cdk-local 0.151.0 → 0.152.0

package/dist/{local-studio-Mta0QWLf.js → local-studio-DPQ50Gve.js}

@@ -1,5 +1,5 @@
-import { C as sanitizeServiceExceptionMessage, S as isAwsServiceException, _ as resolveAssemblyPath, a as isDockerClientEnvKey, b as describeCredentialLoadFailure, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as renderAssemblyPathEscape, h as namesTheSameDirectory, i as getDockerCmd, l as spawnStreaming, m as isPasteableCommandArg, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as clampErrorName, w as stringifyThrown, x as flattenToOneLine, y as describeAwsFailureForWarn } from "./docker-cmd-GME6jkl9.js";
-import { a as setEmbedConfig, r as getEmbedConfig, t as getLogger } from "./logger-CGhtqHg0.js";
+import { C as sanitizeServiceExceptionMessage, S as isAwsServiceException, _ as resolveAssemblyPath, a as isDockerClientEnvKey, b as describeCredentialLoadFailure, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as renderAssemblyPathEscape, h as namesTheSameDirectory, i as getDockerCmd, l as spawnStreaming, m as isPasteableCommandArg, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as clampErrorName, w as stringifyThrown, x as flattenToOneLine, y as describeAwsFailureForWarn } from "./docker-cmd-BSdu45mc.js";
+import { a as setEmbedConfig, r as getEmbedConfig, t as getLogger } from "./logger-CwFXOD1w.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path$1 from "node:path";
@@ -358,6 +358,120 @@ function buildStsClientConfig(args) {
 	};
 }
 
+//#endregion
+//#region src/utils/workload-identity.ts
+let record;
+let stripWarned = false;
+const SECOND_ASSUME_MESSAGE = "A role was already assumed in this process; refusing to assume a second one. Pass --role-arn once.";
+function recordAssumedRole(caller) {
+	if (record !== void 0) throw new Error(SECOND_ASSUME_MESSAGE);
+	record = { caller: caller ? {
+		accessKeyId: caller.accessKeyId,
+		secretAccessKey: caller.secretAccessKey,
+		...caller.sessionToken ? { sessionToken: caller.sessionToken } : {}
+	} : void 0 };
+}
+function assumedRoleRecorded() {
+	return record !== void 0;
+}
+function readEnvCallerCredentials(env = process.env) {
+	const accessKeyId = env["AWS_ACCESS_KEY_ID"];
+	const secretAccessKey = env["AWS_SECRET_ACCESS_KEY"];
+	if (!accessKeyId || !secretAccessKey) return void 0;
+	const sessionToken = env["AWS_SESSION_TOKEN"];
+	return {
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	};
+}
+function resetWorkloadIdentity() {
+	record = void 0;
+	stripWarned = false;
+}
+function callerRecord() {
+	return getEmbedConfig().workloadIdentity === "caller" ? record : void 0;
+}
+const MULTIPLE_CREDENTIAL_SOURCES_WARNING = "Multiple credential sources detected";
+const chainLogger = {
+	debug: () => {},
+	info: () => {},
+	warn: (...args) => {
+		const text = args.map(String).join(" ");
+		if (text.includes(MULTIPLE_CREDENTIAL_SOURCES_WARNING)) return;
+		getLogger().warn(text);
+	},
+	error: (...args) => {
+		getLogger().error(args.map(String).join(" "));
+	}
+};
+function callerChainWithoutEnv(proxied) {
+	let chain;
+	return async (identityProperties) => {
+		chain ??= (async () => {
+			const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
+			return defaultProvider({
+				profile: "default",
+				logger: chainLogger,
+				...proxied ? { clientConfig: { requestHandler: buildProxyRequestHandler() } } : {}
+			});
+		})().catch((err) => {
+			chain = void 0;
+			throw err;
+		});
+		return (await chain)(identityProperties);
+	};
+}
+function workloadClientConfig(opts = {}) {
+	const base = buildProxyClientConfig({ profile: opts.profile });
+	const rec = callerRecord();
+	if (!rec) return base;
+	if (opts.profile || process.env["AWS_PROFILE"]) return base;
+	if (rec.caller) {
+		const caller = rec.caller;
+		const credentials = async () => ({
+			accessKeyId: caller.accessKeyId,
+			secretAccessKey: caller.secretAccessKey,
+			...caller.sessionToken ? { sessionToken: caller.sessionToken } : {}
+		});
+		return {
+			...base,
+			credentials
+		};
+	}
+	return {
+		...base,
+		credentials: callerChainWithoutEnv(base.requestHandler !== void 0)
+	};
+}
+function workloadStsClientConfig(args) {
+	return {
+		...workloadClientConfig({ profile: args.profile }),
+		...args.region && { region: args.region },
+		...args.profile && { profile: args.profile }
+	};
+}
+function applyWorkloadEnvCredentials(env) {
+	const rec = callerRecord();
+	if (!rec) return "unchanged";
+	if (rec.caller) {
+		env["AWS_ACCESS_KEY_ID"] = rec.caller.accessKeyId;
+		env["AWS_SECRET_ACCESS_KEY"] = rec.caller.secretAccessKey;
+		if (rec.caller.sessionToken) env["AWS_SESSION_TOKEN"] = rec.caller.sessionToken;
+		else delete env["AWS_SESSION_TOKEN"];
+		return "restored";
+	}
+	delete env["AWS_ACCESS_KEY_ID"];
+	delete env["AWS_SECRET_ACCESS_KEY"];
+	delete env["AWS_SESSION_TOKEN"];
+	return "stripped";
+}
+function warnWorkloadCredentialsStripped() {
+	if (stripWarned) return;
+	stripWarned = true;
+	getLogger().warn("The --role-arn role is not handed to the emulated workload, and your shell had no static AWS credentials to hand it instead, so the container receives none. Pass --profile <name>, or export static credentials, to give it an identity.");
+}
+
 //#endregion
 //#region src/utils/role-arn.ts
 const IAM_ROLE_ARN_MAX_LENGTH = 2048;
@@ -391,7 +505,7 @@ async function assumeRoleCredentials(opts) {
 		const message = refusedRoleArnMessage(opts.roleArn);
 		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, detail);
 	}
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(workloadStsClientConfig({
 		region: opts.region,
 		profile: opts.profile
 	}));
@@ -425,6 +539,7 @@ async function applyRoleArnIfSet(opts) {
 	const roleArn = opts.roleArn || process.env[`${getEmbedConfig().envPrefix}_ROLE_ARN`];
 	if (!roleArn) return;
 	if (!isIamRoleArn(roleArn)) throw new Error(refusedRoleArnMessage(roleArn));
+	if (assumedRoleRecorded() && getEmbedConfig().workloadIdentity === "caller") throw new Error(SECOND_ASSUME_MESSAGE);
 	const logger = getLogger().child("role-arn");
 	const shownArn = flattenToOneLine(roleArn);
 	logger.debug(`Assuming role ${shownArn}...`);
@@ -447,6 +562,7 @@ async function applyRoleArnIfSet(opts) {
 	if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${shownArn}`);
 	const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
 	if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${shownArn}`);
+	if (!assumedRoleRecorded()) recordAssumedRole(readEnvCallerCredentials());
 	process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
 	process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
 	process.env["AWS_SESSION_TOKEN"] = SessionToken;
@@ -751,7 +867,7 @@ var DynamicReferenceResolver = class {
 		let c = this.smClients.get(key);
 		if (!c) {
 			c = this.options.secretsManagerClientFactory?.(region) ?? new SecretsManagerClient({
-				...buildProxyClientConfig({ profile: this.options.profile }),
+				...workloadClientConfig({ profile: this.options.profile }),
 				...region && { region },
 				...this.options.profile && { profile: this.options.profile }
 			});
@@ -764,7 +880,7 @@ var DynamicReferenceResolver = class {
 		let c = this.ssmClients.get(key);
 		if (!c) {
 			c = this.options.ssmClientFactory?.(region) ?? new SSMClient({
-				...buildProxyClientConfig({ profile: this.options.profile }),
+				...workloadClientConfig({ profile: this.options.profile }),
 				...region && { region },
 				...this.options.profile && { profile: this.options.profile }
 			});
@@ -2082,37 +2198,37 @@ async function getClient(service, region) {
 	switch (service) {
 		case "sqs":
 			client = new (await (import("@aws-sdk/client-sqs"))).SQSClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
 		case "sns":
 			client = new (await (import("@aws-sdk/client-sns"))).SNSClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
 		case "eventbridge":
 			client = new (await (import("@aws-sdk/client-eventbridge"))).EventBridgeClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
 		case "kinesis":
 			client = new (await (import("@aws-sdk/client-kinesis"))).KinesisClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
 		case "sfn":
 			client = new (await (import("@aws-sdk/client-sfn"))).SFNClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
 		case "ssm":
 			client = new (await (import("@aws-sdk/client-ssm"))).SSMClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
@@ -3392,7 +3508,7 @@ async function resolveMultiTarget(provided, params) {
 async function loadSynthDeps() {
 	const [toolkitLib, { CdklIoHost }, { AssetManifestArtifact }] = await Promise.all([
 		import("@aws-cdk/toolkit-lib"),
-		import("./cdkl-io-host-9lPKscRA.js"),
+		import("./cdkl-io-host-CDXI-7cC.js"),
 		import("@aws-cdk/cloud-assembly-api")
 	]);
 	return {
@@ -3672,7 +3788,7 @@ var CfnLocalStateProvider = class {
 	getClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.client) this.client = new CloudFormationClient({
-			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
+			...workloadClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -3681,7 +3797,7 @@ var CfnLocalStateProvider = class {
 	getLambdaClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.lambdaClient) this.lambdaClient = new LambdaClient({
-			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
+			...workloadClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -3690,7 +3806,7 @@ var CfnLocalStateProvider = class {
 	getAgentCoreControlClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.agentCoreControlClient) this.agentCoreControlClient = new BedrockAgentCoreControlClient({
-			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
+			...workloadClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -3699,7 +3815,7 @@ var CfnLocalStateProvider = class {
 	getSsmClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.ssmClient) this.ssmClient = new SSMClient({
-			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
+			...workloadClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -5468,6 +5584,166 @@ function resolveRuntimeCodeMountPath(runtime) {
 	return "/var/task";
 }
 
+//#endregion
+//#region src/utils/docker-argv-redaction.ts
+const REDACTED_ARGV_VALUE = "***";
+const ARGV_VALUE_BEARING_FLAGS = /* @__PURE__ */ new Set([
+	"-e",
+	"--env",
+	"--opt",
+	"--label",
+	"--build-arg"
+]);
+const ARGV_PARAM_LIST_FLAGS = /* @__PURE__ */ new Set(["--cache-from", "--cache-to"]);
+const ARGV_PARAM_LIST_LOCATOR_PARAMS = /* @__PURE__ */ new Set([
+	"type",
+	"mode",
+	"compression",
+	"compression-level",
+	"force-compression",
+	"ignore-error",
+	"image-manifest",
+	"oci-mediatypes",
+	"timeout",
+	"ref",
+	"dest",
+	"src",
+	"digest",
+	"tag",
+	"region",
+	"bucket",
+	"name",
+	"prefix",
+	"manifests_prefix",
+	"blobs_prefix",
+	"use_path_style",
+	"upload_parallelism",
+	"touch_refresh",
+	"account_name",
+	"scope"
+]);
+const ARGV_PARAM_LIST_URL_PARAMS = /* @__PURE__ */ new Set([
+	"account_url",
+	"endpoint_url",
+	"url",
+	"url_v2"
+]);
+function redactUrlLocator(value) {
+	if (value === "") return value;
+	const authority = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\//.exec(value);
+	if (authority === null) return REDACTED_ARGV_VALUE;
+	const prefix = authority[0];
+	let rest = value.slice(prefix.length);
+	const lastAt = rest.lastIndexOf("@");
+	if (lastAt >= 0) rest = `${REDACTED_ARGV_VALUE}${rest.slice(lastAt)}`;
+	else {
+		const host = rest.split(/[/?#]/)[0];
+		const ipv6 = /^\[[0-9A-Fa-f:.]+\]/.exec(host);
+		const bare = ipv6 ? host.slice(ipv6[0].length) : host;
+		if (/:(?!\d{1,5}$)/.test(bare)) return REDACTED_ARGV_VALUE;
+	}
+	for (const delimiter of ["?", "#"]) {
+		const at = rest.indexOf(delimiter);
+		if (at >= 0) rest = `${rest.slice(0, at)}${delimiter}${REDACTED_ARGV_VALUE}`;
+	}
+	return `${prefix}${rest}`;
+}
+function maskArgvFlagValue(flag, value) {
+	if (ARGV_VALUE_BEARING_FLAGS.has(flag)) {
+		const eqIdx = value.indexOf("=");
+		return eqIdx >= 0 ? `${value.substring(0, eqIdx)}=${REDACTED_ARGV_VALUE}` : void 0;
+	}
+	if (ARGV_PARAM_LIST_FLAGS.has(flag)) {
+		let masked = false;
+		const rawParts = value.split(",");
+		const parts = rawParts.map((part, index) => {
+			if (part === "") return part;
+			if (masked) return REDACTED_ARGV_VALUE;
+			const eqIdx = part.indexOf("=");
+			if (eqIdx < 0) {
+				if (index === 0) return part;
+				masked = true;
+				return REDACTED_ARGV_VALUE;
+			}
+			const name = part.substring(0, eqIdx);
+			const normalized = name.trim().toLowerCase();
+			if (ARGV_PARAM_LIST_URL_PARAMS.has(normalized)) {
+				if (rawParts.slice(index + 1).some((later) => later.includes("@"))) {
+					masked = true;
+					return `${name}=${REDACTED_ARGV_VALUE}`;
+				}
+				const rawUrl = part.substring(eqIdx + 1);
+				const safeUrl = redactUrlLocator(rawUrl);
+				if (safeUrl === rawUrl) return part;
+				masked = true;
+				return `${name}=${safeUrl}`;
+			}
+			if (ARGV_PARAM_LIST_LOCATOR_PARAMS.has(normalized)) return part;
+			masked = true;
+			return `${name}=${REDACTED_ARGV_VALUE}`;
+		});
+		return masked ? parts.join(",") : void 0;
+	}
+}
+function maskAttachedShortFlag(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	let chosen;
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) {
+		if (flag.length !== 2 || !flag.startsWith("-") || flag[1] === "-") continue;
+		const at = arg.indexOf(flag[1], 1);
+		if (at < 0 || at === arg.length - 1) continue;
+		if (chosen === void 0 || at < chosen.at) chosen = {
+			at,
+			flag
+		};
+	}
+	if (chosen === void 0) return void 0;
+	const masked = maskArgvFlagValue(chosen.flag, arg.slice(chosen.at + 1));
+	return masked === void 0 ? void 0 : `${arg.slice(0, chosen.at + 1)}${masked}`;
+}
+function trailingShortFlagOfCluster(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	const last = arg[arg.length - 1];
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) if (flag.length === 2 && flag.startsWith("-") && flag[1] !== "-" && flag[1] === last) return flag;
+}
+function redactDockerArgvValues(args) {
+	const out = [];
+	for (let i = 0; i < args.length; i++) {
+		const cur = args[i];
+		const joinedEq = cur.indexOf("=");
+		if (joinedEq > 0) {
+			const maskedJoined = maskArgvFlagValue(cur.substring(0, joinedEq), cur.substring(joinedEq + 1));
+			if (maskedJoined !== void 0) {
+				out.push(`${cur.substring(0, joinedEq)}=${maskedJoined}`);
+				continue;
+			}
+		}
+		const maskedAttached = maskAttachedShortFlag(cur);
+		if (maskedAttached !== void 0) {
+			out.push(maskedAttached);
+			continue;
+		}
+		const next = args[i + 1];
+		if (typeof next === "string") {
+			const maskedNext = maskArgvFlagValue(ARGV_VALUE_BEARING_FLAGS.has(cur) ? cur : trailingShortFlagOfCluster(cur) ?? cur, next);
+			if (maskedNext !== void 0) {
+				out.push(cur, maskedNext);
+				i++;
+				continue;
+			}
+		}
+		out.push(cur);
+	}
+	return out;
+}
+function describeExitWithoutArgv(err) {
+	const e = err;
+	if (typeof e?.signal === "string" && e.signal !== "") return `killed by ${e.signal}`;
+	if (typeof e?.code === "number") return `exited with code ${e.code}`;
+	if (typeof e?.code === "string" && e.code !== "") return `failed (${e.code})`;
+	return "failed with no output";
+}
+
 //#endregion
 //#region src/assets/asset-source-path.ts
 function resolveAssetSourcePath(opts) {
@@ -5744,7 +6020,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
 		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
-		logger.debug(`Building Docker image via executable: ${displayUntrustedValue(source.executable.join(" "))} (cwd=${displayUntrustedValue(cwd)})`);
+		logger.debug(`Building Docker image via executable: ${displayUntrustedValue(redactDockerArgvValues(source.executable).join(" "))} (cwd=${displayUntrustedValue(cwd)})`);
 		warnManifestExecutable(cmd, source.executable, cwd);
 		let result;
 		try {
@@ -5757,13 +6033,13 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${displayUntrustedValue(cmd)}`);
 		return tag;
 	}
-	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (got: ${JSON.stringify(source)})`);
+	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (fields present: ${displayUntrustedValue(Object.keys(source).join(", ") || "none")})`);
 	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
 	const contextDir = contextDirectory(source.directory, `send that directory to docker build as the context of an image ${getEmbedConfig().productName} then runs locally`);
 	buildArgs.push(".");
 	warnEscapingBuildKitPaths(source, contextDir, assetOutdir);
-	logger.debug(`${getDockerCmd()} ${buildArgs.join(" ")} (cwd=${displayUntrustedValue(contextDir)})`);
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${displayUntrustedValue(contextDir)})`);
 	try {
 		await runDockerStreaming(buildArgs, {
 			cwd: contextDir,
@@ -5893,7 +6169,7 @@ async function pullEcrImage(imageUri, options) {
 async function assumeRoleForEcr(roleArn, callerRegion, profile, logger) {
 	if (!isIamRoleArn(roleArn)) throw new LocalInvokeBuildError(refusedRoleArnMessage(roleArn));
 	logger.debug(`Assuming role ${roleArn} for ECR pull...`);
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(workloadStsClientConfig({
 		region: callerRegion,
 		profile
 	}));
@@ -6136,7 +6412,7 @@ async function runDetached(opts) {
 	}
 	args.push(opts.image, ...entryPointTail, ...opts.cmd);
 	const logger = getLogger().child("docker");
-	logger.debug(`${getDockerCmd()} ${redactAwsCredentialsInArgs(args).join(" ")}`);
+	logger.debug(flattenToOneLine(`${getDockerCmd()} ${redactDockerArgvValues(args).join(" ")}`));
 	if (collisions.length > 0) logger.warn(describeRefusedSensitiveEnvKeys(`Container for image ${displayUntrustedValue(opts.image)}`, collisions));
 	const forwardedKeys = Object.keys(passthroughEnv);
 	const refusal = finchSecretArgvRefusal(forwardedKeys.filter((k) => opts.sensitiveEnvKeys?.has(k)), {
@@ -6152,8 +6428,7 @@ async function runDetached(opts) {
 		});
 		return stdout.trim();
 	} catch (error) {
-		const err = error;
-		throw new DockerRunnerError(`docker run failed: ${err.stderr?.trim() || err.message || String(error)}`);
+		throw new DockerRunnerError(`docker run failed: ${error.stderr?.trim() || describeExitWithoutArgv(error)}`);
 	}
 }
 function streamLogs(containerId) {
@@ -6250,26 +6525,6 @@ function execEnvForSecrets(passthrough) {
 	for (const k of keys) defineOwnKey(env, k, passthrough[k]);
 	return { env };
 }
-function redactAwsCredentialsInArgs(args) {
-	const out = [];
-	for (let i = 0; i < args.length; i++) {
-		const cur = args[i];
-		const next = args[i + 1];
-		if (cur === "-e" && typeof next === "string") {
-			const eqIdx = next.indexOf("=");
-			if (eqIdx > 0) {
-				const key = next.substring(0, eqIdx);
-				if (SENSITIVE_ENV_KEYS.has(key)) {
-					out.push("-e", `${key}=***`);
-					i++;
-					continue;
-				}
-			}
-		}
-		out.push(cur);
-	}
-	return out;
-}
 
 //#endregion
 //#region src/assets/asset-manifest-loader.ts
@@ -10133,7 +10388,7 @@ function defaultCredentialsLoader() {
 		if (cached) return cached;
 		cached = (async () => {
 			const { STSClient } = await import("@aws-sdk/client-sts");
-			const client = new STSClient({ ...buildProxyClientConfig() });
+			const client = new STSClient({ ...workloadClientConfig() });
 			const creds = await client.config.credentials();
 			client.destroy();
 			return {
@@ -11501,7 +11756,7 @@ async function assumeRoleForLayer(roleArn, region, options) {
 async function defaultLambdaClientFactory() {
 	const { LambdaClient } = await import("@aws-sdk/client-lambda");
 	return (region, credentials) => new LambdaClient({
-		...buildProxyClientConfig(),
+		...workloadClientConfig(),
 		region,
 		...credentials && { credentials: {
 			accessKeyId: credentials.accessKeyId,
@@ -11513,7 +11768,7 @@ async function defaultLambdaClientFactory() {
 async function defaultStsClientFactory() {
 	const { STSClient } = await import("@aws-sdk/client-sts");
 	return (region) => new STSClient({
-		...buildProxyClientConfig(),
+		...workloadClientConfig(),
 		region
 	});
 }
@@ -12579,13 +12834,14 @@ async function buildContainerSpec(args) {
 		dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
 		if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 	} else {
-		forwardAwsEnv$3(dockerEnv);
+		const forwarded = forwardAwsEnv$3(dockerEnv);
 		if (profileCredentials) {
 			dockerEnv["AWS_ACCESS_KEY_ID"] = profileCredentials.accessKeyId;
 			dockerEnv["AWS_SECRET_ACCESS_KEY"] = profileCredentials.secretAccessKey;
 			if (profileCredentials.sessionToken) dockerEnv["AWS_SESSION_TOKEN"] = profileCredentials.sessionToken;
 			else delete dockerEnv["AWS_SESSION_TOKEN"];
 		}
+		if (forwarded === "stripped" && !dockerEnv["AWS_ACCESS_KEY_ID"]) warnWorkloadCredentialsStripped();
 		if (profileCredsFile) {
 			dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = profileCredsFile.containerPath;
 			dockerEnv["AWS_PROFILE"] = profileCredsFile.profileName;
@@ -12872,6 +13128,7 @@ function forwardAwsEnv$3(env) {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
+	return applyWorkloadEnvCredentials(env);
 }
 function resolveContainerFallbackRegion(args) {
 	return args.stackRegionOverride ?? args.synthRegion ?? args.profileRegion;
@@ -13060,7 +13317,7 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const sts = new STSClient(buildStsClientConfig({
+		const sts = new STSClient(workloadStsClientConfig({
 			region,
 			profile: options.profile
 		}));
@@ -13445,7 +13702,7 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const sts = new STSClient(buildStsClientConfig({
+		const sts = new STSClient(workloadStsClientConfig({
 			region,
 			profile: options.profile
 		}));
@@ -13521,6 +13778,7 @@ function forwardAwsEnv$2(env) {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
+	return applyWorkloadEnvCredentials(env);
 }
 function applyProfileCredentialsOverlay(env, profileCreds, assumeRoleActive) {
 	if (!profileCreds) return;
@@ -13665,8 +13923,9 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 		}
 	}
 	if (!assumeSucceeded) {
-		forwardAwsEnv$2(dockerEnv);
+		const forwarded = forwardAwsEnv$2(dockerEnv);
 		applyProfileCredentialsOverlay(dockerEnv, profileCredentials, false);
+		if (forwarded === "stripped" && !dockerEnv["AWS_ACCESS_KEY_ID"]) warnWorkloadCredentialsStripped();
 	}
 	if (!dockerEnv["AWS_REGION"] && !dockerEnv["AWS_DEFAULT_REGION"]) {
 		const fallbackRegion = resolveContainerFallbackRegion({
@@ -14891,10 +15150,16 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region,
 			...creds.sessionToken && { sessionToken: creds.sessionToken }
 		};
 	}
-	const accessKeyId = process.env["AWS_ACCESS_KEY_ID"];
-	const secretAccessKey = process.env["AWS_SECRET_ACCESS_KEY"];
+	const hostEnv = {
+		AWS_ACCESS_KEY_ID: process.env["AWS_ACCESS_KEY_ID"],
+		AWS_SECRET_ACCESS_KEY: process.env["AWS_SECRET_ACCESS_KEY"],
+		AWS_SESSION_TOKEN: process.env["AWS_SESSION_TOKEN"]
+	};
+	applyWorkloadEnvCredentials(hostEnv);
+	const accessKeyId = hostEnv["AWS_ACCESS_KEY_ID"];
+	const secretAccessKey = hostEnv["AWS_SECRET_ACCESS_KEY"];
 	if (accessKeyId && secretAccessKey) {
-		const sessionToken = process.env["AWS_SESSION_TOKEN"];
+		const sessionToken = hostEnv["AWS_SESSION_TOKEN"];
 		return {
 			accessKeyId,
 			secretAccessKey,
@@ -15121,7 +15386,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 }
 async function resolveCallerAccountId$2(region, profile) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(workloadStsClientConfig({
 		region,
 		profile
 	}));
@@ -15149,8 +15414,9 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 		}
 	}
 	if (!assumeSucceeded) {
-		forwardAwsEnv$1(dockerEnv);
+		const forwarded = forwardAwsEnv$1(dockerEnv);
 		applyProfileCredentialsOverlay(dockerEnv, args.profileCredentials, false);
+		if (forwarded === "stripped" && !dockerEnv["AWS_ACCESS_KEY_ID"]) warnWorkloadCredentialsStripped();
 		if (args.profileCredsFile) {
 			dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = args.profileCredsFile.containerPath;
 			dockerEnv["AWS_PROFILE"] = args.profileCredsFile.profileName;
@@ -15263,11 +15529,12 @@ function forwardAwsEnv$1(env) {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
+	return applyWorkloadEnvCredentials(env);
 }
 async function assumeAgentCoreExecutionRole(roleArn, region, profile) {
 	if (!isIamRoleArn(roleArn)) throw new AssumeRoleFailure(refusedRoleArnMessage(roleArn), `the role ARN is not well-formed: ${describeRejectedRoleArn(roleArn)}`);
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(workloadStsClientConfig({
 		region,
 		profile
 	}));
@@ -15804,8 +16071,7 @@ async function createNetworkAndSidecar(args) {
 		return stdout.trim();
 	} catch (err) {
 		await destroyNetworkOnly(networkName);
-		const e = err;
-		throw new DockerRunnerError(`Failed to start metadata-endpoints sidecar: ${e.stderr?.trim() || e.message || String(err)}`);
+		throw new DockerRunnerError(`Failed to start metadata-endpoints sidecar: ${err.stderr?.trim() || describeExitWithoutArgv(err)}`);
 	}
 }
 async function createTaskNetwork(options = {}) {
@@ -15871,12 +16137,12 @@ async function resolveEcsSecrets(entries, options = {}) {
 	if (entries.length === 0) return [];
 	const logger = getLogger().child("ecs-secrets");
 	const secretsClient = options.secretsManagerClient ?? new SecretsManagerClient({
-		...buildProxyClientConfig({ profile: options.profile }),
+		...workloadClientConfig({ profile: options.profile }),
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile }
 	});
 	const ssmClient = options.ssmClient ?? new SSMClient({
-		...buildProxyClientConfig({ profile: options.profile }),
+		...workloadClientConfig({ profile: options.profile }),
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile }
 	});
@@ -16160,7 +16426,7 @@ async function runEcsTask(task, options, state) {
 			id = stdout.trim();
 		} catch (err) {
 			const e = err;
-			throw new DockerRunnerError(`docker run failed for container '${container.name}': ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new DockerRunnerError(`docker run failed for container '${container.name}': ${e.stderr?.trim() || describeExitWithoutArgv(err)}`);
 		}
 		state.startedContainers.push({
 			name: container.name,
@@ -16378,7 +16644,7 @@ async function realizeDockerVolumes(volumes, state) {
 			logger.debug(`Created docker volume ${dockerVolumeName} for task volume '${v.name}'`);
 		} catch (err) {
 			const e = err;
-			throw new DockerRunnerError(`docker volume create failed for '${v.name}': ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new DockerRunnerError(`docker volume create failed for '${v.name}': ${e.stderr?.trim() || describeExitWithoutArgv(err)}`);
 		}
 		out.set(v.name, {
 			...v,
@@ -17243,7 +17509,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -17256,7 +17522,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -17267,7 +17533,7 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerRestartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["restart", containerId]);
 };
 let dockerRestartImpl = defaultDockerRestartImpl;
@@ -17285,7 +17551,7 @@ async function disconnectOldFromSharedNetwork(oldInstance) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -17425,7 +17691,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -17435,7 +17701,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -18778,6 +19044,7 @@ function forwardAwsEnv() {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
+	if (applyWorkloadEnvCredentials(env) === "stripped" && !env["AWS_ACCESS_KEY_ID"]) warnWorkloadCredentialsStripped();
 	return env;
 }
 function materializeInlineCode(handler, source, fileExtension) {
@@ -20225,7 +20492,7 @@ function describeForwardTargetForSummary(t) {
 async function resolvePlaceholderAccount$1(arn, region, profile) {
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(workloadStsClientConfig({
 		region,
 		profile
 	}));
@@ -20306,7 +20573,7 @@ function pickCandidateStack$1(stackPattern, stacks) {
 }
 async function resolveCallerAccountId$1(region, profile) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(workloadStsClientConfig({
 		region,
 		profile
 	}));
@@ -20651,7 +20918,7 @@ var PlaceholderAccountError = class PlaceholderAccountError extends Error {
 async function resolvePlaceholderAccount(arn, region, profile) {
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(workloadStsClientConfig({
 		region,
 		profile
 	}));
@@ -20729,7 +20996,7 @@ function pickCandidateStack(stackPattern, stacks) {
 }
 async function resolveCallerAccountId(region, profile) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(workloadStsClientConfig({
 		region,
 		profile
 	}));
@@ -22992,7 +23259,7 @@ function defaultFetchObject(bucketName, options) {
 			const { S3Client, GetObjectCommand } = await import("@aws-sdk/client-s3");
 			return {
 				client: new S3Client({
-					...buildProxyClientConfig(),
+					...workloadClientConfig(),
 					...options.region && { region: options.region },
 					...options.credentials && { credentials: {
 						accessKeyId: options.credentials.accessKeyId,
@@ -23059,7 +23326,7 @@ async function resolveDeployedOriginBucket(options) {
 async function defaultGetOrigins(options) {
 	const { CloudFrontClient, GetDistributionConfigCommand } = await import("@aws-sdk/client-cloudfront");
 	const client = new CloudFrontClient({
-		...buildProxyClientConfig(),
+		...workloadClientConfig(),
 		region: "us-east-1",
 		...options.credentials && { credentials: {
 			accessKeyId: options.credentials.accessKeyId,
@@ -23078,7 +23345,7 @@ async function defaultGetOrigins(options) {
 //#region src/local/cloudfront-kvs-client.ts
 function createDeployedKvsDataSource(options) {
 	const client = new CloudFrontKeyValueStoreClient({
-		...buildProxyClientConfig(),
+		...workloadClientConfig(),
 		region: options.region ?? "us-east-1",
 		...options.credentials !== void 0 && { credentials: options.credentials }
 	});
@@ -23100,7 +23367,7 @@ function createDeployedKvsDataSource(options) {
 }
 async function resolveDeployedKvsArnByName(name, options = {}) {
 	const client = new CloudFrontClient({
-		...buildProxyClientConfig(),
+		...workloadClientConfig(),
 		region: options.region ?? "us-east-1",
 		...options.credentials !== void 0 && { credentials: options.credentials }
 	});
@@ -23390,10 +23657,10 @@ function buildLambdaBootOptions(options, profileCredentials, extraStateProviders
 		...extraStateProviders !== void 0 && { extraStateProviders }
 	};
 }
-function warnUnsupported(distribution) {
+function warnUnsupported(distribution, extraStateProviders) {
 	const logger = getLogger();
 	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin '${origin.originId}' is a custom (non-S3, non-Lambda-Function-URL) origin (${origin.domainName}); ${getEmbedConfig().cliName} start-cloudfront serves S3 origins and Lambda Function URL origins only. Requests routed to it return 502.`);
-	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass --from-cfn-stack to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
+	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass ${stateSourceFlagNames(extraStateProviders).join(" or ")} to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
 }
 function warnUnusedCacheOrigin(options, extraStateProviders) {
 	if (options.cacheOrigin === true && !isStateSourceActive(options, extraStateProviders)) {
@@ -23512,7 +23779,7 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 	const initial = await synthAndResolve();
 	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
 	const deployedS3 = await resolveDeployedS3Origins(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
-	warnUnsupported(initial.distribution);
+	warnUnsupported(initial.distribution, extraStateProviders);
 	warnUnusedCacheOrigin(options, extraStateProviders);
 	await attachKvsModules(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
 	const bootOpts = buildLambdaBootOptions(options, profileCredentials, extraStateProviders);
@@ -23560,7 +23827,7 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 						const reloaded = await synthAndResolve();
 						annotateDeployedS3Origins(reloaded.distribution, deployedS3.buckets);
 						for (const reader of deployedS3.readers.values()) reader.clearCache();
-						warnUnsupported(reloaded.distribution);
+						warnUnsupported(reloaded.distribution, extraStateProviders);
 						await attachKvsModules(reloaded.distribution, reloaded.stacks, options, profileCredentials, logger, extraStateProviders);
 						server.update(reloaded.distribution);
 						logger.info("Reload complete.");
@@ -29569,5 +29836,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, DynamicReferenceResolver as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, resolveProfileCredentials as Bi, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, keysOverriddenBy as Fi, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, isProxyEnvConfigured as Hi, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, parseDynamicReference as Ii, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, resolveDynamicReferencesInEnv as Li, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, deployedFillMayBeSecret as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, firstUsableRegion as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, keysNotFromTemplate as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, withoutKeys as Ri, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, buildProxyClientConfig as Vi, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, containsDynamicReference as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, DynamicReferenceResolutionError as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, buildStsClientConfig as zi, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-Mta0QWLf.js.map
+export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, DynamicReferenceResolver as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, assumedRoleRecorded as Bi, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, keysOverriddenBy as Fi, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, workloadStsClientConfig as Gi, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, recordAssumedRole as Hi, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, parseDynamicReference as Ii, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, buildProxyClientConfig as Ji, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, buildStsClientConfig as Ki, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, resolveDynamicReferencesInEnv as Li, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, deployedFillMayBeSecret as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, firstUsableRegion as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, keysNotFromTemplate as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, withoutKeys as Ri, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, resetWorkloadIdentity as Ui, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, readEnvCallerCredentials as Vi, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, workloadClientConfig as Wi, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, isProxyEnvConfigured as Yi, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, containsDynamicReference as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, DynamicReferenceResolutionError as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, resolveProfileCredentials as qi, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, SECOND_ASSUME_MESSAGE as zi, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
+//# sourceMappingURL=local-studio-DPQ50Gve.js.map