cdk-local 0.155.0 → 0.156.0

package/dist/{local-studio-CsftJJ1r.js → local-studio-BhFxp-jM.js}

@@ -46,10 +46,11 @@ import * as vm from "node:vm";
 import "@aws-sdk/signature-v4a";
 import { CloudFrontClient, paginateListKeyValueStores } from "@aws-sdk/client-cloudfront";
 import { CloudFrontKeyValueStoreClient, GetKeyCommand, ResourceNotFoundException } from "@aws-sdk/client-cloudfront-keyvaluestore";
-import { existsSync as existsSync$1, rmSync as rmSync$1, statSync as statSync$1 } from "fs";
+import { existsSync as existsSync$1, readFileSync as readFileSync$1, rmSync as rmSync$1, statSync as statSync$1 } from "fs";
 import { request as request$2 } from "http";
 import { execFile as execFile$1, spawn as spawn$1 } from "child_process";
 import { promisify as promisify$1 } from "util";
+import { randomUUID as randomUUID$1 } from "crypto";
 import { EventEmitter } from "node:events";
 
 //#region src/utils/url-authority.ts
@@ -3536,7 +3537,8 @@ function listTargets(stacks) {
 		agentCoreRuntimes: sortEntries(scanAgentCoreRuntimes(stacks)),
 		loadBalancers: sortEntries(scanApplicationLoadBalancers(stacks)),
 		cloudFrontDistributions: sortEntries(scanByType(stacks, "AWS::CloudFront::Distribution")),
-		webFunctions: sortEntries(scanByType(stacks, "AWS::Lambda::WebFunction"))
+		webFunctions: sortEntries(scanByType(stacks, "AWS::Lambda::WebFunction")),
+		microvmImages: sortEntries(scanByType(stacks, "AWS::Lambda::MicrovmImage"))
 	};
 }
 const pathOf$1 = (e) => e.displayPath ?? e.qualifiedId;
@@ -3559,7 +3561,7 @@ function sortApiEntries(entries) {
 	});
 }
 function countTargets(listing) {
-	return listing.lambdas.length + listing.apis.length + listing.ecsServices.length + listing.ecsTaskDefinitions.length + listing.agentCoreRuntimes.length + listing.loadBalancers.length + listing.cloudFrontDistributions.length + listing.webFunctions.length;
+	return listing.lambdas.length + listing.apis.length + listing.ecsServices.length + listing.ecsTaskDefinitions.length + listing.agentCoreRuntimes.length + listing.loadBalancers.length + listing.cloudFrontDistributions.length + listing.webFunctions.length + listing.microvmImages.length;
 }
 
 //#endregion
@@ -6493,7 +6495,7 @@ function pushMap(hash, name, value) {
 
 //#endregion
 //#region src/local/docker-runner.ts
-const execFileAsync$6 = promisify(execFile);
+const execFileAsync$7 = promisify(execFile);
 var DockerRunnerError = class DockerRunnerError extends Error {
 	constructor(message) {
 		super(message);
@@ -6555,6 +6557,7 @@ async function runDetached(opts) {
 	const host = opts.host ?? "127.0.0.1";
 	args.push("-p", `${host}:${opts.hostPort}:${opts.containerPort ?? 8080}`);
 	if (opts.debugPort !== void 0) args.push("-p", `${host}:${opts.debugPort}:${opts.debugPort}`);
+	for (const extra of opts.extraPorts ?? []) args.push("-p", `${host}:${extra.hostPort}:${extra.containerPort}`);
 	for (const mount of opts.mounts) {
 		const ro = mount.readOnly ? ":ro" : "";
 		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
@@ -6584,7 +6587,7 @@ async function runDetached(opts) {
 	if (refusal !== void 0) throw new DockerRunnerError(refusal);
 	warnFinchArgvExposure(forwardedKeys);
 	try {
-		const { stdout } = await execFileAsync$6(getDockerCmd(), args, {
+		const { stdout } = await execFileAsync$7(getDockerCmd(), args, {
 			maxBuffer: 10 * 1024 * 1024,
 			...execEnvForSecrets(passthroughEnv)
 		});
@@ -6641,8 +6644,8 @@ function streamLogs(containerId, opts = {}) {
 		proc.stderr?.on("data", (chunk) => tap(chunk));
 	}
 	let flush = () => void 0;
-	if (process.env["CDKL_PREFIX_CONTAINER_OUTPUT"] === "1") {
-		const tag = `[${flattenToOneLine(containerId.slice(0, 12)).replace(/[\]\s]/g, "_")}] `;
+	if (opts.prefix !== void 0 || process.env["CDKL_PREFIX_CONTAINER_OUTPUT"] === "1") {
+		const tag = opts.prefix ?? `[${flattenToOneLine(containerId.slice(0, 12)).replace(/[\]\s]/g, "_")}] `;
 		const stdoutRelay = createPrefixedLineRelay(tag, process.stdout);
 		const stderrRelay = createPrefixedLineRelay(tag, process.stderr);
 		proc.stdout?.on("data", (chunk) => stdoutRelay.push(chunk));
@@ -6666,7 +6669,7 @@ async function removeContainer(containerId) {
 	if (!containerId) return;
 	const logger = getLogger().child("docker");
 	try {
-		await execFileAsync$6(getDockerCmd(), [
+		await execFileAsync$7(getDockerCmd(), [
 			"rm",
 			"-f",
 			containerId
@@ -6680,7 +6683,7 @@ async function removeContainer(containerId) {
 async function ensureDockerAvailable() {
 	const cmd = getDockerCmd();
 	try {
-		await execFileAsync$6(cmd, [
+		await execFileAsync$7(cmd, [
 			"version",
 			"--format",
 			"{{.Server.Version}}"
@@ -7213,14 +7216,14 @@ async function handleConnectionsRequest(opts) {
 	const { req, res, registry } = opts;
 	const parsed = parseConnectionsPath(req.url ?? "");
 	if (!parsed) {
-		writeJson(res, 404, { message: "Not Found" });
+		writeJson$1(res, 404, { message: "Not Found" });
 		return;
 	}
 	const { connectionId } = parsed;
 	const entry = registry.get(connectionId);
 	const method = (req.method ?? "").toUpperCase();
 	if (!entry) {
-		writeJson(res, 410, { message: "GoneException" });
+		writeJson$1(res, 410, { message: "GoneException" });
 		return;
 	}
 	if (method === "POST") {
@@ -7228,17 +7231,17 @@ async function handleConnectionsRequest(opts) {
 		try {
 			body = await readRequestBody$1(req);
 		} catch (err) {
-			writeJson(res, 500, { message: `Failed to read request body: ${err instanceof Error ? err.message : String(err)}` });
+			writeJson$1(res, 500, { message: `Failed to read request body: ${err instanceof Error ? err.message : String(err)}` });
 			return;
 		}
 		if (entry.socket.readyState !== entry.socket.OPEN) {
-			writeJson(res, 410, { message: "GoneException" });
+			writeJson$1(res, 410, { message: "GoneException" });
 			return;
 		}
 		try {
 			entry.socket.send(body);
 		} catch (err) {
-			writeJson(res, 500, { message: `Failed to deliver to socket: ${err instanceof Error ? err.message : String(err)}` });
+			writeJson$1(res, 500, { message: `Failed to deliver to socket: ${err instanceof Error ? err.message : String(err)}` });
 			return;
 		}
 		res.writeHead(200);
@@ -7249,7 +7252,7 @@ async function handleConnectionsRequest(opts) {
 		try {
 			entry.socket.close(1e3, "DeleteConnection");
 		} catch (err) {
-			writeJson(res, 500, { message: `Failed to close socket: ${err instanceof Error ? err.message : String(err)}` });
+			writeJson$1(res, 500, { message: `Failed to close socket: ${err instanceof Error ? err.message : String(err)}` });
 			return;
 		}
 		res.writeHead(204);
@@ -7257,7 +7260,7 @@ async function handleConnectionsRequest(opts) {
 		return;
 	}
 	if (method === "GET") {
-		writeJson(res, 200, {
+		writeJson$1(res, 200, {
 			ConnectedAt: new Date(entry.connectedAt).toISOString(),
 			Identity: { SourceIp: "127.0.0.1" },
 			LastActiveAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -7265,9 +7268,9 @@ async function handleConnectionsRequest(opts) {
 		return;
 	}
 	res.setHeader("Allow", "POST, GET, DELETE");
-	writeJson(res, 405, { message: "MethodNotAllowedException" });
+	writeJson$1(res, 405, { message: "MethodNotAllowedException" });
 }
-function writeJson(res, status, body) {
+function writeJson$1(res, status, body) {
 	const json = JSON.stringify(body);
 	res.writeHead(status, {
 		"Content-Type": "application/json",
@@ -11049,7 +11052,7 @@ async function startApiServer(opts) {
 	const logger = getLogger().child("start-api");
 	let currentState = opts.state;
 	const requestHandler = (req, res) => {
-		handleRequest$2(req, res, currentState, opts).catch((err) => {
+		handleRequest$3(req, res, currentState, opts).catch((err) => {
 			logger.error(`Unhandled request error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
 			if (!res.headersSent) writeError$1(res, 502);
 		});
@@ -11101,7 +11104,7 @@ async function startApiServer(opts) {
 		getServerState: () => currentState
 	};
 }
-async function handleRequest$2(req, res, state, opts) {
+async function handleRequest$3(req, res, state, opts) {
 	const logger = getLogger().child("start-api");
 	if (opts.preDispatch) try {
 		if (await opts.preDispatch(req, res)) return;
@@ -16030,7 +16033,7 @@ async function runAgentCoreWatchLoop(args) {
 		}
 	}
 }
-const execFileAsync$5 = promisify(execFile);
+const execFileAsync$6 = promisify(execFile);
 function describeExecError(err) {
 	if (!(err instanceof Error)) return String(err);
 	const stderr = err.stderr;
@@ -16042,7 +16045,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	const dockerCmd = getDockerCmd();
 	let workdir;
 	try {
-		const { stdout } = await execFileAsync$5(dockerCmd, [
+		const { stdout } = await execFileAsync$6(dockerCmd, [
 			"inspect",
 			"--format",
 			"{{.Config.WorkingDir}}",
@@ -16055,7 +16058,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	const workdirDest = workdir.endsWith("/") ? workdir : `${workdir}/`;
 	logger.info(`Soft-reload: docker cp ${flattenToOneLine(newAssetSourceDir)} -> ${containerId}:${workdirDest}; restart.`);
 	try {
-		await execFileAsync$5(dockerCmd, [
+		await execFileAsync$6(dockerCmd, [
 			"cp",
 			`${newAssetSourceDir}/.`,
 			`${containerId}:${workdirDest}`
@@ -16064,7 +16067,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 		throw new CdkLocalError(`softReloadAgentContainer: docker cp into '${containerId}:${workdir}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_CP_FAILED");
 	}
 	try {
-		await execFileAsync$5(dockerCmd, ["restart", containerId]);
+		await execFileAsync$6(dockerCmd, ["restart", containerId]);
 	} catch (err) {
 		throw new CdkLocalError(`softReloadAgentContainer: docker restart of '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_RESTART_FAILED");
 	}
@@ -16240,7 +16243,7 @@ function writePrefixedLines(prefix, buffer, out) {
 
 //#endregion
 //#region src/local/ecs-network.ts
-const execFileAsync$4 = promisify(execFile);
+const execFileAsync$5 = promisify(execFile);
 const METADATA_ENDPOINT_IMAGE = "amazon/amazon-ecs-local-container-endpoints:latest-amd64";
 const METADATA_ENDPOINT_IP = "169.254.170.2";
 const DEFAULT_METADATA_ENDPOINT_SUBNET = "169.254.170.0/24";
@@ -16276,7 +16279,7 @@ async function sweepOrphanedSvcNetworks(prefix) {
 	const filter = `${prefix}-svc-`;
 	let names;
 	try {
-		const { stdout } = await execFileAsync$4(getDockerCmd(), [
+		const { stdout } = await execFileAsync$5(getDockerCmd(), [
 			"network",
 			"ls",
 			"--filter",
@@ -16294,7 +16297,7 @@ async function sweepOrphanedSvcNetworks(prefix) {
 	for (const name of names) {
 		let attached;
 		try {
-			const { stdout } = await execFileAsync$4(getDockerCmd(), [
+			const { stdout } = await execFileAsync$5(getDockerCmd(), [
 				"network",
 				"inspect",
 				name,
@@ -16322,7 +16325,7 @@ async function createNetworkAndSidecar(args) {
 	await pullImage(METADATA_ENDPOINT_IMAGE, skipPull);
 	logger.info(`Creating docker network ${networkName} (subnet ${cidr})...`);
 	try {
-		await execFileAsync$4(getDockerCmd(), [
+		await execFileAsync$5(getDockerCmd(), [
 			"network",
 			"create",
 			"--driver",
@@ -16359,7 +16362,7 @@ async function createNetworkAndSidecar(args) {
 	warnFinchArgvExposure(Object.keys(sidecarPassthroughEnv));
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
 	try {
-		const { stdout } = await execFileAsync$4(getDockerCmd(), sidecarArgs, {
+		const { stdout } = await execFileAsync$5(getDockerCmd(), sidecarArgs, {
 			maxBuffer: 10 * 1024 * 1024,
 			...execEnvForSecrets(sidecarPassthroughEnv)
 		});
@@ -16407,7 +16410,7 @@ async function destroyNetworkOnly(networkName) {
 	if (!networkName) return;
 	const logger = getLogger().child("ecs-network");
 	try {
-		await execFileAsync$4(getDockerCmd(), [
+		await execFileAsync$5(getDockerCmd(), [
 			"network",
 			"rm",
 			networkName
@@ -16521,7 +16524,7 @@ async function resolveSsm(entry, shape, client) {
 
 //#endregion
 //#region src/local/ecs-task-runner.ts
-const execFileAsync$3 = promisify(execFile);
+const execFileAsync$4 = promisify(execFile);
 var EcsTaskRunnerError = class EcsTaskRunnerError extends Error {
 	constructor(message) {
 		super(message);
@@ -16564,7 +16567,7 @@ async function cleanupEcsRun(state, options) {
 	if (state.network && !state.network.ownedByCaller) await destroyTaskNetwork(state.network);
 	state.network = void 0;
 	for (const v of state.dockerVolumeNames) try {
-		await execFileAsync$3(getDockerCmd(), [
+		await execFileAsync$4(getDockerCmd(), [
 			"volume",
 			"rm",
 			v
@@ -16715,7 +16718,7 @@ async function runEcsTask(task, options, state) {
 		let id;
 		warnFinchArgvExposure(Object.keys(sensitiveEnv));
 		try {
-			const { stdout } = await execFileAsync$3(getDockerCmd(), args, {
+			const { stdout } = await execFileAsync$4(getDockerCmd(), args, {
 				maxBuffer: 10 * 1024 * 1024,
 				...execEnvForSecrets(sensitiveEnv)
 			});
@@ -16807,7 +16810,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 	let lastStatus = "";
 	while (Date.now() < deadline) {
 		try {
-			const { stdout } = await execFileAsync$3(getDockerCmd(), [
+			const { stdout } = await execFileAsync$4(getDockerCmd(), [
 				"inspect",
 				"--format",
 				"{{.State.Health.Status}}",
@@ -16830,7 +16833,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 }
 async function waitForContainerExit(containerId) {
 	try {
-		const { stdout } = await execFileAsync$3(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
+		const { stdout } = await execFileAsync$4(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 		const code = Number.parseInt(stdout.trim(), 10);
 		return Number.isFinite(code) ? code : 1;
 	} catch (err) {
@@ -16840,7 +16843,7 @@ async function waitForContainerExit(containerId) {
 }
 async function stopContainer(containerId, graceSeconds) {
 	try {
-		await execFileAsync$3(getDockerCmd(), [
+		await execFileAsync$4(getDockerCmd(), [
 			"stop",
 			"-t",
 			String(graceSeconds),
@@ -16935,7 +16938,7 @@ async function realizeDockerVolumes(volumes, state) {
 		const dockerVolumeName = `${getEmbedConfig().resourceNamePrefix}-${v.name}-${randHex(4)}`;
 		args.push(dockerVolumeName);
 		try {
-			await execFileAsync$3(getDockerCmd(), args);
+			await execFileAsync$4(getDockerCmd(), args);
 			state.dockerVolumeNames.push(dockerVolumeName);
 			logger.debug(`Created docker volume ${displayIdent(dockerVolumeName)} for task volume ${displayIdent(v.name)}`);
 		} catch (err) {
@@ -17335,11 +17338,11 @@ function notFoundError$1(target, stack, resources, parsed) {
 
 //#endregion
 //#region src/local/docker-inspect.ts
-const execFileAsync$2 = promisify(execFile);
+const execFileAsync$3 = promisify(execFile);
 async function getContainerNetworkIp(containerId, networkName) {
 	const format = `{{with index .NetworkSettings.Networks "${networkName}"}}{{.IPAddress}}{{end}}`;
 	try {
-		const { stdout } = await execFileAsync$2(getDockerCmd(), [
+		const { stdout } = await execFileAsync$3(getDockerCmd(), [
 			"inspect",
 			"--format",
 			format,
@@ -17355,7 +17358,7 @@ async function getContainerNetworkIp(containerId, networkName) {
 async function getPublishedHostPort(containerId, containerPort, protocol = "tcp") {
 	const format = `{{with index .NetworkSettings.Ports "${`${containerPort}/${protocol}`}"}}{{with index . 0}}{{.HostPort}}{{end}}{{end}}`;
 	try {
-		const { stdout } = await execFileAsync$2(getDockerCmd(), [
+		const { stdout } = await execFileAsync$3(getDockerCmd(), [
 			"inspect",
 			"--format",
 			format,
@@ -18653,7 +18656,7 @@ function buildHeaderMaps(headers) {
 		multi
 	};
 }
-function firstHeader(headers, name) {
+function firstHeader$1(headers, name) {
 	const lower = name.toLowerCase();
 	for (const [k, v] of Object.entries(headers)) if (k.toLowerCase() === lower) return v[0];
 }
@@ -18661,8 +18664,8 @@ function buildAlbLambdaEvent(req, opts) {
 	const { path, rawQuery } = splitRawUrl(req.rawUrl);
 	const query = parseQuery(rawQuery);
 	const headerMaps = buildHeaderMaps(req.headers);
-	const contentEncoding = firstHeader(req.headers, "content-encoding");
-	const contentType = firstHeader(req.headers, "content-type") ?? "";
+	const contentEncoding = firstHeader$1(req.headers, "content-encoding");
+	const contentType = firstHeader$1(req.headers, "content-type") ?? "";
 	const isBase64Encoded = req.body.length > 0 && (contentEncoding !== void 0 ? true : !isTextualContentType(contentType));
 	const body = isBase64Encoded ? req.body.toString("base64") : req.body.toString("utf-8");
 	const event = {
@@ -18765,7 +18768,7 @@ async function startFrontDoorServer(opts) {
 	const scheme = opts.tls ? "https" : "http";
 	server.on("connection", (socket) => socket.setNoDelay(true));
 	server.on("upgrade", (req, clientSocket, head) => {
-		handleUpgrade(req, clientSocket, head, effectiveOpts).catch((err) => {
+		handleUpgrade$1(req, clientSocket, head, effectiveOpts).catch((err) => {
 			logger.debug(`front-door upgrade error: ${err instanceof Error ? err.message : String(err)}`);
 			if (!clientSocket.destroyed) clientSocket.destroy();
 		});
@@ -19109,7 +19112,7 @@ function writeError(res, statusCode, message) {
 	res.writeHead(statusCode, { "content-type": "text/plain; charset=utf-8" });
 	res.end(`${message}\n`);
 }
-function handleUpgrade(req, clientSocket, head, opts) {
+function handleUpgrade$1(req, clientSocket, head, opts) {
 	clientSocket.setNoDelay?.(true);
 	if (!opts.route) {
 		writeRawHttpError(clientSocket, 404, "Not Found");
@@ -19296,7 +19299,9 @@ function sanitizeRawHeaderValue(value) {
 const STATUS_TEXT$1 = {
 	301: "Moved Permanently",
 	302: "Found",
+	400: "Bad Request",
 	401: "Unauthorized",
+	403: "Forbidden",
 	404: "Not Found",
 	502: "Bad Gateway",
 	503: "Service Unavailable"
@@ -19550,7 +19555,7 @@ function matchBitPrefix(a, b, prefixLength) {
 
 //#endregion
 //#region src/local/front-door-tls.ts
-const execFileAsync$1 = promisify(execFile);
+const execFileAsync$2 = promisify(execFile);
 async function resolveFrontDoorTlsMaterials(opts) {
 	const hasCert = opts.certPath !== void 0 && opts.certPath !== "";
 	const hasKey = opts.keyPath !== void 0 && opts.keyPath !== "";
@@ -19640,7 +19645,7 @@ function readCertNotAfter(certPath) {
 	}
 }
 async function runOpenssl(args) {
-	await execFileAsync$1("openssl", args, { timeout: 3e4 });
+	await execFileAsync$2("openssl", args, { timeout: 3e4 });
 }
 function readPemOrThrow(path, flagName) {
 	try {
@@ -21843,7 +21848,7 @@ function resolveAlbFrontDoor(stack, albLogicalId) {
 		if (resource.Type !== LISTENER_TYPE) continue;
 		const props = resource.Properties ?? {};
 		if (refOf(props["LoadBalancerArn"]) !== albLogicalId) continue;
-		const port = parsePort$2(props["Port"]);
+		const port = parsePort$3(props["Port"]);
 		if (port === void 0) continue;
 		const protocol = typeof props["Protocol"] === "string" ? props["Protocol"] : "HTTP";
 		if (protocol !== "HTTP" && protocol !== "HTTPS") {
@@ -22208,7 +22213,7 @@ function refOf(raw) {
 		if (typeof ref === "string" && ref.length > 0) return ref;
 	}
 }
-function parsePort$2(raw) {
+function parsePort$3(raw) {
 	if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1 && raw <= 65535) return raw;
 	if (typeof raw === "string" && /^\d+$/.test(raw)) {
 		const n = parseInt(raw, 10);
@@ -22216,7 +22221,7 @@ function parsePort$2(raw) {
 	}
 }
 function parseContainerPort(raw) {
-	return parsePort$2(raw);
+	return parsePort$3(raw);
 }
 function parseWeight(raw) {
 	if (typeof raw === "number" && Number.isFinite(raw)) return raw < 0 ? 0 : raw;
@@ -23554,7 +23559,7 @@ async function startCloudFrontServer(options) {
 	const s3OriginReaders = options.s3OriginReaders ?? /* @__PURE__ */ new Map();
 	const state = { distribution: options.distribution };
 	const handler = (req, res) => {
-		handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger).catch((err) => {
+		handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger).catch((err) => {
 			logger.warn(`Request handling failed: ${err instanceof Error ? err.message : String(err)}`);
 			if (!res.headersSent) {
 				res.statusCode = 500;
@@ -23583,7 +23588,7 @@ async function startCloudFrontServer(options) {
 		}
 	};
 }
-async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger) {
+async function handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger) {
 	const distribution = state.distribution;
 	const rawUrl = req.url ?? "/";
 	const queryIdx = rawUrl.indexOf("?");
@@ -24892,7 +24897,7 @@ function readAuthorizationHeader(headers) {
 
 //#endregion
 //#region src/cli/commands/local-start-agentcore.ts
-function parsePort$1(raw) {
+function parsePort$2(raw) {
 	const n = Number(raw);
 	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
 	return n;
@@ -25220,7 +25225,7 @@ function createLocalStartAgentCoreCommand(opts = {}) {
 	return cmd;
 }
 function addStartAgentCoreSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort$1)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--watch", "Re-synth + reload the warm container in place on a CDK source change, keeping the serve up. A per-firing classifier picks rebuild (boot a fresh container, re-point the serve) vs soft-reload (docker cp + docker restart the same container) — the same pattern as start-service / invoke-agentcore --ws --watch.")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort$2)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--watch", "Re-synth + reload the warm container in place on a CDK source change, keeping the serve up. A per-firing classifier picks rebuild (boot a fresh container, re-point the serve) vs soft-reload (docker cp + docker restart the same container) — the same pattern as start-service / invoke-agentcore --ws --watch.")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
 //#endregion
@@ -25399,17 +25404,17 @@ function describeRevisions(revisions, stack) {
 const SUPPORTED_CODE_CONFIG_KEYS = ["S3Object"];
 function parseWebFunctionBuildConfig(revisionLogicalId, buildConfig) {
 	const subject = `Web function revision ${displayIdent(revisionLogicalId)}`;
-	const build = asObject$1(buildConfig);
-	const runtime = asObject$1(build?.["RuntimeConfig"])?.["Runtime"];
+	const build = asObject$2(buildConfig);
+	const runtime = asObject$2(build?.["RuntimeConfig"])?.["Runtime"];
 	if (typeof runtime !== "string" || runtime.length === 0) throw new CdkLocalError(`${subject} has no literal BuildConfig.RuntimeConfig.Runtime.`, "LOCAL_START_WEB_FUNCTION_NO_RUNTIME");
-	const codeConfig = asObject$1(build?.["CodeConfig"]);
+	const codeConfig = asObject$2(build?.["CodeConfig"]);
 	if (!codeConfig) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
 	const unknownKeys = Object.keys(codeConfig).filter((k) => !SUPPORTED_CODE_CONFIG_KEYS.includes(k));
 	if (unknownKeys.length > 0) throw new CdkLocalError(`${subject} uses BuildConfig.CodeConfig.${unknownKeys.map((k) => displayIdent(k)).join(", ")}, which ${getEmbedConfig().cliName} start-web-function does not support yet. Supported: ${SUPPORTED_CODE_CONFIG_KEYS.join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_CODE_CONFIG");
-	const s3 = asObject$1(codeConfig["S3Object"]);
+	const s3 = asObject$2(codeConfig["S3Object"]);
 	if (!s3) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig.S3Object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
 	const key = s3["Key"];
-	if (typeof key !== "string" || key.length === 0) throw new CdkLocalError(`${subject} has a CodeConfig.S3Object.Key that is not a literal string (${describeValue(key)}). The code must come from a CDK asset in this app (for example an s3assets.Asset passing asset.s3BucketName / asset.s3ObjectKey), whose key synthesizes as a literal.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_NOT_LITERAL");
+	if (typeof key !== "string" || key.length === 0) throw new CdkLocalError(`${subject} has a CodeConfig.S3Object.Key that is not a literal string (${describeValue$1(key)}). The code must come from a CDK asset in this app (for example an s3assets.Asset passing asset.s3BucketName / asset.s3ObjectKey), whose key synthesizes as a literal.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_NOT_LITERAL");
 	const versionId = s3["VersionId"];
 	return {
 		runtime,
@@ -25434,7 +25439,7 @@ function findFileAssetForObjectKey(manifest, key) {
 }
 async function resolveWebFunctionArtifact(stack, revisionLogicalId, code, loader = new AssetManifestLoader()) {
 	const subject = `Web function revision ${displayUntrustedValue(revisionLogicalId)} code bundle`;
-	const notFound = () => new CdkLocalError(`${subject} (S3Object bucket ${describeValue(code.s3Object.bucket)}, key ${displayUntrustedValue(code.s3Object.key)}) matches no file asset in this app's cdk.out. ${getEmbedConfig().cliName} start-web-function runs code that comes from a CDK asset in this app (for example an s3assets.Asset of a directory); it does not download deployed code. Re-synthesize the app, or point the revision at an asset.`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NOT_FOUND");
+	const notFound = () => new CdkLocalError(`${subject} (S3Object bucket ${describeValue$1(code.s3Object.bucket)}, key ${displayUntrustedValue(code.s3Object.key)}) matches no file asset in this app's cdk.out. ${getEmbedConfig().cliName} start-web-function runs code that comes from a CDK asset in this app (for example an s3assets.Asset of a directory); it does not download deployed code. Re-synthesize the app, or point the revision at an asset.`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NOT_FOUND");
 	const manifestPath = stack.assetManifestPath;
 	if (!manifestPath) throw notFound();
 	const manifestDir = dirname$1(manifestPath);
@@ -25473,10 +25478,10 @@ function disposeWebFunctionArtifact(artifact) {
 		});
 	} catch {}
 }
-function asObject$1(value) {
+function asObject$2(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function describeValue(value) {
+function describeValue$1(value) {
 	if (typeof value === "string") return displayUntrustedValue(value);
 	let json;
 	try {
@@ -25531,12 +25536,12 @@ const WEB_FUNCTION_HTTP_ENDPOINT_ENV = "AWS_LAMBDA_HTTP_ENDPOINT";
 const APPLICATION_MANAGED_AUTH = "ApplicationManaged";
 const HOME_REGION_ENDPOINT = "HomeRegion";
 function readWebFunctionServiceConfig(revision) {
-	const sc = asObject(revision.Properties?.["ServiceConfig"]) ?? {};
+	const sc = asObject$1(revision.Properties?.["ServiceConfig"]) ?? {};
 	const envRaw = sc["EnvironmentVariables"];
-	const envObj = asObject(envRaw);
+	const envObj = asObject$1(envRaw);
 	const envKeys = envObj ? Object.keys(envObj) : [];
 	const env = envKeys.length === 1 && (envKeys[0] === "Ref" || envKeys[0].startsWith("Fn::")) ? void 0 : envObj;
-	const logGroup = asObject(asObject(sc["TelemetryConfig"])?.["LoggingConfig"])?.["LogGroup"];
+	const logGroup = asObject$1(asObject$1(sc["TelemetryConfig"])?.["LoggingConfig"])?.["LogGroup"];
 	return {
 		environmentVariables: env,
 		environmentUnreadable: envRaw !== void 0 && env === void 0,
@@ -25602,13 +25607,13 @@ function webFunctionFidelityWarnings(resolved, config) {
 	}
 	return out;
 }
-function asObject(value) {
+function asObject$1(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 
 //#endregion
 //#region src/local/web-function-runner.ts
-const execFileAsync = promisify$1(execFile$1);
+const execFileAsync$1 = promisify$1(execFile$1);
 const WEB_FUNCTION_CONTAINER_PORT = 8080;
 const READY_FAILURE_LOG_LINES = 20;
 const MAX_PROBE_TIMEOUT_MS = 1e4;
@@ -25750,7 +25755,7 @@ function probeHttp(host, port, timeoutMs) {
 }
 async function containerIsRunning(containerId) {
 	try {
-		const { stdout } = await execFileAsync(getDockerCmd(), [
+		const { stdout } = await execFileAsync$1(getDockerCmd(), [
 			"inspect",
 			"-f",
 			"{{.State.Running}}",
@@ -25802,12 +25807,12 @@ const defaultReadyDeps = {
 
 //#endregion
 //#region src/cli/commands/local-start-web-function.ts
-function parsePort(raw) {
+function parsePort$1(raw) {
 	const n = Number(raw);
 	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
 	return n;
 }
-function connectHost(host) {
+function connectHost$1(host) {
 	if (host === "0.0.0.0") return "127.0.0.1";
 	if (host === "::" || host === "[::]") return "::1";
 	return host;
@@ -25936,7 +25941,7 @@ async function localStartWebFunctionCommand(target, options, extraStateProviders
 		containerId = id;
 		stopLogs = streamLogs(id, { onOutput: (chunk) => recent.push(chunk) });
 		exitWatch = watchContainerExit(id);
-		const probeHost = connectHost(options.host);
+		const probeHost = connectHost$1(options.host);
 		await waitForWebFunctionReady({
 			containerId: id,
 			host: probeHost,
@@ -25974,7 +25979,1195 @@ function createLocalStartWebFunctionCommand(opts = {}) {
 	return cmd;
 }
 function addStartWebFunctionSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--revision <logicalId>", "Serve this WebFunctionRevision (logical ID) instead of the one the endpoint weights pick.")).addOption(new Option("--port <n>", "Local port to serve on. Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Address to publish the port on.").default("127.0.0.1")).addOption(new Option("--platform <platform>", "docker --platform for the server container. Defaults to the runtime's cloud architecture (linux/arm64 for nodejs24.x).").choices(["linux/amd64", "linux/arm64"])).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"RevisionLogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--no-pull", "Skip docker pull of the runtime base image (use the cached image)")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the server to answer HTTP. Default 60000.").default(6e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the revision's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the revision's ServiceConfig.ExecutionRoleArn: a literal ARN as written, or the Fn::GetAtt / Ref CDK synthesizes resolved against --from-cfn-stack deployed state; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+	return cmd.addOption(new Option("--revision <logicalId>", "Serve this WebFunctionRevision (logical ID) instead of the one the endpoint weights pick.")).addOption(new Option("--port <n>", "Local port to serve on. Default 0 (OS-assigned).").default(0).argParser(parsePort$1)).addOption(new Option("--host <ip>", "Address to publish the port on.").default("127.0.0.1")).addOption(new Option("--platform <platform>", "docker --platform for the server container. Defaults to the runtime's cloud architecture (linux/arm64 for nodejs24.x).").choices(["linux/amd64", "linux/arm64"])).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"RevisionLogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--no-pull", "Skip docker pull of the runtime base image (use the cached image)")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the server to answer HTTP. Default 60000.").default(6e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the revision's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the revision's ServiceConfig.ExecutionRoleArn: a literal ARN as written, or the Fn::GetAtt / Ref CDK synthesizes resolved against --from-cfn-stack deployed state; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+}
+
+//#endregion
+//#region src/local/microvm-image.ts
+const MICROVM_IMAGE_TYPE = "AWS::Lambda::MicrovmImage";
+const MICROVM_DEFAULT_INGRESS_PORT = 8080;
+var MicrovmResolutionError = class MicrovmResolutionError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MicrovmResolutionError";
+		Object.setPrototypeOf(this, MicrovmResolutionError.prototype);
+	}
+};
+function resolveMicrovmImageTarget(target, stacks) {
+	if (stacks.length === 0) throw new MicrovmResolutionError("No stacks found in the synthesized assembly.");
+	const parsed = parseTarget(target);
+	const selection = selectTargetStack(parsed, target, stacks);
+	let stack;
+	switch (selection.kind) {
+		case "found":
+			stack = selection.stack;
+			break;
+		case "no-prefix": throw new MicrovmResolutionError(`Multiple stacks in app, target ${displayIdent(parsed.pathOrId)} is missing a stack prefix. Use StackName:<logicalId> or StackName/... (path form). Available stacks: ${describeStacks(stacks)}.`);
+		case "not-found": throw new MicrovmResolutionError(`Stack ${displayStackName(selection.pattern)} not found. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new MicrovmResolutionError(`Stack pattern ${displayStackName(selection.pattern)} matched ${selection.matched.length} stacks: ${describeStacks(selection.matched)}. Use a more specific pattern, or the stack's display path.`);
+	}
+	const resources = stack.template.Resources ?? {};
+	const images = Object.keys(resources).filter((id) => resources[id]?.Type === MICROVM_IMAGE_TYPE);
+	const notFound = () => new MicrovmResolutionError(`Target ${displayStackName(target)} not found. ` + (images.length > 0 ? `MicroVM images in ${displayStackName(stack.stackName)}: ${images.map((id) => displayIdent(id)).join(", ")}.` : `No ${MICROVM_IMAGE_TYPE} resources found in ${displayStackName(stack.stackName)}.`));
+	if (parsed.isPath) {
+		const matches = resolveCdkPathToLogicalIds(parsed.pathOrId, buildCdkPathIndex(stack.template)).filter(({ logicalId }) => resources[logicalId]?.Type === MICROVM_IMAGE_TYPE);
+		if (matches.length === 1) {
+			const id = matches[0].logicalId;
+			return {
+				stack,
+				logicalId: id,
+				resource: resources[id]
+			};
+		}
+		if (matches.length > 1) throw new MicrovmResolutionError(`Target ${displayStackName(target)} matches ${matches.length} ${MICROVM_IMAGE_TYPE} resources: ${matches.map((m) => displayIdent(m.logicalId)).join(", ")}. Refine the path or use the StackName:<logicalId> form.`);
+		throw notFound();
+	}
+	const resource = resources[parsed.pathOrId];
+	if (!resource) throw notFound();
+	if (resource.Type !== "AWS::Lambda::MicrovmImage") throw new MicrovmResolutionError(`Resource ${displayIdent(parsed.pathOrId)} in ${displayStackName(stack.stackName)} is ${displayIdent(resource.Type)}, not a MicroVM image. ${getEmbedConfig().cliName} start-microvm runs ${MICROVM_IMAGE_TYPE} targets.`);
+	return {
+		stack,
+		logicalId: parsed.pathOrId,
+		resource
+	};
+}
+const HOOK_KEYS = {
+	ready: {
+		group: "MicrovmImageHooks",
+		key: "Ready"
+	},
+	validate: {
+		group: "MicrovmImageHooks",
+		key: "Validate"
+	},
+	run: {
+		group: "MicrovmHooks",
+		key: "Run"
+	},
+	suspend: {
+		group: "MicrovmHooks",
+		key: "Suspend"
+	},
+	resume: {
+		group: "MicrovmHooks",
+		key: "Resume"
+	},
+	terminate: {
+		group: "MicrovmHooks",
+		key: "Terminate"
+	}
+};
+function readMicrovmImageConfig(logicalId, resource) {
+	const subject = `MicroVM image ${displayIdent(logicalId)}`;
+	const props = resource.Properties ?? {};
+	const name = typeof props["Name"] === "string" && props["Name"].length > 0 ? props["Name"] : logicalId;
+	const uri = asObject(props["CodeArtifact"])?.["Uri"];
+	const codeKey = s3KeyOfUri(uri);
+	if (codeKey === void 0) throw new CdkLocalError(`${subject} has a CodeArtifact.Uri whose object key is not a literal (${describeValue(uri)}). The code must come from a CDK asset in this app (for example an s3assets.Asset of a directory holding the Dockerfile, passing asset.s3ObjectUrl), whose key synthesizes as a literal.`, "LOCAL_START_MICROVM_CODE_URI_NOT_LITERAL");
+	const cpu = props["CpuConfigurations"];
+	const archRaw = Array.isArray(cpu) ? asObject(cpu[0])?.["Architecture"] : void 0;
+	const architecture = typeof archRaw === "string" ? normalizeArchitecture(archRaw) : void 0;
+	const environment = {};
+	const envRaw = props["EnvironmentVariables"];
+	const unemulated = [];
+	if (Array.isArray(envRaw)) for (const entry of envRaw) {
+		const e = asObject(entry);
+		if (e && typeof e["Key"] === "string") environment[e["Key"]] = e["Value"];
+	}
+	else if (envRaw !== void 0) unemulated.push("EnvironmentVariables is an intrinsic rather than a list, so none of its variables reach the container (supply them with --env-vars)");
+	const hooksObj = asObject(props["Hooks"]);
+	const hooks = {};
+	for (const [hook, where] of Object.entries(HOOK_KEYS)) {
+		const group = asObject(hooksObj?.[where.group]);
+		const value = group?.[where.key];
+		if (value === void 0 || value === "DISABLED") continue;
+		if (value !== "ENABLED") throw new CdkLocalError(`${subject} has Hooks.${where.group}.${where.key} ${describeValue(value)}; only the literal ENABLED or DISABLED can run locally.`, "LOCAL_START_MICROVM_HOOK_VALUE");
+		const timeout = group?.[`${where.key}TimeoutInSeconds`];
+		hooks[hook] = { timeoutSeconds: typeof timeout === "number" && timeout > 0 ? timeout : void 0 };
+	}
+	const port = hooksObj?.["Port"];
+	const hooksPort = typeof port === "number" && Number.isInteger(port) && port > 0 && port < 65536 ? port : void 0;
+	if (Object.keys(hooks).length > 0 && hooksPort === void 0) throw new CdkLocalError(`${subject} enables lifecycle hooks (${Object.keys(hooks).join(", ")}) but has no literal Hooks.Port. Lambda requires the hooks port whenever a hook is configured; set Hooks.Port to the port the application serves /aws/lambda-microvms/runtime/v1/ on.`, "LOCAL_START_MICROVM_NO_HOOKS_PORT");
+	const present = (key) => {
+		const v = props[key];
+		if (v === void 0 || v === null) return false;
+		if (Array.isArray(v)) return v.length > 0;
+		if (typeof v === "object") return Object.keys(v).length > 0;
+		return true;
+	};
+	if (present("EgressNetworkConnectors")) unemulated.push("EgressNetworkConnectors (the container uses Docker's default network egress)");
+	if (present("AdditionalOsCapabilities")) unemulated.push("AdditionalOsCapabilities (the container runs with Docker's default capabilities)");
+	if (present("Resources")) unemulated.push("Resources sizing (the container gets no memory limit)");
+	if (present("BaseImageVersion")) unemulated.push("BaseImageVersion (the local build uses whatever the Dockerfile names)");
+	if (present("Logging")) unemulated.push("Logging (container output is printed here instead of sent to CloudWatch Logs)");
+	return {
+		logicalId,
+		name,
+		codeKey,
+		architecture,
+		environment,
+		hooksPort,
+		hooks,
+		unemulated
+	};
+}
+function normalizeArchitecture(raw) {
+	const s = raw.toLowerCase().replace(/_/g, "");
+	if (s === "arm64") return "arm64";
+	if (s === "x8664") return "x86_64";
+}
+function s3KeyOfUri(value) {
+	const flat = flattenTemplateString(value);
+	if (flat === void 0) return void 0;
+	const m = /^s3:\/\/[^/]*\/(.+)$/.exec(flat);
+	if (!m) return void 0;
+	const key = m[1];
+	return key.includes("\0") || key.includes("${") ? void 0 : key;
+}
+function flattenTemplateString(value) {
+	if (typeof value === "string") return value;
+	const obj = asObject(value);
+	if (!obj) return void 0;
+	const join = obj["Fn::Join"];
+	if (Array.isArray(join) && typeof join[0] === "string" && Array.isArray(join[1])) return join[1].map((p) => flattenTemplateString(p) ?? "\0").join(join[0]);
+	const sub = obj["Fn::Sub"];
+	if (typeof sub === "string") return sub.replace(/\$\{[^}]*\}/g, "\0");
+	if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0].replace(/\$\{[^}]*\}/g, "\0");
+	return "\0";
+}
+async function resolveMicrovmCodeArtifact(stack, config, loader = new AssetManifestLoader()) {
+	const subject = `MicroVM image ${displayUntrustedValue(config.logicalId)} code artifact`;
+	const notFound = () => new CdkLocalError(`${subject} (key ${displayUntrustedValue(config.codeKey)}) matches no file asset in this app's cdk.out. ${getEmbedConfig().cliName} start-microvm builds code that comes from a CDK asset in this app (for example an s3assets.Asset of a directory holding the Dockerfile); it does not download deployed code. Re-synthesize the app, or point CodeArtifact.Uri at an asset.`, "LOCAL_START_MICROVM_CODE_ASSET_NOT_FOUND");
+	const manifestPath = stack.assetManifestPath;
+	if (!manifestPath) throw notFound();
+	const manifestDir = dirname$1(manifestPath);
+	const manifest = await loader.loadStackManifest(stack, manifestDir);
+	const match = manifest ? findFileAssetForObjectKey(manifest, config.codeKey) : void 0;
+	if (!match) throw notFound();
+	if (typeof match.asset.source.path !== "string" || match.asset.source.path.length === 0) throw new CdkLocalError(`${subject} matches file asset ${displayIdent(match.hash)}, which has no source.path (it is produced by source.executable at publish time), so there is no staged bundle in cdk.out to build. Give the image an asset of a directory or a .zip file.`, "LOCAL_START_MICROVM_CODE_ASSET_NO_PATH");
+	const sourcePath = resolveAssetSourcePath({
+		manifestDir,
+		value: match.asset.source.path,
+		assetOutdir: assetPathDirs(stack).assetOutdir,
+		absolute: "honour-warn",
+		field: "source.path",
+		subject,
+		action: "build it",
+		sink: "send that directory to docker build as the MicroVM image context",
+		wrapError: (message) => new CdkLocalError(message, "LOCAL_START_MICROVM_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	});
+	if (!existsSync$1(sourcePath)) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} does not exist. Re-synthesize the app and retry.`, "LOCAL_START_MICROVM_CODE_SOURCE_MISSING");
+	if (!statSync$1(sourcePath).isDirectory() && !sourcePath.endsWith(".zip")) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} is neither a directory nor a .zip archive, so it is not a code bundle.`, "LOCAL_START_MICROVM_CODE_SOURCE_NOT_BUNDLE");
+	const materialized = materializeAssetCodeDir(sourcePath);
+	const artifact = {
+		contextDir: materialized.dir,
+		...materialized.tmpDir !== void 0 && { tmpDir: materialized.tmpDir },
+		assetHash: match.hash
+	};
+	if (!existsSync$1(join$1(materialized.dir, "Dockerfile"))) {
+		disposeMicrovmCodeArtifact(artifact);
+		throw new CdkLocalError(`${subject} has no Dockerfile at its root. A MicroVM image's code artifact is a zip with a Dockerfile at the root plus the application files.`, "LOCAL_START_MICROVM_NO_DOCKERFILE");
+	}
+	return artifact;
+}
+function disposeMicrovmCodeArtifact(artifact) {
+	if (artifact?.tmpDir === void 0) return;
+	try {
+		if (existsSync$1(artifact.tmpDir)) rmSync$1(artifact.tmpDir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
+}
+function asObject(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function describeValue(value) {
+	if (typeof value === "string") return displayUntrustedValue(value);
+	let json;
+	try {
+		json = JSON.stringify(value);
+	} catch {
+		json = void 0;
+	}
+	return displayUntrustedValue(json ?? String(value));
+}
+
+//#endregion
+//#region src/local/microvm-hooks.ts
+const MICROVM_HOOK_PATH_PREFIX = "/aws/lambda-microvms/runtime/v1/";
+const MAX_RUN_HOOK_PAYLOAD_BYTES = 16 * 1024;
+const HOOK_RETRY_INTERVAL_MS = 250;
+var MicrovmHookError = class MicrovmHookError extends CdkLocalError {
+	constructor(message, code = "LOCAL_START_MICROVM_HOOK_FAILED") {
+		super(message, code);
+		this.name = "MicrovmHookError";
+		Object.setPrototypeOf(this, MicrovmHookError.prototype);
+	}
+};
+function generateMicrovmId() {
+	return `mvm-${randomUUID$1()}`;
+}
+function runHookBody(microvmId, runHookPayload) {
+	return JSON.stringify({
+		microvmId,
+		...runHookPayload !== void 0 && { runHookPayload }
+	});
+}
+async function pollBuildHook(hook, endpoint, timeoutMs, deps = defaultHookDeps) {
+	const path = `${MICROVM_HOOK_PATH_PREFIX}${hook}`;
+	const deadline = deps.now() + timeoutMs;
+	let attempts = 0;
+	let last = { kind: "refused" };
+	while (deps.now() < deadline) {
+		const remaining = Math.max(1, deadline - deps.now());
+		last = await deps.post(endpoint.host, endpoint.port, path, void 0, remaining);
+		attempts++;
+		if (last.kind === "status" && last.status === 200) return attempts;
+		if (last.kind === "timeout") throw new MicrovmHookError(`The /${hook} hook held the request open for ${timeoutMs}ms without answering. Answer 503 immediately while not ready (the cloud ends the image build when a held request reaches the timeout), or raise ${timeoutField(hook)}.`, "LOCAL_START_MICROVM_HOOK_TIMEOUT");
+		if (last.kind === "status" && last.status !== 503) throw new MicrovmHookError(`The /${hook} hook answered HTTP ${last.status}; it must answer 200 when done or 503 to be retried.${bodySuffix(last.body)}`);
+		if (deps.isAlive && attempts % 4 === 0 && !await deps.isAlive()) throw new MicrovmHookError(`The MicroVM container exited while cdk-local polled its /${hook} hook.`, "LOCAL_START_MICROVM_EXITED");
+		await deps.sleep(250);
+	}
+	const lastSeen = last.kind === "status" ? `its last answer was HTTP ${last.status}` : `nothing answered on ${formatAuthority(endpoint.host, endpoint.port)} (the hooks port)`;
+	throw new MicrovmHookError(`The /${hook} hook did not answer 200 within ${timeoutMs}ms (${timeoutField(hook)}); ${lastSeen}.`, "LOCAL_START_MICROVM_HOOK_TIMEOUT");
+}
+async function callRuntimeHook(hook, endpoint, timeoutMs, body, deps = defaultHookDeps) {
+	const path = `${MICROVM_HOOK_PATH_PREFIX}${hook}`;
+	const result = await deps.post(endpoint.host, endpoint.port, path, body, timeoutMs);
+	if (result.kind === "status" && result.status === 200) return;
+	if (result.kind === "timeout") throw new MicrovmHookError(`The /${hook} hook did not answer within ${timeoutMs}ms (${timeoutField(hook)}).`, "LOCAL_START_MICROVM_HOOK_TIMEOUT");
+	if (result.kind === "refused") throw new MicrovmHookError(`The /${hook} hook could not be reached: nothing answered on the hooks port (${formatAuthority(endpoint.host, endpoint.port)}).`);
+	throw new MicrovmHookError(`The /${hook} hook answered HTTP ${result.status}; it must answer 200.${bodySuffix(result.body)}`);
+}
+async function waitForAppAnswer(endpoint, timeoutMs, deps = {
+	probe: probeHttp,
+	sleep: defaultHookDeps.sleep,
+	now: defaultHookDeps.now
+}) {
+	const deadline = deps.now() + timeoutMs;
+	let attempt = 0;
+	while (deps.now() < deadline) {
+		const remaining = Math.max(1, deadline - deps.now());
+		const outcome = await deps.probe(endpoint.host, endpoint.port, Math.min(remaining, 1e4));
+		if (outcome === "answered") return;
+		attempt++;
+		if (deps.isAlive && attempt % 4 === 0 && !await deps.isAlive()) throw new MicrovmHookError("The MicroVM container exited before its application answered HTTP.", "LOCAL_START_MICROVM_EXITED");
+		if (outcome === "refused") await deps.sleep(250);
+	}
+	throw new MicrovmHookError(`The MicroVM application never answered HTTP on ${formatAuthority(endpoint.host, endpoint.port)} within ${timeoutMs}ms. With no /ready hook, cdk-local waits for the app to answer before driving the next hook; raise --timeout, or enable the /ready hook.`, "LOCAL_START_MICROVM_NOT_READY");
+}
+function timeoutField(hook) {
+	return `${hook.charAt(0).toUpperCase() + hook.slice(1)}TimeoutInSeconds, or --timeout when it is unset`;
+}
+function bodySuffix(body) {
+	const trimmed = body.trim();
+	if (trimmed.length === 0) return "";
+	return ` Body: ${displayToolOutput(trimmed.length > 500 ? `${trimmed.slice(0, 500)}...` : trimmed)}`;
+}
+function postHook(host, port, path, body, timeoutMs) {
+	return new Promise((resolvePost) => {
+		let settled = false;
+		const settle = (r) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			resolvePost(r);
+		};
+		const payload = body ?? "";
+		const req = request$2({
+			host,
+			port,
+			path,
+			method: "POST",
+			headers: {
+				connection: "close",
+				"content-length": Buffer.byteLength(payload),
+				...body !== void 0 && { "content-type": "application/json" }
+			}
+		}, (res) => {
+			const chunks = [];
+			let size = 0;
+			res.on("data", (c) => {
+				if (size < 64 * 1024) chunks.push(c);
+				size += c.length;
+			});
+			res.on("end", () => settle({
+				kind: "status",
+				status: res.statusCode ?? 0,
+				body: Buffer.concat(chunks).toString("utf-8")
+			}));
+			res.on("error", () => settle({
+				kind: "status",
+				status: res.statusCode ?? 0,
+				body: ""
+			}));
+		});
+		const timer = setTimeout(() => {
+			settle({ kind: "timeout" });
+			req.destroy();
+		}, timeoutMs);
+		req.on("error", () => settle({ kind: "refused" }));
+		req.end(payload);
+	});
+}
+const defaultHookDeps = {
+	post: postHook,
+	sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+	now: () => Date.now()
+};
+
+//#endregion
+//#region src/local/microvm-front-door.ts
+const MICROVM_CONTROL_PATH = "/_cdkl/microvm";
+const PROXY_PORT_HEADER = "x-aws-proxy-port";
+const MICROVM_WS_BASE_PROTOCOL = "lambda-microvms";
+const CLOSE_GRACE_MS = 1e3;
+function selectTargetPort(headers) {
+	const fromHeader = firstHeader(headers[PROXY_PORT_HEADER]);
+	const fromProtocol = fromHeader === void 0 ? subprotocols(headers).find((p) => p.startsWith(`${MICROVM_WS_BASE_PROTOCOL}.port.`)) : void 0;
+	const raw = fromHeader ?? (fromProtocol !== void 0 ? fromProtocol.slice(`${"lambda-microvms"}.port.`.length) : void 0);
+	if (raw === void 0) return {
+		ok: true,
+		port: MICROVM_DEFAULT_INGRESS_PORT
+	};
+	const trimmed = raw.trim();
+	const n = /^\d{1,5}$/.test(trimmed) ? Number(trimmed) : NaN;
+	if (!Number.isInteger(n) || n < 1 || n > 65535) return {
+		ok: false,
+		status: 400,
+		message: `Invalid ${fromHeader === void 0 ? "WebSocket subprotocol lambda-microvms.port." : "X-aws-proxy-port"} value '${trimmed.slice(0, 32)}': it must be a port number 1-65535.`
+	};
+	return {
+		ok: true,
+		port: n
+	};
+}
+function stripMicrovmProxyHeaders(headers) {
+	for (const name of Object.keys(headers)) if (name.toLowerCase().startsWith("x-aws-proxy-")) delete headers[name];
+	const offered = subprotocols(headers);
+	if (offered.length === 0) return false;
+	const kept = offered.filter((p) => !isMicrovmProtocol(p));
+	if (kept.length > 0) headers["sec-websocket-protocol"] = kept.join(", ");
+	else delete headers["sec-websocket-protocol"];
+	return offered.includes(MICROVM_WS_BASE_PROTOCOL);
+}
+function isMicrovmProtocol(p) {
+	return p === "lambda-microvms" || p.startsWith(`${"lambda-microvms"}.`);
+}
+function subprotocols(headers) {
+	const raw = headers["sec-websocket-protocol"];
+	const joined = Array.isArray(raw) ? raw.join(",") : raw;
+	if (!joined) return [];
+	return joined.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
+}
+function firstHeader(value) {
+	if (Array.isArray(value)) return value[0];
+	if (typeof value === "string") return value.split(",")[0];
+}
+function startMicrovmFrontDoor(opts) {
+	const logger = getLogger().child("microvm");
+	const bound = { port: opts.port };
+	const server = createServer((req, res) => {
+		handleRequest$1(req, res, opts, bound.port).catch((err) => {
+			logger.debug(`microvm front door error: ${err instanceof Error ? err.message : String(err)}`);
+			if (!res.headersSent) writeText(res, 502, "The MicroVM front door failed to forward the request.");
+			else res.destroy();
+		});
+	});
+	const upgraded = /* @__PURE__ */ new Set();
+	const track = (sock) => {
+		upgraded.add(sock);
+		sock.once("close", () => upgraded.delete(sock));
+	};
+	server.on("upgrade", (req, socket, head) => {
+		track(socket);
+		handleUpgrade(req, socket, head, opts, track).catch((err) => {
+			logger.debug(`microvm upgrade error: ${err instanceof Error ? err.message : String(err)}`);
+			writeRawHttpError(socket, 502, "The MicroVM front door failed to forward the upgrade.");
+		});
+	});
+	return new Promise((resolveStart, rejectStart) => {
+		server.once("error", rejectStart);
+		server.listen(opts.port, opts.host, () => {
+			server.off("error", rejectStart);
+			const address = server.address();
+			const port = typeof address === "object" && address !== null ? address.port : opts.port;
+			bound.port = port;
+			resolveStart({
+				port,
+				close: () => new Promise((resolveClose) => {
+					server.close(() => resolveClose());
+					server.closeIdleConnections();
+					for (const sock of upgraded) sock.end();
+					setTimeout(() => {
+						server.closeAllConnections();
+						for (const sock of upgraded) sock.destroy();
+					}, CLOSE_GRACE_MS).unref();
+				})
+			});
+		});
+	});
+}
+async function admit(opts) {
+	const id = opts.target.microvmId;
+	let state = opts.target.state();
+	if ((state === "suspended" || state === "suspending" || state === "resuming") && opts.autoResume) {
+		try {
+			await opts.target.resume();
+		} catch (err) {
+			const now = opts.target.state();
+			if (err instanceof MicrovmStateError && (now === "terminating" || now === "terminated")) return {
+				status: 503,
+				message: `MicroVM ${id} is ${now}.`
+			};
+			return {
+				status: 502,
+				message: `MicroVM ${id} could not be resumed for this request: ${err instanceof Error ? err.message : String(err)}`
+			};
+		}
+		state = opts.target.state();
+	}
+	if (state === "running") return void 0;
+	if (state === "terminating" || state === "terminated") return {
+		status: 503,
+		message: `MicroVM ${id} is ${state}.`
+	};
+	return {
+		status: 503,
+		message: `MicroVM ${id} is ${state}. Resume it with POST ${MICROVM_CONTROL_PATH}/resume (or start with --auto-resume to resume on the first request).`
+	};
+}
+async function handleRequest$1(req, res, opts, boundPort) {
+	const path = (req.url ?? "/").split("?")[0];
+	if (path === "/_cdkl/microvm" || path.startsWith(`${"/_cdkl/microvm"}/`)) {
+		const refusal = controlRequestRefusal(req.headers, opts.host, boundPort);
+		if (refusal !== void 0) {
+			req.resume();
+			writeText(res, 403, refusal);
+			return;
+		}
+		await handleControl(req, res, path, opts);
+		return;
+	}
+	const selection = selectTargetPort(req.headers);
+	if (!selection.ok) {
+		req.resume();
+		writeText(res, selection.status, selection.message);
+		return;
+	}
+	const upstream = opts.target.upstreamFor(selection.port);
+	if (!upstream) {
+		req.resume();
+		writeText(res, 403, notRoutableMessage(selection.port, opts.target));
+		return;
+	}
+	const refusal = await admit(opts);
+	if (refusal) {
+		req.resume();
+		writeText(res, refusal.status, refusal.message);
+		return;
+	}
+	const headers = { ...req.headers };
+	stripHopByHopHeaders(headers);
+	stripMicrovmProxyHeaders(headers);
+	await new Promise((resolveForward) => {
+		const proxyReq = request({
+			host: upstream.host,
+			port: upstream.port,
+			method: req.method,
+			path: req.url,
+			headers
+		}, (proxyRes) => {
+			const resHeaders = { ...proxyRes.headers };
+			stripHopByHopHeaders(resHeaders);
+			res.writeHead(proxyRes.statusCode ?? 502, resHeaders);
+			proxyRes.pipe(res);
+			proxyRes.on("end", resolveForward);
+			proxyRes.on("error", () => {
+				if (!res.writableEnded) res.destroy();
+				resolveForward();
+			});
+		});
+		proxyReq.on("error", () => {
+			if (!res.headersSent) writeText(res, 502, `The application in MicroVM ${opts.target.microvmId} is not responding on port ${selection.port}.`);
+			else if (!res.writableEnded) res.destroy();
+			resolveForward();
+		});
+		res.on("close", () => {
+			if (!res.writableEnded) proxyReq.destroy();
+			resolveForward();
+		});
+		req.pipe(proxyReq);
+	});
+}
+async function handleControl(req, res, path, opts) {
+	req.resume();
+	const target = opts.target;
+	const action = path.slice(14).replace(/^\//, "");
+	if (action === "") {
+		if (req.method !== "GET" && req.method !== "HEAD") {
+			writeText(res, 405, `Use GET ${MICROVM_CONTROL_PATH}.`);
+			return;
+		}
+		writeJson(res, 200, {
+			microvmId: target.microvmId,
+			state: target.state(),
+			ports: target.routablePorts()
+		});
+		return;
+	}
+	if (action !== "suspend" && action !== "resume" && action !== "terminate") {
+		writeText(res, 404, `Unknown control action '${action.slice(0, 32)}'. Use POST ${MICROVM_CONTROL_PATH}/suspend, /resume or /terminate.`);
+		return;
+	}
+	if (req.method !== "POST") {
+		writeText(res, 405, `Use POST ${MICROVM_CONTROL_PATH}/${action}.`);
+		return;
+	}
+	try {
+		await (action === "suspend" ? target.suspend() : action === "resume" ? target.resume() : target.terminate());
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		writeText(res, err instanceof MicrovmStateError ? 409 : 502, message);
+		return;
+	}
+	writeJson(res, 200, {
+		microvmId: target.microvmId,
+		state: target.state()
+	});
+}
+const LOOPBACK_NAMES = [
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+];
+function isWildcard(host) {
+	return host === "0.0.0.0" || host === "::" || host === "[::]";
+}
+function isIpLiteral(name) {
+	return /^\d{1,3}(\.\d{1,3}){3}$/.test(name) || /^\[[0-9a-f:.]+\]$/i.test(name);
+}
+function controlRequestRefusal(headers, boundHost, boundPort) {
+	const fetchSite = firstHeader(headers["sec-fetch-site"])?.trim().toLowerCase();
+	if (fetchSite !== void 0 && fetchSite !== "same-origin" && fetchSite !== "none") return `Refusing a ${fetchSite} request to the MicroVM control endpoint: it accepts requests from this origin only (curl, or a page this front door served).`;
+	const host = (Array.isArray(headers.host) ? headers.host[0] : headers.host)?.trim().toLowerCase();
+	const m = host === void 0 ? null : /^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(host);
+	const name = m?.[1];
+	const port = m ? m[2] !== void 0 ? Number(m[2]) : 80 : NaN;
+	const bindName = boundHost.includes(":") && !boundHost.startsWith("[") ? `[${boundHost}]` : boundHost;
+	const loopbackBind = isWildcard(boundHost) || LOOPBACK_NAMES.includes(bindName.toLowerCase());
+	if (!(name !== void 0 && (name === bindName.toLowerCase() || loopbackBind && LOOPBACK_NAMES.includes(name) || isWildcard(boundHost) && isIpLiteral(name))) || port !== boundPort) return `Refusing a MicroVM control request whose Host header (${(host ?? "<none>").slice(0, 64)}) is not this front door's address.`;
+	const origin = firstHeader(headers.origin)?.trim().toLowerCase();
+	if (origin !== void 0 && origin !== `http://${host}`) return `Refusing a MicroVM control request from origin ${origin.slice(0, 64)}: it accepts requests from this origin only.`;
+}
+var MicrovmStateError = class MicrovmStateError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MicrovmStateError";
+		Object.setPrototypeOf(this, MicrovmStateError.prototype);
+	}
+};
+async function handleUpgrade(req, clientSocket, head, opts, track) {
+	const selection = selectTargetPort(req.headers);
+	if (!selection.ok) {
+		writeRawHttpError(clientSocket, selection.status, selection.message);
+		return;
+	}
+	const upstream = opts.target.upstreamFor(selection.port);
+	if (!upstream) {
+		writeRawHttpError(clientSocket, 403, notRoutableMessage(selection.port, opts.target));
+		return;
+	}
+	const refusal = await admit(opts);
+	if (refusal) {
+		writeRawHttpError(clientSocket, refusal.status, refusal.message);
+		return;
+	}
+	const headers = { ...req.headers };
+	const offeredBase = stripMicrovmProxyHeaders(headers);
+	const appProtocolsLeft = headers["sec-websocket-protocol"] !== void 0;
+	const upstreamSocket = connect({
+		host: upstream.host,
+		port: upstream.port
+	});
+	track(upstreamSocket);
+	upstreamSocket.setNoDelay(true);
+	let connected = false;
+	let responseHead = Buffer.alloc(0);
+	upstreamSocket.on("connect", () => {
+		connected = true;
+		const lines = [`${req.method ?? "GET"} ${req.url ?? "/"} HTTP/${req.httpVersion}`];
+		for (const [name, value] of Object.entries(headers)) {
+			if (value === void 0) continue;
+			for (const v of Array.isArray(value) ? value : [value]) lines.push(`${name}: ${v}`);
+		}
+		upstreamSocket.write(`${lines.join("\r\n")}\r\n\r\n`);
+		if (head.length > 0) upstreamSocket.write(head);
+		clientSocket.pipe(upstreamSocket, { end: false });
+	});
+	const onHead = (chunk) => {
+		responseHead = Buffer.concat([responseHead, chunk]);
+		const end = responseHead.indexOf("\r\n\r\n");
+		if (end === -1 && responseHead.length < 64 * 1024) return;
+		upstreamSocket.pause();
+		upstreamSocket.off("data", onHead);
+		const out = end === -1 ? responseHead : Buffer.concat([Buffer.from(rewriteUpgradeResponseHead(responseHead.subarray(0, end).toString("latin1"), offeredBase && !appProtocolsLeft) + "\r\n\r\n", "latin1"), responseHead.subarray(end + 4)]);
+		responseHead = void 0;
+		clientSocket.write(out);
+		upstreamSocket.pipe(clientSocket);
+	};
+	upstreamSocket.on("data", onHead);
+	const closeBoth = () => {
+		if (!clientSocket.destroyed) clientSocket.destroy();
+		if (!upstreamSocket.destroyed) upstreamSocket.destroy();
+	};
+	let answered = false;
+	const answer502 = (why) => {
+		if (answered || clientSocket.destroyed) return;
+		answered = true;
+		writeRawHttpError(clientSocket, 502, `The application in MicroVM ${opts.target.microvmId} ${why} on port ${selection.port}.`);
+	};
+	upstreamSocket.on("end", () => clientSocket.unpipe(upstreamSocket));
+	upstreamSocket.on("error", () => {
+		if (!connected) return answer502("is not responding");
+		if (responseHead === void 0) closeBoth();
+	});
+	upstreamSocket.on("close", (hadError) => {
+		if (responseHead !== void 0) return answer502("closed the connection before answering the upgrade");
+		if (hadError) closeBoth();
+		else if (!clientSocket.writableEnded) clientSocket.end();
+	});
+	clientSocket.on("error", closeBoth);
+	clientSocket.on("end", () => {
+		if (!upstreamSocket.destroyed && !upstreamSocket.writableEnded) upstreamSocket.end();
+	});
+	clientSocket.on("close", () => {
+		if (!upstreamSocket.destroyed) upstreamSocket.destroy();
+	});
+}
+function rewriteUpgradeResponseHead(head, addBase) {
+	if (!addBase) return head;
+	const lines = head.split("\r\n");
+	if (!/^HTTP\/1\.[01] 101\b/.test(lines[0] ?? "")) return head;
+	if (lines.some((l) => /^sec-websocket-protocol\s*:/i.test(l))) return head;
+	return [...lines, `Sec-WebSocket-Protocol: ${MICROVM_WS_BASE_PROTOCOL}`].join("\r\n");
+}
+function notRoutableMessage(port, target) {
+	return `Port ${port} of MicroVM ${target.microvmId} is not reachable locally. cdk-local publishes 8080, Hooks.Port, the image's EXPOSE ports and every --proxy-port; published: ${target.routablePorts().join(", ")}.`;
+}
+function writeText(res, status, message) {
+	res.writeHead(status, { "content-type": "text/plain; charset=utf-8" });
+	res.end(`${message}\n`);
+}
+function writeJson(res, status, body) {
+	res.writeHead(status, { "content-type": "application/json" });
+	res.end(JSON.stringify(body));
+}
+
+//#endregion
+//#region src/local/microvm-runner.ts
+const execFileAsync = promisify$1(execFile$1);
+const DEFAULT_TERMINATE_HOOK_TIMEOUT_MS = 1e4;
+function microvmImageTag(artifact) {
+	return `${getEmbedConfig().resourceNamePrefix}-microvm-${artifact.assetHash.slice(0, 16).toLowerCase()}`;
+}
+async function buildMicrovmImage(opts) {
+	const tag = microvmImageTag(opts.artifact);
+	const parent = dirname$1(opts.artifact.contextDir);
+	getLogger().info(`Building MicroVM image ${tag}${opts.platform ? ` (platform=${opts.platform})` : ""}...`);
+	await buildDockerImage({ source: {
+		directory: basename$1(opts.artifact.contextDir),
+		...opts.noCache && { cacheDisabled: true }
+	} }, parent, {
+		tag,
+		...opts.platform !== void 0 && { platform: opts.platform },
+		assetOutdir: parent,
+		progressLabel: "Building MicroVM image",
+		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for the MicroVM image's Dockerfile: ${stderr}`)
+	});
+	return tag;
+}
+async function readExposedPorts(image) {
+	try {
+		const { stdout } = await execFileAsync(getDockerCmd(), [
+			"image",
+			"inspect",
+			"-f",
+			"{{json .Config.ExposedPorts}}",
+			image
+		]);
+		const parsed = JSON.parse(stdout.trim() || "null");
+		if (!parsed) return [];
+		return Object.keys(parsed).filter((k) => k.endsWith("/tcp") || !k.includes("/")).map((k) => Number(k.split("/")[0])).filter((n) => Number.isInteger(n) && n > 0 && n < 65536);
+	} catch {
+		return [];
+	}
+}
+function planMicrovmPorts(hooksPort, exposed, extra) {
+	const out = [MICROVM_DEFAULT_INGRESS_PORT];
+	for (const p of [
+		...hooksPort !== void 0 ? [hooksPort] : [],
+		...exposed,
+		...extra
+	]) if (!out.includes(p)) out.push(p);
+	return out;
+}
+async function setContainerPaused(containerId, paused) {
+	try {
+		await execFileAsync(getDockerCmd(), [paused ? "pause" : "unpause", containerId]);
+	} catch (error) {
+		const err = error;
+		throw new CdkLocalError(`docker ${paused ? "pause" : "unpause"} failed: ${displayToolOutput(err.stderr?.trim() || err.message || String(error))}`, "LOCAL_START_MICROVM_PAUSE_FAILED");
+	}
+}
+const defaultDeps = {
+	setPaused: setContainerPaused,
+	remove: removeContainer
+};
+var LocalMicrovm = class {
+	microvmId;
+	containerId;
+	current = "booting";
+	resuming;
+	suspending;
+	paused = false;
+	terminating;
+	opts;
+	deps;
+	constructor(opts, deps = {}) {
+		this.opts = opts;
+		this.deps = {
+			...defaultDeps,
+			...deps
+		};
+		this.microvmId = opts.microvmId;
+		this.containerId = opts.containerId;
+	}
+	state() {
+		return this.current === "booting" ? "resuming" : this.current;
+	}
+	upstreamFor(containerPort) {
+		return this.opts.ports.get(containerPort);
+	}
+	routablePorts() {
+		return [...this.opts.ports.keys()];
+	}
+	log(message) {
+		getLogger().info(`MicroVM ${this.microvmId}: ${message}`);
+	}
+	hookEndpoint() {
+		const port = this.opts.config.hooksPort;
+		const endpoint = port !== void 0 ? this.opts.ports.get(port) : void 0;
+		if (!endpoint) throw new CdkLocalError("The hooks port is not published.", "LOCAL_START_MICROVM_HOOK_FAILED");
+		return endpoint;
+	}
+	hookTimeoutMs(hook) {
+		const seconds = this.opts.config.hooks[hook]?.timeoutSeconds;
+		if (seconds !== void 0) return seconds * 1e3;
+		return hook === "terminate" ? DEFAULT_TERMINATE_HOOK_TIMEOUT_MS : this.opts.timeoutMs;
+	}
+	hookDeps() {
+		return {
+			...this.deps.hooks ?? defaultHookDeps,
+			...this.deps.isAlive && { isAlive: this.deps.isAlive }
+		};
+	}
+	async runtimeHook(hook, body) {
+		if (!this.opts.config.hooks[hook]) return false;
+		await callRuntimeHook(hook, this.hookEndpoint(), this.hookTimeoutMs(hook), body, this.hookDeps());
+		this.log(`/${hook} hook answered 200`);
+		return true;
+	}
+	async boot(runHookPayload) {
+		const { hooks } = this.opts.config;
+		const deps = this.hookDeps();
+		if (hooks.ready) {
+			const attempts = await pollBuildHook("ready", this.hookEndpoint(), this.hookTimeoutMs("ready"), deps);
+			this.log(`/ready hook answered 200 after ${attempts} attempt(s)`);
+		} else {
+			const port = this.opts.config.hooksPort ?? 8080;
+			const endpoint = this.opts.ports.get(port);
+			await (this.deps.waitForAnswer ?? waitForAppAnswer)(endpoint, this.opts.timeoutMs, {
+				probe: probeHttp,
+				sleep: deps.sleep,
+				now: deps.now,
+				...this.deps.isAlive && { isAlive: this.deps.isAlive }
+			});
+			this.log("application answered HTTP (no /ready hook)");
+		}
+		if (hooks.validate) {
+			const attempts = await pollBuildHook("validate", this.hookEndpoint(), this.hookTimeoutMs("validate"), deps);
+			this.log(`/validate hook answered 200 after ${attempts} attempt(s)`);
+		}
+		await this.runtimeHook("run", runHookBody(this.microvmId, runHookPayload));
+		if (this.current === "booting") this.current = "running";
+	}
+	async setPaused(paused) {
+		await this.deps.setPaused(this.containerId, paused);
+		this.paused = paused;
+	}
+	suspend() {
+		if (this.current !== "running") return Promise.reject(new MicrovmStateError(`MicroVM ${this.microvmId} is ${this.state()}; only a running MicroVM can be suspended.`));
+		this.current = "suspending";
+		this.suspending = (async () => {
+			try {
+				await this.runtimeHook("suspend");
+				await this.setPaused(true);
+			} catch (err) {
+				if (this.current === "suspending") this.current = "running";
+				throw err;
+			} finally {
+				this.suspending = void 0;
+			}
+			if (this.current === "suspending") {
+				this.current = "suspended";
+				this.log("suspended (container paused)");
+			}
+		})();
+		return this.suspending;
+	}
+	resume() {
+		if (this.current === "resuming" && this.resuming) return this.resuming;
+		if (this.current === "suspending" && this.suspending) return this.suspending.then(() => this.resume(), () => void 0);
+		if (this.current !== "suspended") return Promise.reject(new MicrovmStateError(`MicroVM ${this.microvmId} is ${this.state()}; only a suspended MicroVM can be resumed.`));
+		this.current = "resuming";
+		this.resuming = (async () => {
+			try {
+				await this.setPaused(false);
+				try {
+					await this.runtimeHook("resume");
+				} catch (err) {
+					if (this.current === "resuming") await this.setPaused(true).catch(() => void 0);
+					throw err;
+				}
+			} catch (err) {
+				if (this.current === "resuming") this.current = "suspended";
+				throw err;
+			} finally {
+				this.resuming = void 0;
+			}
+			if (this.current === "resuming") {
+				this.current = "running";
+				this.log("resumed");
+			}
+		})();
+		return this.resuming;
+	}
+	terminate() {
+		this.terminating ??= (async () => {
+			const wasBooting = this.current === "booting";
+			this.current = "terminating";
+			await Promise.allSettled([this.suspending, this.resuming].filter((p) => p !== void 0));
+			try {
+				if (this.paused) await this.setPaused(false).catch(() => void 0);
+				if (!wasBooting) await this.runtimeHook("terminate");
+			} catch (err) {
+				getLogger().warn(`MicroVM ${this.microvmId}: ${err instanceof Error ? err.message : String(err)} Removing its container anyway.`);
+			}
+			await this.deps.remove(this.containerId);
+			this.current = "terminated";
+			this.log("terminated (container removed)");
+			this.opts.onTerminated?.(this);
+		})();
+		return this.terminating;
+	}
+};
+
+//#endregion
+//#region src/cli/commands/local-start-microvm.ts
+function parsePort(raw) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
+	return n;
+}
+function parseCount(raw) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 1 || n > 64) throw new InvalidArgumentError(`--count must be an integer 1-64, got '${raw}'.`);
+	return n;
+}
+function parseProxyPort(raw, previous) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 1 || n > 65535) throw new InvalidArgumentError(`--proxy-port must be an integer 1-65535, got '${raw}'.`);
+	return [...previous ?? [], n];
+}
+function connectHost(host) {
+	if (host === "0.0.0.0") return "127.0.0.1";
+	if (host === "::" || host === "[::]") return "::1";
+	return host;
+}
+function readRunHookPayload(options, readFile = (p) => readFileSync$1(p, "utf-8")) {
+	if (options.runHookPayload !== void 0 && options.runHookPayloadFile !== void 0) throw new CdkLocalError("--run-hook-payload and --run-hook-payload-file are mutually exclusive.", "LOCAL_START_MICROVM_PAYLOAD_CONFLICT");
+	let payload = options.runHookPayload;
+	if (options.runHookPayloadFile !== void 0) try {
+		payload = readFile(options.runHookPayloadFile);
+	} catch (err) {
+		throw new CdkLocalError(`Cannot read --run-hook-payload-file ${displayUntrustedValue(options.runHookPayloadFile)}: ${err instanceof Error ? err.message : String(err)}`, "LOCAL_START_MICROVM_PAYLOAD_UNREADABLE");
+	}
+	if (payload !== void 0 && Buffer.byteLength(payload) > 16384) throw new CdkLocalError(`The run hook payload is ${Buffer.byteLength(payload)} bytes; run-microvm accepts at most ${MAX_RUN_HOOK_PAYLOAD_BYTES} (16 KB).`, "LOCAL_START_MICROVM_PAYLOAD_TOO_LARGE");
+	return payload;
+}
+function buildMicrovmLambdaView(resolved, config) {
+	return {
+		kind: "zip",
+		stack: resolved.stack,
+		logicalId: resolved.logicalId,
+		resource: {
+			Type: resolved.resource.Type,
+			Properties: { Environment: { Variables: config.environment } },
+			...resolved.resource.Metadata !== void 0 && { Metadata: resolved.resource.Metadata }
+		},
+		memoryMb: 128,
+		timeoutSec: 0,
+		layers: [],
+		runtime: "",
+		handler: "",
+		codePath: null,
+		architecture: config.architecture ?? "arm64"
+	};
+}
+const LAMBDA_RUNTIME_ENV_KEYS = [
+	"AWS_LAMBDA_FUNCTION_NAME",
+	"AWS_LAMBDA_FUNCTION_MEMORY_SIZE",
+	"AWS_LAMBDA_FUNCTION_TIMEOUT",
+	"AWS_LAMBDA_FUNCTION_VERSION",
+	"AWS_LAMBDA_LOG_GROUP_NAME",
+	"AWS_LAMBDA_LOG_STREAM_NAME"
+];
+function finalizeMicrovmEnv(lambdaEnv, declared) {
+	const env = { ...lambdaEnv };
+	for (const key of LAMBDA_RUNTIME_ENV_KEYS) if (!Object.hasOwn(declared, key)) delete env[key];
+	return env;
+}
+function microvmFidelityWarnings(config) {
+	const image = displayIdent(config.logicalId);
+	const out = [
+		`MicroVM image ${image}: each MicroVM is a Docker container started fresh from the built image, not a MicroVM restored from a snapshot — state the app initializes before /ready answers 200 is NOT shared across MicroVMs (each one runs its own startup), and there is no VM isolation or memory checkpoint (suspend is docker pause).`,
+		`MicroVM image ${image}: requests are accepted without X-aws-proxy-auth — the JWE token the cloud endpoint requires is not checked locally (the header is still stripped).`,
+		`MicroVM image ${image}: the idle policy is not emulated — a MicroVM suspends, resumes and terminates only through ${MICROVM_CONTROL_PATH}/suspend|resume|terminate (and --auto-resume).`,
+		`MicroVM image ${image}: the Dockerfile is built by the local Docker engine, not on the Lambda-managed MicroVM base OS (BaseImageArn).`
+	];
+	if (config.hooks.validate) out.push(`MicroVM image ${image}: /validate is called on the same container as /ready (the cloud calls it on a fresh MicroVM started from the built snapshot).`);
+	for (const what of config.unemulated) out.push(`MicroVM image ${image}: ${what} is not emulated.`);
+	return out;
+}
+async function localStartMicrovmCommand(target, options, extraStateProviders, hostSynthesizer) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	const runHookPayload = readRunHookPayload(options);
+	const vms = [];
+	const frontDoors = /* @__PURE__ */ new Map();
+	const logStops = [];
+	const exitWatches = [];
+	const bareContainers = /* @__PURE__ */ new Set();
+	let runInFlight;
+	let containerName;
+	let artifact;
+	let teardownPromise;
+	let shuttingDown = false;
+	let waitingOnRun = false;
+	const forever = () => new Promise(() => void 0);
+	const doTeardown = async () => {
+		for (const w of exitWatches) w.stop();
+		if (runInFlight !== void 0) {
+			waitingOnRun = true;
+			try {
+				bareContainers.add(await runInFlight);
+			} catch {} finally {
+				waitingOnRun = false;
+			}
+		}
+		await Promise.allSettled(vms.map((vm) => vm.terminate()));
+		for (const vm of vms) bareContainers.delete(vm.containerId);
+		await Promise.allSettled([...bareContainers].map((id) => removeContainer(id)));
+		await Promise.allSettled([...frontDoors.values()].map((fd) => fd.close()));
+		for (const stop of logStops) try {
+			stop();
+		} catch (err) {
+			logger.debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		disposeMicrovmCodeArtifact(artifact);
+	};
+	const teardown = () => teardownPromise ??= doTeardown();
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region,
+		profile: options.profile
+	});
+	await ensureDockerAvailable();
+	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
+	const appCmd = resolveApp(options.app);
+	if (!appCmd) throw new Error(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
+	logger.info("Synthesizing CDK app...");
+	const synthesizer = hostSynthesizer ?? new Synthesizer();
+	const context = parseContextOptions(options.context);
+	const synthOpts = {
+		app: appCmd,
+		output: options.output,
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile },
+		...Object.keys(context).length > 0 && { context }
+	};
+	const { stacks } = await synthesizer.synthesize(synthOpts);
+	const resolved = resolveMicrovmImageTarget(await resolveSingleTarget(target, {
+		entries: listTargets(stacks).microvmImages,
+		message: "Select a Lambda MicroVM image to run",
+		noun: "Lambda MicroVM images",
+		onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} start-microvm requires a <target> (a MicrovmImage display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_START_MICROVM_TARGET_REQUIRED")
+	}), stacks);
+	const config = readMicrovmImageConfig(resolved.logicalId, resolved.resource);
+	const platform = options.platform ?? (config.architecture !== void 0 ? architectureToPlatform(config.architecture) : void 0);
+	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.logicalId}`)} (MicroVM image ${displayIdent(config.name)}; hooks: ${Object.keys(config.hooks).join(", ") || "none"}${platform ? `; ${platform}` : ""})`);
+	for (const line of microvmFidelityWarnings(config)) logger.warn(line);
+	artifact = await resolveMicrovmCodeArtifact(resolved.stack, config);
+	const shutdown = async (signal, exitCode) => {
+		if (shuttingDown) {
+			if (!waitingOnRun) {
+				logger.info(`Received ${signal} again; still terminating the MicroVMs, please wait...`);
+				return;
+			}
+			disposeMicrovmCodeArtifact(artifact);
+			logger.warn(`Received ${signal} again; exiting without waiting for docker run to return. The container may still be starting, and its environment holds the forwarded AWS credentials. Remove it by its name (this works even if it is created after this exit): docker rm -f ${containerName ?? "<name>"}`);
+			process.exit(signal === "SIGINT" ? 130 : 143);
+			return;
+		}
+		shuttingDown = true;
+		logger.info(`Received ${signal}, terminating ${vms.length} MicroVM(s)...`);
+		await teardown();
+		process.exit(exitCode);
+	};
+	process.on("SIGINT", () => void shutdown("SIGINT", 130));
+	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
+	const recents = /* @__PURE__ */ new Map();
+	let allTerminated;
+	const everyVmTerminated = new Promise((r) => allTerminated = r);
+	const checkAllTerminated = () => {
+		if (vms.length === options.count && vms.every((v) => v.state() === "terminated")) allTerminated();
+	};
+	let unexpectedExit;
+	const anyUnexpectedExit = new Promise((r) => unexpectedExit = r);
+	const probeHost = connectHost(options.host);
+	try {
+		const containerEnv = await resolveLambdaContainerEnv(buildMicrovmLambdaView(resolved, config), {
+			...options,
+			deployedFunctionLookups: false
+		}, profileCredentials, extraStateProviders);
+		const env = finalizeMicrovmEnv(containerEnv.env, config.environment);
+		const image = await buildMicrovmImage({
+			artifact,
+			platform,
+			noCache: options.buildCache === false
+		});
+		if (teardownPromise) return await forever();
+		const containerPorts = planMicrovmPorts(config.hooksPort, await readExposedPorts(image), options.proxyPort ?? []);
+		logger.info(`Publishing container ports ${containerPorts.join(", ")} to the front door(s).`);
+		for (let i = 0; i < options.count; i++) {
+			const microvmId = generateMicrovmId();
+			const hostPorts = /* @__PURE__ */ new Map();
+			for (const cp of containerPorts) hostPorts.set(cp, {
+				host: "127.0.0.1",
+				port: await pickFreePort()
+			});
+			const [first, ...rest] = containerPorts;
+			const name = containerName = `${getEmbedConfig().resourceNamePrefix}-microvm-${process.pid}-${i}-${Math.random().toString(36).slice(2, 8)}`;
+			logger.info(`Starting MicroVM ${microvmId} (container ${name})...`);
+			runInFlight = runDetached({
+				image,
+				mounts: [],
+				env,
+				...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) },
+				cmd: [],
+				hostPort: hostPorts.get(first).port,
+				containerPort: first,
+				extraPorts: rest.map((cp) => ({
+					hostPort: hostPorts.get(cp).port,
+					containerPort: cp
+				})),
+				host: "127.0.0.1",
+				...platform !== void 0 && { platform },
+				name,
+				autoRemove: false
+			});
+			const containerId = await runInFlight;
+			runInFlight = void 0;
+			bareContainers.add(containerId);
+			if (teardownPromise) return await forever();
+			const recent = new RecentOutput();
+			recents.set(containerId, recent);
+			logStops.push(streamLogs(containerId, {
+				onOutput: (chunk) => recent.push(chunk),
+				...options.count > 1 && { prefix: `[${microvmId.slice(0, 12)}] ` }
+			}));
+			const watch = watchContainerExit(containerId);
+			exitWatches.push(watch);
+			let exited = false;
+			const vm = new LocalMicrovm({
+				microvmId,
+				containerId,
+				ports: hostPorts,
+				config,
+				timeoutMs: options.timeout,
+				onTerminated: checkAllTerminated
+			}, { isAlive: async () => !exited });
+			vms.push(vm);
+			bareContainers.delete(containerId);
+			watch.exited.then((code) => {
+				exited = true;
+				const s = vm.state();
+				if (s !== "terminating" && s !== "terminated") unexpectedExit({
+					vm,
+					code
+				});
+			});
+			await vm.boot(runHookPayload);
+			if (teardownPromise) return await forever();
+			const fd = await startMicrovmFrontDoor({
+				host: options.host,
+				port: options.port === 0 ? 0 : options.port + i,
+				target: vm,
+				autoResume: options.autoResume === true
+			});
+			frontDoors.set(vm, fd);
+			const base = `http://${formatAuthority(probeHost, fd.port)}`;
+			logger.info(`MicroVM ${microvmId} listening on ${base}  (control: ${base}${MICROVM_CONTROL_PATH})`);
+		}
+		logger.info("Press ^C to terminate the MicroVM(s).");
+		checkAllTerminated();
+	} catch (err) {
+		if (shuttingDown) return await forever();
+		const failed = vms.at(-1);
+		const wrapped = err instanceof MicrovmHookError && failed ? await containerFailure(err.message, failed.containerId, recents.get(failed.containerId) ?? new RecentOutput()).then((f) => new CdkLocalError(f.message, err.code)) : err;
+		await teardown();
+		throw wrapped;
+	}
+	const outcome = await Promise.race([everyVmTerminated.then(() => void 0), anyUnexpectedExit]);
+	if (shuttingDown) return await forever();
+	if (outcome === void 0) {
+		logger.info("Every MicroVM is terminated; shutting down.");
+		await teardown();
+		return;
+	}
+	if (teardownPromise) return await forever();
+	const failure = await containerFailure(`MicroVM ${outcome.vm.microvmId}'s container exited (exit code ${outcome.code ?? "unknown"}) while running.`, outcome.vm.containerId, recents.get(outcome.vm.containerId) ?? new RecentOutput());
+	await teardown();
+	throw new CdkLocalError(failure.message, "LOCAL_START_MICROVM_EXITED");
+}
+function createLocalStartMicrovmCommand(opts = {}) {
+	setEmbedConfig(opts.embedConfig);
+	const cmd = new Command("start-microvm").description("Run AWS Lambda MicroVMs locally. Builds a MicrovmImage code artifact (a Dockerfile plus the app, from cdk.out) once, starts --count containers with its EnvironmentVariables, drives the /ready, /validate and /run lifecycle hooks in the cloud order, and serves each MicroVM on its own local URL: X-aws-proxy-port / lambda-microvms.port.N routing (default 8080), X-aws-proxy-* stripping, and a control endpoint for suspend / resume / terminate. Target accepts a CDK display path or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C, which calls /terminate.").argument("[target]", "CDK display path or stack-qualified logical ID of the MicrovmImage (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
+		await localStartMicrovmCommand(target, options, opts.extraStateProviders, opts.synthesizer);
+	}));
+	addStartMicrovmSpecificOptions(cmd);
+	[
+		...commonOptions(),
+		...appOptions(),
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(regionOption);
+	return cmd;
+}
+function addStartMicrovmSpecificOptions(cmd) {
+	return cmd.addOption(new Option("--count <n>", "Number of independent MicroVMs to run, each with its own URL.").default(1).argParser(parseCount)).addOption(new Option("--run-hook-payload <string>", "The runHookPayload string delivered to each MicroVM's /run hook (max 16 KB).")).addOption(new Option("--run-hook-payload-file <path>", "Read the runHookPayload from a file (mutually exclusive with --run-hook-payload).")).addOption(new Option("--port <n>", "Local port of the first MicroVM; MicroVM i listens on <n>+i. Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Address the MicroVM URLs listen on.").default("127.0.0.1")).addOption(new Option("--platform <platform>", "docker --platform for the build and the containers. Defaults to the image's CpuConfigurations architecture.").choices(["linux/amd64", "linux/arm64"])).addOption(new Option("--proxy-port <port>", "An extra container port X-aws-proxy-port may route to (repeatable). 8080, Hooks.Port and the image's EXPOSE ports are always routable.").argParser(parseProxyPort)).addOption(new Option("--auto-resume", "Resume a suspended MicroVM on its next request instead of answering 503 (autoResumeEnabled).")).addOption(new Option("--no-build-cache", "Build the image with docker build --no-cache.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"MicrovmImageLogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--timeout <ms>", "Default deadline in milliseconds for each hook without its own <Hook>TimeoutInSeconds (/terminate defaults to 10000), and for the app to answer HTTP when there is no /ready hook. Default 60000.").default(6e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role <arn>", "Assume this role (the MicroVM's execution role, a run-microvm parameter rather than part of the template) and forward STS-issued temp credentials to the containers. Off by default: the shell credentials are forwarded.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
 //#endregion
@@ -26003,7 +27196,7 @@ async function localListCommand(options) {
 	process.stdout.write(`${formatTargetListing(listing, getEmbedConfig().cliName, { long: options.long })}\n`);
 }
 function formatTargetListing(listing, cliName, options = {}) {
-	if (countTargets(listing) === 0) return `No runnable targets (Lambda functions, APIs, ECS services / tasks, AgentCore Runtimes, load balancers, CloudFront distributions, Lambda web functions) found in this CDK app.`;
+	if (countTargets(listing) === 0) return `No runnable targets (Lambda functions, APIs, ECS services / tasks, AgentCore Runtimes, load balancers, CloudFront distributions, Lambda web functions, Lambda MicroVM images) found in this CDK app.`;
 	const long = options.long ?? false;
 	return "\n" + [
 		formatSection("Lambda Functions", `${cliName} invoke <target>`, listing.lambdas, long),
@@ -26013,7 +27206,8 @@ function formatTargetListing(listing, cliName, options = {}) {
 		formatSection("AgentCore Runtimes", `${cliName} invoke-agentcore <target>`, listing.agentCoreRuntimes, long),
 		formatSection("Application Load Balancers", `${cliName} start-alb <target...>`, listing.loadBalancers, long),
 		formatSection("CloudFront Distributions", `${cliName} start-cloudfront <target>`, listing.cloudFrontDistributions, long),
-		formatSection("Lambda Web Functions", `${cliName} start-web-function <target>`, listing.webFunctions, long)
+		formatSection("Lambda Web Functions", `${cliName} start-web-function <target>`, listing.webFunctions, long),
+		formatSection("Lambda MicroVM Images", `${cliName} start-microvm <target>`, listing.microvmImages, long)
 	].filter((lines) => lines.length > 0).map((lines) => lines.join("\n")).join("\n\n");
 }
 function formatSection(title, command, entries, long) {
@@ -31289,5 +32483,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { WEB_FUNCTION_TYPE as $, AgentCoreResolutionError as $i, invokeAgentCore as $n, pickResponseTemplate as $r, parseLbPortOverrides as $t, containerFailure as A, resolveCfnRegion as Ai, listPinnedTargets as An, buildCognitoJwksUrl as Ar, buildEdgeRequestEvent as At, webFunctionAssumeRole as B, discoverWebSocketApis as Bi, bridgeAgentCoreWs as Bn, invokeTokenAuthorizer as Br, pickLambdaEdgeFunctionLogicalId as Bt, addListSpecificOptions as C, workloadClientConfig as Ca, substituteEnvVarsFromState as Ci, mergeForService as Cn, filterRoutesByApiIdentifiers as Cr, matchBehavior as Ct, createLocalStartWebFunctionCommand as D, buildProxyClientConfig as Da, isCfnFlagPresent as Di, describePinnedImageUri as Dn, resolveSelectionExpression as Dr, serveLambdaUrlOrigin as Dt, addStartWebFunctionSpecificOptions as E, resolveProfileCredentials as Ea, createLocalStateProvider as Ei, runImageOverrideBuilds as En, startApiServer as Er, serveFromStaticOrigin as Et, watchContainerExit as F, resolveWatchConfig as Fi, setShadowReadyTimeoutMs as Fn, verifyJwtViaDiscovery as Fr, describeS3OriginDomain as Ft, resolveWebFunctionRuntime as G, discoverRoutes as Gi, MCP_CONTAINER_PORT as Gn, isFunctionUrlOacFronted as Gr, runViewerResponse as Gt, WEB_FUNCTION_RUNTIMES as H, filterWebSocketApisByIdentifiers as Hi, A2A_CONTAINER_PORT as Hn, applyCorsResponseHeaders as Hr, resolveCloudFrontDistribution as Ht, WEB_FUNCTION_HTTP_ENDPOINT_ENV as I, resolveSingleTarget as Ii, getContainerNetworkIp as In, buildMethodArn as Ir, extractKvsAssociations as It, findFileAssetForObjectKey as J, AGENTCORE_A2A_PROTOCOL as Ji, mcpInvokeOnce as Jn, translateLambdaResponse as Jr, createLocalFileKvsDataSource as Jt, supportedWebFunctionRuntimes as K, pickRefLogicalId as Ki, MCP_PATH as Kn, matchPreflight as Kr, stripCloudFrontImport as Kt, buildWebFunctionLambdaView as L, countTargets as Li, attachContainerLogStreamer as Ln, computeRequestIdentityHash as Lr, isCloudFrontDistribution as Lt, readContainerLogTail as M, CfnLocalStateProvider as Mi, CloudMapRegistry as Mn, createJwksCache as Mr, edgeHeadersToHttp as Mt, startWebFunctionContainer as N, collectSsmParameterRefs as Ni, DEFAULT_SHADOW_READY_TIMEOUT_MS as Nn, verifyCognitoJwt as Nr, httpHeadersToEdge as Nt, RecentOutput as O, isProxyEnvConfigured as Oa, rejectExplicitCfnStackWithMultipleStacks as Oi, imageOverrideKeyAliases as On, resolveServiceIntegrationParameters as Or, applyEdgeRequestResult as Ot, waitForWebFunctionReady as P, resolveSsmParameters as Pi, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Pn, verifyJwtAuthorizer as Pr, CLOUDFRONT_DISTRIBUTION_TYPE as Pt, WEB_FUNCTION_REVISION_TYPE as Q, AGENTCORE_RUNTIME_TYPE as Qi, AGENTCORE_SESSION_ID_HEADER as Qn, evaluateResponseParameters as Qr, createLocalStartAlbCommand as Qt, finalizeWebFunctionEnv as R, listTargets as Ri, addInvokeAgentCoreSpecificOptions as Rn, evaluateCachedLambdaPolicy as Rr, pickFunctionUrlLogicalIdFromOrigin as Rt, StudioEventBus as S, resetWorkloadIdentity as Sa, substituteAgainstStateAsync as Si, enforceImageOverrideOrphans as Sn, filterRoutesByApiIdentifier as Sr, createS3OriginReader as St, formatTargetListing as T, buildStsClientConfig as Ta, LocalStateSourceError as Ti, resolveImageOverrides as Tn, readMtlsMaterialsFromDisk as Tr, resolveErrorResponseCandidates as Tt, buildNodeEntryFileStart as U, parseSelectionExpressionPath as Ui, A2A_PATH as Un, buildCorsConfigByApiId as Ur, compileCloudFrontFunction as Ut, webFunctionFidelityWarnings as V, discoverWebSocketApisOrThrow as Vi, invokeAgentCoreWs as Vn, attachAuthorizers as Vr, pickTargetFunctionLogicalId as Vt, defaultWebFunctionPlatform as W, webSocketApiMatchesIdentifier as Wi, a2aInvokeOnce as Wn, buildCorsConfigFromCloudFrontChain as Wr, runViewerRequest as Wt, resolveWebFunctionArtifact as X, AGENTCORE_HTTP_PROTOCOL as Xi, AGENTCORE_SIGV4_SERVICE as Xn, buildHttpApiV2Event as Xr, addAlbSpecificOptions as Xt, parseWebFunctionBuildConfig as Y, AGENTCORE_AGUI_PROTOCOL as Yi, parseSseForJsonRpc as Yn, applyAuthorizerOverlay as Yr, createUnboundCloudFrontModule as Yt, WEB_FUNCTION_ENDPOINT_TYPE as Z, AGENTCORE_MCP_PROTOCOL as Zi, signAgentCoreInvocation as Zn, buildRestV1Event as Zr, albStrategy as Zt, filterStudioTargetGroups as _, SECOND_ASSUME_MESSAGE as _a, resolveRuntimeCodeMountPath as _i, resolveSharedSidecarCredentials as _n, attachStageContext as _r, resolveKvsModulesForDistribution as _t, createLocalStudioCommand as a, tryResolveImageFnJoin as aa, probeHostGatewaySupport as ai, serviceStrategy as an, computeCodeImageTag as ar, selectServeInboundAuth as at, renderStudioHtml as b, readEnvCallerCredentials as ba, EcsTaskResolutionError as bi, buildImageOverrideTag as bn, resolveEnvVars$1 as br, resolveDeployedOriginBucket as bt, startStudioProxy as c, DynamicReferenceResolver as ca, ConnectionRegistry as ci, MAX_TASKS_SUBNET_RANGE_CAP as cn, classifySourceChange as cr, startAgentCoreWsBridge as ct, createStudioDispatcher as d, firstUsableRegion as da, parseConnectionsPath as di, addImageOverrideOptions as dn, addStartApiSpecificOptions as dr, createLocalStartCloudFrontCommand as dt, pickAgentCoreCandidateStack as ea, selectIntegrationResponse as ei, resolveAlbTarget as en, waitForAgentCoreHttpReady as er, WebFunctionResolutionError as et, filterStudioCustomResources as f, keysNotFromTemplate as fa, buildConnectEvent as fi, buildEcsImageResolutionContext$1 as fn, createLocalStartApiCommand as fr, normalizeKvsFileKeys as ft, annotatePinnedEcsTargets as g, withoutKeys as ga, buildContainerImage as gi, resolveEcsAssumeRoleOption as gn, createFileWatcher as gr, idFromArn as gt, annotateEcsTaskPinnedTargets as h, resolveDynamicReferencesInEnv as ha, architectureToPlatform as hi, parseRestartPolicy as hn, createAuthorizerCache as hr, resolveCloudFrontTarget as ht, coerceStopRequest as i, substituteImagePlaceholders as ia, HOST_GATEWAY_MIN_VERSION as ii, createLocalStartServiceCommand as in, buildAgentCoreCodeImage as ir, buildAgentCoreServeAuthCheck as it, planWebFunctionContainer as j, resolveCfnStackName as ji, buildCloudMapIndex as jn, buildJwksUrlFromIssuer as jr, buildEdgeResponseEvent as jt, WEB_FUNCTION_CONTAINER_PORT as k, resolveCfnFallbackRegion as ki, isLocalCdkAssetImage as kn, defaultCredentialsLoader as kr, applyEdgeResponseResult as kt, relayServeRequest as l, containsDynamicReference as la, buildMgmtEndpointEnvUrl as li, addCommonEcsServiceOptions as ln, addInvokeSpecificOptions as lr, LocalStartCloudFrontError as lt, annotateAlbPinnedBackingServices as m, parseDynamicReference as ma, buildMessageEvent as mi, parseMaxTasks as mn, resolveApiTargetSubset as mr, parseOriginOverrides as mt, coerceRunRequest as n, derivePseudoParametersFromRegion as na, VtlEvaluationError as ni, resolveAlbFrontDoor as nn, downloadAndExtractS3Bundle as nr, addStartAgentCoreSpecificOptions as nt, resolveServeBaseUrl as o, LocalInvokeBuildError as oa, resolveHostGatewayExtraHosts as oi, addRunTaskSpecificOptions as on, renderCodeDockerfile as or, startAgentCoreHttpServer as ot, isCustomResourceLambdaTarget as p, keysOverriddenBy as pa, buildDisconnectEvent as pi, ecsClusterOption as pn, createWatchPredicates as pr, parseKvsFileOverrides as pt, disposeWebFunctionArtifact as q, resolveLambdaArnIntrinsic as qi, MCP_PROTOCOL_VERSION as qn, matchRoute as qr, createCloudFrontModule as qt, coerceServeRequest as r, formatStateRemedy as ra, HOST_DOCKER_INTERNAL_GATEWAY as ri, addStartServiceSpecificOptions as rn, SUPPORTED_CODE_RUNTIMES as rr, createLocalStartAgentCoreCommand as rt, createStudioServeManager as s, DynamicReferenceResolutionError as sa, bufferToBody as si, createLocalRunTaskCommand as sn, toCmdArgv as sr, attachAgentCoreWsBridge as st, addStudioSpecificOptions as t, resolveAgentCoreTarget as ta, tryParseStatus as ti, isApplicationLoadBalancer as tn, waitForAgentCorePing as tr, resolveWebFunctionTarget as tt, reinvoke as u, deployedFillMayBeSecret as ua, handleConnectionsRequest as ui, addEcsAssumeRoleOptions as un, createLocalInvokeCommand as ur, addStartCloudFrontSpecificOptions as ut, startStudioServer as v, assumedRoleRecorded as va, resolveRuntimeFileExtension as vi, runEcsServiceEmulator as vn, buildStageMap as vr, createDeployedKvsDataSource as vt, createLocalListCommand as w, workloadStsClientConfig as wa, substituteEnvVarsFromStateAsync as wi, parseImageOverrideFlags as wn, groupRoutesByServer as wr, startCloudFrontServer as wt, createStudioStore as x, recordAssumedRole as xa, substituteAgainstState as xi, canonicalizeImageOverrideKeys as xn, availableApiIdentifiers as xr, classifyS3Error as xt, toStudioTargetGroups as y, deployAccountStsClientConfig as ya, resolveRuntimeImage as yi, ImageOverrideError as yn, materializeLayerFromArn as yr, resolveDeployedKvsArnByName as yt, readWebFunctionServiceConfig as z, availableWebSocketApiIdentifiers as zi, createLocalInvokeAgentCoreCommand as zn, invokeRequestAuthorizer as zr, pickKvsLogicalIdFromArn as zt };
-//# sourceMappingURL=local-studio-CsftJJ1r.js.map
+export { postHook as $, resolveDynamicReferencesInEnv as $a, architectureToPlatform as $i, parseRestartPolicy as $n, createAuthorizerCache as $r, resolveCloudFrontTarget as $t, microvmFidelityWarnings as A, pickRefLogicalId as Aa, matchPreflight as Ai, stripCloudFrontImport as An, MCP_PATH as Ar, supportedWebFunctionRuntimes as At, MICROVM_WS_BASE_PROTOCOL as B, derivePseudoParametersFromRegion as Ba, VtlEvaluationError as Bi, resolveAlbFrontDoor as Bn, downloadAndExtractS3Bundle as Br, addStartAgentCoreSpecificOptions as Bt, addListSpecificOptions as C, availableWebSocketApiIdentifiers as Ca, invokeRequestAuthorizer as Ci, pickKvsLogicalIdFromArn as Cn, createLocalInvokeAgentCoreCommand as Cr, readWebFunctionServiceConfig as Ct, buildMicrovmLambdaView as D, parseSelectionExpressionPath as Da, buildCorsConfigByApiId as Di, compileCloudFrontFunction as Dn, A2A_PATH as Dr, buildNodeEntryFileStart as Dt, addStartMicrovmSpecificOptions as E, filterWebSocketApisByIdentifiers as Ea, applyCorsResponseHeaders as Ei, resolveCloudFrontDistribution as En, A2A_CONTAINER_PORT as Er, WEB_FUNCTION_RUNTIMES as Et, microvmImageTag as F, AGENTCORE_MCP_PROTOCOL as Fa, buildRestV1Event as Fi, albStrategy as Fn, signAgentCoreInvocation as Fr, WEB_FUNCTION_ENDPOINT_TYPE as Ft, startMicrovmFrontDoor as G, DynamicReferenceResolutionError as Ga, bufferToBody as Gi, createLocalRunTaskCommand as Gn, toCmdArgv as Gr, attachAgentCoreWsBridge as Gt, PROXY_PORT_HEADER as H, substituteImagePlaceholders as Ha, HOST_GATEWAY_MIN_VERSION as Hi, createLocalStartServiceCommand as Hn, buildAgentCoreCodeImage as Hr, buildAgentCoreServeAuthCheck as Ht, planMicrovmPorts as I, AGENTCORE_RUNTIME_TYPE as Ia, evaluateResponseParameters as Ii, createLocalStartAlbCommand as In, AGENTCORE_SESSION_ID_HEADER as Ir, WEB_FUNCTION_REVISION_TYPE as It, MICROVM_HOOK_PATH_PREFIX as J, deployedFillMayBeSecret as Ja, handleConnectionsRequest as Ji, addEcsAssumeRoleOptions as Jn, createLocalInvokeCommand as Jr, addStartCloudFrontSpecificOptions as Jt, stripMicrovmProxyHeaders as K, DynamicReferenceResolver as Ka, ConnectionRegistry as Ki, MAX_TASKS_SUBNET_RANGE_CAP as Kn, classifySourceChange as Kr, startAgentCoreWsBridge as Kt, readExposedPorts as L, AgentCoreResolutionError as La, pickResponseTemplate as Li, parseLbPortOverrides as Ln, invokeAgentCore as Lr, WEB_FUNCTION_TYPE as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, AGENTCORE_A2A_PROTOCOL as Ma, translateLambdaResponse as Mi, createLocalFileKvsDataSource as Mn, mcpInvokeOnce as Mr, findFileAssetForObjectKey as Mt, LocalMicrovm as N, AGENTCORE_AGUI_PROTOCOL as Na, applyAuthorizerOverlay as Ni, createUnboundCloudFrontModule as Nn, parseSseForJsonRpc as Nr, parseWebFunctionBuildConfig as Nt, createLocalStartMicrovmCommand as O, webSocketApiMatchesIdentifier as Oa, buildCorsConfigFromCloudFrontChain as Oi, runViewerRequest as On, a2aInvokeOnce as Or, defaultWebFunctionPlatform as Ot, buildMicrovmImage as P, AGENTCORE_HTTP_PROTOCOL as Pa, buildHttpApiV2Event as Pi, addAlbSpecificOptions as Pn, AGENTCORE_SIGV4_SERVICE as Pr, resolveWebFunctionArtifact as Pt, pollBuildHook as Q, parseDynamicReference as Qa, buildMessageEvent as Qi, parseMaxTasks as Qn, resolveApiTargetSubset as Qr, parseOriginOverrides as Qt, setContainerPaused as R, pickAgentCoreCandidateStack as Ra, selectIntegrationResponse as Ri, resolveAlbTarget as Rn, waitForAgentCoreHttpReady as Rr, WebFunctionResolutionError as Rt, StudioEventBus as S, listTargets as Sa, evaluateCachedLambdaPolicy as Si, pickFunctionUrlLogicalIdFromOrigin as Sn, addInvokeAgentCoreSpecificOptions as Sr, finalizeWebFunctionEnv as St, formatTargetListing as T, discoverWebSocketApisOrThrow as Ta, attachAuthorizers as Ti, pickTargetFunctionLogicalId as Tn, invokeAgentCoreWs as Tr, webFunctionFidelityWarnings as Tt, rewriteUpgradeResponseHead as U, tryResolveImageFnJoin as Ua, probeHostGatewaySupport as Ui, serviceStrategy as Un, computeCodeImageTag as Ur, selectServeInboundAuth as Ut, MicrovmStateError as V, formatStateRemedy as Va, HOST_DOCKER_INTERNAL_GATEWAY as Vi, addStartServiceSpecificOptions as Vn, SUPPORTED_CODE_RUNTIMES as Vr, createLocalStartAgentCoreCommand as Vt, selectTargetPort as W, LocalInvokeBuildError as Wa, resolveHostGatewayExtraHosts as Wi, addRunTaskSpecificOptions as Wn, renderCodeDockerfile as Wr, startAgentCoreHttpServer as Wt, callRuntimeHook as X, keysNotFromTemplate as Xa, buildConnectEvent as Xi, buildEcsImageResolutionContext$1 as Xn, createLocalStartApiCommand as Xr, normalizeKvsFileKeys as Xt, MicrovmHookError as Y, firstUsableRegion as Ya, parseConnectionsPath as Yi, addImageOverrideOptions as Yn, addStartApiSpecificOptions as Yr, createLocalStartCloudFrontCommand as Yt, generateMicrovmId as Z, keysOverriddenBy as Za, buildDisconnectEvent as Zi, ecsClusterOption as Zn, createWatchPredicates as Zr, parseKvsFileOverrides as Zt, filterStudioTargetGroups as _, collectSsmParameterRefs as _a, verifyCognitoJwt as _i, httpHeadersToEdge as _n, DEFAULT_SHADOW_READY_TIMEOUT_MS as _r, startWebFunctionContainer as _t, createLocalStudioCommand as a, substituteAgainstState as aa, availableApiIdentifiers as ai, classifyS3Error as an, recordAssumedRole as ao, canonicalizeImageOverrideKeys as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, resolveSingleTarget as ba, buildMethodArn as bi, extractKvsAssociations as bn, getContainerNetworkIp as br, WEB_FUNCTION_HTTP_ENDPOINT_ENV as bt, startStudioProxy as c, substituteEnvVarsFromStateAsync as ca, groupRoutesByServer as ci, startCloudFrontServer as cn, workloadStsClientConfig as co, parseImageOverrideFlags as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, isCfnFlagPresent as da, resolveSelectionExpression as di, serveLambdaUrlOrigin as dn, buildProxyClientConfig as do, describePinnedImageUri as dr, createLocalStartWebFunctionCommand as dt, buildContainerImage as ea, createFileWatcher as ei, idFromArn as en, withoutKeys as eo, resolveEcsAssumeRoleOption as er, runHookBody as et, filterStudioCustomResources as f, rejectExplicitCfnStackWithMultipleStacks as fa, resolveServiceIntegrationParameters as fi, applyEdgeRequestResult as fn, isProxyEnvConfigured as fo, imageOverrideKeyAliases as fr, RecentOutput as ft, annotatePinnedEcsTargets as g, CfnLocalStateProvider as ga, createJwksCache as gi, edgeHeadersToHttp as gn, CloudMapRegistry as gr, readContainerLogTail as gt, annotateEcsTaskPinnedTargets as h, resolveCfnStackName as ha, buildJwksUrlFromIssuer as hi, buildEdgeResponseEvent as hn, buildCloudMapIndex as hr, planWebFunctionContainer as ht, coerceStopRequest as i, EcsTaskResolutionError as ia, resolveEnvVars$1 as ii, resolveDeployedOriginBucket as in, readEnvCallerCredentials as io, buildImageOverrideTag as ir, MicrovmResolutionError as it, readRunHookPayload as j, resolveLambdaArnIntrinsic as ja, matchRoute as ji, createCloudFrontModule as jn, MCP_PROTOCOL_VERSION as jr, disposeWebFunctionArtifact as jt, finalizeMicrovmEnv as k, discoverRoutes as ka, isFunctionUrlOacFronted as ki, runViewerResponse as kn, MCP_CONTAINER_PORT as kr, resolveWebFunctionRuntime as kt, relayServeRequest as l, LocalStateSourceError as la, readMtlsMaterialsFromDisk as li, resolveErrorResponseCandidates as ln, buildStsClientConfig as lo, resolveImageOverrides as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, resolveCfnRegion as ma, buildCognitoJwksUrl as mi, buildEdgeRequestEvent as mn, listPinnedTargets as mr, containerFailure as mt, coerceRunRequest as n, resolveRuntimeFileExtension as na, buildStageMap as ni, createDeployedKvsDataSource as nn, assumedRoleRecorded as no, runEcsServiceEmulator as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, substituteAgainstStateAsync as oa, filterRoutesByApiIdentifier as oi, createS3OriginReader as on, resetWorkloadIdentity as oo, enforceImageOverrideOrphans as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, resolveCfnFallbackRegion as pa, defaultCredentialsLoader as pi, applyEdgeResponseResult as pn, isLocalCdkAssetImage as pr, WEB_FUNCTION_CONTAINER_PORT as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, containsDynamicReference as qa, buildMgmtEndpointEnvUrl as qi, addCommonEcsServiceOptions as qn, addInvokeSpecificOptions as qr, LocalStartCloudFrontError as qt, coerceServeRequest as r, resolveRuntimeImage as ra, materializeLayerFromArn as ri, resolveDeployedKvsArnByName as rn, deployAccountStsClientConfig as ro, ImageOverrideError as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, substituteEnvVarsFromState as sa, filterRoutesByApiIdentifiers as si, matchBehavior as sn, workloadClientConfig as so, mergeForService as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, resolveRuntimeCodeMountPath as ta, attachStageContext as ti, resolveKvsModulesForDistribution as tn, SECOND_ASSUME_MESSAGE as to, resolveSharedSidecarCredentials as tr, waitForAppAnswer as tt, reinvoke as u, createLocalStateProvider as ua, startApiServer as ui, serveFromStaticOrigin as un, resolveProfileCredentials as uo, runImageOverrideBuilds as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveSsmParameters as va, verifyJwtAuthorizer as vi, CLOUDFRONT_DISTRIBUTION_TYPE as vn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as vr, waitForWebFunctionReady as vt, createLocalListCommand as w, discoverWebSocketApis as wa, invokeTokenAuthorizer as wi, pickLambdaEdgeFunctionLogicalId as wn, bridgeAgentCoreWs as wr, webFunctionAssumeRole as wt, createStudioStore as x, countTargets as xa, computeRequestIdentityHash as xi, isCloudFrontDistribution as xn, attachContainerLogStreamer as xr, buildWebFunctionLambdaView as xt, toStudioTargetGroups as y, resolveWatchConfig as ya, verifyJwtViaDiscovery as yi, describeS3OriginDomain as yn, setShadowReadyTimeoutMs as yr, watchContainerExit as yt, MICROVM_CONTROL_PATH as z, resolveAgentCoreTarget as za, tryParseStatus as zi, isApplicationLoadBalancer as zn, waitForAgentCorePing as zr, resolveWebFunctionTarget as zt };
+//# sourceMappingURL=local-studio-BhFxp-jM.js.map