactly those spellings as
-* inside — so the equality beside it would stay silent for them.
-*
-* Conservative on failure: an unresolvable side answers from the lexical
-* comparison alone, so it can only say "not the same", never wrongly claim
-* identity.
-*/
-function namesTheSameDirectory(bound, candidate) {
-	const resolvedBound = resolve(bound);
-	const target = resolve(candidate);
-	if (target === resolvedBound) return true;
-	const realBound = resolveThroughLinks(resolvedBound);
-	const realTarget = resolveThroughLinks(target);
-	return realBound !== void 0 && realTarget !== void 0 && realBound === realTarget;
-}
-/**
-* The escape verdict for an assembly-supplied path WITHOUT throwing, taking
-* whichever arm the value's own shape calls for: {@link absoluteAssemblyPathEscape}
-* for an absolute value, {@link resolveAssemblyPath} for a relative one.
-*
-* For a caller that only WARNS and has many values to judge — the BuildKit
-* passthroughs in `src/assets/buildkit-passthrough-warnings.ts`. `base` is what
-* a relative value resolves against, `bound` what it must stay inside.
-* Returns `undefined` when the value is fine, including when it names `bound`
-* itself ({@link namesTheSameDirectory}).
-*/
-function assemblyPathEscape(base, bound, candidate) {
-	if (isAbsolute(candidate)) return absoluteAssemblyPathEscape(bound, candidate);
-	const resolved = resolveAssemblyPath(base, candidate, { containWithin: bound });
-	if (resolved.contained || namesTheSameDirectory(bound, resolved.path)) return void 0;
-	return resolved;
-}
-/**
-* The shared tail of a containment refusal: what the value resolved to, what
-* it escaped, and why that means the assembly is not CDK-generated. The call
-* site supplies its own subject ("Lambda 'X' has ... which ") and its own
-* error class. `action` completes "Refusing to ..." and is REQUIRED rather
-* than defaulted: a default is a branch no caller takes, so it can neither be
-* fenced nor be right for the next caller.
-*
-* `provenanceOverride` replaces that whole closing sentence for a caller that
-* does NOT refuse — the BuildKit passthrough warnings, where "Refusing to ..."
-* would be a false statement about a value that is forwarded anyway.
-*/
-function renderAssemblyPathEscape(escape, dir, action, provenanceOverride) {
-	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
-	const base = resolve(dir);
-	const realBase = resolveThroughLinks(base) ?? base;
-	const shownPath = displayUntrustedValue(escape.path);
-	const shownBase = displayUntrustedValue(base);
-	if (escape.escape === "symlink") {
-		if (escape.realPath === realBase) return `resolves to ${shownPath}, a symbolic link to the directory ${shownBase} itself rather than to a path inside it. ${provenance}`;
-		return `resolves to ${shownPath}, which leads through a symbolic link to ${displayUntrustedValue(escape.realPath)}, outside ${shownBase}. ${provenance}`;
-	}
-	if (escape.path === base) return `names the directory ${shownBase} itself rather than a path inside it. ${provenance}`;
-	return `resolves to ${shownPath}, outside ${shownBase}. ${provenance}`;
-}
-/**
-* A letter or digit that neither draws as a blank nor reads as a quote.
-* `\p{L}` alone admits both, so two classes are carved out: the
-* default-ignorables, which hold letters that draw as a blank (the Hangul
-* fillers U+3164 and U+FFA0), and the quote-shaped letters — the Spacing
-* Modifier Letters block (U+02BA reads as `"`, U+02BC as `'`) plus the ones
-* outside it (U+0374, U+0559, U+07F4-U+07F5, U+A78B-U+A78C, and the halfwidth
-* sound marks U+FF9E-U+FF9F). Not all of `\p{Lm}`: U+30FC is in it, and it is
-* an ordinary character of a Japanese directory name.
-*/
-const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Point}\u02b0-\u02ff\u0374\u0559\u07f4\u07f5\ua78b\ua78c\uff9e\uff9f])[\p{L}\p{N}]$`, "u");
-/**
-* A combining mark, which counts only DIRECTLY after a visible letter (or a
-* mark that itself counted): on a space or on punctuation it draws on its own,
-* and U+030B / U+030E there look like a quote.
-*/
-const COMBINING_MARK = /^\p{M}$/u;
-/**
-* A default-ignorable code point, which draws as NOTHING. Tested before the
-* mark rule, because some are combining marks (U+034F, U+17B4, U+180B, the
-* variation selectors U+FE00-U+FE0F and U+E0100-U+E01EF): after a letter they
-* would otherwise pass as bare, and `/home/me/.ss\u034fh` would print exactly
-* like `.ssh` while naming a different path. The host's classifier
-* (go-to-k/cdkd#3509) does not carve these out; this one does.
-*/
-const DEFAULT_IGNORABLE = /^\p{Default_Ignorable_Code_Point}$/u;
-/**
-* The ASCII a bare value may carry besides letters and digits. Everything else
-* — any whitespace, any quote, any other symbol — takes the boundary, which
-* costs a legitimate path nothing but a pair of quotes.
-*/
-const BARE_PUNCTUATION = /^[/\\._~+@:=-]$/;
-/**
-* Classify each code point: `bare` (allowed in a bare value), `shown` (shown
-* as itself inside the boundary), or `escaped`. An ALLOWLIST, because a
-* denylist has to enumerate every character that draws as a blank or reads as
-* a quote.
-*
-* Each test is ONE character and this walks the value — never `^(...)+$` over
-* the whole of it: alternatives that overlap under a quantifier backtrack
-* exponentially on a long value that fails near its end.
-*/
-function classify(chars) {
-	let afterLetter = false;
-	return chars.map((ch) => {
-		if (DEFAULT_IGNORABLE.test(ch)) {
-			afterLetter = false;
-			return "escaped";
-		}
-		if (COMBINING_MARK.test(ch)) return afterLetter ? "bare" : "escaped";
-		afterLetter = VISIBLE_LETTER.test(ch);
-		if (afterLetter || BARE_PUNCTUATION.test(ch)) return "bare";
-		return ch >= " " && ch <= "~" ? "shown" : "escaped";
-	});
-}
-/**
-* Render an untrusted value — a filesystem path, identifier or command an
-* assembly chose, or a key a request supplied — into cdk-local's own prose
-* (go-to-k/cdk-local#758; the host's `displayAssemblyPath`, go-to-k/cdkd#3509).
-* The caller writes NO quotes around the result.
-*
-* `sanitizeServiceExceptionMessage` alone is not enough inside quotes of ours:
-* it flattens control characters and passes `'`, so a value carrying one
-* closed the quote and wrote a clause of its own into the message. This keeps
-* a plain value bare and puts any other one inside a JSON string literal.
-* Inside it, `"` and `\` are escaped as JSON escapes them, and so is every
-* character that is neither printable ASCII nor a visible letter — a curly or
-* fullwidth quote that could pass for the boundary's own closing `"`, and a
-* blank that could pass for a space. The result stays valid JSON: `JSON.parse`
-* returns the sanitized value.
-*
-* A legitimate value with a space or any symbol outside `/ \ . _ ~ + @ : = -`
-* (`/Users/me/My Project/cdk.out`) renders quoted; a non-ASCII letter is
-* shown as itself, and a non-letter non-ASCII character (an emoji, `©`) as
-* its `\u` escape. A value the sanitizer ALTERED (a control character
-* flattened, an over-long value truncated) did not arrive plain, so it always
-* takes the boundary. The empty string renders as `""`.
-*
-* The sanitizer also CAPS the value at 512 code points, so a longer path
-* prints truncated (inside the boundary, with its true length named). That
-* is deliberate: an unbounded assembly-chosen value would otherwise make the
-* log line as long as the attacker likes, and a real path is far shorter.
-*/
-function displayUntrustedValue(value) {
-	const clean = sanitizeServiceExceptionMessage(value);
-	const chars = Array.from(clean);
-	const kinds = classify(chars);
-	if (clean === value && chars.length > 0 && kinds.every((k) => k === "bare")) return clean;
-	let body = "";
-	chars.forEach((ch, i) => {
-		if (ch === "\"" || ch === "\\") body += `\\${ch}`;
-		else if (kinds[i] !== "escaped") body += ch;
-		else for (let u = 0; u < ch.length; u++) body += `\\u${ch.charCodeAt(u).toString(16).padStart(4, "0")}`;
-	});
-	return `"${body}"`;
-}
-
-//#endregion
-//#region src/utils/docker-cmd.ts
-var docker_cmd_exports = /* @__PURE__ */ __exportAll({
-	DOCKER_CLIENT_ENV_KEYS: () => DOCKER_CLIENT_ENV_KEYS,
-	DOCKER_CLIENT_ENV_PREFIXES: () => DOCKER_CLIENT_ENV_PREFIXES,
-	DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS: () => DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS,
-	allowSecretsOnArgvEnvName: () => allowSecretsOnArgvEnvName,
-	finchSecretArgvRefusal: () => finchSecretArgvRefusal,
-	formatDockerLoginError: () => formatDockerLoginError,
-	getDockerCmd: () => getDockerCmd,
-	isDockerClientEnvKey: () => isDockerClientEnvKey,
-	isFinchVmClient: () => isFinchVmClient,
-	isMalformedEnvKey: () => isMalformedEnvKey,
-	runDockerForeground: () => runDockerForeground,
-	runDockerStreaming: () => runDockerStreaming,
-	spawnForeground: () => spawnForeground,
-	spawnStreaming: () => spawnStreaming,
-	warnFinchArgvExposure: () => warnFinchArgvExposure
-});
-/**
-* Shared helpers for invoking the docker-compatible CLI binary across cdk-local.
-*
-* Two parity decisions with `aws-cdk-cli`'s `cdk-assets-lib`:
-*   1. `CDK_DOCKER` env var swaps the binary so podman / finch users can
-*      run cdk-local without code changes (`CDK_DOCKER=podman cdkl invoke`).
-*   2. `runDockerStreaming` uses streaming spawn rather than `execFile`'s
-*      buffered `maxBuffer` ceiling. BuildKit's progress output can run to
-*      tens of MB on multi-stage builds with `# syntax=docker/dockerfile:1`
-*      frontend downloads + heredoc / `RUN --mount=...` features; the 50 MB
-*      `execFile` ceiling cdk-local used to set silently killed those builds
-*      with `ERR_CHILD_PROCESS_STDIO_MAXBUFFER`.
-*
-* Output handling: stdout/stderr are collected in memory unconditionally so
-* `runDockerStreaming` can return them to the caller for error wrapping.
-* When the logger is at debug level (i.e. the user passed `--verbose`),
-* the chunks are ALSO mirrored to `process.stdout` / `process.stderr` so
-* the user sees live build progress.
-*/
-/**
-* Return the docker-compatible CLI binary to invoke. Matches CDK CLI:
-* `CDK_DOCKER` env var overrides the default `docker` so users on
-* podman / finch / nerdctl can swap without changing cdk-local code.
-*/
-function getDockerCmd() {
-	const override = process.env["CDK_DOCKER"];
-	return override && override.length > 0 ? override : "docker";
-}
-/**
-* Is the container client finch running its Lima VM (macOS / Windows)? There
-* the value-less `-e KEY` form (`appendEnvFlags` in `local/docker-runner.ts`)
-* does NOT keep a value off the process command line (issue #749): finch's
-* `handleEnv` resolves each bare `KEY` against its own environment and
-* re-emits `-e KEY=<value>` on the argv of the `limactl shell finch sudo -E
-* nerdctl ...` child it starts, and `--env-file` is read on the host and
-* re-emitted the same way (runfinch/finch `cmd/finch/nerdctl_remote.go`,
-* `handleEnv` / `handleEnvFile`). Its `passedEnvs` list also puts
-* `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` from its
-* environment on that argv for every command. finch on Linux passes the argv
-* to nerdctl unchanged and is NOT matched.
-*
-* Detection is by the BASENAME of the resolved binary (`finch`, `finch.exe`,
-* any case): a wrapper script or a symlink under another name is not
-* recognised, and neither is Lima's own `nerdctl.lima`.
-*/
-function isFinchVmClient(cmd = getDockerCmd(), platform = process.platform) {
-	if (platform !== "darwin" && platform !== "win32") return false;
-	const base = (cmd.split(/[\\/]/).pop() ?? "").toLowerCase();
-	return base === "finch" || base === "finch.exe";
-}
-/**
-* The env var that accepts, while it is set, that a container client puts
-* secret VALUES on a process command line ({@link finchSecretArgvRefusal}):
-* `<envPrefix>_ALLOW_SECRETS_ON_ARGV`, so `CDKL_ALLOW_SECRETS_ON_ARGV` for
-* `cdkl` and the embedding host's own prefix otherwise. Only `1` or `true`
-* (any case) opts in.
-*/
-function allowSecretsOnArgvEnvName() {
-	return `${getEmbedConfig().envPrefix}_ALLOW_SECRETS_ON_ARGV`;
-}
-function secretsOnArgvAllowed() {
-	const v = process.env[allowSecretsOnArgvEnvName()];
-	return v !== void 0 && ["1", "true"].includes(v.trim().toLowerCase());
-}
-const MESSAGE_UNSAFE_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g;
-/**
-* Render template- or state-sourced text (an env var name, a container name,
-* an image URI) for a message: control and line-separator characters are
-* escaped as `\uXXXX` so a hostile value cannot drive the terminal or forge a
-* log line. Plain text renders unchanged.
-*/
-function escapeForMessage(text) {
-	return text.replace(MESSAGE_UNSAFE_CHARS, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
-}
-/**
-* The refusal text when template-sourced secrets (ECS `Secrets`, decrypted
-* `SecureString` values) would be forwarded under {@link isFinchVmClient}, or
-* `undefined` when they may be forwarded: another client, no such secret, or
-* {@link allowSecretsOnArgvEnvName} set. The caller throws it in its own error
-* class BEFORE any `docker run`. The AWS credential set is not refused here
-* but warned about by {@link warnFinchArgvExposure}: forwarding it is what puts
-* credentials that are not in this process's own environment (`--assume-role`,
-* `--profile`, the metadata sidecar's) on that argv, and the warning makes that
-* visible while keeping finch usable for containers that need AWS access. Names
-* only, never a value. `subject` is context such as the container name; it is
-* escaped like the names.
-*/
-function finchSecretArgvRefusal(secretNames, subject) {
-	if (secretNames.length === 0 || !isFinchVmClient() || secretsOnArgvAllowed()) return void 0;
-	const names = [...new Set(secretNames)];
-	return `${escapeForMessage(subject)}: refusing to forward secret(s) ${names.map(escapeForMessage).join(", ")} under CDK_DOCKER=finch on macOS / Windows. finch turns each value-less '-e KEY' into '-e KEY=<value>' on the command line of the limactl process it starts, where other local processes can read the plaintext. Use a container client that keeps the value off the command line (for example the default 'docker', by unsetting CDK_DOCKER), or set ${allowSecretsOnArgvEnvName()}=1 to accept that exposure while it stays set.`;
-}
-/** Key sets already warned about by {@link warnFinchArgvExposure} in this process. */
-const finchArgvWarned = /* @__PURE__ */ new Set();
-/**
-* Warn, once per process per distinct key set, that under
-* {@link isFinchVmClient} the values of `keys` (the sensitive env about to be
-* forwarded as value-less `-e KEY`) reach the `limactl` command line. Names
-* only, never a value.
-*/
-function warnFinchArgvExposure(keys) {
-	if (keys.length === 0 || !isFinchVmClient()) return;
-	const names = [...new Set(keys)].sort();
-	const latch = JSON.stringify(names);
-	if (finchArgvWarned.has(latch)) return;
-	finchArgvWarned.add(latch);
-	getLogger().warn(`CDK_DOCKER=finch on macOS / Windows puts the values of ${names.map(escapeForMessage).join(", ")} on the command line of the limactl process it starts (finch turns a value-less '-e KEY' into '-e KEY=<value>'), where other local processes can read them. The default 'docker' client keeps them off the command line.`);
-}
-/**
-* Spawn a docker-compatible CLI binary (resolved via `getDockerCmd`) with
-* streaming I/O. Collects stdout/stderr in memory and resolves with both
-* on exit code 0; rejects with a `SpawnError` carrying both streams on any
-* non-zero exit so the caller can wrap with its own error class without
-* losing the upstream output.
-*
-* No `maxBuffer` ceiling: BuildKit progress output frequently exceeds the
-* `child_process.execFile` default of 1 MB (cdk-local previously bumped to 50 MB
-* but BuildKit + frontend pulls can still exceed that on first-time builds).
-*/
-async function runDockerStreaming(args, options = {}) {
-	return spawnStreaming(getDockerCmd(), args, options);
-}
-/**
-* Generic streaming spawn — used by `runDockerStreaming` AND by the
-* `executable` source mode in `docker-build.ts` (which runs an arbitrary
-* user-supplied build command, not docker).
-*/
-async function spawnStreaming(cmd, args, options = {}) {
-	const streamLive = options.streamLive ?? getLogger().getLevel() === "debug";
-	const env = options.env ? mergeEnv(options.env) : void 0;
-	const spin = startProgressSpinner(options.progressLabel, streamLive);
-	return new Promise((resolve, reject) => {
-		let child;
-		try {
-			child = spawn(cmd, args, {
-				cwd: options.cwd,
-				env,
-				stdio: [
-					options.input ? "pipe" : "ignore",
-					"pipe",
-					"pipe"
-				]
-			});
-		} catch (err) {
-			stopProgressSpinner(spin, options.progressLabel);
-			reject(err);
-			return;
-		}
-		const stdoutChunks = [];
-		const stderrChunks = [];
-		child.stdout.on("data", (chunk) => {
-			stdoutChunks.push(chunk);
-			if (streamLive) process.stdout.write(chunk);
-		});
-		child.stderr.on("data", (chunk) => {
-			stderrChunks.push(chunk);
-			if (streamLive) process.stderr.write(chunk);
-		});
-		child.once("error", (err) => {
-			stopProgressSpinner(spin, options.progressLabel);
-			if (err.code === "ENOENT") {
-				const usingOverride = process.env["CDK_DOCKER"] === cmd && cmd !== "docker";
-				const shownCmd = displayUntrustedValue(cmd);
-				reject(/* @__PURE__ */ new Error(usingOverride ? `Failed to find and execute ${shownCmd} (resolved via CDK_DOCKER). Install ${shownCmd} or unset CDK_DOCKER to fall back to 'docker'.` : `Failed to find and execute ${shownCmd}. Install Docker (or set the 'CDK_DOCKER' environment variable to a compatible binary such as podman / finch).`));
-			} else {
-				const wrapped = /* @__PURE__ */ new Error(`Failed to execute ${displayUntrustedValue(cmd)} (${err.code ?? "spawn error"})`);
-				if (err.code !== void 0) wrapped.code = err.code;
-				reject(wrapped);
-			}
-		});
-		child.once("close", (code) => {
-			const stdout = Buffer.concat(stdoutChunks).toString("utf-8");
-			const stderr = Buffer.concat(stderrChunks).toString("utf-8");
-			if (code === 0) {
-				stopProgressSpinner(spin, options.progressLabel);
-				resolve({
-					stdout,
-					stderr
-				});
-			} else {
-				stopProgressSpinner(spin, options.progressLabel);
-				const message = stderr.trim() || stdout.trim() || `${displayUntrustedValue(cmd)} exited with code ${code}`;
-				const err = new Error(message);
-				err.stderr = stderr;
-				err.stdout = stdout;
-				err.exitCode = code;
-				reject(err);
-			}
-		});
-		if (options.input !== void 0) {
-			child.stdin.on("error", () => {});
-			child.stdin.write(options.input);
-			child.stdin.end();
-		}
-	});
-}
-/**
-* Start an interactive clack spinner for the spawn, but only when the
-* current shell would actually render it (TTY) and the caller isn't
-* already streaming live output. Returns `undefined` when either
-* precondition fails — `stopProgressSpinner` then is a no-op.
-*
-* Test seam: the integration with `@clack/prompts` is mocked in
-* `tests/unit/utils/docker-cmd-progress-spinner.test.ts`.
-*/
-function startProgressSpinner(label, streamLive) {
-	if (label === void 0 || streamLive || process.stdout.isTTY !== true) return void 0;
-	const spin = spinner();
-	spin.start(label);
-	return spin;
-}
-function stopProgressSpinner(spin, label) {
-	if (spin === void 0) return;
-	spin.stop(label ?? "");
-}
-/**
-* Spawn a docker-compatible CLI binary (resolved via `getDockerCmd`) attached
-* to the parent process's stdio so the user sees live output (`docker pull`
-* layer progress, `docker login` interactive prompts that should never fire
-* with `--password-stdin` but still safe to inherit, etc.). Resolves on exit
-* code 0; rejects with a plain `Error` carrying the exit code on any non-zero
-* exit, so the caller can wrap with its own error class.
-*
-* Differs from {@link runDockerStreaming} in two ways:
-*   1. `stdio: 'inherit'` — output is NOT captured, so terminal control codes
-*      (color, progress bar overwrites) flow through unchanged. This is the
-*      load-bearing reason for the split: `docker pull`'s progress bars only
-*      animate properly when stdout is a real TTY connected to the parent.
-*   2. No `input` / `streamLive` options — inherit-mode has nothing to
-*      capture and nothing to mirror.
-*
-* Used by the `--verbose`-mode `docker pull` plumbing in `docker-runner.ts`
-* and `ecr-puller.ts` (visible layer progress). Non-verbose pulls go through
-* {@link runDockerStreaming} so stderr can be folded into the error message.
-*/
-async function runDockerForeground(args, options = {}) {
-	return spawnForeground(getDockerCmd(), args, options);
-}
-/**
-* Foreground (stdio-inherit) spawn — the inherit-mode counterpart to
-* {@link spawnStreaming}. Used by {@link runDockerForeground} for docker-CLI
-* subprocesses.
-*
-* The ENOENT branch crafts a docker-specific install hint ("Install Docker
-* (or set CDK_DOCKER ...)"), so non-docker callers reusing this helper
-* would see a misleading error on missing-binary failures. Keep the binary
-* docker-shaped, or update the ENOENT message before adding a non-docker
-* call site.
-*/
-async function spawnForeground(cmd, args, options = {}) {
-	const env = options.env ? mergeEnv(options.env) : void 0;
-	return new Promise((resolve, reject) => {
-		const child = spawn(cmd, args, {
-			cwd: options.cwd,
-			env,
-			stdio: "inherit"
-		});
-		child.once("error", (err) => {
-			if (err.code === "ENOENT") {
-				const usingOverride = process.env["CDK_DOCKER"] === cmd && cmd !== "docker";
-				const shownCmd = displayUntrustedValue(cmd);
-				reject(/* @__PURE__ */ new Error(usingOverride ? `Failed to find and execute ${shownCmd} (resolved via CDK_DOCKER). Install ${shownCmd} or unset CDK_DOCKER to fall back to 'docker'.` : `Failed to find and execute ${shownCmd}. Install Docker (or set the 'CDK_DOCKER' environment variable to a compatible binary such as podman / finch).`));
-			} else reject(/* @__PURE__ */ new Error(`${cmd} failed: ${err.message}`));
-		});
-		child.once("close", (code) => {
-			if (code === 0) resolve();
-			else reject(/* @__PURE__ */ new Error(`${cmd} exited with code ${code}`));
-		});
-	});
-}
-/**
-* Format the stderr from a failed `docker login` so the surfaced cdk-local
-* error gives the user an actionable workaround when the underlying
-* failure is a credential-helper persistence bug (which has nothing to
-* do with cdk-local, AWS, or IAM perms — the docker CLI itself fails to
-* save the auth token to the platform's credential store). The most
-* common shape is `osxkeychain` on macOS rejecting an overwrite for
-* an existing entry, but `wincred` (Windows), `pass` (Linux), and
-* `secretservice` (Linux) hit the same class of `Error saving
-* credentials` failure, so the rewritten message stays platform-
-* agnostic — `docker logout <endpoint>` is the correct recovery on
-* every backend.
-*
-* Detected docker / docker-credential-* output patterns:
-*   - `error storing credentials - err: exit status 1, out: \`The
-*     specified item already exists in the keychain.\`` (osxkeychain)
-*   - `Error saving credentials: ...` (any backend)
-*
-* Non-matching failures (genuine IAM / network / endpoint problems)
-* pass through with just the stderr trimmed — the original message
-* stays load-bearing for diagnosis.
-*/
-function formatDockerLoginError(stderr, endpoint) {
-	const trimmed = stderr.trim();
-	if (trimmed.includes("already exists in the keychain") || trimmed.includes("Error saving credentials")) return `docker's credential helper (osxkeychain on macOS / wincred on Windows / pass / secretservice on Linux) failed to persist the ECR auth token. The "already exists in the keychain" / "Error saving credentials" output is a known docker-credential-helpers issue — unrelated to ${getEmbedConfig().productName}, AWS credentials, or IAM perms. Quick fix: run \`docker logout ${endpoint}\` to clear the stale entry, then retry the ${getEmbedConfig().productName} command. Permanent fix: edit ~/.docker/config.json and remove (or empty) the platform-specific "credsStore" entry (e.g. "osxkeychain" → "" or "desktop" on macOS Docker Desktop). Original docker stderr: ${trimmed}`;
-	return trimmed;
-}
-function mergeEnv(overrides) {
-	const merged = { ...process.env };
-	for (const [k, v] of Object.entries(overrides)) if (v === void 0) delete merged[k];
-	else merged[k] = v;
-	return merged;
-}
-/**
-* Env vars the container CLI itself reads to decide how / where to run — the
-* binary {@link getDockerCmd} resolves, i.e. `docker` or whatever `CDK_DOCKER`
-* names (podman / nerdctl / finch). A resolved ECS secret (or SecureString)
-* whose NAME collides with one of these must NOT override it in the client's
-* own process environment: a secret named `DOCKER_HOST` (or podman's
-* `CONTAINER_HOST`) would redirect the client to a different daemon, and `PATH`
-* would break locating the binary. See issues
-* go-to-k/cdkd#2183 and go-to-k/cdkd#2188.
-*
-* Ported from cdkd's `src/utils/docker-cmd.ts` (go-to-k/cdk-local#772) with its
-* lists, prefix families and rationale intact; issue references in these
-* comments point at cdkd, where each entry was decided. Keep the two copies
-* in sync.
-*
-* RULE for additions: anything a supported container CLIENT (or a credential /
-* connection helper it execs) reads to decide WHAT CODE IT LOADS, WHAT IT
-* TRUSTS, or WHERE / HOW IT CONNECTS. The docker CLI's documented set is kept
-* whole, behaviour toggles included; beyond it, a var that only tunes
-* behaviour (a storage driver, a snapshotter, a temp dir, an experimental
-* toggle) is OUT, because dropping a colliding secret costs the user that
-* secret. The operator's OWN value is never touched — the spawn
-* env starts from `process.env` — so adding a key costs only a secret of that
-* name.
-*/
-const DOCKER_CLIENT_ENV_KEYS = /* @__PURE__ */ new Set([
-	"PATH",
-	"PATHEXT",
-	"HOME",
-	"USERPROFILE",
-	"HOMEDRIVE",
-	"HOMEPATH",
-	"DOCKER_HOST",
-	"DOCKER_CONTEXT",
-	"DOCKER_CONFIG",
-	"DOCKER_CERT_PATH",
-	"DOCKER_TLS",
-	"DOCKER_TLS_VERIFY",
-	"DOCKER_API_VERSION",
-	"DOCKER_AUTH_CONFIG",
-	"DOCKER_DEFAULT_PLATFORM",
-	"DOCKER_CUSTOM_HEADERS",
-	"DOCKER_CONTENT_TRUST",
-	"DOCKER_CONTENT_TRUST_SERVER",
-	"DOCKER_HIDE_LEGACY_COMMANDS",
-	"BUILDKIT_PROGRESS",
-	"GLIBC_TUNABLES",
-	"GCONV_PATH",
-	"BASH_ENV",
-	"SHELLOPTS",
-	"PS4",
-	"PYTHONPATH",
-	"PYTHONHOME",
-	"PYTHONUSERBASE",
-	"PYTHONPYCACHEPREFIX",
-	"PYTHONPLATLIBDIR",
-	"PYTHONWARNINGS",
-	"BROWSER",
-	"REQUESTS_CA_BUNDLE",
-	"CURL_CA_BUNDLE",
-	"HTTPLIB2_CA_CERTS",
-	"SSLKEYLOGFILE",
-	"GCE_METADATA_HOST",
-	"GCE_METADATA_ROOT",
-	"GCE_METADATA_IP",
-	"NODE_OPTIONS",
-	"NODE_PATH",
-	"NODE_COMPILE_CACHE",
-	"NODE_EXTRA_CA_CERTS",
-	"NODE_TLS_REJECT_UNAUTHORIZED",
-	"RUBYOPT",
-	"RUBYLIB",
-	"GEM_PATH",
-	"GEM_HOME",
-	"RUBYGEMS_GEMDEPS",
-	"PERL5OPT",
-	"PERL5LIB",
-	"PERLLIB",
-	"PERL5DB",
-	"OPENSSL_CONF",
-	"OPENSSL_MODULES",
-	"OPENSSL_ENGINES",
-	"SSH_AUTH_SOCK",
-	"SSH_ASKPASS",
-	"SSH_ASKPASS_REQUIRE",
-	"SSH_SK_HELPER",
-	"SSH_SK_PROVIDER",
-	"SSH_PKCS11_HELPER",
-	"SSH_AGENT_PID",
-	"AWS_ENDPOINT_URL",
-	"AWS_CA_BUNDLE",
-	"AWS_PROFILE",
-	"AWS_CONFIG_FILE",
-	"AWS_SHARED_CREDENTIALS_FILE",
-	"AWS_WEB_IDENTITY_TOKEN_FILE",
-	"AWS_CONTAINER_CREDENTIALS_FULL_URI",
-	"AWS_ROLE_ARN",
-	"AWS_EC2_METADATA_SERVICE_ENDPOINT",
-	"AWS_ECR_CACHE_DIR",
-	"CONTAINER_HOST",
-	"CONTAINER_CONNECTION",
-	"CONTAINER_SSHKEY",
-	"PODMAN_CONNECTIONS_CONF",
-	"CONTAINER_PROXY",
-	"CONTAINERS_SSH_CONF",
-	"CONTAINERS_CONF",
-	"CONTAINERS_CONF_OVERRIDE",
-	"CONTAINERS_REGISTRIES_CONF",
-	"CONTAINERS_REGISTRIES_CONF_OVERRIDE",
-	"REGISTRIES_CONFIG_PATH",
-	"CONTAINERS_STORAGE_CONF",
-	"CONTAINERS_STORAGE_CONF_OVERRIDE",
-	"CONTAINERS_POLICY_JSON",
-	"STORAGE_OPTS",
-	"CONTAINERS_HELPER_BINARY_DIR",
-	"REGISTRY_AUTH_FILE",
-	"DBUS_SESSION_BUS_ADDRESS",
-	"NOTIFY_SOCKET",
-	"XDG_CONFIG_HOME",
-	"XDG_RUNTIME_DIR",
-	"APPDATA",
-	"PROGRAMDATA",
-	"PROGRAMFILES",
-	"LOCALAPPDATA",
-	"SSH",
-	"CONTAINERD_ADDRESS",
-	"CONTAINERD_NAMESPACE",
-	"NERDCTL_TOML",
-	"CNI_PATH",
-	"NETCONFPATH",
-	"ROOTLESSKIT_STATE_DIR",
-	"NERDCTL_LOG_FILE",
-	"SSL_CERT_FILE",
-	"SSL_CERT_DIR",
-	"GODEBUG",
-	"HTTP_PROXY",
-	"HTTPS_PROXY",
-	"NO_PROXY",
-	"FTP_PROXY",
-	"ALL_PROXY"
-]);
-const DOCKER_CLIENT_ENV_KEYS_UPPER = new Set([...DOCKER_CLIENT_ENV_KEYS].map((k) => k.toUpperCase()));
-/**
-* Env-var prefixes whose WHOLE family the docker client (or a helper it execs)
-* reads, so a NAMED list is always one release behind and a colliding secret in
-* ANY member is a hazard. `LD_*` / `DYLD_*` are the dynamic loader (code
-* injection, glibc + macOS); `AWS_ENDPOINT_URL_*` is the per-service endpoint
-* family aws-sdk-go-v2 (and so `docker-credential-ecr-login`) honours — a
-* secret named `AWS_ENDPOINT_URL_ECR` walks around the exact
-* `AWS_ENDPOINT_URL` entry and redirects a request signed with the operator's
-* real credentials (go-to-k/cdkd#2186 round 4). `CLOUDSDK_` is gcloud's (go-to-k/cdkd#3599): every
-* gcloud property is settable as `CLOUDSDK_<SECTION>_<NAME>`, which covers
-* its token host, API endpoint overrides, proxy, CA bundle and account, and
-* the `docker-credential-gcloud` wrapper execs `$CLOUDSDK_PYTHON
-* $CLOUDSDK_PYTHON_ARGS`. `BASH_FUNC_` is bash's exported-function family.
-* No plausible secret name collides with these, apart from the one listed in
-* {@link DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS}. Matched by prefix rather than
-* enumerated (issue go-to-k/cdkd#2183 review). `SSH_` was a prefix here and was demoted to
-* an EXACT enumeration in {@link DOCKER_CLIENT_ENV_KEYS} (go-to-k/cdkd#2186 review round
-* 3): the family is not
-* uniformly dangerous and is not growing, while the prefix broke realistic,
-* currently-working secrets (`SSH_PRIVATE_KEY`, GitLab CI's canonical
-* deploy-key spelling). Exported so the test fence can assert the EXACT
-* contents — a hardcoded copy in the test made the anti-shadowing fence
-* one-directional (go-to-k/cdkd#2186 round 4 finding 2).
-*/
-const DOCKER_CLIENT_ENV_PREFIXES = [
-	"LD_",
-	"DYLD_",
-	"AWS_ENDPOINT_URL_",
-	"CLOUDSDK_",
-	"BASH_FUNC_"
-];
-/**
-* Exact names inside a {@link DOCKER_CLIENT_ENV_PREFIXES} family that are still
-* delivered. An entry must be a realistic secret name AND harmless to the
-* helper that reads it. `CLOUDSDK_AUTH_ACCESS_TOKEN` is gcloud's own variable
-* for a caller-supplied access token (go-to-k/cdkd#3599). Given to `docker-credential-gcloud`,
-* it only changes which token gcloud hands docker, with no network call of its
-* own. gcloud's `auth docker-helper` answers only for a registry in its own
-* supported list unless `artifacts/allow_unrecognized_registry` is set, and
-* that property, the token host, the universe domain and every other variable
-* that could redirect or weaken the exchange stay refused by the `CLOUDSDK_`
-* prefix. Stored upper-case and matched case-insensitively. Never exempt an
-* exact {@link DOCKER_CLIENT_ENV_KEYS} member: the exact list wins.
-*/
-const DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS = /* @__PURE__ */ new Set(["CLOUDSDK_AUTH_ACCESS_TOKEN"]);
-/**
-* Is `key` the name of a var the docker client reads? Case-INSENSITIVE, because
-* Windows environment lookups are, so a lowercase `docker_host` must be caught
-* too (issue go-to-k/cdkd#2183). Matches the exact denylist OR a prefixed family — the
-* prefix families are fail-closed on the whole prefix, so an unlisted `LD_*` /
-* `DYLD_*` / `AWS_ENDPOINT_URL_*` / `CLOUDSDK_*` / `BASH_FUNC_*` secret is
-* dropped (with a rename warning) rather than reaching the client, except for
-* a name in {@link DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS}.
-*/
-function isDockerClientEnvKey(key) {
-	const upper = key.toUpperCase();
-	if (DOCKER_CLIENT_ENV_KEYS_UPPER.has(upper)) return true;
-	if (DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS.has(upper)) return false;
-	return DOCKER_CLIENT_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
-}
-/**
-* A well-formed `docker run -e` variable NAME: non-empty, and containing
-* neither `=` (the OS parses the environ entry's name as everything before the
-* first one) nor NUL (Node refuses to spawn). A newline IS accepted, because it
-* is inside the class — not because of the anchor: JS `$` without the `m` flag
-* matches only at end of input (`/^abc$/.test('abc\n') === false`). That
-* matches the clause list this replaced, i.e. deliberately not stricter.
-*/
-const WELL_FORMED_ENV_KEY = /^[^=\u0000]+$/;
-/**
-* Is `key` a shape that cannot be a well-formed `docker run -e` variable NAME?
-* Defined POSITIVELY as {@link WELL_FORMED_ENV_KEY}'s complement (go-to-k/cdkd#2186 rounds
-* 5-6). Enumerating the bad spellings one at a time closed `=` in round 4 and
-* left the empty key (`-e ''` — docker rejects it with an opaque error naming
-* no secret) and a NUL-bearing key still open; the complement closes any
-* further bad shape without another clause. A sensitive key matching this
-* takes the same fail-closed
-* collision path as a docker-client-var name: no `-e` flag, no spawn-env entry,
-* reported in `collisions`. (This is the NAME only.)
-*/
-function isMalformedEnvKey(key) {
-	return !WELL_FORMED_ENV_KEY.test(key);
-}
-
-//#endregion
-export { stringifyThrown as C, resetEmbedConfig as D, getEmbedConfig as E, setEmbedConfig as O, sanitizeServiceExceptionMessage as S, resolveConfiguredLogLevel as T, clampErrorName as _, isDockerClientEnvKey as a, flattenToOneLine as b, runDockerStreaming as c, absoluteAssemblyPathEscape as d, assemblyPathEscape as f, resolveAssemblyPath as g, renderAssemblyPathEscape as h, getDockerCmd as i, spawnStreaming as l, namesTheSameDirectory as m, finchSecretArgvRefusal as n, isMalformedEnvKey as o, displayUntrustedValue as p, formatDockerLoginError as r, runDockerForeground as s, docker_cmd_exports as t, warnFinchArgvExposure as u, describeAwsFailureForWarn as v, getLogger as w, isAwsServiceException as x, describeCredentialLoadFailure as y };
-//# sourceMappingURL=docker-cmd-leyvDn1u.js.map