cdk-local 0.149.8 → 0.149.9

package/dist/{local-studio-DGJn7XtJ.js → local-studio-CcK2y5Gs.js}

@@ -14,13 +14,14 @@ import { Agent as Agent$2 } from "agent-base";
 import { HttpProxyAgent } from "http-proxy-agent";
 import { HttpsProxyAgent } from "https-proxy-agent";
 import { getProxyForUrl } from "proxy-from-env";
+import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { GetParameterCommand, GetParametersCommand, SSMClient } from "@aws-sdk/client-ssm";
 import { unzipSync } from "fflate";
 import { MultiSelectPrompt } from "@clack/core";
 import { S_BAR, S_BAR_END, S_BAR_START, S_CHECKBOX_ACTIVE, S_CHECKBOX_INACTIVE, S_CHECKBOX_SELECTED, confirm, isCancel, multiselect, select, text } from "@clack/prompts";
 import { CloudFormationClient, DescribeStacksCommand, ListExportsCommand, ListStackResourcesCommand } from "@aws-sdk/client-cloudformation";
 import { GetFunctionConfigurationCommand, LambdaClient } from "@aws-sdk/client-lambda";
 import { BedrockAgentCoreControlClient, GetAgentRuntimeCommand } from "@aws-sdk/client-bedrock-agentcore-control";
-import { GetParameterCommand, GetParametersCommand, SSMClient } from "@aws-sdk/client-ssm";
 import { execFile, spawn } from "node:child_process";
 import { connect, createServer as createServer$2 } from "node:net";
 import { promisify } from "node:util";
@@ -38,7 +39,6 @@ import * as chokidar from "chokidar";
 import { Sha256 } from "@aws-crypto/sha256-js";
 import { SignatureV4 } from "@smithy/signature-v4";
 import graphlib from "graphlib";
-import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 import * as nodeBuffer from "node:buffer";
 import * as nodeQuerystring from "node:querystring";
 import * as vm from "node:vm";
@@ -506,6 +506,355 @@ function effectiveAssumeRoleArn(logicalId, opt) {
 	return opt.perLambda?.[logicalId] ?? opt.globalArn;
 }
 
+//#endregion
+//#region src/utils/own-keys.ts
+function defineOwnKey(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
+}
+
+//#endregion
+//#region src/local/dynamic-reference-resolver.ts
+var DynamicReferenceResolutionError = class DynamicReferenceResolutionError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "DynamicReferenceResolutionError";
+		Object.setPrototypeOf(this, DynamicReferenceResolutionError.prototype);
+	}
+};
+var DeferredFailure = class extends Error {
+	build;
+	constructor(build) {
+		super("deferred dynamic-reference failure");
+		this.build = build;
+	}
+	render(opts) {
+		return new DynamicReferenceResolutionError(this.build(opts.consumer, opts.overridable !== false));
+	}
+};
+function deferred(build) {
+	return new DeferredFailure(build);
+}
+const DYNAMIC_REFERENCE_SOURCE = String.raw`\{\{resolve:[^}]*\}\}`;
+const DYNAMIC_REFERENCE_DETECT = new RegExp(DYNAMIC_REFERENCE_SOURCE);
+function dynamicReferenceMatcher() {
+	return new RegExp(DYNAMIC_REFERENCE_SOURCE, "g");
+}
+function firstUsableRegion(...candidates) {
+	return candidates.find((r) => r !== void 0 && r !== "" && r !== "unknown-region");
+}
+function keysOverriddenBy(templateEnv, applyOverrides) {
+	const out = /* @__PURE__ */ new Set();
+	if (!templateEnv) return out;
+	const sentinel = {};
+	for (const k of Object.keys(templateEnv)) defineOwnKey(sentinel, k, `\u0000cdkl-sentinel:${k}`);
+	const applied = applyOverrides(sentinel);
+	for (const k of Object.keys(templateEnv)) if (!Object.hasOwn(applied, k) || applied[k] !== sentinel[k]) out.add(k);
+	return out;
+}
+function withoutKeys(env, keys) {
+	const out = {};
+	for (const k of Object.keys(env)) if (!keys.has(k)) defineOwnKey(out, k, env[k]);
+	return out;
+}
+function deployedFillMayBeSecret(templateValue, template) {
+	const resources = template?.Resources ?? {};
+	const secretAttribute = (logicalId, attribute) => {
+		const res = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		const type = res && typeof res === "object" ? res["Type"] : void 0;
+		if (typeof type !== "string") return false;
+		if (type.startsWith("Custom::") || type === "AWS::CloudFormation::CustomResource") return true;
+		if (type === "AWS::CloudFormation::Stack") return attribute.startsWith("Outputs.");
+		return type === "AWS::IAM::AccessKey" && attribute === "SecretAccessKey" || type === "AWS::AppSync::ApiKey" && attribute === "ApiKey" || type === "AWS::Cognito::UserPoolClient" && attribute === "ClientSecret";
+	};
+	const getAttTarget = (arg) => {
+		if (Array.isArray(arg) && typeof arg[0] === "string" && typeof arg[1] === "string") return [arg[0], arg[1]];
+		if (typeof arg === "string" && arg.includes(".")) {
+			const i = arg.indexOf(".");
+			return [arg.slice(0, i), arg.slice(i + 1)];
+		}
+	};
+	const noEcho = /* @__PURE__ */ new Set();
+	for (const [name, decl] of Object.entries(template?.Parameters ?? {})) if (decl && typeof decl === "object") {
+		const flag = decl["NoEcho"];
+		if (String(flag).toLowerCase() === "true") noEcho.add(name);
+	}
+	const subNamesNoEcho = (body, bound) => {
+		for (const m of body.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+			const name = m[1].trim();
+			if (bound.has(name)) continue;
+			if (noEcho.has(name)) return true;
+			const dot = name.indexOf(".");
+			if (dot > 0 && secretAttribute(name.slice(0, dot), name.slice(dot + 1))) return true;
+		}
+		return false;
+	};
+	const walk = (v) => {
+		if (typeof v === "string") return v.includes("{{resolve:");
+		if (Array.isArray(v)) return v.some(walk);
+		if (v === null || typeof v !== "object") return false;
+		const obj = v;
+		if (Object.hasOwn(obj, "Fn::ImportValue") || Object.hasOwn(obj, "Fn::GetStackOutput")) return true;
+		if (Object.hasOwn(obj, "Fn::GetAtt")) {
+			const target = getAttTarget(obj["Fn::GetAtt"]);
+			if (target && secretAttribute(target[0], target[1])) return true;
+		}
+		if (Object.hasOwn(obj, "Ref")) {
+			const target = obj["Ref"];
+			if (typeof target === "string" && noEcho.has(target)) return true;
+		}
+		if (Object.hasOwn(obj, "Fn::Sub")) {
+			const sub = obj["Fn::Sub"];
+			if (typeof sub === "string" && subNamesNoEcho(sub, /* @__PURE__ */ new Set())) return true;
+			if (Array.isArray(sub) && typeof sub[0] === "string") {
+				const bindings = sub[1] && typeof sub[1] === "object" ? sub[1] : {};
+				if (subNamesNoEcho(sub[0], new Set(Object.keys(bindings)))) return true;
+			}
+		}
+		return Object.values(obj).some(walk);
+	};
+	return walk(templateValue);
+}
+function containsDynamicReference(value) {
+	return typeof value === "string" && DYNAMIC_REFERENCE_DETECT.test(value);
+}
+function malformed(raw, why) {
+	return new DynamicReferenceResolutionError(`Malformed CloudFormation dynamic reference ${displayUntrustedValue(raw)}: ${why}.`);
+}
+function parseDynamicReference(raw) {
+	const m = /^\{\{resolve:([^:{}]*):([^{}]*)\}\}$/.exec(raw);
+	if (!m) throw malformed(raw, "expected {{resolve:<service>:<reference>}}");
+	const service = m[1];
+	const body = m[2];
+	if (service === "secretsmanager") return parseSecretsManager(raw, body);
+	if (service === "ssm" || service === "ssm-secure") return parseSsm(raw, service, body);
+	throw malformed(raw, `unsupported service ${displayUntrustedValue(service)} (expected secretsmanager, ssm or ssm-secure)`);
+}
+function parseSecretsManager(raw, body) {
+	const parts = body.split(":");
+	let secretId;
+	let rest;
+	let arnRegion;
+	if (body.startsWith("arn:")) {
+		if (parts.length < 7 || parts[2] !== "secretsmanager" || parts[5] !== "secret" || !parts[6]) throw malformed(raw, "the secret ARN is not arn:<partition>:secretsmanager:<region>:<account>:secret:<name>");
+		secretId = parts.slice(0, 7).join(":");
+		arnRegion = parts[3] || void 0;
+		rest = parts.slice(7);
+	} else {
+		secretId = parts[0];
+		rest = parts.slice(1);
+	}
+	if (secretId.length === 0) throw malformed(raw, "the secret id is empty");
+	if (rest.length > 4) throw malformed(raw, "too many segments after the secret id (expected SecretString:<json-key>:<version-stage>:<version-id>)");
+	const [secretString, jsonKey, versionStage, versionId] = rest;
+	if (secretString !== void 0 && secretString !== "" && secretString !== "SecretString") throw malformed(raw, "the only supported value segment is SecretString");
+	if (versionStage && versionId) throw malformed(raw, "specify a version stage or a version id, not both");
+	return {
+		service: "secretsmanager",
+		raw,
+		secretId,
+		...arnRegion !== void 0 && { arnRegion },
+		...jsonKey && { jsonKey },
+		...versionStage && { versionStage },
+		...versionId && { versionId }
+	};
+}
+function parseSsm(raw, service, body) {
+	const parts = body.split(":");
+	let nameParts;
+	let versionParts;
+	let arnRegion;
+	if (body.startsWith("arn:")) {
+		if (parts.length < 6 || parts[2] !== "ssm" || !parts[5]?.startsWith("parameter/")) throw malformed(raw, "the parameter ARN is not arn:<partition>:ssm:<region>:<account>:parameter/<name>");
+		nameParts = parts.slice(0, 6);
+		versionParts = parts.slice(6);
+		arnRegion = parts[3] || void 0;
+	} else {
+		nameParts = parts.slice(0, 1);
+		versionParts = parts.slice(1);
+	}
+	const name = nameParts.join(":");
+	if (name.length === 0) throw malformed(raw, "the parameter name is empty");
+	if (versionParts.length > 1) throw malformed(raw, "too many segments after the parameter name");
+	const version = versionParts[0];
+	if (version !== void 0 && !/^[1-9]\d*$/.test(version)) throw malformed(raw, "the parameter version must be a positive integer");
+	return {
+		service,
+		raw,
+		name,
+		...arnRegion !== void 0 && { arnRegion },
+		...version !== void 0 && { version }
+	};
+}
+function requiredPermissionsFor(ref) {
+	switch (ref.service) {
+		case "secretsmanager": return "secretsmanager:GetSecretValue (plus kms:Decrypt when the secret uses a customer managed KMS key)";
+		case "ssm": return "ssm:GetParameter";
+		case "ssm-secure": return "ssm:GetParameter and kms:Decrypt on the parameter key";
+	}
+}
+var DynamicReferenceResolver = class {
+	smClients = /* @__PURE__ */ new Map();
+	ssmClients = /* @__PURE__ */ new Map();
+	cache = /* @__PURE__ */ new Map();
+	options;
+	constructor(options = {}) {
+		this.options = options;
+	}
+	async resolveString(value, opts) {
+		if (!containsDynamicReference(value)) return value;
+		const tokens = [...value.matchAll(dynamicReferenceMatcher())].map((m) => m[0]);
+		const resolved = await Promise.all(tokens.map((t) => this.resolveToken(t, opts)));
+		let i = 0;
+		return value.replace(dynamicReferenceMatcher(), () => resolved[i++]);
+	}
+	dispose() {
+		for (const c of this.smClients.values()) c.destroy();
+		for (const c of this.ssmClients.values()) c.destroy();
+		this.smClients.clear();
+		this.ssmClients.clear();
+		this.cache.clear();
+	}
+	resolveToken(raw, opts) {
+		let ref;
+		try {
+			ref = parseDynamicReference(raw);
+		} catch (err) {
+			if (!(err instanceof DynamicReferenceResolutionError)) throw err;
+			return Promise.reject(new DynamicReferenceResolutionError(`${err.message.replace(/\.$/, "")} (${opts.consumer}).`));
+		}
+		const region = firstUsableRegion(ref.arnRegion, opts.region);
+		const cacheKey = `${region ?? ""}\u0000${raw}`;
+		let pending = this.cache.get(cacheKey);
+		if (!pending) {
+			pending = ref.service === "secretsmanager" ? this.fetchSecret(ref, region) : this.fetchParameter(ref, region);
+			this.cache.set(cacheKey, pending);
+			pending.catch(() => this.cache.delete(cacheKey));
+		}
+		const service = ref.service;
+		return pending.then((value) => {
+			getLogger().child("dynamic-reference").debug(`Resolved ${service} dynamic reference for ${opts.consumer}`);
+			return value;
+		}, (err) => {
+			throw err instanceof DeferredFailure ? err.render(opts) : err;
+		});
+	}
+	smClient(region) {
+		const key = region ?? "";
+		let c = this.smClients.get(key);
+		if (!c) {
+			c = this.options.secretsManagerClientFactory?.(region) ?? new SecretsManagerClient({
+				...buildProxyClientConfig({ profile: this.options.profile }),
+				...region && { region },
+				...this.options.profile && { profile: this.options.profile }
+			});
+			this.smClients.set(key, c);
+		}
+		return c;
+	}
+	ssmClient(region) {
+		const key = region ?? "";
+		let c = this.ssmClients.get(key);
+		if (!c) {
+			c = this.options.ssmClientFactory?.(region) ?? new SSMClient({
+				...buildProxyClientConfig({ profile: this.options.profile }),
+				...region && { region },
+				...this.options.profile && { profile: this.options.profile }
+			});
+			this.ssmClients.set(key, c);
+		}
+		return c;
+	}
+	fetchFailure(ref, region, operation, err) {
+		const name = err instanceof Error ? err.name : "";
+		let hint = "";
+		if (/NotFound/.test(name)) hint = ` The ${ref.service === "secretsmanager" ? "secret" : "parameter"} (or the requested version) does not exist in ${region ?? "the default region"}.`;
+		else if (/AccessDenied|NotAuthorized|UnrecognizedClient|ExpiredToken/.test(name)) hint = " The credentials cdk-local resolves with were refused.";
+		const detail = describeAwsFailureForWarn(err, operation);
+		return deferred((consumer, overridable) => `Could not resolve CloudFormation dynamic reference ${displayUntrustedValue(ref.raw)} for ${consumer} (${operation} in ${region ?? "the default region"}): ${detail}.${hint} Resolving it needs ${requiredPermissionsFor(ref)}. cdk-local does not fall back to the unresolved token` + (overridable ? "; override the variable with --env-vars to skip the lookup." : "."));
+	}
+	async fetchSecret(ref, region) {
+		const operation = "SecretsManager GetSecretValue";
+		let secretString;
+		try {
+			secretString = (await this.smClient(region).send(new GetSecretValueCommand({
+				SecretId: ref.secretId,
+				...ref.versionStage && { VersionStage: ref.versionStage },
+				...ref.versionId && { VersionId: ref.versionId }
+			}))).SecretString;
+		} catch (err) {
+			throw this.fetchFailure(ref, region, operation, err);
+		}
+		if (secretString === void 0) throw deferred((consumer) => `CloudFormation dynamic reference ${displayUntrustedValue(ref.raw)} for ${consumer}: the secret has no SecretString (binary secrets cannot be referenced).`);
+		if (ref.jsonKey === void 0) return secretString;
+		const jsonKey = ref.jsonKey;
+		let parsed;
+		try {
+			parsed = JSON.parse(secretString);
+		} catch (err) {
+			const kind = err instanceof Error ? err.name : "unknown";
+			throw deferred((consumer) => `CloudFormation dynamic reference ${displayUntrustedValue(ref.raw)} for ${consumer} names json-key ${displayUntrustedValue(jsonKey)} but the secret value is not valid JSON (${kind}). The parser detail is withheld because it would echo the secret plaintext.`);
+		}
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw deferred((consumer) => `CloudFormation dynamic reference ${displayUntrustedValue(ref.raw)} for ${consumer} names json-key ${displayUntrustedValue(jsonKey)} but the secret root is not a JSON object.`);
+		if (!Object.hasOwn(parsed, jsonKey)) throw deferred((consumer) => `CloudFormation dynamic reference ${displayUntrustedValue(ref.raw)} for ${consumer} names json-key ${displayUntrustedValue(jsonKey)} but no such key exists in the secret JSON.`);
+		const value = parsed[jsonKey];
+		return typeof value === "string" ? value : JSON.stringify(value);
+	}
+	async fetchParameter(ref, region) {
+		const operation = "SSM GetParameter";
+		let value;
+		let type;
+		try {
+			const resp = await this.ssmClient(region).send(new GetParameterCommand({
+				Name: ref.version !== void 0 ? `${ref.name}:${ref.version}` : ref.name,
+				WithDecryption: ref.service === "ssm-secure"
+			}));
+			value = resp.Parameter?.Value;
+			type = resp.Parameter?.Type;
+		} catch (err) {
+			throw this.fetchFailure(ref, region, operation, err);
+		}
+		if (value === void 0) throw deferred((consumer) => `CloudFormation dynamic reference ${displayUntrustedValue(ref.raw)} for ${consumer}: SSM returned no parameter value.`);
+		if (ref.service === "ssm" && type === "SecureString") throw deferred((consumer) => `CloudFormation dynamic reference ${displayUntrustedValue(ref.raw)} for ${consumer} names a SecureString parameter; use {{resolve:ssm-secure:...}} for SecureString parameters.`);
+		return value;
+	}
+};
+function keysNotFromTemplate(templateEnv, finalEnv) {
+	const out = /* @__PURE__ */ new Set();
+	for (const [k, v] of Object.entries(finalEnv)) {
+		const declared = templateEnv !== void 0 && Object.hasOwn(templateEnv, k) ? templateEnv[k] : void 0;
+		if (declared === void 0 || typeof declared !== "string" && typeof declared !== "number" && typeof declared !== "boolean" || String(declared) !== v) out.add(k);
+	}
+	return out;
+}
+async function resolveDynamicReferencesInEnv(env, options) {
+	const candidates = Object.keys(env).filter((k) => !options.skipKeys?.has(k) && containsDynamicReference(env[k]));
+	if (candidates.length === 0) return {
+		env,
+		resolvedKeys: []
+	};
+	const resolver = options.resolver ?? new DynamicReferenceResolver(options);
+	try {
+		const values = await Promise.all(candidates.map((k) => resolver.resolveString(env[k], {
+			region: options.region,
+			consumer: `${options.label} env var ${displayUntrustedValue(k)}`
+		})));
+		const out = {};
+		for (const k of Object.keys(env)) defineOwnKey(out, k, env[k]);
+		candidates.forEach((k, i) => defineOwnKey(out, k, values[i]));
+		return {
+			env: out,
+			resolvedKeys: candidates
+		};
+	} finally {
+		if (!options.resolver) resolver.dispose();
+	}
+}
+
 //#endregion
 //#region src/utils/error-handler.ts
 var CdkLocalError = class CdkLocalError extends Error {
@@ -3612,17 +3961,6 @@ function toFlagName(field) {
 	return "--" + field.replace(/([A-Z])/g, "-$1").toLowerCase();
 }
 
-//#endregion
-//#region src/utils/own-keys.ts
-function defineOwnKey(target, key, value) {
-	Object.defineProperty(target, key, {
-		value,
-		writable: true,
-		enumerable: true,
-		configurable: true
-	});
-}
-
 //#endregion
 //#region src/local/state-resolver.ts
 function substituteAgainstState(value, contextOrResources) {
@@ -3988,9 +4326,20 @@ async function resolveImportValueAsync(arg, context) {
 		kind: "unresolved",
 		reason: `Fn::ImportValue ${displayUntrustedValue(exportName)}: export not found in any deployed stack in this region`
 	};
+	return crossStackLiteral(resolved, context.consumerRegion ?? context.pseudoParameters?.region, context);
+}
+async function crossStackLiteral(value, producerRegion, context) {
+	if (producerRegion && context.resolveDynamicReferences && containsDynamicReference(value)) {
+		const plain = await context.resolveDynamicReferences(value, producerRegion);
+		context.onDynamicReferenceResolved?.();
+		return {
+			kind: "literal",
+			value: plain
+		};
+	}
 	return {
 		kind: "literal",
-		value: resolved
+		value
 	};
 }
 async function resolveGetStackOutputAsync(arg, context) {
@@ -4057,10 +4406,7 @@ async function resolveGetStackOutputAsync(arg, context) {
 		kind: "unresolved",
 		reason: `Fn::GetStackOutput ${displayUntrustedValue(stackName)}.${displayUntrustedValue(outputName)} (${displayUntrustedValue(region)}): output not found in producer stack state`
 	};
-	return {
-		kind: "literal",
-		value: resolved
-	};
+	return crossStackLiteral(resolved, region, context);
 }
 function substituteEnvVarsFromState(templateEnv, contextOrResources) {
 	const env = {};
@@ -4111,7 +4457,7 @@ function resolveWithSensitivity(value, context) {
 	};
 }
 async function resolveWithSensitivityAsync(value, context) {
-	if (!context.sensitiveParameters || context.sensitiveParameters.size === 0) return {
+	if ((!context.sensitiveParameters || context.sensitiveParameters.size === 0) && !context.resolveDynamicReferences) return {
 		result: await substituteAgainstStateAsync(value, context),
 		consumedSensitive: false
 	};
@@ -4121,6 +4467,9 @@ async function resolveWithSensitivityAsync(value, context) {
 			...context,
 			onSensitiveParameterConsumed: () => {
 				consumedSensitive = true;
+			},
+			onDynamicReferenceResolved: () => {
+				consumedSensitive = true;
 			}
 		}),
 		consumedSensitive
@@ -4928,6 +5277,7 @@ function checkVolumeHostPath(hostPath) {
 }
 async function applyCrossStackResolverToTask(task, context) {
 	if (!context.crossStackResolver) return;
+	const { resolveDynamicReferences: _envOnly, ...secretContext } = context;
 	const rawContainers = (task.resource.Properties ?? {})["ContainerDefinitions"];
 	if (!Array.isArray(rawContainers)) return;
 	for (let idx = 0; idx < task.containers.length; idx += 1) {
@@ -4963,7 +5313,7 @@ async function applyCrossStackResolverToTask(task, context) {
 			if (typeof valueFromRaw === "string" && valueFromRaw.length > 0) continue;
 			if (container.secrets.some((s) => s.name === sName)) continue;
 			if (!isCrossStackIntrinsic(valueFromRaw)) continue;
-			const sub = await substituteAgainstStateAsync(valueFromRaw, context);
+			const sub = await substituteAgainstStateAsync(valueFromRaw, secretContext);
 			if (sub.kind === "literal" && typeof sub.value === "string" && sub.value.length > 0) {
 				container.secrets.push({
 					name: sName,
@@ -12136,6 +12486,8 @@ async function buildContainerSpec(args) {
 	let templateEnv = getTemplateEnv$1(lambda.resource);
 	const stateBundle = stateByStack.get(lambda.stack.stackName);
 	let stateAudit;
+	const plaintextKeys = /* @__PURE__ */ new Set();
+	const deployedSecretKeys = [];
 	if (stateBundle) {
 		const context = { resources: stateBundle.state.resources };
 		if (stateBundle.pseudoParameters) context.pseudoParameters = stateBundle.pseudoParameters;
@@ -12153,13 +12505,15 @@ async function buildContainerSpec(args) {
 			unresolved = fb.stillUnresolved;
 			for (const key of fb.filled) {
 				resolvedKeys.push(key);
+				plaintextKeys.add(key);
+				if (deployedFillMayBeSecret(getTemplateEnv$1(lambda.resource)?.[key], lambda.stack.template)) deployedSecretKeys.push(key);
 				getLogger().debug(`Lambda ${logicalId}: filled env var ${key} from deployed function config`);
 			}
 		}
 		stateAudit = {
 			resolvedKeys,
 			unresolved,
-			sensitiveKeys: audit.sensitiveKeys
+			sensitiveKeys: [...audit.sensitiveKeys, ...deployedSecretKeys]
 		};
 		for (const { key, reason } of unresolved) getLogger().warn(`Lambda ${logicalId}: state source could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
 	}
@@ -12170,6 +12524,14 @@ async function buildContainerSpec(args) {
 		const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? logicalId;
 		getLogger().warn(`Lambda ${logicalId}: env var ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}) or pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to recover deployed values.`);
 	}
+	for (const key of stateAudit?.sensitiveKeys ?? []) plaintextKeys.add(key);
+	for (const key of keysNotFromTemplate(templateEnv, envResult.resolved)) plaintextKeys.add(key);
+	const dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
+		region: firstUsableRegion(stateBundle?.region, stackRegionOverride, lambda.stack.region, stsRegion, profileRegion),
+		label: `Lambda ${logicalId}`,
+		skipKeys: plaintextKeys,
+		...profile !== void 0 && { profile }
+	});
 	const dockerEnv = {
 		AWS_LAMBDA_FUNCTION_NAME: logicalId,
 		AWS_LAMBDA_FUNCTION_MEMORY_SIZE: String(lambda.memoryMb),
@@ -12177,7 +12539,7 @@ async function buildContainerSpec(args) {
 		AWS_LAMBDA_FUNCTION_VERSION: "$LATEST",
 		AWS_LAMBDA_LOG_GROUP_NAME: `/aws/lambda/${logicalId}`,
 		AWS_LAMBDA_LOG_STREAM_NAME: "local",
-		...envResult.resolved
+		...dynamic.env
 	};
 	const roleArn = resolveStartApiAssumeRoleArn({
 		logicalId,
@@ -12217,7 +12579,8 @@ async function buildContainerSpec(args) {
 		target: "/tmp",
 		sizeMb: lambda.ephemeralStorageMb
 	} : void 0;
-	const sensitiveEnvKeys = stateAudit && stateAudit.sensitiveKeys.length > 0 ? new Set(stateAudit.sensitiveKeys) : void 0;
+	const sensitiveKeyList = [...stateAudit?.sensitiveKeys ?? [], ...dynamic.resolvedKeys];
+	const sensitiveEnvKeys = sensitiveKeyList.length > 0 ? new Set(sensitiveKeyList) : void 0;
 	if (lambda.kind === "zip") return {
 		kind: "zip",
 		lambda,
@@ -12631,13 +12994,16 @@ async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options,
 		try {
 			const loaded = await provider.load(stack.stackName, stack.region);
 			if (!loaded) continue;
-			const bundle = { state: {
-				version: 1,
-				stackName: stack.stackName,
-				resources: loaded.resources,
-				outputs: loaded.outputs,
-				lastModified: 0
-			} };
+			const bundle = {
+				state: {
+					version: 1,
+					stackName: stack.stackName,
+					resources: loaded.resources,
+					outputs: loaded.outputs,
+					lastModified: 0
+				},
+				region: loaded.region
+			};
 			if (stackHasIntrinsicEnv(stackName)) {
 				const pseudo = await resolvePseudoParametersForStartApi(loaded.region, options);
 				if (pseudo) bundle.pseudoParameters = pseudo;
@@ -13145,14 +13511,30 @@ function applyProfileCredentialsOverlay(env, profileCreds, assumeRoleActive) {
 	else delete env["AWS_SESSION_TOKEN"];
 }
 async function resolveLambdaContainerEnv(lambda, options, profileCredentials, extraStateProviders) {
+	const dynamicRefs = new DynamicReferenceResolver({ ...options.profile !== void 0 && { profile: options.profile } });
+	try {
+		return await resolveLambdaContainerEnvWith(lambda, options, profileCredentials, extraStateProviders, dynamicRefs);
+	} finally {
+		dynamicRefs.dispose();
+	}
+}
+async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials, extraStateProviders, dynamicRefs) {
 	const logger = getLogger();
 	let stateAudit;
-	let templateEnv = getTemplateEnv(lambda.resource);
+	let ownerRegion;
+	const plaintextKeys = /* @__PURE__ */ new Set();
+	const deployedSecretKeys = [];
+	const declaredEnv = getTemplateEnv(lambda.resource);
+	const overrides = readEnvOverridesFile$3(options.envVars);
+	const lambdaCdkPath = readCdkPathOrUndefined(lambda.resource);
+	const overriddenKeys = keysOverriddenBy(declaredEnv, (env) => resolveEnvVars$1(lambda.logicalId, lambdaCdkPath, env, overrides).resolved);
+	let templateEnv = declaredEnv && withoutKeys(declaredEnv, overriddenKeys);
 	let stateForRoleHint;
 	const stateProvider = createLocalStateProvider(options, lambda.stack.stackName, await resolveCfnFallbackRegion(options, lambda.stack.region), extraStateProviders);
 	if (stateProvider) try {
 		const loaded = await stateProvider.load(lambda.stack.stackName, lambda.stack.region);
 		if (loaded) {
+			ownerRegion = loaded.region;
 			stateForRoleHint = {
 				version: 1,
 				stackName: lambda.stack.stackName,
@@ -13162,7 +13544,11 @@ async function resolveLambdaContainerEnv(lambda, options, profileCredentials, ex
 			};
 			const subContext = {
 				resources: loaded.resources,
-				consumerRegion: loaded.region
+				consumerRegion: loaded.region,
+				resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
+					region: producerRegion,
+					consumer: `Lambda ${lambda.logicalId} cross-stack env value`
+				})
 			};
 			if (envHasIntrinsicValue(templateEnv)) {
 				const pseudo = await resolvePseudoParametersForInvoke(lambda.stack.region, options);
@@ -13192,6 +13578,8 @@ async function resolveLambdaContainerEnv(lambda, options, profileCredentials, ex
 					unresolved = fb.stillUnresolved;
 					for (const key of fb.filled) {
 						resolvedKeys.push(key);
+						plaintextKeys.add(key);
+						if (deployedFillMayBeSecret(declaredEnv?.[key], lambda.stack.template)) deployedSecretKeys.push(key);
 						logger.debug(`${label}: filled env var ${key} from deployed function config`);
 					}
 				}
@@ -13199,7 +13587,7 @@ async function resolveLambdaContainerEnv(lambda, options, profileCredentials, ex
 			stateAudit = {
 				resolvedKeys,
 				unresolved,
-				sensitiveKeys: audit.sensitiveKeys
+				sensitiveKeys: [...audit.sensitiveKeys, ...deployedSecretKeys]
 			};
 			for (const { key, reason } of unresolved) logger.warn(`${label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
 		}
@@ -13207,14 +13595,20 @@ async function resolveLambdaContainerEnv(lambda, options, profileCredentials, ex
 		stateProvider.dispose();
 		throw err;
 	}
-	const overrides = readEnvOverridesFile$3(options.envVars);
-	const lambdaCdkPath = readCdkPathOrUndefined(lambda.resource);
 	const envResult = resolveEnvVars$1(lambda.logicalId, lambdaCdkPath, templateEnv, overrides);
 	for (const key of envResult.unresolved) {
 		if (stateAudit && stateAudit.unresolved.some((u) => u.key === key)) continue;
 		const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? lambda.logicalId;
 		logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to recover deployed values.`);
 	}
+	for (const key of stateAudit?.sensitiveKeys ?? []) plaintextKeys.add(key);
+	for (const key of keysNotFromTemplate(templateEnv, envResult.resolved)) plaintextKeys.add(key);
+	const dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
+		region: firstUsableRegion(ownerRegion, options.stackRegion, lambda.stack.region, options.region, profileCredentials?.region),
+		label: `Lambda ${lambda.logicalId}`,
+		skipKeys: plaintextKeys,
+		resolver: dynamicRefs
+	});
 	let resolvedAssumeRoleArn;
 	try {
 		resolvedAssumeRoleArn = await resolveAssumeRoleArnForLambda(options.assumeRole, stateForRoleHint, stateProvider, lambda.logicalId);
@@ -13228,7 +13622,7 @@ async function resolveLambdaContainerEnv(lambda, options, profileCredentials, ex
 		AWS_LAMBDA_FUNCTION_VERSION: "$LATEST",
 		AWS_LAMBDA_LOG_GROUP_NAME: `/aws/lambda/${lambda.logicalId}`,
 		AWS_LAMBDA_LOG_STREAM_NAME: "local",
-		...envResult.resolved
+		...dynamic.env
 	};
 	let assumeSucceeded = false;
 	if (resolvedAssumeRoleArn) {
@@ -13264,7 +13658,7 @@ async function resolveLambdaContainerEnv(lambda, options, profileCredentials, ex
 	}
 	return {
 		env: dockerEnv,
-		sensitiveEnvKeys: stateAudit?.sensitiveKeys ?? [],
+		sensitiveEnvKeys: [.../* @__PURE__ */ new Set([...stateAudit?.sensitiveKeys ?? [], ...dynamic.resolvedKeys])],
 		...stateForRoleHint !== void 0 && { stateForRoleHint },
 		assumeRoleApplied: assumeSucceeded
 	};
@@ -14583,13 +14977,28 @@ function findFileAssetByObjectKey$1(fileAssets, hash) {
 	for (const asset of fileAssets.values()) if (Object.values(asset.destinations).some((d) => d.objectKey === zip || d.objectKey.endsWith(`/${zip}`))) return asset;
 }
 async function buildContainerEnv(resolved, options, profileCredentials, profileCredsFile, stateProvider, loaded, imageContext) {
+	const dynamicRefs = new DynamicReferenceResolver({ ...options.profile !== void 0 && { profile: options.profile } });
+	try {
+		return await buildContainerEnvWith(resolved, options, profileCredentials, profileCredsFile, stateProvider, loaded, imageContext, dynamicRefs);
+	} finally {
+		dynamicRefs.dispose();
+	}
+}
+async function buildContainerEnvWith(resolved, options, profileCredentials, profileCredsFile, stateProvider, loaded, imageContext, dynamicRefs) {
 	const logger = getLogger();
-	let templateEnv = resolved.environmentVariables;
+	const overrides = readEnvOverridesFile$2(options.envVars);
+	const cdkPath = readCdkPathOrUndefined(resolved.resource);
+	const overriddenKeys = keysOverriddenBy(resolved.environmentVariables, (env) => resolveEnvVars$1(resolved.logicalId, cdkPath, env, overrides).resolved);
+	let templateEnv = withoutKeys(resolved.environmentVariables, overriddenKeys);
 	const sensitiveEnvKeys = /* @__PURE__ */ new Set();
 	if (stateProvider && loaded) {
 		const subContext = {
 			resources: imageContext?.stateResources ?? loaded.resources,
-			consumerRegion: loaded.region
+			consumerRegion: loaded.region,
+			resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
+				region: producerRegion,
+				consumer: `AgentCore Runtime ${resolved.logicalId} cross-stack env value`
+			})
 		};
 		const pseudo = imageContext?.pseudoParameters ?? derivePseudoParametersFromRegion(loaded.region);
 		if (pseudo) subContext.pseudoParameters = pseudo;
@@ -14603,14 +15012,21 @@ async function buildContainerEnv(resolved, options, profileCredentials, profileC
 		for (const key of audit.sensitiveKeys) sensitiveEnvKeys.add(key);
 		for (const { key, reason } of audit.unresolved) logger.warn(`${stateProvider.label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
 	}
-	const overrides = readEnvOverridesFile$2(options.envVars);
-	const cdkPath = readCdkPathOrUndefined(resolved.resource);
 	const envResult = resolveEnvVars$1(resolved.logicalId, cdkPath, templateEnv, overrides);
 	for (const key of envResult.unresolved) {
 		const overrideKeyExample = cdkPath?.replace(/\/Resource$/, "") ?? resolved.logicalId;
 		logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass a state-source flag (e.g. --from-cfn-stack) to recover deployed values.`);
 	}
-	const dockerEnv = { ...envResult.resolved };
+	const skipKeys = keysNotFromTemplate(templateEnv, envResult.resolved);
+	for (const key of sensitiveEnvKeys) skipKeys.add(key);
+	const dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
+		region: firstUsableRegion(loaded?.region, options.stackRegion, resolved.stack.region, options.region),
+		label: `AgentCore Runtime ${resolved.logicalId}`,
+		skipKeys,
+		resolver: dynamicRefs
+	});
+	for (const key of dynamic.resolvedKeys) sensitiveEnvKeys.add(key);
+	const dockerEnv = { ...dynamic.env };
 	const assumeRoleArn = await resolveAssumeRoleArn(options, resolved, loaded, stateProvider);
 	await applyAgentCoreCredentialEnv(dockerEnv, {
 		...assumeRoleArn !== void 0 && { assumeRoleArn },
@@ -15588,13 +16004,27 @@ async function runEcsTask(task, options, state) {
 	const startOrder = topoSort(buildDependencyGraph(task.containers), task.containers);
 	const finchRefusals = [];
 	for (const c of task.containers) {
-		const refusal = finchSecretArgvRefusal([...c.secrets.map((s) => s.name), ...c.sensitiveEnvKeys].filter((n) => !isMalformedEnvKey(n) && !isDockerClientEnvKey(n)), {
+		const refusal = finchSecretArgvRefusal([
+			...c.secrets.map((s) => s.name),
+			...c.sensitiveEnvKeys,
+			...dynamicReferenceEnvKeys(c, options.envOverrides)
+		].filter((n) => !isMalformedEnvKey(n) && !isDockerClientEnvKey(n)), {
 			label: "Container",
 			name: c.name
 		});
 		if (refusal !== void 0) finchRefusals.push(refusal);
 	}
 	if (finchRefusals.length > 0) throw new EcsTaskRunnerError(finchRefusals.join("\n"));
+	const argvRefusals = [];
+	for (const c of task.containers) {
+		const fields = [
+			["Command", c.command],
+			["EntryPoint", c.entryPoint],
+			["HealthCheck.Command", c.healthCheck?.command]
+		];
+		for (const [field, argv] of fields) if (argv?.some((a) => containsDynamicReference(a))) argvRefusals.push(`Container ${displayUntrustedValue(c.name)}: ${field} carries a CloudFormation dynamic reference ({{resolve:...}}). cdk-local resolves dynamic references only in Environment, because resolving one here would put the secret on the docker run argv. Move the value into an Environment variable or a Secrets entry.`);
+	}
+	if (argvRefusals.length > 0) throw new EcsTaskRunnerError(argvRefusals.join("\n"));
 	const imagePlan = options.imagePlanByContainer ?? /* @__PURE__ */ new Map();
 	if (!options.imagePlanByContainer) await prepareImages(task, imagePlan, options);
 	const allSecrets = [];
@@ -15607,6 +16037,22 @@ async function runEcsTask(task, options, state) {
 		...options.region !== void 0 && { region: options.region },
 		...options.profile !== void 0 && { profile: options.profile }
 	}));
+	const dynamicEnvByContainer = /* @__PURE__ */ new Map();
+	const dynamicRefs = new DynamicReferenceResolver({ ...options.profile !== void 0 && { profile: options.profile } });
+	try {
+		for (const c of task.containers) {
+			const tokenKeys = new Set(dynamicReferenceEnvKeys(c, options.envOverrides));
+			if (tokenKeys.size === 0) continue;
+			dynamicEnvByContainer.set(c.name, await resolveDynamicReferencesInEnv(c.environment, {
+				region: firstUsableRegion(options.stackRegion, task.stack.region, options.region),
+				label: `Container ${c.name}`,
+				skipKeys: new Set(Object.keys(c.environment).filter((k) => !tokenKeys.has(k))),
+				resolver: dynamicRefs
+			}));
+		}
+	} finally {
+		dynamicRefs.dispose();
+	}
 	if (options.existingNetwork) state.network = {
 		...options.existingNetwork,
 		ownedByCaller: true
@@ -15645,9 +16091,14 @@ async function runEcsTask(task, options, state) {
 	for (const container of task.containers) {
 		const image = imagePlan.get(container.name);
 		if (!image) throw new EcsTaskRunnerError(`Internal: no resolved image for container '${container.name}'.`);
+		const dynamic = dynamicEnvByContainer.get(container.name);
 		const built = buildDockerRunArgs({
 			task,
-			container,
+			container: dynamic && dynamic.resolvedKeys.length > 0 ? {
+				...container,
+				environment: dynamic.env,
+				sensitiveEnvKeys: [...container.sensitiveEnvKeys, ...dynamic.resolvedKeys]
+			} : container,
 			image,
 			network: state.network.networkName,
 			volumeByName,
@@ -15919,6 +16370,18 @@ async function realizeDockerVolumes(volumes, state) {
 function randHex(bytes) {
 	return randomBytes(bytes).toString("hex");
 }
+function overriddenEnvKeys(overrides, containerName) {
+	if (!overrides) return [];
+	return [...Object.keys(overrides["Parameters"] ?? {}), ...Object.keys(overrides[containerName] ?? {})];
+}
+function dynamicReferenceEnvKeys(container, overrides) {
+	const skip = /* @__PURE__ */ new Set([
+		...container.sensitiveEnvKeys,
+		...container.secrets.map((s) => s.name),
+		...overriddenEnvKeys(overrides, container.name)
+	]);
+	return Object.keys(container.environment).filter((k) => !skip.has(k) && containsDynamicReference(container.environment[k]));
+}
 function groupSecretsByContainer(resolved) {
 	const out = /* @__PURE__ */ new Map();
 	for (const r of resolved) {
@@ -19395,15 +19858,25 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 		const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? service.stack.region ?? "us-east-1";
 		const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
 		if (resolver) {
+			const dynamicRefs = new DynamicReferenceResolver({ ...options.profile !== void 0 && { profile: options.profile } });
 			const subContext = {
 				resources: imageContext?.stateResources ?? {},
 				...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
 				...imageContext?.stateParameters && { parameters: imageContext.stateParameters },
 				...imageContext?.stateSensitiveParameters?.length && { sensitiveParameters: new Set(imageContext.stateSensitiveParameters) },
 				consumerRegion,
-				crossStackResolver: resolver
+				crossStackResolver: resolver,
+				resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
+					region: producerRegion,
+					consumer: `Task ${service.task.taskDefinitionLogicalId} cross-stack env value`,
+					overridable: false
+				})
 			};
-			await applyCrossStackResolverToTask(service.task, subContext);
+			try {
+				await applyCrossStackResolverToTask(service.task, subContext);
+			} finally {
+				dynamicRefs.dispose();
+			}
 		}
 	} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
 	const effectiveAssumeRole = resolveEcsAssumeRoleOption(options);
@@ -19427,6 +19900,7 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 		detach: true
 	};
 	if (envOverrides) taskOpts.envOverrides = envOverrides;
+	if (options.stackRegion) taskOpts.stackRegion = options.stackRegion;
 	if (assumedCredentials) taskOpts.taskCredentials = assumedCredentials;
 	if (resolvedRoleArn) taskOpts.taskRoleArn = resolvedRoleArn;
 	if (options.platform) taskOpts.platformOverride = options.platform;
@@ -20045,14 +20519,27 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 		if (stateProvider && taskNeeds.needsCrossStackResolver) {
 			const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? task.stack.region ?? "us-east-1";
 			const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
-			if (resolver) await applyCrossStackResolverToTask(task, {
-				resources: imageContext?.stateResources ?? {},
-				...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
-				...imageContext?.stateParameters && { parameters: imageContext.stateParameters },
-				...imageContext?.stateSensitiveParameters?.length && { sensitiveParameters: new Set(imageContext.stateSensitiveParameters) },
-				consumerRegion,
-				crossStackResolver: resolver
-			});
+			if (resolver) {
+				const dynamicRefs = new DynamicReferenceResolver({ ...options.profile !== void 0 && { profile: options.profile } });
+				const subContext = {
+					resources: imageContext?.stateResources ?? {},
+					...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
+					...imageContext?.stateParameters && { parameters: imageContext.stateParameters },
+					...imageContext?.stateSensitiveParameters?.length && { sensitiveParameters: new Set(imageContext.stateSensitiveParameters) },
+					consumerRegion,
+					crossStackResolver: resolver,
+					resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
+						region: producerRegion,
+						consumer: `Task ${task.taskDefinitionLogicalId} cross-stack env value`,
+						overridable: false
+					})
+				};
+				try {
+					await applyCrossStackResolverToTask(task, subContext);
+				} finally {
+					dynamicRefs.dispose();
+				}
+			}
 		} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
 		sigintHandler = () => {
 			sigintCount += 1;
@@ -20092,6 +20579,7 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 		if (resolvedRoleArn) runOpts.taskRoleArn = resolvedRoleArn;
 		if (options.platform) runOpts.platformOverride = options.platform;
 		if (options.region) runOpts.region = options.region;
+		if (options.stackRegion) runOpts.stackRegion = options.stackRegion;
 		if (options.ecrRoleArn) runOpts.ecrRoleArn = options.ecrRoleArn;
 		if (options.profile) runOpts.profile = options.profile;
 		const hostPortOverrides = parseHostPortOverrides(options.hostPort);
@@ -29038,5 +29526,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, resolveProfileCredentials as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, isProxyEnvConfigured as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildProxyClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, buildStsClientConfig as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-DGJn7XtJ.js.map
+export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, DynamicReferenceResolver as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, resolveProfileCredentials as Bi, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, keysOverriddenBy as Fi, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, isProxyEnvConfigured as Hi, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, parseDynamicReference as Ii, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, resolveDynamicReferencesInEnv as Li, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, deployedFillMayBeSecret as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, firstUsableRegion as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, keysNotFromTemplate as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, withoutKeys as Ri, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, buildProxyClientConfig as Vi, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, containsDynamicReference as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, DynamicReferenceResolutionError as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, buildStsClientConfig as zi, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
+//# sourceMappingURL=local-studio-CcK2y5Gs.js.map