cdk-local 0.151.1 → 0.153.0

package/dist/{local-studio-a7HMFLOC.js → local-studio-DIB4WEk6.js}

@@ -1,5 +1,5 @@
-import { C as sanitizeServiceExceptionMessage, S as isAwsServiceException, _ as resolveAssemblyPath, a as isDockerClientEnvKey, b as describeCredentialLoadFailure, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as renderAssemblyPathEscape, h as namesTheSameDirectory, i as getDockerCmd, l as spawnStreaming, m as isPasteableCommandArg, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as clampErrorName, w as stringifyThrown, x as flattenToOneLine, y as describeAwsFailureForWarn } from "./docker-cmd-GME6jkl9.js";
-import { a as setEmbedConfig, r as getEmbedConfig, t as getLogger } from "./logger-CGhtqHg0.js";
+import { C as sanitizeServiceExceptionMessage, S as isAwsServiceException, _ as resolveAssemblyPath, a as isDockerClientEnvKey, b as describeCredentialLoadFailure, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as renderAssemblyPathEscape, h as namesTheSameDirectory, i as getDockerCmd, l as spawnStreaming, m as isPasteableCommandArg, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as clampErrorName, w as stringifyThrown, x as flattenToOneLine, y as describeAwsFailureForWarn } from "./docker-cmd-BSdu45mc.js";
+import { a as setEmbedConfig, r as getEmbedConfig, t as getLogger } from "./logger-CwFXOD1w.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path$1 from "node:path";
@@ -358,6 +358,145 @@ function buildStsClientConfig(args) {
 	};
 }
 
+//#endregion
+//#region src/utils/workload-identity.ts
+function copyCredentials(c) {
+	return c ? {
+		accessKeyId: c.accessKeyId,
+		secretAccessKey: c.secretAccessKey,
+		...c.sessionToken ? { sessionToken: c.sessionToken } : {}
+	} : void 0;
+}
+let record;
+let stripWarned = false;
+const SECOND_ASSUME_MESSAGE = "A role was already assumed in this process; refusing to assume a second one. Pass --role-arn once.";
+function recordAssumedRole(caller, role) {
+	if (record !== void 0) throw new Error(SECOND_ASSUME_MESSAGE);
+	record = {
+		caller: copyCredentials(caller),
+		role: copyCredentials(role)
+	};
+}
+function assumedRoleRecorded() {
+	return record !== void 0;
+}
+function readEnvCallerCredentials(env = process.env) {
+	const accessKeyId = env["AWS_ACCESS_KEY_ID"];
+	const secretAccessKey = env["AWS_SECRET_ACCESS_KEY"];
+	if (!accessKeyId || !secretAccessKey) return void 0;
+	const sessionToken = env["AWS_SESSION_TOKEN"];
+	return {
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	};
+}
+function resetWorkloadIdentity() {
+	record = void 0;
+	stripWarned = false;
+}
+function callerRecord() {
+	return getEmbedConfig().workloadIdentity === "caller" ? record : void 0;
+}
+const MULTIPLE_CREDENTIAL_SOURCES_WARNING = "Multiple credential sources detected";
+const chainLogger = {
+	debug: () => {},
+	info: () => {},
+	warn: (...args) => {
+		const text = args.map(String).join(" ");
+		if (text.includes(MULTIPLE_CREDENTIAL_SOURCES_WARNING)) return;
+		getLogger().warn(text);
+	},
+	error: (...args) => {
+		getLogger().error(args.map(String).join(" "));
+	}
+};
+function callerChainWithoutEnv(proxied) {
+	let chain;
+	return async (identityProperties) => {
+		chain ??= (async () => {
+			const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
+			return defaultProvider({
+				profile: "default",
+				logger: chainLogger,
+				...proxied ? { clientConfig: { requestHandler: buildProxyRequestHandler() } } : {}
+			});
+		})().catch((err) => {
+			chain = void 0;
+			throw err;
+		});
+		return (await chain)(identityProperties);
+	};
+}
+function workloadClientConfig(opts = {}) {
+	const base = buildProxyClientConfig({ profile: opts.profile });
+	const rec = callerRecord();
+	if (!rec) return base;
+	if (opts.profile || process.env["AWS_PROFILE"]) return base;
+	if (rec.caller) {
+		const caller = rec.caller;
+		const credentials = async () => ({
+			accessKeyId: caller.accessKeyId,
+			secretAccessKey: caller.secretAccessKey,
+			...caller.sessionToken ? { sessionToken: caller.sessionToken } : {}
+		});
+		return {
+			...base,
+			credentials
+		};
+	}
+	return {
+		...base,
+		credentials: callerChainWithoutEnv(base.requestHandler !== void 0)
+	};
+}
+function workloadStsClientConfig(args) {
+	return {
+		...workloadClientConfig({ profile: args.profile }),
+		...args.region && { region: args.region },
+		...args.profile && { profile: args.profile }
+	};
+}
+function deployAccountStsClientConfig(args) {
+	const role = callerRecord()?.role;
+	if (!role) return {
+		...buildProxyClientConfig({ profile: args.profile }),
+		...args.region && { region: args.region },
+		...args.profile && { profile: args.profile }
+	};
+	const credentials = async () => ({
+		accessKeyId: role.accessKeyId,
+		secretAccessKey: role.secretAccessKey,
+		...role.sessionToken ? { sessionToken: role.sessionToken } : {}
+	});
+	return {
+		...buildProxyClientConfig(),
+		...args.region && { region: args.region },
+		...args.profile && { profile: args.profile },
+		credentials
+	};
+}
+function applyWorkloadEnvCredentials(env) {
+	const rec = callerRecord();
+	if (!rec) return "unchanged";
+	if (rec.caller) {
+		env["AWS_ACCESS_KEY_ID"] = rec.caller.accessKeyId;
+		env["AWS_SECRET_ACCESS_KEY"] = rec.caller.secretAccessKey;
+		if (rec.caller.sessionToken) env["AWS_SESSION_TOKEN"] = rec.caller.sessionToken;
+		else delete env["AWS_SESSION_TOKEN"];
+		return "restored";
+	}
+	delete env["AWS_ACCESS_KEY_ID"];
+	delete env["AWS_SECRET_ACCESS_KEY"];
+	delete env["AWS_SESSION_TOKEN"];
+	return "stripped";
+}
+function warnWorkloadCredentialsStripped() {
+	if (stripWarned) return;
+	stripWarned = true;
+	getLogger().warn("The --role-arn role is not handed to the emulated workload, and your shell had no static AWS credentials to hand it instead, so the container receives none. Pass --profile <name>, or export static credentials, to give it an identity.");
+}
+
 //#endregion
 //#region src/utils/role-arn.ts
 const IAM_ROLE_ARN_MAX_LENGTH = 2048;
@@ -391,7 +530,7 @@ async function assumeRoleCredentials(opts) {
 		const message = refusedRoleArnMessage(opts.roleArn);
 		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, detail);
 	}
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(workloadStsClientConfig({
 		region: opts.region,
 		profile: opts.profile
 	}));
@@ -425,6 +564,7 @@ async function applyRoleArnIfSet(opts) {
 	const roleArn = opts.roleArn || process.env[`${getEmbedConfig().envPrefix}_ROLE_ARN`];
 	if (!roleArn) return;
 	if (!isIamRoleArn(roleArn)) throw new Error(refusedRoleArnMessage(roleArn));
+	if (assumedRoleRecorded() && getEmbedConfig().workloadIdentity === "caller") throw new Error(SECOND_ASSUME_MESSAGE);
 	const logger = getLogger().child("role-arn");
 	const shownArn = flattenToOneLine(roleArn);
 	logger.debug(`Assuming role ${shownArn}...`);
@@ -447,6 +587,11 @@ async function applyRoleArnIfSet(opts) {
 	if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${shownArn}`);
 	const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
 	if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${shownArn}`);
+	if (!assumedRoleRecorded()) recordAssumedRole(readEnvCallerCredentials(), {
+		accessKeyId: AccessKeyId,
+		secretAccessKey: SecretAccessKey,
+		sessionToken: SessionToken
+	});
 	process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
 	process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
 	process.env["AWS_SESSION_TOKEN"] = SessionToken;
@@ -751,7 +896,7 @@ var DynamicReferenceResolver = class {
 		let c = this.smClients.get(key);
 		if (!c) {
 			c = this.options.secretsManagerClientFactory?.(region) ?? new SecretsManagerClient({
-				...buildProxyClientConfig({ profile: this.options.profile }),
+				...workloadClientConfig({ profile: this.options.profile }),
 				...region && { region },
 				...this.options.profile && { profile: this.options.profile }
 			});
@@ -764,7 +909,7 @@ var DynamicReferenceResolver = class {
 		let c = this.ssmClients.get(key);
 		if (!c) {
 			c = this.options.ssmClientFactory?.(region) ?? new SSMClient({
-				...buildProxyClientConfig({ profile: this.options.profile }),
+				...workloadClientConfig({ profile: this.options.profile }),
 				...region && { region },
 				...this.options.profile && { profile: this.options.profile }
 			});
@@ -2082,37 +2227,37 @@ async function getClient(service, region) {
 	switch (service) {
 		case "sqs":
 			client = new (await (import("@aws-sdk/client-sqs"))).SQSClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
 		case "sns":
 			client = new (await (import("@aws-sdk/client-sns"))).SNSClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
 		case "eventbridge":
 			client = new (await (import("@aws-sdk/client-eventbridge"))).EventBridgeClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
 		case "kinesis":
 			client = new (await (import("@aws-sdk/client-kinesis"))).KinesisClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
 		case "sfn":
 			client = new (await (import("@aws-sdk/client-sfn"))).SFNClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
 		case "ssm":
 			client = new (await (import("@aws-sdk/client-ssm"))).SSMClient({
-				...buildProxyClientConfig(),
+				...workloadClientConfig(),
 				region
 			});
 			break;
@@ -3392,7 +3537,7 @@ async function resolveMultiTarget(provided, params) {
 async function loadSynthDeps() {
 	const [toolkitLib, { CdklIoHost }, { AssetManifestArtifact }] = await Promise.all([
 		import("@aws-cdk/toolkit-lib"),
-		import("./cdkl-io-host-9lPKscRA.js"),
+		import("./cdkl-io-host-CDXI-7cC.js"),
 		import("@aws-cdk/cloud-assembly-api")
 	]);
 	return {
@@ -3672,7 +3817,7 @@ var CfnLocalStateProvider = class {
 	getClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.client) this.client = new CloudFormationClient({
-			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
+			...workloadClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -3681,7 +3826,7 @@ var CfnLocalStateProvider = class {
 	getLambdaClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.lambdaClient) this.lambdaClient = new LambdaClient({
-			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
+			...workloadClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -3690,7 +3835,7 @@ var CfnLocalStateProvider = class {
 	getAgentCoreControlClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.agentCoreControlClient) this.agentCoreControlClient = new BedrockAgentCoreControlClient({
-			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
+			...workloadClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -3699,7 +3844,7 @@ var CfnLocalStateProvider = class {
 	getSsmClient() {
 		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.ssmClient) this.ssmClient = new SSMClient({
-			...buildProxyClientConfig({ profile: this.clientOptions.profile }),
+			...workloadClientConfig({ profile: this.clientOptions.profile }),
 			region: this.region,
 			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
 		});
@@ -6053,7 +6198,7 @@ async function pullEcrImage(imageUri, options) {
 async function assumeRoleForEcr(roleArn, callerRegion, profile, logger) {
 	if (!isIamRoleArn(roleArn)) throw new LocalInvokeBuildError(refusedRoleArnMessage(roleArn));
 	logger.debug(`Assuming role ${roleArn} for ECR pull...`);
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(workloadStsClientConfig({
 		region: callerRegion,
 		profile
 	}));
@@ -10272,7 +10417,7 @@ function defaultCredentialsLoader() {
 		if (cached) return cached;
 		cached = (async () => {
 			const { STSClient } = await import("@aws-sdk/client-sts");
-			const client = new STSClient({ ...buildProxyClientConfig() });
+			const client = new STSClient({ ...workloadClientConfig() });
 			const creds = await client.config.credentials();
 			client.destroy();
 			return {
@@ -11640,7 +11785,7 @@ async function assumeRoleForLayer(roleArn, region, options) {
 async function defaultLambdaClientFactory() {
 	const { LambdaClient } = await import("@aws-sdk/client-lambda");
 	return (region, credentials) => new LambdaClient({
-		...buildProxyClientConfig(),
+		...workloadClientConfig(),
 		region,
 		...credentials && { credentials: {
 			accessKeyId: credentials.accessKeyId,
@@ -11652,7 +11797,7 @@ async function defaultLambdaClientFactory() {
 async function defaultStsClientFactory() {
 	const { STSClient } = await import("@aws-sdk/client-sts");
 	return (region) => new STSClient({
-		...buildProxyClientConfig(),
+		...workloadClientConfig(),
 		region
 	});
 }
@@ -12718,13 +12863,14 @@ async function buildContainerSpec(args) {
 		dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
 		if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 	} else {
-		forwardAwsEnv$3(dockerEnv);
+		const forwarded = forwardAwsEnv$3(dockerEnv);
 		if (profileCredentials) {
 			dockerEnv["AWS_ACCESS_KEY_ID"] = profileCredentials.accessKeyId;
 			dockerEnv["AWS_SECRET_ACCESS_KEY"] = profileCredentials.secretAccessKey;
 			if (profileCredentials.sessionToken) dockerEnv["AWS_SESSION_TOKEN"] = profileCredentials.sessionToken;
 			else delete dockerEnv["AWS_SESSION_TOKEN"];
 		}
+		if (forwarded === "stripped" && !dockerEnv["AWS_ACCESS_KEY_ID"]) warnWorkloadCredentialsStripped();
 		if (profileCredsFile) {
 			dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = profileCredsFile.containerPath;
 			dockerEnv["AWS_PROFILE"] = profileCredsFile.profileName;
@@ -13011,6 +13157,7 @@ function forwardAwsEnv$3(env) {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
+	return applyWorkloadEnvCredentials(env);
 }
 function resolveContainerFallbackRegion(args) {
 	return args.stackRegionOverride ?? args.synthRegion ?? args.profileRegion;
@@ -13199,7 +13346,7 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const sts = new STSClient(buildStsClientConfig({
+		const sts = new STSClient(deployAccountStsClientConfig({
 			region,
 			profile: options.profile
 		}));
@@ -13584,7 +13731,7 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const sts = new STSClient(buildStsClientConfig({
+		const sts = new STSClient(deployAccountStsClientConfig({
 			region,
 			profile: options.profile
 		}));
@@ -13660,6 +13807,7 @@ function forwardAwsEnv$2(env) {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
+	return applyWorkloadEnvCredentials(env);
 }
 function applyProfileCredentialsOverlay(env, profileCreds, assumeRoleActive) {
 	if (!profileCreds) return;
@@ -13804,8 +13952,9 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 		}
 	}
 	if (!assumeSucceeded) {
-		forwardAwsEnv$2(dockerEnv);
+		const forwarded = forwardAwsEnv$2(dockerEnv);
 		applyProfileCredentialsOverlay(dockerEnv, profileCredentials, false);
+		if (forwarded === "stripped" && !dockerEnv["AWS_ACCESS_KEY_ID"]) warnWorkloadCredentialsStripped();
 	}
 	if (!dockerEnv["AWS_REGION"] && !dockerEnv["AWS_DEFAULT_REGION"]) {
 		const fallbackRegion = resolveContainerFallbackRegion({
@@ -15030,10 +15179,16 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region,
 			...creds.sessionToken && { sessionToken: creds.sessionToken }
 		};
 	}
-	const accessKeyId = process.env["AWS_ACCESS_KEY_ID"];
-	const secretAccessKey = process.env["AWS_SECRET_ACCESS_KEY"];
+	const hostEnv = {
+		AWS_ACCESS_KEY_ID: process.env["AWS_ACCESS_KEY_ID"],
+		AWS_SECRET_ACCESS_KEY: process.env["AWS_SECRET_ACCESS_KEY"],
+		AWS_SESSION_TOKEN: process.env["AWS_SESSION_TOKEN"]
+	};
+	applyWorkloadEnvCredentials(hostEnv);
+	const accessKeyId = hostEnv["AWS_ACCESS_KEY_ID"];
+	const secretAccessKey = hostEnv["AWS_SECRET_ACCESS_KEY"];
 	if (accessKeyId && secretAccessKey) {
-		const sessionToken = process.env["AWS_SESSION_TOKEN"];
+		const sessionToken = hostEnv["AWS_SESSION_TOKEN"];
 		return {
 			accessKeyId,
 			secretAccessKey,
@@ -15260,7 +15415,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 }
 async function resolveCallerAccountId$2(region, profile) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(deployAccountStsClientConfig({
 		region,
 		profile
 	}));
@@ -15288,8 +15443,9 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 		}
 	}
 	if (!assumeSucceeded) {
-		forwardAwsEnv$1(dockerEnv);
+		const forwarded = forwardAwsEnv$1(dockerEnv);
 		applyProfileCredentialsOverlay(dockerEnv, args.profileCredentials, false);
+		if (forwarded === "stripped" && !dockerEnv["AWS_ACCESS_KEY_ID"]) warnWorkloadCredentialsStripped();
 		if (args.profileCredsFile) {
 			dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = args.profileCredsFile.containerPath;
 			dockerEnv["AWS_PROFILE"] = args.profileCredsFile.profileName;
@@ -15402,11 +15558,12 @@ function forwardAwsEnv$1(env) {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
+	return applyWorkloadEnvCredentials(env);
 }
 async function assumeAgentCoreExecutionRole(roleArn, region, profile) {
 	if (!isIamRoleArn(roleArn)) throw new AssumeRoleFailure(refusedRoleArnMessage(roleArn), `the role ARN is not well-formed: ${describeRejectedRoleArn(roleArn)}`);
 	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(workloadStsClientConfig({
 		region,
 		profile
 	}));
@@ -16009,12 +16166,12 @@ async function resolveEcsSecrets(entries, options = {}) {
 	if (entries.length === 0) return [];
 	const logger = getLogger().child("ecs-secrets");
 	const secretsClient = options.secretsManagerClient ?? new SecretsManagerClient({
-		...buildProxyClientConfig({ profile: options.profile }),
+		...workloadClientConfig({ profile: options.profile }),
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile }
 	});
 	const ssmClient = options.ssmClient ?? new SSMClient({
-		...buildProxyClientConfig({ profile: options.profile }),
+		...workloadClientConfig({ profile: options.profile }),
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile }
 	});
@@ -17381,7 +17538,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -17394,7 +17551,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -17405,7 +17562,7 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerRestartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["restart", containerId]);
 };
 let dockerRestartImpl = defaultDockerRestartImpl;
@@ -17423,7 +17580,7 @@ async function disconnectOldFromSharedNetwork(oldInstance) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -17563,7 +17720,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -17573,7 +17730,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -18916,6 +19073,7 @@ function forwardAwsEnv() {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
+	if (applyWorkloadEnvCredentials(env) === "stripped" && !env["AWS_ACCESS_KEY_ID"]) warnWorkloadCredentialsStripped();
 	return env;
 }
 function materializeInlineCode(handler, source, fileExtension) {
@@ -20363,7 +20521,7 @@ function describeForwardTargetForSummary(t) {
 async function resolvePlaceholderAccount$1(arn, region, profile) {
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(deployAccountStsClientConfig({
 		region,
 		profile
 	}));
@@ -20444,7 +20602,7 @@ function pickCandidateStack$1(stackPattern, stacks) {
 }
 async function resolveCallerAccountId$1(region, profile) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(deployAccountStsClientConfig({
 		region,
 		profile
 	}));
@@ -20789,7 +20947,7 @@ var PlaceholderAccountError = class PlaceholderAccountError extends Error {
 async function resolvePlaceholderAccount(arn, region, profile) {
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(deployAccountStsClientConfig({
 		region,
 		profile
 	}));
@@ -20867,7 +21025,7 @@ function pickCandidateStack(stackPattern, stacks) {
 }
 async function resolveCallerAccountId(region, profile) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	const sts = new STSClient(deployAccountStsClientConfig({
 		region,
 		profile
 	}));
@@ -23130,7 +23288,7 @@ function defaultFetchObject(bucketName, options) {
 			const { S3Client, GetObjectCommand } = await import("@aws-sdk/client-s3");
 			return {
 				client: new S3Client({
-					...buildProxyClientConfig(),
+					...workloadClientConfig(),
 					...options.region && { region: options.region },
 					...options.credentials && { credentials: {
 						accessKeyId: options.credentials.accessKeyId,
@@ -23197,7 +23355,7 @@ async function resolveDeployedOriginBucket(options) {
 async function defaultGetOrigins(options) {
 	const { CloudFrontClient, GetDistributionConfigCommand } = await import("@aws-sdk/client-cloudfront");
 	const client = new CloudFrontClient({
-		...buildProxyClientConfig(),
+		...workloadClientConfig(),
 		region: "us-east-1",
 		...options.credentials && { credentials: {
 			accessKeyId: options.credentials.accessKeyId,
@@ -23216,7 +23374,7 @@ async function defaultGetOrigins(options) {
 //#region src/local/cloudfront-kvs-client.ts
 function createDeployedKvsDataSource(options) {
 	const client = new CloudFrontKeyValueStoreClient({
-		...buildProxyClientConfig(),
+		...workloadClientConfig(),
 		region: options.region ?? "us-east-1",
 		...options.credentials !== void 0 && { credentials: options.credentials }
 	});
@@ -23238,7 +23396,7 @@ function createDeployedKvsDataSource(options) {
 }
 async function resolveDeployedKvsArnByName(name, options = {}) {
 	const client = new CloudFrontClient({
-		...buildProxyClientConfig(),
+		...workloadClientConfig(),
 		region: options.region ?? "us-east-1",
 		...options.credentials !== void 0 && { credentials: options.credentials }
 	});
@@ -23449,7 +23607,7 @@ async function bootLambdaUrlOrigins(distribution, stacks, opts) {
 	for (const functionLogicalId of functionLogicalIds) {
 		let runner;
 		try {
-			const lambda = resolveLambdaTarget(functionLogicalId, stacks);
+			const lambda = resolveLambdaTarget(`${distribution.stackName}:${functionLogicalId}`, stacks);
 			const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
 			runner = createFrontDoorLambdaRunner(lambda, {
 				containerHost: opts.containerHost,
@@ -23488,7 +23646,7 @@ async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
 		]) if (assoc) functionLogicalIds.add(assoc.functionLogicalId);
 	}
 	for (const functionLogicalId of functionLogicalIds) try {
-		const lambda = resolveLambdaTarget(functionLogicalId, stacks);
+		const lambda = resolveLambdaTarget(`${distribution.stackName}:${functionLogicalId}`, stacks);
 		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
 		const runner = createFrontDoorLambdaRunner(lambda, {
 			containerHost: opts.containerHost,
@@ -29707,5 +29865,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, DynamicReferenceResolver as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, resolveProfileCredentials as Bi, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, keysOverriddenBy as Fi, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, isProxyEnvConfigured as Hi, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, parseDynamicReference as Ii, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, resolveDynamicReferencesInEnv as Li, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, deployedFillMayBeSecret as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, firstUsableRegion as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, keysNotFromTemplate as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, withoutKeys as Ri, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, buildProxyClientConfig as Vi, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, containsDynamicReference as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, DynamicReferenceResolutionError as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, buildStsClientConfig as zi, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-a7HMFLOC.js.map
+export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, DynamicReferenceResolver as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, assumedRoleRecorded as Bi, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, keysOverriddenBy as Fi, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, workloadClientConfig as Gi, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, readEnvCallerCredentials as Hi, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, parseDynamicReference as Ii, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, resolveProfileCredentials as Ji, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, workloadStsClientConfig as Ki, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, resolveDynamicReferencesInEnv as Li, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, deployedFillMayBeSecret as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, firstUsableRegion as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, keysNotFromTemplate as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, withoutKeys as Ri, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, recordAssumedRole as Ui, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, deployAccountStsClientConfig as Vi, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, resetWorkloadIdentity as Wi, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, isProxyEnvConfigured as Xi, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, buildProxyClientConfig as Yi, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, containsDynamicReference as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, DynamicReferenceResolutionError as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, buildStsClientConfig as qi, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, SECOND_ASSUME_MESSAGE as zi, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
+//# sourceMappingURL=local-studio-DIB4WEk6.js.map