cdk-local 0.150.0 → 0.151.1

package/dist/{local-studio-BhqhdhZ5.js → local-studio-a7HMFLOC.js}

@@ -1,5 +1,5 @@
-import { C as stringifyThrown, E as setEmbedConfig, S as sanitizeServiceExceptionMessage, _ as clampErrorName, a as isDockerClientEnvKey, b as flattenToOneLine, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as resolveAssemblyPath, h as renderAssemblyPathEscape, i as getDockerCmd, l as spawnStreaming, m as namesTheSameDirectory, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as describeAwsFailureForWarn, w as getEmbedConfig, x as isAwsServiceException, y as describeCredentialLoadFailure } from "./docker-cmd-C2kvSLVs.js";
-import { t as getLogger } from "./logger-CuUAMAnt.js";
+import { C as sanitizeServiceExceptionMessage, S as isAwsServiceException, _ as resolveAssemblyPath, a as isDockerClientEnvKey, b as describeCredentialLoadFailure, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as renderAssemblyPathEscape, h as namesTheSameDirectory, i as getDockerCmd, l as spawnStreaming, m as isPasteableCommandArg, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as clampErrorName, w as stringifyThrown, x as flattenToOneLine, y as describeAwsFailureForWarn } from "./docker-cmd-GME6jkl9.js";
+import { a as setEmbedConfig, r as getEmbedConfig, t as getLogger } from "./logger-CGhtqHg0.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path$1 from "node:path";
@@ -326,7 +326,10 @@ async function resolveProfileCredentials(profile) {
 	try {
 		const credsProvider = sts.config.credentials;
 		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
-		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) throw new Error(`--profile '${profile}': credential provider chain resolved without usable credentials. Check \`aws sso login --profile ` + profile + "` for SSO profiles, or `~/.aws/credentials` / `~/.aws/config` for regular profiles.");
+		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) {
+			const ssoHint = isPasteableCommandArg(profile) ? "Check `aws sso login --profile " + profile + "` for SSO profiles" : "For an SSO profile, run `aws sso login` for that profile (the command is not written out because the name as rendered may not be the one your shell would act on)";
+			throw new Error(`--profile ${displayUntrustedValue(profile)}: credential provider chain resolved without usable credentials. ${ssoHint}, or check \`~/.aws/credentials\` / \`~/.aws/config\` for regular profiles.`);
+		}
 		let region;
 		try {
 			const regionProvider = sts.config.region;
@@ -3389,7 +3392,7 @@ async function resolveMultiTarget(provided, params) {
 async function loadSynthDeps() {
 	const [toolkitLib, { CdklIoHost }, { AssetManifestArtifact }] = await Promise.all([
 		import("@aws-cdk/toolkit-lib"),
-		import("./cdkl-io-host-DYuHWzAS.js"),
+		import("./cdkl-io-host-9lPKscRA.js"),
 		import("@aws-cdk/cloud-assembly-api")
 	]);
 	return {
@@ -3916,6 +3919,28 @@ function isCfnFlagPresent(opts) {
 	const v = opts.fromCfnStack;
 	return v !== void 0 && v !== false;
 }
+function hasExtraStateProviderActive(options, extraStateProviders) {
+	if (!extraStateProviders) return false;
+	const bag = options;
+	return Object.keys(extraStateProviders).some((key) => Boolean(bag[key]));
+}
+function isStateSourceActive(options, extraStateProviders) {
+	return isCfnFlagPresent(options) || hasExtraStateProviderActive(options, extraStateProviders);
+}
+function activeStateSourceFlag(options, extraStateProviders) {
+	if (isCfnFlagPresent(options)) return "--from-cfn-stack";
+	if (!extraStateProviders) return void 0;
+	const bag = options;
+	const key = Object.keys(extraStateProviders).find((k) => Boolean(bag[k]));
+	return key === void 0 ? void 0 : toFlagName(key);
+}
+function stateSourceFlagNames(extraStateProviders) {
+	return ["--from-cfn-stack", ...Object.keys(extraStateProviders ?? {}).map(toFlagName)];
+}
+function hostStateSourceFields(options, extraStateProviders) {
+	if (!extraStateProviders || Object.keys(extraStateProviders).length === 0) return {};
+	return { ...options };
+}
 function resolveCfnRegion(options, synthRegion) {
 	const region = options.stackRegion ?? options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion;
 	if (region === void 0) throw new LocalStateSourceError("--from-cfn-stack requires a region to query CloudFormation. Set one of: --stack-region <region>, --region <region>, AWS_REGION env var, AWS_DEFAULT_REGION env var, or an env.region on the target CDK stack.");
@@ -5443,6 +5468,166 @@ function resolveRuntimeCodeMountPath(runtime) {
 	return "/var/task";
 }
 
+//#endregion
+//#region src/utils/docker-argv-redaction.ts
+const REDACTED_ARGV_VALUE = "***";
+const ARGV_VALUE_BEARING_FLAGS = /* @__PURE__ */ new Set([
+	"-e",
+	"--env",
+	"--opt",
+	"--label",
+	"--build-arg"
+]);
+const ARGV_PARAM_LIST_FLAGS = /* @__PURE__ */ new Set(["--cache-from", "--cache-to"]);
+const ARGV_PARAM_LIST_LOCATOR_PARAMS = /* @__PURE__ */ new Set([
+	"type",
+	"mode",
+	"compression",
+	"compression-level",
+	"force-compression",
+	"ignore-error",
+	"image-manifest",
+	"oci-mediatypes",
+	"timeout",
+	"ref",
+	"dest",
+	"src",
+	"digest",
+	"tag",
+	"region",
+	"bucket",
+	"name",
+	"prefix",
+	"manifests_prefix",
+	"blobs_prefix",
+	"use_path_style",
+	"upload_parallelism",
+	"touch_refresh",
+	"account_name",
+	"scope"
+]);
+const ARGV_PARAM_LIST_URL_PARAMS = /* @__PURE__ */ new Set([
+	"account_url",
+	"endpoint_url",
+	"url",
+	"url_v2"
+]);
+function redactUrlLocator(value) {
+	if (value === "") return value;
+	const authority = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\//.exec(value);
+	if (authority === null) return REDACTED_ARGV_VALUE;
+	const prefix = authority[0];
+	let rest = value.slice(prefix.length);
+	const lastAt = rest.lastIndexOf("@");
+	if (lastAt >= 0) rest = `${REDACTED_ARGV_VALUE}${rest.slice(lastAt)}`;
+	else {
+		const host = rest.split(/[/?#]/)[0];
+		const ipv6 = /^\[[0-9A-Fa-f:.]+\]/.exec(host);
+		const bare = ipv6 ? host.slice(ipv6[0].length) : host;
+		if (/:(?!\d{1,5}$)/.test(bare)) return REDACTED_ARGV_VALUE;
+	}
+	for (const delimiter of ["?", "#"]) {
+		const at = rest.indexOf(delimiter);
+		if (at >= 0) rest = `${rest.slice(0, at)}${delimiter}${REDACTED_ARGV_VALUE}`;
+	}
+	return `${prefix}${rest}`;
+}
+function maskArgvFlagValue(flag, value) {
+	if (ARGV_VALUE_BEARING_FLAGS.has(flag)) {
+		const eqIdx = value.indexOf("=");
+		return eqIdx >= 0 ? `${value.substring(0, eqIdx)}=${REDACTED_ARGV_VALUE}` : void 0;
+	}
+	if (ARGV_PARAM_LIST_FLAGS.has(flag)) {
+		let masked = false;
+		const rawParts = value.split(",");
+		const parts = rawParts.map((part, index) => {
+			if (part === "") return part;
+			if (masked) return REDACTED_ARGV_VALUE;
+			const eqIdx = part.indexOf("=");
+			if (eqIdx < 0) {
+				if (index === 0) return part;
+				masked = true;
+				return REDACTED_ARGV_VALUE;
+			}
+			const name = part.substring(0, eqIdx);
+			const normalized = name.trim().toLowerCase();
+			if (ARGV_PARAM_LIST_URL_PARAMS.has(normalized)) {
+				if (rawParts.slice(index + 1).some((later) => later.includes("@"))) {
+					masked = true;
+					return `${name}=${REDACTED_ARGV_VALUE}`;
+				}
+				const rawUrl = part.substring(eqIdx + 1);
+				const safeUrl = redactUrlLocator(rawUrl);
+				if (safeUrl === rawUrl) return part;
+				masked = true;
+				return `${name}=${safeUrl}`;
+			}
+			if (ARGV_PARAM_LIST_LOCATOR_PARAMS.has(normalized)) return part;
+			masked = true;
+			return `${name}=${REDACTED_ARGV_VALUE}`;
+		});
+		return masked ? parts.join(",") : void 0;
+	}
+}
+function maskAttachedShortFlag(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	let chosen;
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) {
+		if (flag.length !== 2 || !flag.startsWith("-") || flag[1] === "-") continue;
+		const at = arg.indexOf(flag[1], 1);
+		if (at < 0 || at === arg.length - 1) continue;
+		if (chosen === void 0 || at < chosen.at) chosen = {
+			at,
+			flag
+		};
+	}
+	if (chosen === void 0) return void 0;
+	const masked = maskArgvFlagValue(chosen.flag, arg.slice(chosen.at + 1));
+	return masked === void 0 ? void 0 : `${arg.slice(0, chosen.at + 1)}${masked}`;
+}
+function trailingShortFlagOfCluster(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	const last = arg[arg.length - 1];
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) if (flag.length === 2 && flag.startsWith("-") && flag[1] !== "-" && flag[1] === last) return flag;
+}
+function redactDockerArgvValues(args) {
+	const out = [];
+	for (let i = 0; i < args.length; i++) {
+		const cur = args[i];
+		const joinedEq = cur.indexOf("=");
+		if (joinedEq > 0) {
+			const maskedJoined = maskArgvFlagValue(cur.substring(0, joinedEq), cur.substring(joinedEq + 1));
+			if (maskedJoined !== void 0) {
+				out.push(`${cur.substring(0, joinedEq)}=${maskedJoined}`);
+				continue;
+			}
+		}
+		const maskedAttached = maskAttachedShortFlag(cur);
+		if (maskedAttached !== void 0) {
+			out.push(maskedAttached);
+			continue;
+		}
+		const next = args[i + 1];
+		if (typeof next === "string") {
+			const maskedNext = maskArgvFlagValue(ARGV_VALUE_BEARING_FLAGS.has(cur) ? cur : trailingShortFlagOfCluster(cur) ?? cur, next);
+			if (maskedNext !== void 0) {
+				out.push(cur, maskedNext);
+				i++;
+				continue;
+			}
+		}
+		out.push(cur);
+	}
+	return out;
+}
+function describeExitWithoutArgv(err) {
+	const e = err;
+	if (typeof e?.signal === "string" && e.signal !== "") return `killed by ${e.signal}`;
+	if (typeof e?.code === "number") return `exited with code ${e.code}`;
+	if (typeof e?.code === "string" && e.code !== "") return `failed (${e.code})`;
+	return "failed with no output";
+}
+
 //#endregion
 //#region src/assets/asset-source-path.ts
 function resolveAssetSourcePath(opts) {
@@ -5719,7 +5904,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
 		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
-		logger.debug(`Building Docker image via executable: ${displayUntrustedValue(source.executable.join(" "))} (cwd=${displayUntrustedValue(cwd)})`);
+		logger.debug(`Building Docker image via executable: ${displayUntrustedValue(redactDockerArgvValues(source.executable).join(" "))} (cwd=${displayUntrustedValue(cwd)})`);
 		warnManifestExecutable(cmd, source.executable, cwd);
 		let result;
 		try {
@@ -5732,13 +5917,13 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${displayUntrustedValue(cmd)}`);
 		return tag;
 	}
-	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (got: ${JSON.stringify(source)})`);
+	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (fields present: ${displayUntrustedValue(Object.keys(source).join(", ") || "none")})`);
 	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
 	const contextDir = contextDirectory(source.directory, `send that directory to docker build as the context of an image ${getEmbedConfig().productName} then runs locally`);
 	buildArgs.push(".");
 	warnEscapingBuildKitPaths(source, contextDir, assetOutdir);
-	logger.debug(`${getDockerCmd()} ${buildArgs.join(" ")} (cwd=${displayUntrustedValue(contextDir)})`);
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${displayUntrustedValue(contextDir)})`);
 	try {
 		await runDockerStreaming(buildArgs, {
 			cwd: contextDir,
@@ -6111,7 +6296,7 @@ async function runDetached(opts) {
 	}
 	args.push(opts.image, ...entryPointTail, ...opts.cmd);
 	const logger = getLogger().child("docker");
-	logger.debug(`${getDockerCmd()} ${redactAwsCredentialsInArgs(args).join(" ")}`);
+	logger.debug(flattenToOneLine(`${getDockerCmd()} ${redactDockerArgvValues(args).join(" ")}`));
 	if (collisions.length > 0) logger.warn(describeRefusedSensitiveEnvKeys(`Container for image ${displayUntrustedValue(opts.image)}`, collisions));
 	const forwardedKeys = Object.keys(passthroughEnv);
 	const refusal = finchSecretArgvRefusal(forwardedKeys.filter((k) => opts.sensitiveEnvKeys?.has(k)), {
@@ -6127,8 +6312,7 @@ async function runDetached(opts) {
 		});
 		return stdout.trim();
 	} catch (error) {
-		const err = error;
-		throw new DockerRunnerError(`docker run failed: ${err.stderr?.trim() || err.message || String(error)}`);
+		throw new DockerRunnerError(`docker run failed: ${error.stderr?.trim() || describeExitWithoutArgv(error)}`);
 	}
 }
 function streamLogs(containerId) {
@@ -6225,26 +6409,6 @@ function execEnvForSecrets(passthrough) {
 	for (const k of keys) defineOwnKey(env, k, passthrough[k]);
 	return { env };
 }
-function redactAwsCredentialsInArgs(args) {
-	const out = [];
-	for (let i = 0; i < args.length; i++) {
-		const cur = args[i];
-		const next = args[i + 1];
-		if (cur === "-e" && typeof next === "string") {
-			const eqIdx = next.indexOf("=");
-			if (eqIdx > 0) {
-				const key = next.substring(0, eqIdx);
-				if (SENSITIVE_ENV_KEYS.has(key)) {
-					out.push("-e", `${key}=***`);
-					i++;
-					continue;
-				}
-			}
-		}
-		out.push(cur);
-	}
-	return out;
-}
 
 //#endregion
 //#region src/assets/asset-manifest-loader.ts
@@ -11811,7 +11975,7 @@ function getContainerAwsCredentialsPath() {
 }
 async function writeProfileCredentialsFile(profileName, creds) {
 	if (profileName === "") throw new Error("writeProfileCredentialsFile: profile name must not be empty.");
-	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name '${profileName}' contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
+	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name ${displayUntrustedValue(profileName)} contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
 	const dir = await mkdtemp(path$1.join(tmpdir(), `${getEmbedConfig().productName}-profile-creds-`));
 	const hostPath = path$1.join(dir, "credentials");
 	const lines = [
@@ -12959,11 +13123,6 @@ function envHasIntrinsicValue$1(templateEnv) {
 	}
 	return false;
 }
-function hasExtraStateProviderActive(options, extraStateProviders) {
-	if (!extraStateProviders) return false;
-	for (const key of Object.keys(extraStateProviders)) if (options[key]) return true;
-	return false;
-}
 async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options, extraStateProviders) {
 	const logger = getLogger();
 	const out = /* @__PURE__ */ new Map();
@@ -14861,7 +15020,7 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region,
 		return await assumeAgentCoreExecutionRole(assumeRoleArn, region, options.profile);
 	} catch (err) {
 		const sigv4Detail = assumeRoleDetail(err, "STS AssumeRole (--sigv4 signing)");
-		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for --sigv4 signing: ${sigv4Detail}. Falling back to ${options.profile ? `--profile ${options.profile}` : "shell credentials"}.`);
+		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for --sigv4 signing: ${sigv4Detail}. Falling back to ${options.profile ? `--profile ${displayUntrustedValue(options.profile)}` : "shell credentials"}.`);
 	}
 	if (options.profile) {
 		const creds = await resolveProfileCredentials(options.profile);
@@ -14953,7 +15112,7 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 		credentials = await assumeAgentCoreExecutionRole(assumeRoleArn, region, options.profile);
 	} catch (err) {
 		const bundleDetail = assumeRoleDetail(err, "STS AssumeRole (fromS3 bundle download)");
-		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for the fromS3 bundle download: ${bundleDetail}. Falling back to ${options.profile ? `--profile ${options.profile}` : "the default credentials"}.`);
+		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for the fromS3 bundle download: ${bundleDetail}. Falling back to ${options.profile ? `--profile ${displayUntrustedValue(options.profile)}` : "the default credentials"}.`);
 	}
 	const bundle = await downloadAndExtractS3Bundle(location, {
 		...region !== void 0 && { region },
@@ -15784,8 +15943,7 @@ async function createNetworkAndSidecar(args) {
 		return stdout.trim();
 	} catch (err) {
 		await destroyNetworkOnly(networkName);
-		const e = err;
-		throw new DockerRunnerError(`Failed to start metadata-endpoints sidecar: ${e.stderr?.trim() || e.message || String(err)}`);
+		throw new DockerRunnerError(`Failed to start metadata-endpoints sidecar: ${err.stderr?.trim() || describeExitWithoutArgv(err)}`);
 	}
 }
 async function createTaskNetwork(options = {}) {
@@ -16140,7 +16298,7 @@ async function runEcsTask(task, options, state) {
 			id = stdout.trim();
 		} catch (err) {
 			const e = err;
-			throw new DockerRunnerError(`docker run failed for container '${container.name}': ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new DockerRunnerError(`docker run failed for container '${container.name}': ${e.stderr?.trim() || describeExitWithoutArgv(err)}`);
 		}
 		state.startedContainers.push({
 			name: container.name,
@@ -16358,7 +16516,7 @@ async function realizeDockerVolumes(volumes, state) {
 			logger.debug(`Created docker volume ${dockerVolumeName} for task volume '${v.name}'`);
 		} catch (err) {
 			const e = err;
-			throw new DockerRunnerError(`docker volume create failed for '${v.name}': ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new DockerRunnerError(`docker volume create failed for '${v.name}': ${e.stderr?.trim() || describeExitWithoutArgv(err)}`);
 		}
 		out.set(v.name, {
 			...v,
@@ -17223,7 +17381,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -17236,7 +17394,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -17247,7 +17405,7 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerRestartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["restart", containerId]);
 };
 let dockerRestartImpl = defaultDockerRestartImpl;
@@ -17265,7 +17423,7 @@ async function disconnectOldFromSharedNetwork(oldInstance) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -17405,7 +17563,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -17415,7 +17573,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -19950,6 +20108,7 @@ async function resolveAlbLambdaTargetEnv(plan, options, extraStateProviders) {
 	if (lambdas.size === 0) return out;
 	const effectiveAssumeRole = resolveEcsAssumeRoleOption(options);
 	const envOptions = {
+		...hostStateSourceFields(options, extraStateProviders),
 		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
 		...effectiveAssumeRole !== void 0 && { assumeRole: effectiveAssumeRole },
 		...options.region !== void 0 && { region: options.region },
@@ -22642,7 +22801,7 @@ async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3
 		if (!assoc) continue;
 		const invoke = edgeInvokers.get(assoc.functionLogicalId);
 		if (!invoke) {
-			logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (added after start-up); skipping. Restart start-cloudfront.`);
+			logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (it failed to boot at start-up, see the boot warning, or was added after start-up); skipping. Restart start-cloudfront.`);
 			continue;
 		}
 		if (assoc.includeBody && edgeInput.body === void 0) edgeInput = {
@@ -22738,7 +22897,7 @@ async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3
 async function runEdgeResponseStage(assoc, eventType, ctx, edgeInvokers, logger) {
 	const invoke = edgeInvokers.get(assoc.functionLogicalId);
 	if (!invoke) {
-		logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (added after start-up); skipping. Restart start-cloudfront.`);
+		logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (it failed to boot at start-up, see the boot warning, or was added after start-up); skipping. Restart start-cloudfront.`);
 		return;
 	}
 	return applyEdgeResponseResult(await invoke(buildEdgeResponseEvent({
@@ -23214,10 +23373,16 @@ async function attachKvsModules(distribution, stacks, options, profileCredential
 	const stack = stacks.find((s) => s.stackName === distribution.stackName);
 	const synthRegion = stack?.region;
 	const kvsFiles = stack ? normalizeKvsFileKeys(parseKvsFileOverrides(options.kvsFile), stack.template) : parseKvsFileOverrides(options.kvsFile);
-	const resolveDeployedKvs = isCfnFlagPresent(options) ? async (kvsLogicalId) => {
+	const resolveDeployedKvs = isStateSourceActive(options, extraStateProviders) ? async (kvsLogicalId) => {
 		const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
 		if (!provider) return void 0;
-		const physicalId = (await provider.load(distribution.stackName, synthRegion))?.resources[kvsLogicalId]?.physicalId;
+		let record;
+		try {
+			record = await provider.load(distribution.stackName, synthRegion);
+		} finally {
+			provider.dispose();
+		}
+		const physicalId = record?.resources[kvsLogicalId]?.physicalId;
 		if (!physicalId) return void 0;
 		if (physicalId.startsWith("arn:")) {
 			const id = idFromArn(physicalId);
@@ -23285,7 +23450,7 @@ async function bootLambdaUrlOrigins(distribution, stacks, opts) {
 		let runner;
 		try {
 			const lambda = resolveLambdaTarget(functionLogicalId, stacks);
-			const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials);
+			const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
 			runner = createFrontDoorLambdaRunner(lambda, {
 				containerHost: opts.containerHost,
 				skipPull: opts.skipPull,
@@ -23324,7 +23489,7 @@ async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
 	}
 	for (const functionLogicalId of functionLogicalIds) try {
 		const lambda = resolveLambdaTarget(functionLogicalId, stacks);
-		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials);
+		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
 		const runner = createFrontDoorLambdaRunner(lambda, {
 			containerHost: opts.containerHost,
 			skipPull: opts.skipPull,
@@ -23344,25 +23509,53 @@ async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
 		runners
 	};
 }
-function warnUnsupported(distribution) {
+function buildLambdaEnvOptions(options, extraStateProviders) {
+	return {
+		...hostStateSourceFields(options, extraStateProviders),
+		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
+		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
+		...options.region !== void 0 && { region: options.region },
+		...options.profile !== void 0 && { profile: options.profile },
+		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
+	};
+}
+function buildLambdaBootOptions(options, profileCredentials, extraStateProviders) {
+	return {
+		containerHost: options.host,
+		skipPull: options.pull === false,
+		envOptions: buildLambdaEnvOptions(options, extraStateProviders),
+		...profileCredentials !== void 0 && { profileCredentials },
+		...extraStateProviders !== void 0 && { extraStateProviders }
+	};
+}
+function warnUnsupported(distribution, extraStateProviders) {
 	const logger = getLogger();
 	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin '${origin.originId}' is a custom (non-S3, non-Lambda-Function-URL) origin (${origin.domainName}); ${getEmbedConfig().cliName} start-cloudfront serves S3 origins and Lambda Function URL origins only. Requests routed to it return 502.`);
-	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass --from-cfn-stack to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
+	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass ${stateSourceFlagNames(extraStateProviders).join(" or ")} to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
 }
-function warnUnusedCacheOrigin(options) {
-	if (options.cacheOrigin === true && !isCfnFlagPresent(options)) getLogger().warn("--cache-origin has no effect without --from-cfn-stack: it caches a deployed-S3 read-through origin, which is only built under --from-cfn-stack. A local BucketDeployment / --origin <id>=<dir> origin serves from disk and is not cached. Pass --from-cfn-stack to enable the deployed-S3 origin (then --cache-origin applies), or drop --cache-origin.");
+function warnUnusedCacheOrigin(options, extraStateProviders) {
+	if (options.cacheOrigin === true && !isStateSourceActive(options, extraStateProviders)) {
+		const flags = stateSourceFlagNames(extraStateProviders).join(" or ");
+		getLogger().warn(`--cache-origin has no effect without ${flags}: it caches a deployed-S3 read-through origin, which is only built under a state source. A local BucketDeployment / --origin <id>=<dir> origin serves from disk and is not cached. Pass ${flags} to enable the deployed-S3 origin (then --cache-origin applies), or drop --cache-origin.`);
+	}
 }
 async function resolveDeployedS3Origins(distribution, stacks, options, profileCredentials, logger, extraStateProviders) {
 	const readers = /* @__PURE__ */ new Map();
 	const buckets = /* @__PURE__ */ new Map();
-	if (!isCfnFlagPresent(options)) return {
+	const stateFlag = activeStateSourceFlag(options, extraStateProviders);
+	if (stateFlag === void 0) return {
 		readers,
 		buckets
 	};
 	const synthRegion = stacks.find((s) => s.stackName === distribution.stackName)?.region;
-	const region = options.stackRegion ?? options.region ?? synthRegion;
 	const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
-	const record = provider ? await provider.load(distribution.stackName, synthRegion) : void 0;
+	let record;
+	try {
+		record = provider ? await provider.load(distribution.stackName, synthRegion) : void 0;
+	} finally {
+		provider?.dispose();
+	}
+	const region = options.stackRegion ?? options.region ?? synthRegion ?? record?.region;
 	const distributionId = record?.resources[distribution.logicalId]?.physicalId;
 	for (const origin of [...distribution.origins.values()]) {
 		if (origin.kind !== "s3-unresolved") continue;
@@ -23394,7 +23587,7 @@ async function resolveDeployedS3Origins(distribution, stacks, options, profileCr
 			originId: origin.originId,
 			bucketName
 		});
-		logger.info(`Origin '${origin.originId}': no local BucketDeployment source; serving from deployed S3 (bucket=${bucketName}, resolved via ${via}) on demand under --from-cfn-stack.`);
+		logger.info(`Origin '${origin.originId}': no local BucketDeployment source; serving from deployed S3 (bucket=${bucketName}, resolved via ${via}) on demand under ${stateFlag}.`);
 	}
 	return {
 		readers,
@@ -23457,22 +23650,10 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 	const initial = await synthAndResolve();
 	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
 	const deployedS3 = await resolveDeployedS3Origins(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
-	warnUnsupported(initial.distribution);
-	warnUnusedCacheOrigin(options);
-	const envOptions = {
-		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
-		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
-		...options.region !== void 0 && { region: options.region },
-		...options.profile !== void 0 && { profile: options.profile },
-		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
-	};
+	warnUnsupported(initial.distribution, extraStateProviders);
+	warnUnusedCacheOrigin(options, extraStateProviders);
 	await attachKvsModules(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
-	const bootOpts = {
-		containerHost: options.host,
-		skipPull: options.pull === false,
-		envOptions,
-		...profileCredentials !== void 0 && { profileCredentials }
-	};
+	const bootOpts = buildLambdaBootOptions(options, profileCredentials, extraStateProviders);
 	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, bootOpts);
 	const { invokers: edgeInvokers, runners: edgeRunners } = await bootLambdaEdgeFunctions(initial.distribution, initial.stacks, bootOpts);
 	let server;
@@ -23517,7 +23698,7 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 						const reloaded = await synthAndResolve();
 						annotateDeployedS3Origins(reloaded.distribution, deployedS3.buckets);
 						for (const reader of deployedS3.readers.values()) reader.clearCache();
-						warnUnsupported(reloaded.distribution);
+						warnUnsupported(reloaded.distribution, extraStateProviders);
 						await attachKvsModules(reloaded.distribution, reloaded.stacks, options, profileCredentials, logger, extraStateProviders);
 						server.update(reloaded.distribution);
 						logger.info("Reload complete.");
@@ -23552,7 +23733,7 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 }
 function createLocalStartCloudFrontCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("start-cloudfront").description("Run a long-running local server that serves a CloudFront distribution: its S3 origin content (resolved from the BucketDeployment source in the cloud assembly) and its Lambda Function URL origins (the backing Lambda is run locally via RIE), plus its viewer-request / viewer-response CloudFront Functions, reproducing the distribution routing locally so a rewrite / routing change is verifiable in seconds. Serves S3 and Lambda Function URL origins; other custom origins and Lambda@Edge are not run (warn-and-skip). Tip: omit the target in a terminal to pick interactively.").argument("[target]", "CloudFront distribution to serve. Accepts the CDK Construct path ('MyStack/MyDist'), an ancestor prefix, or the stack-qualified logical id ('MyStack:MyDist'). When omitted in a TTY, an interactive picker opens.").action(withErrorHandling(async (target, options) => {
+	const cmd = new Command("start-cloudfront").description("Run a long-running local server that serves a CloudFront distribution: its S3 origin content (resolved from the BucketDeployment source in the cloud assembly) and its Lambda Function URL origins (the backing Lambda is run locally via RIE), plus its viewer-request / viewer-response CloudFront Functions, reproducing the distribution routing locally so a rewrite / routing change is verifiable in seconds. Serves S3 and Lambda Function URL origins, and runs Lambda@Edge functions in local RIE containers. Both Lambda kinds need Docker: a Function URL origin that fails to boot stops start-up, while a Lambda@Edge function that fails to boot is warn-and-skipped (its stage does not run). Other custom origins are not run (warn-and-skip; requests routed to one return 502). Tip: omit the target in a terminal to pick interactively.").argument("[target]", "CloudFront distribution to serve. Accepts the CDK Construct path ('MyStack/MyDist'), an ancestor prefix, or the stack-qualified logical id ('MyStack:MyDist'). When omitted in a TTY, an interactive picker opens.").action(withErrorHandling(async (target, options) => {
 		await localStartCloudFrontCommand(target, options, opts.extraStateProviders, opts.synthesizer);
 	}));
 	addStartCloudFrontSpecificOptions(cmd);
@@ -29527,4 +29708,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, DynamicReferenceResolver as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, resolveProfileCredentials as Bi, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, keysOverriddenBy as Fi, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, isProxyEnvConfigured as Hi, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, parseDynamicReference as Ii, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, resolveDynamicReferencesInEnv as Li, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, deployedFillMayBeSecret as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, firstUsableRegion as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, keysNotFromTemplate as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, withoutKeys as Ri, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, buildProxyClientConfig as Vi, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, containsDynamicReference as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, DynamicReferenceResolutionError as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, buildStsClientConfig as zi, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-BhqhdhZ5.js.map
+//# sourceMappingURL=local-studio-a7HMFLOC.js.map