cdk-local 0.158.0 → 0.158.2

package/dist/{local-studio-vhvbqvPb.js → local-studio-DKhMiVll.js}

@@ -1,7 +1,7 @@
 import { C as sanitizeServiceExceptionMessage, S as isAwsServiceException, _ as resolveAssemblyPath, a as isDockerClientEnvKey, b as describeCredentialLoadFailure, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as renderAssemblyPathEscape, h as namesTheSameDirectory, i as getDockerCmd, l as spawnStreaming, m as isPasteableCommandArg, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as clampErrorName, w as stringifyThrown, x as flattenToOneLine, y as describeAwsFailureForWarn } from "./docker-cmd-CoZdbeos.js";
 import { a as displayIdent, c as getEmbedConfig, i as STACK_REF_MAX_CODE_POINTS, o as displayStackName, s as displayToolOutput, t as getLogger, u as setEmbedConfig } from "./logger-Co5XVwco.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
+import { homedir, hostname, tmpdir } from "node:os";
 import * as path$1 from "node:path";
 import path, { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { Command, InvalidArgumentError, Option } from "commander";
@@ -4910,6 +4910,14 @@ var EcsTaskResolutionError = class EcsTaskResolutionError extends Error {
 		Object.setPrototypeOf(this, EcsTaskResolutionError.prototype);
 	}
 };
+function assertEcsTaskImagesResolvable(task, coveredContainers = /* @__PURE__ */ new Set()) {
+	const reasons = [];
+	for (const c of task.containers) {
+		if (c.image.kind !== "same-stack-ecr" || coveredContainers.has(c.name)) continue;
+		reasons.push(c.image.unresolvedReason);
+	}
+	if (reasons.length > 0) throw new EcsTaskResolutionError(reasons.join("\n"));
+}
 function detectEcsImageResolutionNeeds(stack) {
 	const resources = stack.template.Resources ?? {};
 	let needsPseudoParameters = false;
@@ -5345,6 +5353,7 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 		ulimits,
 		warnings
 	};
+	if (droppedSecretKeys.length > 0) out.droppedSecretNames = droppedSecretKeys.map((d) => d.key);
 	if (command !== void 0) out.command = command;
 	if (entryPoint !== void 0) out.entryPoint = entryPoint;
 	if (workingDirectory !== void 0) out.workingDirectory = workingDirectory;
@@ -5364,10 +5373,11 @@ function buildSubstitutionContextFromImageContext(context) {
 }
 function parseContainerImage(raw, containerName, taskLogicalId, resources, _stack, context) {
 	const getAttImage = tryResolveImageGetAtt(raw, resources, context);
-	if (getAttImage) return classifyResolvedImage(getAttImage);
+	if (getAttImage?.kind === "resolved") return classifyResolvedImage(getAttImage.uri);
+	if (getAttImage?.kind === "needs-state") return sameStackEcrImage(containerName, taskLogicalId, getAttImage.repoLogicalId, context);
 	const joinResolved = tryResolveImageFnJoin(raw, resources, context);
 	if (joinResolved.kind === "resolved") return classifyResolvedImage(joinResolved.uri);
-	if (joinResolved.kind === "needs-state") throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} references same-stack ECR repository ${displayIdent(joinResolved.repoLogicalId)} via Fn::Join. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — ` + formatStateRemedy(context) + ", build via ContainerImage.fromAsset, or pin a public image.");
+	if (joinResolved.kind === "needs-state") return sameStackEcrImage(containerName, taskLogicalId, joinResolved.repoLogicalId, context, " via Fn::Join");
 	if (joinResolved.kind === "unsupported-join") throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} has an unsupported Fn::Join Image shape: ${joinResolved.reason}. ${getEmbedConfig().cliName} recognizes the canonical CDK 2.x ContainerImage.fromEcrRepository Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
 	const flat = extractImageString(raw);
 	if (!flat) throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} has an unparseable Image property. ${getEmbedConfig().cliName} supports flat string images, single-key Fn::Sub bodies, and CDK-asset Image references.`);
@@ -5380,7 +5390,7 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 	const substituted = substituteImagePlaceholders(flat, resources, context);
 	if (substituted.includes("${")) {
 		const unresolvedRepoRef = findUnresolvedEcrRepositoryRef(substituted, resources);
-		if (unresolvedRepoRef) throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} references same-stack ECR repository ${displayIdent(unresolvedRepoRef)}. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — ` + formatStateRemedy(context) + ", build via ContainerImage.fromAsset, or pin a public image.");
+		if (unresolvedRepoRef) return sameStackEcrImage(containerName, taskLogicalId, unresolvedRepoRef, context);
 		if (substituted.includes("AWS::")) throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} has an Image that references AWS pseudo parameters (${displayUntrustedValue(substituted)}). ${getEmbedConfig().productName} could not resolve them: confirm AWS credentials are configured so STS GetCallerIdentity succeeds, and that --region / AWS_REGION names the target region. Workaround: build the image locally (ContainerImage.fromAsset) or pin a public image.`);
 		throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} has an Image with unresolved \${...} placeholders (${displayUntrustedValue(substituted)}). ${getEmbedConfig().cliName} only resolves AWS pseudo parameters and same-stack AWS::ECR::Repository refs.`);
 	}
@@ -5396,6 +5406,13 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 		uri: substituted
 	};
 }
+function sameStackEcrImage(containerName, taskLogicalId, repoLogicalId, context, via = "") {
+	return {
+		kind: "same-stack-ecr",
+		repoLogicalId,
+		unresolvedReason: `Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} references same-stack ECR repository ${displayIdent(repoLogicalId)}${via}. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — ` + formatStateRemedy(context) + ", build via ContainerImage.fromAsset, pin a public image, or pass --image-override to build it from a local Dockerfile."
+	};
+}
 function findUnresolvedEcrRepositoryRef(substituted, resources) {
 	const placeholderRegex = /\$\{([^}]+)\}/g;
 	let m;
@@ -5446,7 +5463,14 @@ function tryResolveImageGetAtt(raw, resources, context) {
 	if (resources[logicalId]?.Type !== "AWS::ECR::Repository") return void 0;
 	if (attr !== "RepositoryUri" && attr !== "Arn") return void 0;
 	const cached = context?.stateResources?.[logicalId]?.attributes?.[attr];
-	if (typeof cached === "string" && cached.length > 0) return cached;
+	if (typeof cached === "string" && cached.length > 0) return {
+		kind: "resolved",
+		uri: cached
+	};
+	if (attr === "RepositoryUri") return {
+		kind: "needs-state",
+		repoLogicalId: logicalId
+	};
 }
 function extractImageString(value) {
 	if (typeof value === "string" && value.length > 0) return value;
@@ -16246,7 +16270,8 @@ function writePrefixedLines(prefix, buffer, out) {
 const execFileAsync$5 = promisify(execFile);
 const METADATA_ENDPOINT_IMAGE = "amazon/amazon-ecs-local-container-endpoints:latest-amd64";
 const METADATA_ENDPOINT_IP = "169.254.170.2";
-const DEFAULT_METADATA_ENDPOINT_SUBNET = "169.254.170.0/24";
+const TASK_ROLE_SUBNET_OCTET = 170;
+const TASK_ROLE_CREDENTIALS_PATH = "/creds";
 function buildEndpointSubnet(subnetOctet) {
 	if (subnetOctet < 1 || subnetOctet > 254 || !Number.isInteger(subnetOctet)) throw new Error(`buildEndpointSubnet: subnetOctet must be an integer in 1..254 (got ${subnetOctet}).`);
 	return {
@@ -16255,25 +16280,53 @@ function buildEndpointSubnet(subnetOctet) {
 	};
 }
 const SHARED_SVC_SUBNET_OCTET = 171;
+const OWNER_PID_LABEL = "cdk-local.owner-pid";
+const OWNER_HOST_LABEL = "cdk-local.owner-host";
+function fallbackSubnetOctets(preferred) {
+	const out = [preferred];
+	const push = (o) => {
+		if (o !== preferred) out.push(o);
+	};
+	for (let o = 171; o <= 254; o++) push(o);
+	for (let o = 1; o <= 168; o++) push(o);
+	return out;
+}
+function isSubnetTakenError(message) {
+	return /pool overlaps|overlaps with|overlapping|is already used|already in use/i.test(message);
+}
 async function createSharedSvcNetwork(options = {}) {
 	const prefix = options.prefix ?? getEmbedConfig().resourceNamePrefix;
 	await sweepOrphanedSvcNetworks(prefix);
 	const networkName = `${prefix}-svc-${randomBytes(4).toString("hex")}`;
-	const { cidr, sidecarIp } = buildEndpointSubnet(171);
+	const { sidecarContainerId, sidecarIp } = await createNetworkAndSidecar({
+		networkName,
+		subnetOctets: options.taskRole ? [170] : fallbackSubnetOctets(171),
+		labels: {
+			[OWNER_PID_LABEL]: String(process.pid),
+			[OWNER_HOST_LABEL]: hostname()
+		},
+		skipPull: options.skipPull ?? false,
+		...options.credentials !== void 0 ? { credentials: options.credentials } : {},
+		...options.cluster !== void 0 ? { cluster: options.cluster } : {}
+	});
 	return {
 		networkName,
-		sidecarContainerId: await createNetworkAndSidecar({
-			networkName,
-			cidr,
-			sidecarIp,
-			skipPull: options.skipPull ?? false,
-			...options.credentials !== void 0 ? { credentials: options.credentials } : {},
-			...options.cluster !== void 0 ? { cluster: options.cluster } : {}
-		}),
+		sidecarContainerId,
 		sidecarIp,
 		ownedByCaller: true
 	};
 }
+function ownerIsAlive(pidLabel, hostLabel) {
+	if (hostLabel !== hostname()) return true;
+	const pid = Number(pidLabel);
+	if (!Number.isInteger(pid) || pid <= 0) return true;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return err.code !== "ESRCH";
+	}
+}
 async function sweepOrphanedSvcNetworks(prefix) {
 	const logger = getLogger().child("ecs-network");
 	const filter = `${prefix}-svc-`;
@@ -16312,6 +16365,29 @@ async function sweepOrphanedSvcNetworks(prefix) {
 		}
 		const sidecarName = `${name}-metadata`;
 		if (attached.some((c) => c !== sidecarName)) continue;
+		let owner;
+		try {
+			const { stdout } = await execFileAsync$5(getDockerCmd(), [
+				"network",
+				"inspect",
+				name,
+				"--format",
+				`{{index .Labels "${OWNER_PID_LABEL}"}} {{index .Labels "${OWNER_HOST_LABEL}"}}`
+			]);
+			const [pid = "", host = ""] = stdout.trim().split(/\s+/);
+			owner = {
+				pid,
+				host
+			};
+		} catch (err) {
+			const e = err;
+			logger.debug(`docker network inspect ${name} labels (sweep) failed: ${displayToolOutput(e.stderr || e.message || String(err))}`);
+			continue;
+		}
+		if (owner.pid !== "" && ownerIsAlive(owner.pid, owner.host)) {
+			if (owner.host !== hostname()) logger.info(`Keeping shared network ${name}: it was created on host ${displayToolOutput(owner.host)}, whose processes cannot be checked from here; \`docker network rm\` it if it is stale.`);
+			continue;
+		}
 		logger.info(`Reclaiming orphaned shared network ${name} (no live owner)...`);
 		await removeContainer(sidecarName);
 		await destroyNetworkOnly(name);
@@ -16321,23 +16397,66 @@ async function sweepOrphanedSvcNetworks(prefix) {
 }
 async function createNetworkAndSidecar(args) {
 	const logger = getLogger().child("ecs-network");
-	const { networkName, cidr, sidecarIp, credentials, cluster, skipPull } = args;
+	const { networkName, subnetOctets, labels, credentials, cluster, skipPull } = args;
 	await pullImage(METADATA_ENDPOINT_IMAGE, skipPull);
-	logger.info(`Creating docker network ${networkName} (subnet ${cidr})...`);
+	const labelArgs = Object.entries(labels ?? {}).flatMap(([k, v]) => ["--label", `${k}=${v}`]);
+	let sidecarIp;
+	let lastCidr = "";
+	let lastDetail = "";
+	logger.info(`Creating docker network ${networkName}...`);
+	for (const octet of subnetOctets) {
+		const subnet = buildEndpointSubnet(octet);
+		lastCidr = subnet.cidr;
+		logger.debug(`Trying subnet ${subnet.cidr} for ${networkName}`);
+		try {
+			await execFileAsync$5(getDockerCmd(), [
+				"network",
+				"create",
+				"--driver",
+				"bridge",
+				"--subnet",
+				subnet.cidr,
+				...labelArgs,
+				networkName
+			]);
+			sidecarIp = subnet.sidecarIp;
+			logger.info(`Created docker network ${networkName} (subnet ${subnet.cidr})`);
+			break;
+		} catch (err) {
+			const e = err;
+			lastDetail = e.stderr?.trim() || e.message || String(err);
+			if (subnetOctets.length > 1 && isSubnetTakenError(lastDetail)) {
+				logger.debug(`Subnet ${subnet.cidr} is taken; trying the next link-local /24`);
+				continue;
+			}
+			break;
+		}
+	}
+	if (sidecarIp === void 0) {
+		let hint;
+		if (subnetOctets.length > 1) hint = isSubnetTakenError(lastDetail) ? "Hint: every candidate link-local /24 subnet is taken; remove leftover networks with `docker network ls` + `docker network rm`." : "Hint: check that the docker daemon is running and can create bridge networks.";
+		else if (isSubnetTakenError(lastDetail)) hint = pinnedSubnetConflictHint(lastCidr, await findNetworkHoldingSubnet(lastCidr));
+		else hint = "Hint: check that the docker daemon is running and can create bridge networks.";
+		throw new DockerRunnerError(`docker network create failed: ${displayToolOutput(lastDetail)}. ${hint}`);
+	}
 	try {
-		await execFileAsync$5(getDockerCmd(), [
-			"network",
-			"create",
-			"--driver",
-			"bridge",
-			"--subnet",
-			cidr,
-			networkName
-		]);
+		return {
+			sidecarContainerId: await startSidecar({
+				networkName,
+				sidecarIp,
+				...credentials !== void 0 ? { credentials } : {},
+				...cluster !== void 0 ? { cluster } : {}
+			}),
+			sidecarIp
+		};
 	} catch (err) {
-		const e = err;
-		throw new DockerRunnerError(`docker network create failed: ${displayToolOutput(e.stderr?.trim() || e.message || String(err))}. Hint: another ${getEmbedConfig().productName} run may already own subnet ${cidr}; wait for it to finish, or remove the leftover network with \`docker network ls\` + \`docker network rm\`. \`${getEmbedConfig().cliName} start-service\` shares one network across every service in the run; bare \`${getEmbedConfig().cliName} run-task\` uses a per-task network so only one run can be active at a time.`);
+		await destroyNetworkOnly(networkName);
+		throw err;
 	}
+}
+async function startSidecar(args) {
+	const logger = getLogger().child("ecs-network");
+	const { networkName, sidecarIp, credentials, cluster } = args;
 	const sidecarArgs = [
 		"run",
 		"-d",
@@ -16368,26 +16487,21 @@ async function createNetworkAndSidecar(args) {
 		});
 		return stdout.trim();
 	} catch (err) {
-		await destroyNetworkOnly(networkName);
 		throw new DockerRunnerError(`Failed to start metadata-endpoints sidecar: ${displayToolOutput(err.stderr?.trim() || describeExitWithoutArgv(err))}`);
 	}
 }
 async function createTaskNetwork(options = {}) {
 	const networkName = `${options.prefix ?? getEmbedConfig().resourceNamePrefix}-task-${randomBytes(4).toString("hex")}`;
-	const { cidr, sidecarIp } = options.subnetOctet === void 0 ? {
-		cidr: DEFAULT_METADATA_ENDPOINT_SUBNET,
-		sidecarIp: METADATA_ENDPOINT_IP
-	} : buildEndpointSubnet(options.subnetOctet);
+	const { sidecarContainerId, sidecarIp } = await createNetworkAndSidecar({
+		networkName,
+		subnetOctets: options.subnetOctet === void 0 ? [170] : fallbackSubnetOctets(options.subnetOctet),
+		skipPull: options.skipPull ?? false,
+		...options.credentials !== void 0 ? { credentials: options.credentials } : {},
+		...options.cluster !== void 0 ? { cluster: options.cluster } : {}
+	});
 	return {
 		networkName,
-		sidecarContainerId: await createNetworkAndSidecar({
-			networkName,
-			cidr,
-			sidecarIp,
-			skipPull: options.skipPull ?? false,
-			...options.credentials !== void 0 ? { credentials: options.credentials } : {},
-			...options.cluster !== void 0 ? { cluster: options.cluster } : {}
-		}),
+		sidecarContainerId,
 		sidecarIp
 	};
 }
@@ -16397,10 +16511,56 @@ function buildMetadataEnv(opts) {
 		ECS_CONTAINER_METADATA_URI_V4: `http://${ip}/v4/${opts.containerName}`,
 		ECS_CONTAINER_METADATA_URI: `http://${ip}/v3/${opts.containerName}`
 	};
-	if (opts.roleArn) env["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"] = `/role/${encodeURIComponent(opts.roleArn)}`;
+	if (opts.roleArn) {
+		if (ip !== "169.254.170.2") throw new DockerRunnerError(`A task role needs the metadata sidecar at ${METADATA_ENDPOINT_IP} (SDKs read task-role credentials only from there), but this task's network put it at ${ip}.`);
+		env["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"] = TASK_ROLE_CREDENTIALS_PATH;
+	}
 	if (opts.region) env["AWS_REGION"] = opts.region;
 	return env;
 }
+async function serveTaskRoleFromSharedSidecar(net, args) {
+	if (net.taskRoleArn === args.roleArn) return;
+	if (net.taskRoleArn !== void 0) throw new DockerRunnerError(`This run's services resolve to different task roles (${displayToolOutput(net.taskRoleArn)} and ${displayToolOutput(args.roleArn)}; on a --watch reload, the task role changed since startup), but the shared metadata sidecar at ${METADATA_ENDPOINT_IP} can serve only one. Pass one role for every service with \`--assume-role <arn>\`, start the services in separate runs one at a time, or restart the run after changing the role.`);
+	if (net.sidecarIp !== "169.254.170.2") throw new DockerRunnerError(`A task role needs the metadata sidecar at ${METADATA_ENDPOINT_IP}, but network ${net.networkName} put it at ${net.sidecarIp}.`);
+	getLogger().child("ecs-network").info(`Restarting the metadata sidecar to serve task role ${displayToolOutput(args.roleArn)}...`);
+	await removeContainer(net.sidecarContainerId);
+	net.sidecarContainerId = await startSidecar({
+		networkName: net.networkName,
+		sidecarIp: net.sidecarIp,
+		credentials: args.credentials,
+		...args.cluster !== void 0 ? { cluster: args.cluster } : {}
+	});
+	net.taskRoleArn = args.roleArn;
+}
+async function findNetworkHoldingSubnet(cidr) {
+	try {
+		const { stdout: ls } = await execFileAsync$5(getDockerCmd(), [
+			"network",
+			"ls",
+			"--format",
+			"{{.Name}}"
+		]);
+		const names = ls.split("\n").map((n) => n.trim()).filter((n) => n.length > 0);
+		if (names.length === 0) return void 0;
+		const { stdout } = await execFileAsync$5(getDockerCmd(), [
+			"network",
+			"inspect",
+			"--format",
+			"{{.Name}} {{range .IPAM.Config}}{{.Subnet}} {{end}}",
+			...names
+		]);
+		for (const line of stdout.split("\n")) {
+			const [name, ...subnets] = line.trim().split(/\s+/);
+			if (name && subnets.includes(cidr)) return name;
+		}
+	} catch {}
+}
+function pinnedSubnetConflictHint(cidr, holder) {
+	const { productName, cliName } = getEmbedConfig();
+	const who = holder !== void 0 ? `docker network ${displayToolOutput(holder)} already holds ${cidr}` : `another network already holds ${cidr}`;
+	const remove = holder !== void 0 ? `\`docker network rm ${displayToolOutput(holder)}\`` : "`docker network ls` + `docker network rm`";
+	return `Hint: ${who}. A task role needs that subnet: AWS SDKs read task-role credentials only from the metadata sidecar at ${METADATA_ENDPOINT_IP}, so a ${productName} run with a task role (\`${cliName} run-task\` / \`start-service\` / \`start-alb\` with \`--assume-role\`) cannot move to another subnet, and only one can be active per host. Stop the run that owns it, or remove a leftover network with ${remove}, then retry.`;
+}
 async function destroyTaskNetwork(net) {
 	if (!net) return;
 	await removeContainer(net.sidecarContainerId);
@@ -16590,6 +16750,7 @@ async function runEcsTask(task, options, state) {
 	for (const c of task.containers) {
 		const refusal = finchSecretArgvRefusal([
 			...c.secrets.map((s) => s.name),
+			...(c.droppedSecretNames ?? []).filter((n) => overriddenEnvKeys(options.envOverrides, c.name).includes(n)),
 			...c.sensitiveEnvKeys,
 			...dynamicReferenceEnvKeys(c, options.envOverrides)
 		].filter((n) => !isMalformedEnvKey(n) && !isDockerClientEnvKey(n)), {
@@ -16612,11 +16773,20 @@ async function runEcsTask(task, options, state) {
 	const imagePlan = options.imagePlanByContainer ?? /* @__PURE__ */ new Map();
 	if (!options.imagePlanByContainer) await prepareImages(task, imagePlan, options);
 	const allSecrets = [];
-	for (const c of task.containers) for (const s of c.secrets) allSecrets.push({
-		containerName: c.name,
-		name: s.name,
-		valueFrom: s.valueFrom
-	});
+	for (const c of task.containers) {
+		const overridden = new Set(overriddenEnvKeys(options.envOverrides, c.name));
+		for (const s of c.secrets) {
+			if (overridden.has(s.name)) {
+				logger.debug(`Secret ${displayIdent(c.name)}.${displayIdent(s.name)} not fetched: --env-vars gives this key.`);
+				continue;
+			}
+			allSecrets.push({
+				containerName: c.name,
+				name: s.name,
+				valueFrom: s.valueFrom
+			});
+		}
+	}
 	const secretsByContainer = groupSecretsByContainer(await resolveEcsSecrets(allSecrets, {
 		...options.region !== void 0 && { region: options.region },
 		...options.profile !== void 0 && { profile: options.profile }
@@ -16648,7 +16818,7 @@ async function runEcsTask(task, options, state) {
 		};
 		if (options.taskCredentials) netCreateOpts.credentials = options.taskCredentials;
 		if (options.cluster) netCreateOpts.cluster = options.cluster;
-		if (options.subnetOctet !== void 0) netCreateOpts.subnetOctet = options.subnetOctet;
+		if (!options.taskRoleArn) netCreateOpts.subnetOctet = options.subnetOctet ?? 171;
 		state.network = await createTaskNetwork(netCreateOpts);
 	}
 	const volumeByName = await realizeDockerVolumes(task.volumes, state);
@@ -16871,6 +17041,7 @@ async function prepareImages(task, out, options) {
 async function prepareOneImage(task, container, options) {
 	const image = container.image;
 	switch (image.kind) {
+		case "same-stack-ecr": throw new EcsTaskRunnerError(image.unresolvedReason);
 		case "public":
 			await pullImage(image.uri, options.skipPull);
 			return image.uri;
@@ -17092,6 +17263,8 @@ function buildDockerRunArgs(opts) {
 	}
 	const sensitiveEnvKeys = new Set(SENSITIVE_ENV_KEYS);
 	for (const s of secrets) sensitiveEnvKeys.add(s.name);
+	for (const s of container.secrets) sensitiveEnvKeys.add(s.name);
+	for (const n of container.droppedSecretNames ?? []) sensitiveEnvKeys.add(n);
 	for (const k of container.sensitiveEnvKeys) sensitiveEnvKeys.add(k);
 	const { passthrough: sensitiveEnv, collisions } = appendEnvFlags(args, finalEnv, sensitiveEnvKeys);
 	if (container.user) args.push("--user", container.user);
@@ -19927,6 +20100,7 @@ function describePinnedImageUri(service) {
 	const image = representativeImage(service);
 	if (!image) return void 0;
 	if (image.kind === "cdk-asset") return void 0;
+	if (image.kind === "same-stack-ecr") return `same-stack ECR repository ${image.repoLogicalId}`;
 	return image.uri;
 }
 function imageOverrideKeyAliases(service) {
@@ -20069,6 +20243,20 @@ function parseImageOverrideFlags(input) {
 		if (!stage) throw new ImageOverrideError(`Invalid --image-target value "${raw}": right side (stage) is empty.`);
 		getPerSvc(svc).targetStage = stage;
 	}
+	const imageContextList = input.imageContext === void 0 ? [] : Array.isArray(input.imageContext) ? input.imageContext : [input.imageContext];
+	for (const raw of imageContextList) {
+		if (!raw || !raw.trim()) throw new ImageOverrideError("Invalid --image-context value: empty string.");
+		const eq = raw.indexOf("=");
+		if (eq < 0) {
+			globals.contextDir = raw.trim();
+			continue;
+		}
+		const svc = raw.slice(0, eq).trim();
+		const dir = raw.slice(eq + 1).trim();
+		if (!svc) throw new ImageOverrideError(`Invalid --image-context value "${raw}": left side (service target) is empty.`);
+		if (!dir) throw new ImageOverrideError(`Invalid --image-context value "${raw}": right side (build context directory) is empty.`);
+		getPerSvc(svc).contextDir = dir;
+	}
 	return {
 		explicit,
 		pickerPaths,
@@ -20114,7 +20302,8 @@ function canonicalizeImageOverrideKeys(rawFlags, pinnedAliases, knownTargets = [
 			perService.set(target, {
 				buildArgs: new Map(overlay.buildArgs),
 				buildSecrets: new Map(overlay.buildSecrets),
-				...overlay.targetStage !== void 0 && { targetStage: overlay.targetStage }
+				...overlay.targetStage !== void 0 && { targetStage: overlay.targetStage },
+				...overlay.contextDir !== void 0 && { contextDir: overlay.contextDir }
 			});
 			continue;
 		}
@@ -20133,6 +20322,10 @@ function canonicalizeImageOverrideKeys(rawFlags, pinnedAliases, knownTargets = [
 			if (into.targetStage !== void 0 && into.targetStage !== overlay.targetStage) conflict("the target stage");
 			into.targetStage = overlay.targetStage;
 		}
+		if (overlay.contextDir !== void 0) {
+			if (into.contextDir !== void 0 && resolve(expandTilde(into.contextDir)) !== resolve(expandTilde(overlay.contextDir))) conflict("the build context");
+			into.contextDir = overlay.contextDir;
+		}
 	}
 	return {
 		...rawFlags,
@@ -20300,16 +20493,19 @@ function mergeForService(serviceTarget, globals, perService) {
 	const buildArgs = new Map(globals.buildArgs);
 	const buildSecrets = new Map(globals.buildSecrets);
 	let targetStage = globals.targetStage;
+	let contextDir = globals.contextDir;
 	const overlay = perService.get(serviceTarget);
 	if (overlay) {
 		for (const [k, v] of overlay.buildArgs.entries()) buildArgs.set(k, v);
 		for (const [k, v] of overlay.buildSecrets.entries()) buildSecrets.set(k, v);
 		if (overlay.targetStage !== void 0) targetStage = overlay.targetStage;
+		if (overlay.contextDir !== void 0) contextDir = overlay.contextDir;
 	}
 	return {
 		buildArgs,
 		buildSecrets,
-		...targetStage !== void 0 && { targetStage }
+		...targetStage !== void 0 && { targetStage },
+		...contextDir !== void 0 && { contextDir }
 	};
 }
 function makeEntryFromPath(raw, serviceTarget, rawFlags, cwd) {
@@ -20318,9 +20514,14 @@ function makeEntryFromPath(raw, serviceTarget, rawFlags, cwd) {
 	if (!existsSync(abs)) throw new ImageOverrideError(`--image-override: Dockerfile '${raw}' does not exist (resolved to '${abs}').`);
 	if (!statSync(abs).isFile()) throw new ImageOverrideError(`--image-override: '${raw}' is not a regular file (resolved to '${abs}').`);
 	const merged = mergeForService(serviceTarget, rawFlags.globals, rawFlags.perService);
+	let contextDir = dirname(abs);
+	if (merged.contextDir !== void 0) {
+		contextDir = resolve(cwd, expandTilde(merged.contextDir));
+		if (!existsSync(contextDir) || !statSync(contextDir).isDirectory()) throw new ImageOverrideError(`--image-context: '${merged.contextDir}' is not an existing directory (resolved to '${contextDir}').`);
+	}
 	return {
 		dockerfile: abs,
-		contextDir: dirname(abs),
+		contextDir,
 		buildArgs: merged.buildArgs,
 		buildSecrets: merged.buildSecrets,
 		...merged.targetStage !== void 0 && { targetStage: merged.targetStage }
@@ -20352,6 +20553,10 @@ function buildImageOverrideTag(serviceTarget, entry) {
 		hash.update(";");
 	}
 	hash.update("}");
+	if (entry.contextDir !== dirname(entry.dockerfile)) {
+		hash.update("\0context=");
+		hash.update(entry.contextDir);
+	}
 	const svcSlug = serviceTarget.replace(/[^A-Za-z0-9]+/g, "-").slice(0, 24).toLowerCase();
 	return `${getEmbedConfig().resourceNamePrefix}-override-${svcSlug}-${hash.digest("hex").slice(0, 16)}:local`;
 }
@@ -20412,6 +20617,7 @@ function enforceImageOverrideOrphans(rawFlags, resolvedOverrides) {
 			offenders.push(`--image-build-secret ${svc}:${ids} references a service with no --image-override mapping.`);
 		}
 		if (overlay.targetStage !== void 0) offenders.push(`--image-target ${svc}=${overlay.targetStage} references a service with no --image-override mapping.`);
+		if (overlay.contextDir !== void 0) offenders.push(`--image-context ${svc}=${overlay.contextDir} references a service with no --image-override mapping.`);
 	}
 	if (offenders.length === 0) return;
 	throw new LocalStartServiceError(`Per-service image-override flag(s) target a service with no --image-override coverage. Add the matching --image-override <service>=<dockerfile>, drop the per-service flag, or fix the service name:\n  ${offenders.join("\n  ")}`);
@@ -20514,12 +20720,14 @@ async function runEcsServiceEmulator(targets, options, strategy, extraStateProvi
 			for (const w of index.warnings) logger.warn(w);
 		}
 		const registry = new CloudMapRegistry();
-		const sidecarCredentials = await resolveSharedSidecarCredentials(options);
+		const taskRoleMode = isTaskRoleInEffect(options);
+		const sidecarCredentials = taskRoleMode ? void 0 : await resolveSharedSidecarCredentials(options);
 		try {
 			sharedNetwork = await createSharedSvcNetwork({
 				prefix: options.cluster,
 				skipPull,
 				cluster: options.cluster,
+				...taskRoleMode && { taskRole: true },
 				...sidecarCredentials !== void 0 && { credentials: sidecarCredentials }
 			});
 		} catch (err) {
@@ -20836,8 +21044,10 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 	const logger = getLogger();
 	const target = boot.target;
 	const quiet = opts.quiet === true;
-	const imageContext = await buildEcsImageResolutionContext$1(target, stacks, options, stateProvider);
+	const imageContext = await buildEcsImageResolutionContext$1(target, stacks, options, stateProvider, opts.imageOverrideTag !== void 0 ? { imageOverridden: true } : {});
 	const service = resolveEcsServiceTarget(target, stacks, imageContext, { suppressLoadBalancerWarning });
+	const representative = service.task.containers.find((c) => c.essential) ?? service.task.containers[0];
+	assertEcsTaskImagesResolvable(service.task, new Set(opts.imageOverrideTag !== void 0 && representative ? [representative.name] : []));
 	if (!quiet) logger.info(`Target: ${displayStackName(`${service.stack.stackName}/${service.serviceLogicalId}`)} (service=${displayIdent(service.serviceName)}, desiredCount=${service.desiredCount}, task=${displayIdent(service.task.taskDefinitionLogicalId)})`);
 	if (!quiet && service.serviceConnect) logger.info(`Service Connect: namespace=${displayIdent(service.serviceConnect.namespaceName)}, ${service.serviceConnect.services.length} service(s) registered for peer discovery.`);
 	if (!quiet && service.serviceRegistries.length > 0) logger.info(`Cloud Map: ${service.serviceRegistries.length} ServiceRegistry binding(s).`);
@@ -20878,6 +21088,15 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 		resolvedRoleArn = effectiveAssumeRole;
 		assumedCredentials = await assumeTaskRole$1(resolvedRoleArn, options.region, options.profile);
 	}
+	if (discovery.sharedNetwork && resolvedRoleArn !== void 0 && assumedCredentials) try {
+		await serveTaskRoleFromSharedSidecar(discovery.sharedNetwork, {
+			roleArn: resolvedRoleArn,
+			credentials: assumedCredentials,
+			...options.cluster !== void 0 && { cluster: options.cluster }
+		});
+	} catch (err) {
+		throw new LocalStartServiceError(err instanceof Error ? err.message : String(err));
+	}
 	const envOverrides = readEnvOverridesFile$1(options.envVars);
 	const taskOpts = {
 		cluster: options.cluster,
@@ -21265,7 +21484,7 @@ async function buildEcsImageResolutionContext$1(target, stacks, options, statePr
 			if (ssmParameters.secureStringLogicalIds.length > 0) ctx.stateSensitiveParameters = ssmParameters.secureStringLogicalIds;
 		}
 	} else if (!stateProvider && needs.needsStateResources) {
-		if (!opts.suppressStateWarning) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI.");
+		if (!opts.suppressStateWarning && !opts.imageOverridden) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI, or --image-override to build it from a local Dockerfile.");
 	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) {
 		if (!opts.suppressStateWarning) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against the deployed state.");
 	}
@@ -21393,7 +21612,8 @@ async function resolveAndBuildImageOverrides(args) {
 		...options.imageOverride && { imageOverride: options.imageOverride },
 		...options.imageBuildArg && { imageBuildArg: options.imageBuildArg },
 		...options.imageBuildSecret && { imageBuildSecret: options.imageBuildSecret },
-		...options.imageTarget && { imageTarget: options.imageTarget }
+		...options.imageTarget && { imageTarget: options.imageTarget },
+		...options.imageContext && { imageContext: options.imageContext }
 	}), pinnedAliases, perTarget);
 	if (pinnedTargets.length === 0 && rawFlags.explicit.size === 0 && rawFlags.pickerPaths.length === 0 && rawFlags.perService.size === 0) return {
 		tags: /* @__PURE__ */ new Map(),
@@ -21429,6 +21649,10 @@ function addEcsAssumeRoleOptions(cmd) {
 	return cmd.addOption(new Option("--assume-task-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed task role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override. DEPRECATED alias of `--assume-role`; both forms work, but `--assume-role` is the cross-command name and will become the only form in a future release.")).addOption(new Option("--assume-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed task role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override. Cross-command alias matching the same flag on `invoke` / `invoke-agentcore` / `start-api`; supersedes the older `--assume-task-role` (which still works)."));
 }
 let assumeTaskRoleDeprecationWarned = false;
+function isTaskRoleInEffect(options) {
+	const effective = resolveEcsAssumeRoleOption(options);
+	return effective === true || typeof effective === "string";
+}
 function resolveEcsAssumeRoleOption(options) {
 	if (options.assumeRole !== void 0) return options.assumeRole;
 	if (options.assumeTaskRole !== void 0) {
@@ -21452,7 +21676,7 @@ function addCommonEcsServiceOptions(cmd) {
 	return cmd;
 }
 function addImageOverrideOptions(cmd) {
-	return cmd.addOption(new Option("--image-override <service=dockerfile or dockerfile...>", "Replace a service target's deployed-registry image with a local `docker build` of the supplied Dockerfile (repeatable). Two forms: <service>=<dockerfile> binds the service explicitly; a bare <dockerfile> opens a multi-select picker against the still-uncovered pinned targets (one Dockerfile across N services). Mix freely. Lets `--from-cfn-stack` still reach real AWS state while you iterate locally on the application container.")).addOption(new Option("--image-build-arg <KEY=VAL...>", "Global `docker build --build-arg KEY=VAL` pair applied to every --image-override build (repeatable). Lets a CDK Dockerfile that branches on an ARG (env target, base image tag, package mirror) honor that ARG locally without editing the Dockerfile.")).addOption(new Option("--image-build-secret <id=src...>", "Global `docker build --secret id=<id>,src=<src>` entry applied to every --image-override build (repeatable). Enables `RUN --mount=type=secret,id=<id>` in the Dockerfile — the standard private-registry / npm-token recipe (e.g. `--image-build-secret npmrc=./.npmrc`).")).addOption(new Option("--image-target <stage or svc=stage...>", "Repeatable. Bare `<stage>` is a global --target for every --image-override build; `<service>=<stage>` (issue #240) scopes the --target to one overridden target so a monorepo with different multi-stage Dockerfiles per service can stop each at its own intermediate stage. Per-service form overrides the global on the named target.")).addOption(new Option("--no-interactive-overrides", "Suppress the interactive boot prompt that walks each pinned target asking for a Dockerfile path, and the multi-select prompt fired by `--image-override <dockerfile>` (picker form). Useful for CI / scripted invocations.")).addOption(new Option("--strict-overrides", "Fail fast at boot when any pinned target remains uncovered after `--image-override` + the boot prompt resolve. Off by default; the boot WARN per uncovered pinned target still fires regardless.").default(false));
+	return cmd.addOption(new Option("--image-override <service=dockerfile or dockerfile...>", "Replace a service target's deployed-registry image with a local `docker build` of the supplied Dockerfile (repeatable). Two forms: <service>=<dockerfile> binds the service explicitly; a bare <dockerfile> opens a multi-select picker against the still-uncovered pinned targets (one Dockerfile across N services). Mix freely. Lets `--from-cfn-stack` still reach real AWS state while you iterate locally on the application container.")).addOption(new Option("--image-build-arg <KEY=VAL...>", "Global `docker build --build-arg KEY=VAL` pair applied to every --image-override build (repeatable). Lets a CDK Dockerfile that branches on an ARG (env target, base image tag, package mirror) honor that ARG locally without editing the Dockerfile.")).addOption(new Option("--image-build-secret <id=src...>", "Global `docker build --secret id=<id>,src=<src>` entry applied to every --image-override build (repeatable). Enables `RUN --mount=type=secret,id=<id>` in the Dockerfile — the standard private-registry / npm-token recipe (e.g. `--image-build-secret npmrc=./.npmrc`).")).addOption(new Option("--image-target <stage or svc=stage...>", "Repeatable. Bare `<stage>` is a global --target for every --image-override build; `<service>=<stage>` (issue #240) scopes the --target to one overridden target so a monorepo with different multi-stage Dockerfiles per service can stop each at its own intermediate stage. Per-service form overrides the global on the named target.")).addOption(new Option("--image-context <dir or svc=dir...>", "Repeatable. The `docker build` context for --image-override builds whose Dockerfile lives below it (a monorepo whose apps share code: --image-override Svc=apps/api/Dockerfile --image-context Svc=.). Bare `<dir>` applies to every overridden target; `<service>=<dir>` scopes it to one and overrides the global. Default: the Dockerfile's directory.")).addOption(new Option("--no-interactive-overrides", "Suppress the interactive boot prompt that walks each pinned target asking for a Dockerfile path, and the multi-select prompt fired by `--image-override <dockerfile>` (picker form). Useful for CI / scripted invocations.")).addOption(new Option("--strict-overrides", "Fail fast at boot when any pinned target remains uncovered after `--image-override` + the boot prompt resolve. Off by default; the boot WARN per uncovered pinned target still fires regardless.").default(false));
 }
 
 //#endregion
@@ -21593,7 +21817,8 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 			cwd: process.cwd()
 		});
 		if (imageOverrideResult.imageOverrideByContainer) runOpts.imageOverrideByContainer = imageOverrideResult.imageOverrideByContainer;
-		else if (imageOverrideResult.pinnedUncovered) logger.warn("Task definition image is pinned to a deployed registry; local source edits will not take effect. Pass --image-override <dockerfile> to rebuild it from local source.");
+		assertEcsTaskImagesResolvable(task, runOpts.imageOverrideByContainer);
+		if (!imageOverrideResult.imageOverrideByContainer && imageOverrideResult.pinnedUncovered) logger.warn("Task definition image is pinned to a deployed registry; local source edits will not take effect. Pass --image-override <dockerfile> to rebuild it from local source.");
 		if (!options.detach) runOpts.onReady = () => {
 			logger.info(`Task running (family=${task.family}); streaming container logs. Stop with Ctrl-C.`);
 		};
@@ -21695,8 +21920,9 @@ async function buildEcsImageResolutionContext(candidate, stateProvider, options)
 			if (Object.keys(ssmParameters.values).length > 0) ctx.stateParameters = ssmParameters.values;
 			if (ssmParameters.secureStringLogicalIds.length > 0) ctx.stateSensitiveParameters = ssmParameters.secureStringLogicalIds;
 		}
-	} else if (!stateProvider && needs.needsStateResources) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI. Otherwise the resolver will surface its existing error.");
-	else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
+	} else if (!stateProvider && needs.needsStateResources) {
+		if (!options.imageOverride?.length) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI, or --image-override to build it from a local Dockerfile. Otherwise the resolver will surface its existing error.");
+	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
 	return ctx;
 }
 function pickCandidateStack(target, stacks) {
@@ -21773,7 +21999,8 @@ async function resolveRunTaskImageOverride(args) {
 		...options.imageOverride && { imageOverride: options.imageOverride },
 		...options.imageBuildArg && { imageBuildArg: options.imageBuildArg },
 		...options.imageBuildSecret && { imageBuildSecret: options.imageBuildSecret },
-		...options.imageTarget && { imageTarget: options.imageTarget }
+		...options.imageTarget && { imageTarget: options.imageTarget },
+		...options.imageContext && { imageContext: options.imageContext }
 	}), pinnedAliases, [target]);
 	if (pinnedTargets.length === 0 && rawFlags.explicit.size === 0 && rawFlags.pickerPaths.length === 0 && rawFlags.perService.size === 0) return {};
 	const overrides = await resolveImageOverrides({
@@ -21861,7 +22088,7 @@ function resolveAlbFrontDoor(stack, albLogicalId) {
 		for (const { ruleLogicalId, ruleProps } of rulesByListener.get(listenerLogicalId) ?? []) {
 			const priority = parsePriority(ruleProps["Priority"]);
 			const ruleLabel = `Listener rule ${displayIdent(ruleLogicalId)} (priority ${priority})`;
-			const parsed = parseRuleConditions(ruleProps["Conditions"], ruleLabel, warnings);
+			const parsed = parseRuleConditions(ruleProps["Conditions"], albLogicalId, ruleLabel, warnings);
 			if (!parsed) continue;
 			const { pathPatterns, hostPatterns, httpHeaderConditions, httpRequestMethods, queryStringConditions, sourceIpCidrs } = parsed;
 			if (!(pathPatterns.length > 0 || hostPatterns.length > 0 || httpHeaderConditions.length > 0 || httpRequestMethods.length > 0 || queryStringConditions.length > 0 || sourceIpCidrs.length > 0)) continue;
@@ -22073,7 +22300,7 @@ function indexRulesByListener(resources) {
 	}
 	return index;
 }
-function parseRuleConditions(conditions, ruleLabel, warnings) {
+function parseRuleConditions(conditions, albLogicalId, ruleLabel, warnings) {
 	const out = {
 		pathPatterns: [],
 		hostPatterns: [],
@@ -22087,18 +22314,41 @@ function parseRuleConditions(conditions, ruleLabel, warnings) {
 		if (!cond || typeof cond !== "object") continue;
 		const c = cond;
 		const field = typeof c["Field"] === "string" ? c["Field"] : "(unknown)";
-		if (field === "path-pattern") out.pathPatterns.push(...conditionValues(c, "PathPatternConfig"));
-		else if (field === "host-header") out.hostPatterns.push(...conditionValues(c, "HostHeaderConfig"));
-		else if (field === "http-header") {
+		if (field === "path-pattern") {
+			const values = conditionValues(c, "PathPatternConfig");
+			if (!values) {
+				warnings.push(unresolvableConditionWarning(ruleLabel, field));
+				return;
+			}
+			out.pathPatterns.push(...values);
+		} else if (field === "host-header") {
+			const values = hostHeaderConditionValues(c, albLogicalId);
+			if (!values) {
+				warnings.push(unresolvableConditionWarning(ruleLabel, field));
+				return;
+			}
+			out.hostPatterns.push(...values);
+		} else if (field === "http-header") {
 			const parsed = parseHttpHeaderCondition(c);
 			if (!parsed) {
-				warnings.push(`${ruleLabel} has an http-header condition with no HttpHeaderName / Values; skipping the rule.`);
+				warnings.push(`${ruleLabel} has an http-header condition with no HttpHeaderName / Values, or a value that is not a literal string; skipping the rule.`);
 				return;
 			}
 			out.httpHeaderConditions.push(parsed);
-		} else if (field === "http-request-method") out.httpRequestMethods.push(...conditionValues(c, "HttpRequestMethodConfig"));
-		else if (field === "query-string") {
-			const { parsed, hadEntries } = parseQueryStringConditionValues(c);
+		} else if (field === "http-request-method") {
+			const values = conditionValues(c, "HttpRequestMethodConfig");
+			if (!values) {
+				warnings.push(unresolvableConditionWarning(ruleLabel, field));
+				return;
+			}
+			out.httpRequestMethods.push(...values);
+		} else if (field === "query-string") {
+			const qs = parseQueryStringConditionValues(c);
+			if (!qs) {
+				warnings.push(unresolvableConditionWarning(ruleLabel, field));
+				return;
+			}
+			const { parsed, hadEntries } = qs;
 			if (hadEntries && parsed.length === 0) {
 				warnings.push(`${ruleLabel} query-string condition has no parseable { Key?, Value } entries; skipping the rule.`);
 				return;
@@ -22106,6 +22356,10 @@ function parseRuleConditions(conditions, ruleLabel, warnings) {
 			out.queryStringConditions.push(...parsed);
 		} else if (field === "source-ip") {
 			const values = conditionValues(c, "SourceIpConfig");
+			if (!values) {
+				warnings.push(unresolvableConditionWarning(ruleLabel, field));
+				return;
+			}
 			const invalid = values.filter((v) => !isValidCidr(v));
 			if (invalid.length > 0) {
 				warnings.push(`${ruleLabel} source-ip condition has unparseable CIDR(s): ${invalid.join(", ")}. The local ALB front-door requires valid IPv4 / IPv6 CIDRs; skipping the rule.`);
@@ -22125,24 +22379,26 @@ function parseHttpHeaderCondition(cond) {
 	const c = cfg;
 	const name = c["HttpHeaderName"];
 	if (typeof name !== "string" || name.length === 0) return void 0;
-	const values = (Array.isArray(c["Values"]) ? c["Values"] : []).filter((v) => typeof v === "string");
-	if (values.length === 0) return void 0;
+	const values = Array.isArray(c["Values"]) ? c["Values"] : [];
+	if (values.length === 0 || !values.every((v) => typeof v === "string")) return;
 	return {
 		name,
 		values
 	};
 }
 function parseQueryStringConditionValues(cond) {
-	const cfg = cond["QueryStringConfig"];
-	const rawValues = cfg && typeof cfg === "object" && Array.isArray(cfg["Values"]) ? cfg["Values"] : Array.isArray(cond["Values"]) ? cond["Values"] : [];
+	const rawValues = rawConditionValues(cond, "QueryStringConfig");
+	if (!rawValues) return void 0;
 	const parsed = [];
 	for (const v of rawValues) if (typeof v === "string") parsed.push({ value: v });
 	else if (v && typeof v === "object") {
 		const e = v;
+		if (isIntrinsic(e)) return void 0;
 		const value = e["Value"];
-		if (typeof value !== "string") continue;
 		const key = e["Key"];
-		parsed.push(typeof key === "string" ? {
+		if (value && typeof value === "object" || key && typeof key === "object") return;
+		if (typeof value !== "string" || key !== void 0 && typeof key !== "string") continue;
+		parsed.push(key !== void 0 ? {
 			key,
 			value
 		} : { value });
@@ -22152,6 +22408,9 @@ function parseQueryStringConditionValues(cond) {
 		hadEntries: rawValues.length > 0
 	};
 }
+function isIntrinsic(obj) {
+	return Object.keys(obj).some((k) => k === "Ref" || k.startsWith("Fn::"));
+}
 function isValidCidr(value) {
 	const slash = value.indexOf("/");
 	if (slash === -1) return false;
@@ -22168,9 +22427,39 @@ function isValidCidr(value) {
 	if (addr.includes(":")) return prefixLen >= 0 && prefixLen <= 128;
 	return false;
 }
-function conditionValues(cond, configKey) {
+function rawConditionValues(cond, configKey) {
 	const cfg = cond[configKey];
-	return (cfg && typeof cfg === "object" && Array.isArray(cfg["Values"]) ? cfg["Values"] : Array.isArray(cond["Values"]) ? cond["Values"] : []).filter((v) => typeof v === "string");
+	if (cfg !== void 0) {
+		if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) return void 0;
+		const c = cfg;
+		if (isIntrinsic(c)) return void 0;
+		if (Array.isArray(c["Values"])) return c["Values"];
+		if (c["Values"] !== void 0) return void 0;
+	}
+	if (Array.isArray(cond["Values"])) return cond["Values"];
+	return cond["Values"] === void 0 ? [] : void 0;
+}
+function conditionValues(cond, configKey) {
+	const raw = rawConditionValues(cond, configKey);
+	return raw?.every((v) => typeof v === "string") ? raw : void 0;
+}
+function hostHeaderConditionValues(cond, albLogicalId) {
+	const raw = rawConditionValues(cond, "HostHeaderConfig");
+	if (!raw) return void 0;
+	const out = [];
+	for (const v of raw) if (typeof v === "string") out.push(v);
+	else if (isOwnDnsNameGetAtt(v, albLogicalId)) out.push("*");
+	else return void 0;
+	return out;
+}
+function isOwnDnsNameGetAtt(raw, albLogicalId) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+	const getAtt = raw["Fn::GetAtt"];
+	const parts = typeof getAtt === "string" ? getAtt.split(".") : getAtt;
+	return Array.isArray(parts) && parts.length === 2 && parts[0] === albLogicalId && parts[1] === "DNSName";
+}
+function unresolvableConditionWarning(ruleLabel, field) {
+	return `${ruleLabel} has a ${field} condition value that is not a literal string (an intrinsic such as Ref / Fn::GetAtt / Fn::Join / Fn::ImportValue that cannot be resolved locally); skipping the rule.`;
 }
 function collectForwardTargetGroupRefs(action) {
 	const out = [];
@@ -32987,5 +33276,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { postHook as $, firstUsableRegion as $a, parseConnectionsPath as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, filterWebSocketApisByIdentifiers as Aa, applyCorsResponseHeaders as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AGENTCORE_RUNTIME_TYPE as Ba, evaluateResponseParameters as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveWatchConfig as Ca, verifyJwtViaDiscovery as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, availableWebSocketApiIdentifiers as Da, invokeRequestAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, listTargets as Ea, evaluateCachedLambdaPolicy as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, resolveLambdaArnIntrinsic as Fa, matchRoute as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, formatStateRemedy as Ga, HOST_DOCKER_INTERNAL_GATEWAY as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, pickAgentCoreCandidateStack as Ha, selectIntegrationResponse as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, AGENTCORE_A2A_PROTOCOL as Ia, translateLambdaResponse as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, LocalInvokeBuildError as Ja, resolveHostGatewayExtraHosts as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, substituteImagePlaceholders as Ka, HOST_GATEWAY_MIN_VERSION as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_AGUI_PROTOCOL as La, applyAuthorizerOverlay as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, webSocketApiMatchesIdentifier as Ma, buildCorsConfigFromCloudFrontChain as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, discoverRoutes as Na, isFunctionUrlOacFronted as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, discoverWebSocketApis as Oa, invokeTokenAuthorizer as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, pickRefLogicalId as Pa, matchPreflight as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, deployedFillMayBeSecret as Qa, handleConnectionsRequest as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_HTTP_PROTOCOL as Ra, buildHttpApiV2Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, resolveSsmParameters as Sa, verifyJwtAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, countTargets as Ta, computeRequestIdentityHash as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, resolveAgentCoreTarget as Ua, tryParseStatus as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, AgentCoreResolutionError as Va, pickResponseTemplate as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, derivePseudoParametersFromRegion as Wa, VtlEvaluationError as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, DynamicReferenceResolver as Xa, ConnectionRegistry as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, DynamicReferenceResolutionError as Ya, bufferToBody as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, containsDynamicReference as Za, buildMgmtEndpointEnvUrl as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveCfnFallbackRegion as _a, defaultCredentialsLoader as _i, pickKvsLogicalIdFromArn as _n, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, resolveRuntimeCodeMountPath as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, SECOND_ASSUME_MESSAGE as ao, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, CfnLocalStateProvider as ba, createJwksCache as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, EcsTaskResolutionError as ca, resolveEnvVars$1 as ci, buildEdgeRequestEvent as cn, readEnvCallerCredentials as co, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, substituteEnvVarsFromState as da, filterRoutesByApiIdentifiers as di, httpHeadersToEdge as dn, workloadClientConfig as do, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildConnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, keysNotFromTemplate as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, substituteEnvVarsFromStateAsync as fa, groupRoutesByServer as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, workloadStsClientConfig as fo, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, rejectExplicitCfnStackWithMultipleStacks as ga, resolveServiceIntegrationParameters as gi, pickFunctionUrlLogicalIdFromOrigin as gn, isProxyEnvConfigured as go, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, isCfnFlagPresent as ha, resolveSelectionExpression as hi, isCloudFrontDistribution as hn, buildProxyClientConfig as ho, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, buildContainerImage as ia, createFileWatcher as ii, serveFromStaticOrigin as in, withoutKeys as io, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, parseSelectionExpressionPath as ja, buildCorsConfigByApiId as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, discoverWebSocketApisOrThrow as ka, attachAuthorizers as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, substituteAgainstState as la, availableApiIdentifiers as li, buildEdgeResponseEvent as ln, recordAssumedRole as lo, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, createLocalStateProvider as ma, startApiServer as mi, extractKvsAssociations as mn, resolveProfileCredentials as mo, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, buildMessageEvent as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, parseDynamicReference as no, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, resolveRuntimeFileExtension as oa, buildStageMap as oi, applyEdgeRequestResult as on, assumedRoleRecorded as oo, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, LocalStateSourceError as pa, readMtlsMaterialsFromDisk as pi, describeS3OriginDomain as pn, buildStsClientConfig as po, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, tryResolveImageFnJoin as qa, probeHostGatewaySupport as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, architectureToPlatform as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, resolveDynamicReferencesInEnv as ro, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, resolveRuntimeImage as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, deployAccountStsClientConfig as so, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildDisconnectEvent as ta, createWatchPredicates as ti, matchBehavior as tn, keysOverriddenBy as to, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteAgainstStateAsync as ua, filterRoutesByApiIdentifier as ui, edgeHeadersToHttp as un, resetWorkloadIdentity as uo, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnRegion as va, buildCognitoJwksUrl as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, resolveSingleTarget as wa, buildMethodArn as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, collectSsmParameterRefs as xa, verifyCognitoJwt as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, resolveCfnStackName as ya, buildJwksUrlFromIssuer as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_MCP_PROTOCOL as za, buildRestV1Event as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
-//# sourceMappingURL=local-studio-vhvbqvPb.js.map
+export { postHook as $, deployedFillMayBeSecret as $a, parseConnectionsPath as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, discoverWebSocketApisOrThrow as Aa, applyCorsResponseHeaders as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AGENTCORE_MCP_PROTOCOL as Ba, evaluateResponseParameters as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveSsmParameters as Ca, verifyJwtViaDiscovery as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, listTargets as Da, invokeRequestAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, countTargets as Ea, evaluateCachedLambdaPolicy as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, pickRefLogicalId as Fa, matchRoute as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, derivePseudoParametersFromRegion as Ga, HOST_DOCKER_INTERNAL_GATEWAY as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, AgentCoreResolutionError as Ha, selectIntegrationResponse as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, resolveLambdaArnIntrinsic as Ia, translateLambdaResponse as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, tryResolveImageFnJoin as Ja, resolveHostGatewayExtraHosts as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, formatStateRemedy as Ka, HOST_GATEWAY_MIN_VERSION as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_A2A_PROTOCOL as La, applyAuthorizerOverlay as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, parseSelectionExpressionPath as Ma, buildCorsConfigFromCloudFrontChain as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, webSocketApiMatchesIdentifier as Na, isFunctionUrlOacFronted as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, availableWebSocketApiIdentifiers as Oa, invokeTokenAuthorizer as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, discoverRoutes as Pa, matchPreflight as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, containsDynamicReference as Qa, handleConnectionsRequest as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_AGUI_PROTOCOL as Ra, buildHttpApiV2Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, collectSsmParameterRefs as Sa, verifyJwtAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, resolveSingleTarget as Ta, computeRequestIdentityHash as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, pickAgentCoreCandidateStack as Ua, tryParseStatus as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, AGENTCORE_RUNTIME_TYPE as Va, pickResponseTemplate as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, resolveAgentCoreTarget as Wa, VtlEvaluationError as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, DynamicReferenceResolutionError as Xa, ConnectionRegistry as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, LocalInvokeBuildError as Ya, bufferToBody as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, DynamicReferenceResolver as Za, buildMgmtEndpointEnvUrl as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, rejectExplicitCfnStackWithMultipleStacks as _a, defaultCredentialsLoader as _i, pickKvsLogicalIdFromArn as _n, isProxyEnvConfigured as _o, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, resolveRuntimeCodeMountPath as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, withoutKeys as ao, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, resolveCfnStackName as ba, createJwksCache as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, EcsTaskResolutionError as ca, resolveEnvVars$1 as ci, buildEdgeRequestEvent as cn, deployAccountStsClientConfig as co, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, substituteAgainstStateAsync as da, filterRoutesByApiIdentifiers as di, httpHeadersToEdge as dn, resetWorkloadIdentity as do, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildConnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, firstUsableRegion as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, substituteEnvVarsFromState as fa, groupRoutesByServer as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, workloadClientConfig as fo, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, isCfnFlagPresent as ga, resolveServiceIntegrationParameters as gi, pickFunctionUrlLogicalIdFromOrigin as gn, buildProxyClientConfig as go, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, createLocalStateProvider as ha, resolveSelectionExpression as hi, isCloudFrontDistribution as hn, resolveProfileCredentials as ho, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, buildContainerImage as ia, createFileWatcher as ii, serveFromStaticOrigin as in, resolveDynamicReferencesInEnv as io, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, filterWebSocketApisByIdentifiers as ja, buildCorsConfigByApiId as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, discoverWebSocketApis as ka, attachAuthorizers as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, assertEcsTaskImagesResolvable as la, availableApiIdentifiers as li, buildEdgeResponseEvent as ln, readEnvCallerCredentials as lo, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, LocalStateSourceError as ma, startApiServer as mi, extractKvsAssociations as mn, buildStsClientConfig as mo, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, buildMessageEvent as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, keysOverriddenBy as no, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, resolveRuntimeFileExtension as oa, buildStageMap as oi, applyEdgeRequestResult as on, SECOND_ASSUME_MESSAGE as oo, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, substituteEnvVarsFromStateAsync as pa, readMtlsMaterialsFromDisk as pi, describeS3OriginDomain as pn, workloadStsClientConfig as po, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, substituteImagePlaceholders as qa, probeHostGatewaySupport as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, architectureToPlatform as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, parseDynamicReference as ro, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, resolveRuntimeImage as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, assumedRoleRecorded as so, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildDisconnectEvent as ta, createWatchPredicates as ti, matchBehavior as tn, keysNotFromTemplate as to, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteAgainstState as ua, filterRoutesByApiIdentifier as ui, edgeHeadersToHttp as un, recordAssumedRole as uo, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnFallbackRegion as va, buildCognitoJwksUrl as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, resolveWatchConfig as wa, buildMethodArn as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, CfnLocalStateProvider as xa, verifyCognitoJwt as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, resolveCfnRegion as ya, buildJwksUrlFromIssuer as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_HTTP_PROTOCOL as za, buildRestV1Event as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
+//# sourceMappingURL=local-studio-DKhMiVll.js.map