cdk-local 0.160.0 → 0.161.0

package/dist/{local-studio-D1XHJoJZ.js → local-studio-DNWiPLme.js}

@@ -1,21 +1,18 @@
-import { C as sanitizeServiceExceptionMessage, S as isAwsServiceException, _ as resolveAssemblyPath, a as isDockerClientEnvKey, b as describeCredentialLoadFailure, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as renderAssemblyPathEscape, h as namesTheSameDirectory, i as getDockerCmd, l as spawnStreaming, m as isPasteableCommandArg, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as clampErrorName, w as stringifyThrown, x as flattenToOneLine, y as describeAwsFailureForWarn } from "./docker-cmd-CoZdbeos.js";
 import { a as displayIdent, c as getEmbedConfig, i as STACK_REF_MAX_CODE_POINTS, o as displayStackName, s as displayToolOutput, t as getLogger, u as setEmbedConfig } from "./logger-Co5XVwco.js";
-import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
-import { homedir, hostname, tmpdir } from "node:os";
-import * as path$1 from "node:path";
-import path, { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
+import { A as warnWorkloadCredentialsStripped, B as formatAuthority, C as accountLookupStsClientConfig, H as hostFromAuthority, I as proxyAwareFetch, M as workloadStsClientConfig, N as buildProxyClientConfig, R as isLoopbackHostname, V as formatHostForAuthority, _ as resolveHostDefaultCredentials, a as activateWorkloadAwsWiring, j as workloadClientConfig, l as effectiveLoopbackPorts, o as applyWorkloadAwsWiringToEnv, s as awsEmulatorEnvName, u as getActiveWorkloadAwsWiring, w as applyWorkloadEnvCredentials, z as isWildcardHostname } from "./workload-aws-wiring-BIxf0jtl.js";
+import { c as clampErrorName, d as flattenToOneLine, f as isAwsServiceException, l as describeAwsFailureForWarn, m as stringifyThrown, o as renderAssemblyPathEscape, p as sanitizeServiceExceptionMessage, r as displayUntrustedValue, s as resolveAssemblyPath, t as absoluteAssemblyPathEscape, u as describeCredentialLoadFailure } from "./assembly-path-R96uhMm1.js";
+import { A as parseEcrRegistryHost, B as RouteDiscoveryError, C as warnIfEmulatedPlatform, D as buildDockerImage, E as pullEcrImage, F as tryResolveImageFnJoin, G as applyRoleArnIfSet, H as withErrorHandling, I as CdkLocalError, J as isIamRoleArn, K as assumeRoleCredentials, L as InteractiveTtyRequiredError, M as derivePseudoParametersFromRegion, N as formatStateRemedy, O as resolveAssetSourcePath, P as substituteImagePlaceholders, R as LocalInvokeBuildError, S as buildContainerImage, T as parseEcrUri, U as defineOwnKey, V as TargetSelectionCancelledError, W as AssumeRoleFailure, X as buildStsClientConfig, Y as refusedRoleArnMessage, Z as resolveProfileCredentials, a as describeRefusedSensitiveEnvKeys, c as execEnvForSecrets, d as pullImage, f as removeContainer, i as attachLoopbackForwarder, j as derivePartitionAndUrlSuffix, k as describeExitWithoutArgv, l as pickFreePort, m as streamLogs, n as SENSITIVE_ENV_KEYS, p as runDetached, q as describeRejectedRoleArn, r as appendEnvFlags, s as ensureDockerAvailable, t as DockerRunnerError, u as prepareLoopbackForwarder, w as isImageInLocalCache, x as architectureToPlatform, z as LocalStartServiceError } from "./docker-runner-CnXQIUjd.js";
+import { a as isDockerClientEnvKey, c as runDockerStreaming, i as getDockerCmd, n as finchSecretArgvRefusal, o as isMalformedEnvKey, u as warnFinchArgvExposure } from "./docker-cmd-Cjg3jGYF.js";
+import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, promises, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { Command, InvalidArgumentError, Option } from "commander";
-import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
+import { STSClient } from "@aws-sdk/client-sts";
 import * as nodeCrypto from "node:crypto";
 import { X509Certificate, createHash, createHmac, createPublicKey, createVerify, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { Agent, createServer, request } from "node:http";
-import { Agent as Agent$1, createServer as createServer$1, request as request$1 } from "node:https";
-import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
-import { NodeHttpHandler } from "@smithy/node-http-handler";
-import { Agent as Agent$2 } from "agent-base";
-import { HttpProxyAgent } from "http-proxy-agent";
-import { HttpsProxyAgent } from "https-proxy-agent";
-import { getProxyForUrl } from "proxy-from-env";
+import { createServer, request } from "node:http";
+import { createServer as createServer$1 } from "node:https";
+import * as nodePath from "node:path";
+import path, { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
+import { homedir, hostname, tmpdir } from "node:os";
 import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 import { GetParameterCommand, GetParametersCommand, SSMClient } from "@aws-sdk/client-ssm";
 import { unzipSync } from "fflate";
@@ -25,10 +22,8 @@ import { CloudFormationClient, DescribeStacksCommand, ListExportsCommand, ListSt
 import { GetFunctionConfigurationCommand, LambdaClient } from "@aws-sdk/client-lambda";
 import { BedrockAgentCoreControlClient, GetAgentRuntimeCommand } from "@aws-sdk/client-bedrock-agentcore-control";
 import { execFile, spawn } from "node:child_process";
-import { connect, createServer as createServer$2 } from "node:net";
-import { StringDecoder } from "node:string_decoder";
+import { connect } from "node:net";
 import { promisify } from "node:util";
-import { ECRClient, GetAuthorizationTokenCommand } from "@aws-sdk/client-ecr";
 import { readFile } from "fs/promises";
 import { basename as basename$1, dirname as dirname$1, isAbsolute as isAbsolute$1, join as join$1, posix, relative as relative$1, resolve as resolve$1, sep as sep$1 } from "path";
 import { WebSocket, WebSocketServer } from "ws";
@@ -53,603 +48,6 @@ import { promisify as promisify$1 } from "util";
 import { randomUUID as randomUUID$1 } from "crypto";
 import { EventEmitter } from "node:events";
 
-//#region src/utils/url-authority.ts
-const IPV6_LITERAL_CHARS = /^[0-9A-Fa-f:.]+$/;
-function formatHostForAuthority(host) {
-	const inner = host.length > 1 && host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-	if (!inner.includes(":")) return host;
-	const zoneAt = inner.indexOf("%");
-	const literal = zoneAt === -1 ? inner : inner.slice(0, zoneAt);
-	if (!IPV6_LITERAL_CHARS.test(literal)) return host;
-	return `[${literal}]`;
-}
-function formatAuthority(host, port) {
-	return `${formatHostForAuthority(host)}:${port}`;
-}
-function hostFromAuthority(authority) {
-	if (authority.startsWith("[")) {
-		const close = authority.indexOf("]");
-		if (close === -1) return "";
-		const afterBracket = authority.slice(close + 1);
-		if (afterBracket !== "" && !/^:\d+$/.test(afterBracket)) return "";
-		return authority.slice(1, close);
-	}
-	const firstColon = authority.indexOf(":");
-	if (firstColon === -1) return authority;
-	if (authority.includes(":", firstColon + 1)) return "";
-	return authority.slice(0, firstColon);
-}
-
-//#endregion
-//#region src/utils/loopback-host.ts
-function normaliseHostLiteral(hostname) {
-	return hostname.trim().replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
-}
-function isLoopbackLiteral(h) {
-	if (h === "localhost") return true;
-	if (h === "::1" || h === "0:0:0:0:0:0:0:1") return true;
-	const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(h);
-	if (mapped) return parseInt(mapped[1], 16) >> 8 === 127;
-	const dotted = /^(?:::ffff:)?(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
-	if (!dotted) return false;
-	const octets = dotted.slice(1).map(Number);
-	if (octets.some((o) => o > 255)) return false;
-	return octets[0] === 127;
-}
-function isWildcardLiteral(h) {
-	return h === "0.0.0.0" || h === "::" || h === "0:0:0:0:0:0:0:0" || h === "::ffff:0.0.0.0" || h === "::ffff:0:0";
-}
-function isLoopbackHostname(hostname) {
-	return isLoopbackLiteral(normaliseHostLiteral(hostname));
-}
-function isWildcardHostname(hostname) {
-	return isWildcardLiteral(normaliseHostLiteral(hostname));
-}
-function isLoopbackHost(hostname) {
-	const h = normaliseHostLiteral(hostname).replace(/\.$/, "");
-	return h.endsWith(".localhost") || isLoopbackLiteral(h) || isWildcardLiteral(h);
-}
-
-//#endregion
-//#region src/utils/aws-proxy.ts
-const AGENT_OPTS = {
-	keepAlive: true,
-	maxSockets: 50
-};
-function isProxyEnvConfigured() {
-	return PROXY_ENV_VARIABLES.some((key) => Boolean(process.env[key]));
-}
-const PROXY_ENV_VARIABLES = [
-	"https_proxy",
-	"HTTPS_PROXY",
-	"http_proxy",
-	"HTTP_PROXY",
-	"all_proxy",
-	"ALL_PROXY"
-];
-function isSpeakableProxyEnvValue(value) {
-	return !value.includes("://") || isSpeakableProxy(value.trim());
-}
-const AWS_ENDPOINT_PROBES = ["https://sts.amazonaws.com", "http://sts.amazonaws.com"];
-function everySetProxyEnvValueIsUnspeakable() {
-	const set = PROXY_ENV_VARIABLES.map((key) => process.env[key] ?? "").filter((v) => v !== "");
-	return set.length > 0 && !set.some(isSpeakableProxyEnvValue);
-}
-const warnedProxySchemes = /* @__PURE__ */ new Set();
-function proxySchemeOf(proxyUrl) {
-	const match = /^([a-z][a-z0-9+.-]{0,31}):\/\//i.exec(proxyUrl);
-	return match ? match[1].toLowerCase() : "(unrecognized)";
-}
-function isSpeakableProxy(proxyUrl) {
-	return /^https?:\/\//i.test(proxyUrl);
-}
-function warnUnspeakableProxy(proxyUrl) {
-	const scheme = proxySchemeOf(proxyUrl);
-	if (warnedProxySchemes.has(scheme)) return;
-	try {
-		getLogger().child("aws-proxy").warn(`Unsupported proxy scheme "${scheme}" — cdk-local speaks HTTP CONNECT proxies only, so requests it would carry go DIRECT instead of through the proxy. Set HTTPS_PROXY / HTTP_PROXY / ALL_PROXY to an http:// or https:// proxy URL. (The proxy URL is withheld here: it can carry credentials.)`);
-	} catch {
-		return;
-	}
-	warnedProxySchemes.add(scheme);
-}
-function resolveProxyForTarget(targetHref) {
-	const proxyUrl = getProxyForUrl(targetHref).trim();
-	if (proxyUrl === "") return "";
-	if (isSpeakableProxy(proxyUrl)) return proxyUrl;
-	warnUnspeakableProxy(proxyUrl);
-	return "";
-}
-var EnvRoutingProxyAgent = class extends Agent$2 {
-	proxyAgents = /* @__PURE__ */ new Map();
-	directHttpAgent = new Agent(AGENT_OPTS);
-	directHttpsAgent = new Agent$1(AGENT_OPTS);
-	constructor() {
-		super(AGENT_OPTS);
-	}
-	connect(_req, options) {
-		const secure = options.secureEndpoint;
-		const host = options.host ?? "localhost";
-		const port = options.port || (secure ? 443 : 80);
-		const proxyUrl = resolveProxyForTarget(`${secure ? "https" : "http"}://${formatAuthority(host, port)}`);
-		if (!proxyUrl) return secure ? this.directHttpsAgent : this.directHttpAgent;
-		const key = `${secure ? "https" : "http"}|${proxyUrl}`;
-		let agent = this.proxyAgents.get(key);
-		if (!agent) {
-			agent = secure ? new HttpsProxyAgent(proxyUrl, AGENT_OPTS) : new HttpProxyAgent(proxyUrl, AGENT_OPTS);
-			this.proxyAgents.set(key, agent);
-		}
-		return agent;
-	}
-	destroy() {
-		for (const agent of this.proxyAgents.values()) agent.destroy();
-		this.proxyAgents.clear();
-		this.directHttpAgent.destroy();
-		this.directHttpsAgent.destroy();
-		super.destroy();
-	}
-};
-function buildProxyRequestHandler() {
-	const agent = new EnvRoutingProxyAgent();
-	return new NodeHttpHandler({
-		httpAgent: agent,
-		httpsAgent: agent
-	});
-}
-function buildProxyClientConfig(opts = {}) {
-	if (!isProxyEnvConfigured()) return {};
-	if (everySetProxyEnvValueIsUnspeakable()) {
-		for (const probe of AWS_ENDPOINT_PROBES) resolveProxyForTarget(probe);
-		return {};
-	}
-	const profile = opts.profile;
-	let chain;
-	const credentials = async (identityProperties) => {
-		chain ??= (async () => {
-			const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
-			return defaultProvider({
-				...profile ? { profile } : {},
-				clientConfig: { requestHandler: buildProxyRequestHandler() }
-			});
-		})().catch((err) => {
-			chain = void 0;
-			throw err;
-		});
-		return (await chain)(identityProperties);
-	};
-	return {
-		requestHandler: buildProxyRequestHandler(),
-		credentials
-	};
-}
-const MAX_FETCH_REDIRECTS = 20;
-const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
-	204,
-	205,
-	304
-]);
-const REQUEST_STALL_TIMEOUT_MS = 3e5;
-function isRedirectStatus(status) {
-	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
-}
-function parseHttpUrl(href) {
-	const parsed = new URL(href);
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new TypeError(`Unsupported protocol for a proxied request: "${parsed.protocol}"`);
-	return parsed;
-}
-function getThroughAgent(url, agent, timeoutMs = REQUEST_STALL_TIMEOUT_MS) {
-	return new Promise((resolve, reject) => {
-		let settled = false;
-		let timer;
-		let rearm = () => void 0;
-		const succeed = (value) => {
-			if (settled) return;
-			settled = true;
-			if (timer) clearTimeout(timer);
-			resolve(value);
-		};
-		const fail = (err) => {
-			if (settled) return;
-			settled = true;
-			if (timer) clearTimeout(timer);
-			reject(err);
-		};
-		const req = (url.protocol === "https:" ? request$1 : request)(url, {
-			agent,
-			headers: {
-				accept: "*/*",
-				"accept-encoding": "identity"
-			}
-		}, (res) => {
-			rearm();
-			const chunks = [];
-			res.on("data", (chunk) => {
-				rearm();
-				chunks.push(chunk);
-			});
-			res.on("error", fail);
-			res.on("end", () => {
-				if (res.statusCode === void 0) {
-					fail(/* @__PURE__ */ new Error("Malformed HTTP response: no status code"));
-					return;
-				}
-				succeed({
-					status: res.statusCode,
-					statusText: res.statusMessage ?? "",
-					headers: res.headers,
-					body: Buffer.concat(chunks)
-				});
-			});
-		});
-		req.on("error", fail);
-		rearm = () => {
-			if (settled) return;
-			if (timer) clearTimeout(timer);
-			timer = setTimeout(() => {
-				req.destroy();
-				fail(/* @__PURE__ */ new Error(`Proxied request stalled for ${timeoutMs} ms with no progress`));
-			}, timeoutMs);
-			timer.unref?.();
-		};
-		rearm();
-		req.end();
-	});
-}
-function decodeContentEncoding(raw) {
-	const header = raw.headers["content-encoding"];
-	const encoding = (Array.isArray(header) ? header.join(",") : header ?? "").trim().toLowerCase();
-	if (encoding === "" || encoding === "identity") return {
-		body: raw.body,
-		decoded: false
-	};
-	try {
-		if (encoding === "gzip" || encoding === "x-gzip") return {
-			body: gunzipSync(raw.body),
-			decoded: true
-		};
-		if (encoding === "deflate" || encoding === "x-deflate") return {
-			body: inflateSync(raw.body),
-			decoded: true
-		};
-		if (encoding === "br") return {
-			body: brotliDecompressSync(raw.body),
-			decoded: true
-		};
-	} catch {
-		return {
-			body: raw.body,
-			decoded: false
-		};
-	}
-	return {
-		body: raw.body,
-		decoded: false
-	};
-}
-function toWebResponse(raw) {
-	if (raw.status < 200 || raw.status > 599) throw new Error(`Unsupported HTTP status in response: ${raw.status}`);
-	const { body, decoded } = decodeContentEncoding(raw);
-	const headers = new Headers();
-	for (const [name, value] of Object.entries(raw.headers)) {
-		if (value === void 0) continue;
-		if (decoded && (name === "content-encoding" || name === "content-length")) continue;
-		if (Array.isArray(value)) for (const one of value) headers.append(name, one);
-		else headers.append(name, value);
-	}
-	return new Response(NULL_BODY_STATUSES.has(raw.status) ? null : body, {
-		status: raw.status,
-		statusText: raw.statusText.replace(/[^\t\x20-\x7e\x80-\xff]/g, ""),
-		headers
-	});
-}
-async function proxyAwareFetch(url, opts = {}) {
-	if (!isProxyEnvConfigured()) return globalThis.fetch(url);
-	let target = parseHttpUrl(url);
-	for (let hop = 0;; hop++) {
-		if (isLoopbackHost(target.hostname) || resolveProxyForTarget(target.href) === "") return globalThis.fetch(target.href);
-		const agent = new EnvRoutingProxyAgent();
-		let raw;
-		try {
-			raw = await getThroughAgent(target, agent, opts.timeoutMs);
-		} finally {
-			agent.destroy();
-		}
-		const location = raw.headers["location"];
-		if (!isRedirectStatus(raw.status) || typeof location !== "string" || location === "") return toWebResponse(raw);
-		if (hop >= MAX_FETCH_REDIRECTS) throw new Error(`Too many redirects (more than ${MAX_FETCH_REDIRECTS})`);
-		target = parseHttpUrl(new URL(location, target).href);
-	}
-}
-
-//#endregion
-//#region src/utils/profile-resolver.ts
-async function resolveProfileCredentials(profile) {
-	const sts = new STSClient(buildStsClientConfig({ profile }));
-	try {
-		const credsProvider = sts.config.credentials;
-		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
-		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) {
-			const ssoHint = isPasteableCommandArg(profile) ? "Check `aws sso login --profile " + profile + "` for SSO profiles" : "For an SSO profile, run `aws sso login` for that profile (the command is not written out because the name as rendered may not be the one your shell would act on)";
-			throw new Error(`--profile ${displayUntrustedValue(profile)}: credential provider chain resolved without usable credentials. ${ssoHint}, or check \`~/.aws/credentials\` / \`~/.aws/config\` for regular profiles.`);
-		}
-		let region;
-		try {
-			const regionProvider = sts.config.region;
-			const resolved = typeof regionProvider === "function" ? await regionProvider() : regionProvider;
-			if (typeof resolved === "string" && resolved.length > 0) region = resolved;
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			if (!(/region is missing/i.test(msg) || /could not resolve region/i.test(msg) || /no region in config/i.test(msg) || /region.*not.*set/i.test(msg))) throw err;
-			region = void 0;
-		}
-		return {
-			accessKeyId: creds.accessKeyId,
-			secretAccessKey: creds.secretAccessKey,
-			...creds.sessionToken && { sessionToken: creds.sessionToken },
-			...region && { region }
-		};
-	} finally {
-		sts.destroy();
-	}
-}
-function buildStsClientConfig(args) {
-	return {
-		...buildProxyClientConfig({ profile: args.profile }),
-		...args.region && { region: args.region },
-		...args.profile && { profile: args.profile }
-	};
-}
-
-//#endregion
-//#region src/utils/workload-identity.ts
-function copyCredentials(c) {
-	return c ? {
-		accessKeyId: c.accessKeyId,
-		secretAccessKey: c.secretAccessKey,
-		...c.sessionToken ? { sessionToken: c.sessionToken } : {}
-	} : void 0;
-}
-let record;
-let stripWarned = false;
-const SECOND_ASSUME_MESSAGE = "A role was already assumed in this process; refusing to assume a second one. Pass --role-arn once.";
-function recordAssumedRole(caller, role) {
-	if (record !== void 0) throw new Error(SECOND_ASSUME_MESSAGE);
-	record = {
-		caller: copyCredentials(caller),
-		role: copyCredentials(role)
-	};
-}
-function assumedRoleRecorded() {
-	return record !== void 0;
-}
-function readEnvCallerCredentials(env = process.env) {
-	const accessKeyId = env["AWS_ACCESS_KEY_ID"];
-	const secretAccessKey = env["AWS_SECRET_ACCESS_KEY"];
-	if (!accessKeyId || !secretAccessKey) return void 0;
-	const sessionToken = env["AWS_SESSION_TOKEN"];
-	return {
-		accessKeyId,
-		secretAccessKey,
-		...sessionToken ? { sessionToken } : {}
-	};
-}
-function resetWorkloadIdentity() {
-	record = void 0;
-	stripWarned = false;
-}
-function callerRecord() {
-	return getEmbedConfig().workloadIdentity === "caller" ? record : void 0;
-}
-const MULTIPLE_CREDENTIAL_SOURCES_WARNING = "Multiple credential sources detected";
-const chainLogger = {
-	debug: () => {},
-	info: () => {},
-	warn: (...args) => {
-		const text = args.map(String).join(" ");
-		if (text.includes(MULTIPLE_CREDENTIAL_SOURCES_WARNING)) return;
-		getLogger().warn(text);
-	},
-	error: (...args) => {
-		getLogger().error(args.map(String).join(" "));
-	}
-};
-function callerChainWithoutEnv(proxied) {
-	let chain;
-	return async (identityProperties) => {
-		chain ??= (async () => {
-			const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
-			return defaultProvider({
-				profile: "default",
-				logger: chainLogger,
-				...proxied ? { clientConfig: { requestHandler: buildProxyRequestHandler() } } : {}
-			});
-		})().catch((err) => {
-			chain = void 0;
-			throw err;
-		});
-		return (await chain)(identityProperties);
-	};
-}
-function workloadClientConfig(opts = {}) {
-	const base = buildProxyClientConfig({ profile: opts.profile });
-	const rec = callerRecord();
-	if (!rec) return base;
-	if (opts.profile || process.env["AWS_PROFILE"]) return base;
-	if (rec.caller) {
-		const caller = rec.caller;
-		const credentials = async () => ({
-			accessKeyId: caller.accessKeyId,
-			secretAccessKey: caller.secretAccessKey,
-			...caller.sessionToken ? { sessionToken: caller.sessionToken } : {}
-		});
-		return {
-			...base,
-			credentials
-		};
-	}
-	return {
-		...base,
-		credentials: callerChainWithoutEnv(base.requestHandler !== void 0)
-	};
-}
-function workloadStsClientConfig(args) {
-	return {
-		...workloadClientConfig({ profile: args.profile }),
-		...args.region && { region: args.region },
-		...args.profile && { profile: args.profile }
-	};
-}
-function deployAccountStsClientConfig(args) {
-	const role = callerRecord()?.role;
-	if (!role) return {
-		...buildProxyClientConfig({ profile: args.profile }),
-		...args.region && { region: args.region },
-		...args.profile && { profile: args.profile }
-	};
-	const credentials = async () => ({
-		accessKeyId: role.accessKeyId,
-		secretAccessKey: role.secretAccessKey,
-		...role.sessionToken ? { sessionToken: role.sessionToken } : {}
-	});
-	return {
-		...buildProxyClientConfig(),
-		...args.region && { region: args.region },
-		...args.profile && { profile: args.profile },
-		credentials
-	};
-}
-function accountLookupStsClientConfig(args) {
-	return args.readFromCfnStack ? workloadStsClientConfig({
-		region: args.region,
-		profile: args.profile
-	}) : deployAccountStsClientConfig({
-		region: args.region,
-		profile: args.profile
-	});
-}
-function applyWorkloadEnvCredentials(env) {
-	const rec = callerRecord();
-	if (!rec) return "unchanged";
-	if (rec.caller) {
-		env["AWS_ACCESS_KEY_ID"] = rec.caller.accessKeyId;
-		env["AWS_SECRET_ACCESS_KEY"] = rec.caller.secretAccessKey;
-		if (rec.caller.sessionToken) env["AWS_SESSION_TOKEN"] = rec.caller.sessionToken;
-		else delete env["AWS_SESSION_TOKEN"];
-		return "restored";
-	}
-	delete env["AWS_ACCESS_KEY_ID"];
-	delete env["AWS_SECRET_ACCESS_KEY"];
-	delete env["AWS_SESSION_TOKEN"];
-	return "stripped";
-}
-function warnWorkloadCredentialsStripped() {
-	if (stripWarned) return;
-	stripWarned = true;
-	getLogger().warn("The --role-arn role is not handed to the emulated workload, and your shell had no static AWS credentials to hand it instead, so the container receives none. Pass --profile <name>, or export static credentials, to give it an identity.");
-}
-
-//#endregion
-//#region src/utils/role-arn.ts
-const IAM_ROLE_ARN_MAX_LENGTH = 2048;
-const IAM_ROLE_ARN_PATTERN = /^arn:[A-Za-z0-9-]+:iam::[0-9]+:role\/[!-~]+$/;
-function isIamRoleArn(value) {
-	if (typeof value !== "string") return false;
-	if (value.length > 2048) return false;
-	return IAM_ROLE_ARN_PATTERN.test(value);
-}
-const REJECTED_ARN_PREVIEW_MAX = 128;
-function describeRejectedRoleArn(value) {
-	if (typeof value !== "string") return `a non-string ${typeof value} value`;
-	const points = [...flattenToOneLine(value)];
-	return `"${points.length <= REJECTED_ARN_PREVIEW_MAX ? points.join("") : `${points.slice(0, REJECTED_ARN_PREVIEW_MAX).join("")}...`}" (${points.length} characters)`;
-}
-function refusedRoleArnMessage(value) {
-	return `AssumeRole refused: the role ARN is not a well-formed IAM role ARN (expected arn:<partition>:iam::<account>:role/<name>, at most ${IAM_ROLE_ARN_MAX_LENGTH} characters): ${describeRejectedRoleArn(value)}. Nothing was sent to STS.`;
-}
-var AssumeRoleFailure = class AssumeRoleFailure extends Error {
-	detail;
-	constructor(message, detail) {
-		super(message);
-		this.name = "AssumeRoleFailure";
-		this.detail = detail;
-		Object.setPrototypeOf(this, AssumeRoleFailure.prototype);
-	}
-};
-async function assumeRoleCredentials(opts) {
-	if (!isIamRoleArn(opts.roleArn)) {
-		const detail = `the role ARN is not well-formed: ${describeRejectedRoleArn(opts.roleArn)}`;
-		const message = refusedRoleArnMessage(opts.roleArn);
-		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, detail);
-	}
-	const sts = new STSClient(workloadStsClientConfig({
-		region: opts.region,
-		profile: opts.profile
-	}));
-	const shownArn = flattenToOneLine(opts.roleArn);
-	let response;
-	try {
-		response = await sts.send(new AssumeRoleCommand({
-			RoleArn: opts.roleArn,
-			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-${opts.sessionNameSuffix}-${Date.now()}`,
-			DurationSeconds: 3600
-		}));
-	} catch (err) {
-		const detail = describeAwsFailureForWarn(err, "STS AssumeRole");
-		const message = `AssumeRole(${shownArn}) failed: ${detail}`;
-		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, detail);
-	} finally {
-		sts.destroy();
-	}
-	const creds = response.Credentials;
-	if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) {
-		const message = `AssumeRole(${shownArn}) returned no usable credentials.`;
-		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, "the response carried no usable credentials");
-	}
-	return {
-		accessKeyId: creds.AccessKeyId,
-		secretAccessKey: creds.SecretAccessKey,
-		sessionToken: creds.SessionToken
-	};
-}
-async function applyRoleArnIfSet(opts) {
-	const roleArn = opts.roleArn || process.env[`${getEmbedConfig().envPrefix}_ROLE_ARN`];
-	if (!roleArn) return;
-	if (!isIamRoleArn(roleArn)) throw new Error(refusedRoleArnMessage(roleArn));
-	if (assumedRoleRecorded() && getEmbedConfig().workloadIdentity === "caller") throw new Error(SECOND_ASSUME_MESSAGE);
-	const logger = getLogger().child("role-arn");
-	const shownArn = flattenToOneLine(roleArn);
-	logger.debug(`Assuming role ${shownArn}...`);
-	const sts = new STSClient(buildStsClientConfig({
-		region: opts.region,
-		profile: opts.profile
-	}));
-	let response;
-	try {
-		response = await sts.send(new AssumeRoleCommand({
-			RoleArn: roleArn,
-			RoleSessionName: `${getEmbedConfig().binaryName}-${Date.now()}`,
-			DurationSeconds: 3600
-		}));
-	} catch (err) {
-		throw new Error(`AssumeRole(${shownArn}) failed: ${describeAwsFailureForWarn(err, "STS AssumeRole")}`);
-	} finally {
-		sts.destroy();
-	}
-	if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${shownArn}`);
-	const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
-	if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${shownArn}`);
-	if (!assumedRoleRecorded()) recordAssumedRole(readEnvCallerCredentials(), {
-		accessKeyId: AccessKeyId,
-		secretAccessKey: SecretAccessKey,
-		sessionToken: SessionToken
-	});
-	process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
-	process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
-	process.env["AWS_SESSION_TOKEN"] = SessionToken;
-	logger.info(`Assumed role ${shownArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
-}
-
-//#endregion
 //#region src/cli/options.ts
 function parseContextOptions(contextArgs) {
 	const context = {};
@@ -668,6 +66,13 @@ function commonOptions() {
 		new Option("-y, --yes", "Automatically answer interactive prompts with the recommended response").default(false)
 	];
 }
+function awsEndpointOptions() {
+	return [new Option("--aws-emulator [url]", `Run against a local AWS Emulator (default https://127.0.0.1:9297; the port selects ~/.aws/emulator/<port>/): this command's own AWS calls (--from-cfn-stack included) and every workload container use it, and containers get only its credentials and trust its CA (env: ${awsEmulatorEnvName()})`), new Option("--ca-bundle <file>", "PEM CA bundle mounted read-only into every workload container, with AWS_CA_BUNDLE / NODE_EXTRA_CA_CERTS / REQUESTS_CA_BUNDLE / SSL_CERT_FILE pointed at it (default: the host AWS_CA_BUNDLE)")];
+}
+function addAwsEndpointOptions(cmd) {
+	for (const opt of awsEndpointOptions()) cmd.addOption(opt);
+	return cmd;
+}
 const regionOption = new Option("--region <region>", "AWS region for SDK calls; defaults to AWS_REGION env, the synthesized stack region, or the resolved profile region");
 function appOptions() {
 	const { envPrefix } = getEmbedConfig();
@@ -705,17 +110,6 @@ function effectiveAssumeRoleArn(logicalId, opt) {
 	return opt.perLambda?.[logicalId] ?? opt.globalArn;
 }
 
-//#endregion
-//#region src/utils/own-keys.ts
-function defineOwnKey(target, key, value) {
-	Object.defineProperty(target, key, {
-		value,
-		writable: true,
-		enumerable: true,
-		configurable: true
-	});
-}
-
 //#endregion
 //#region src/local/dynamic-reference-resolver.ts
 var DynamicReferenceResolutionError = class DynamicReferenceResolutionError extends Error {
@@ -1054,86 +448,6 @@ async function resolveDynamicReferencesInEnv(env, options) {
 	}
 }
 
-//#endregion
-//#region src/utils/error-handler.ts
-var CdkLocalError = class CdkLocalError extends Error {
-	code;
-	cause;
-	constructor(message, code, cause) {
-		super(message);
-		this.code = code;
-		this.cause = cause;
-		this.name = "CdkLocalError";
-		Object.setPrototypeOf(this, CdkLocalError.prototype);
-	}
-};
-var LocalInvokeBuildError = class LocalInvokeBuildError extends CdkLocalError {
-	constructor(message, cause) {
-		super(message, "LOCAL_INVOKE_BUILD_ERROR", cause);
-		this.name = "LocalInvokeBuildError";
-		Object.setPrototypeOf(this, LocalInvokeBuildError.prototype);
-	}
-};
-var RouteDiscoveryError = class RouteDiscoveryError extends CdkLocalError {
-	constructor(message, cause) {
-		super(message, "ROUTE_DISCOVERY_ERROR", cause);
-		this.name = "RouteDiscoveryError";
-		Object.setPrototypeOf(this, RouteDiscoveryError.prototype);
-	}
-};
-var LocalStartServiceError = class LocalStartServiceError extends CdkLocalError {
-	constructor(message, cause) {
-		super(message, "LOCAL_START_SERVICE_ERROR", cause);
-		this.name = "LocalStartServiceError";
-		Object.setPrototypeOf(this, LocalStartServiceError.prototype);
-	}
-};
-var TargetSelectionCancelledError = class TargetSelectionCancelledError extends CdkLocalError {
-	silent = true;
-	exitCode = 130;
-	constructor() {
-		super("Target selection cancelled.", "TARGET_SELECTION_CANCELLED");
-		this.name = "TargetSelectionCancelledError";
-		Object.setPrototypeOf(this, TargetSelectionCancelledError.prototype);
-	}
-};
-var InteractiveTtyRequiredError = class InteractiveTtyRequiredError extends CdkLocalError {
-	constructor(message) {
-		super(message, "INTERACTIVE_TTY_REQUIRED");
-		this.name = "InteractiveTtyRequiredError";
-		Object.setPrototypeOf(this, InteractiveTtyRequiredError.prototype);
-	}
-};
-function isCdkLocalError(error) {
-	return error instanceof CdkLocalError;
-}
-function formatError(error) {
-	if (isCdkLocalError(error)) {
-		let message = `${error.name}: ${error.message}`;
-		if (error.cause) message += `\nCaused by: ${error.cause.message}`;
-		return message;
-	}
-	if (error instanceof Error) return `${error.name}: ${error.message}`;
-	return String(error);
-}
-function handleError(error) {
-	const logger = getLogger();
-	if (!(error instanceof CdkLocalError && error.silent)) logger.error(formatError(error));
-	if (error instanceof Error && error.stack) logger.debug("Stack trace:", error.stack);
-	const customExitCode = error instanceof CdkLocalError ? error.exitCode : void 0;
-	const exitCode = typeof customExitCode === "number" ? customExitCode : 1;
-	process.exit(exitCode);
-}
-function withErrorHandling(fn) {
-	return async (...args) => {
-		try {
-			await fn(...args);
-		} catch (error) {
-			handleError(error);
-		}
-	};
-}
-
 //#endregion
 //#region src/cli/cdk-path.ts
 function readCdkPath(resource) {
@@ -1269,301 +583,37 @@ function pathGlobMatches(pattern, subject) {
 }
 
 //#endregion
-//#region src/local/intrinsic-image.ts
-function formatStateRemedy(context) {
-	if (context?.stateLoadFailureMessage) return `the state-source attempt failed: ${context.stateLoadFailureMessage}; verify the stack name (try --from-cfn-stack <deployed-name> if it differs from the synthesized name) and that --region / --profile target the right account`;
-	return "pass --from-cfn-stack to load the deployed stack state";
-}
-const PARTITION_TABLE = [
-	{
-		regionPrefix: "cn-",
-		partition: "aws-cn",
-		urlSuffix: "amazonaws.com.cn"
-	},
-	{
-		regionPrefix: "us-gov-",
-		partition: "aws-us-gov",
-		urlSuffix: "amazonaws.com"
-	},
-	{
-		regionPrefix: "us-isob-",
-		partition: "aws-iso-b",
-		urlSuffix: "sc2s.sgov.gov"
-	},
-	{
-		regionPrefix: "us-isof-",
-		partition: "aws-iso-f",
-		urlSuffix: "csp.hci.ic.gov"
-	},
-	{
-		regionPrefix: "us-iso-",
-		partition: "aws-iso",
-		urlSuffix: "c2s.ic.gov"
-	},
-	{
-		regionPrefix: "eu-isoe-",
-		partition: "aws-iso-e",
-		urlSuffix: "cloud.adc-e.uk"
-	},
-	{
-		regionPrefix: "eusc-",
-		partition: "aws-eusc",
-		urlSuffix: "amazonaws.eu"
+//#region src/utils/stringify.ts
+function stringifyValue(value) {
+	switch (typeof value) {
+		case "string": return value;
+		case "number":
+		case "boolean":
+		case "bigint": return String(value);
+		case "symbol": return value.toString();
+		case "undefined": return "undefined";
+		case "function": return value.name ? `[Function: ${value.name}]` : "[Function]";
+		case "object":
+			if (value === null) return "null";
+			try {
+				const json = JSON.stringify(value);
+				if (json !== void 0) return json;
+			} catch {}
+			return Object.prototype.toString.call(value);
 	}
-];
-function derivePartitionAndUrlSuffix(region) {
-	const normalized = region.toLowerCase();
-	for (const row of PARTITION_TABLE) if (normalized.startsWith(row.regionPrefix)) return {
-		partition: row.partition,
-		urlSuffix: row.urlSuffix
-	};
-	return {
-		partition: "aws",
-		urlSuffix: "amazonaws.com"
-	};
 }
-function derivePseudoParametersFromRegion(region, accountId) {
-	if (!region || typeof region !== "string" || region.length === 0) return void 0;
-	const { partition, urlSuffix } = derivePartitionAndUrlSuffix(region);
-	return {
-		...accountId !== void 0 && { accountId },
-		region,
-		partition,
-		urlSuffix
-	};
-}
-function tryResolveImageFnJoin(raw, resources, context) {
-	if (!raw || typeof raw !== "object") return { kind: "not-applicable" };
-	const arg = raw["Fn::Join"];
-	if (arg === void 0) return { kind: "not-applicable" };
-	if (!Array.isArray(arg) || arg.length !== 2 || !Array.isArray(arg[1])) return {
-		kind: "unsupported-join",
-		reason: "Fn::Join must be [delimiter, [elements]]"
-	};
-	const [delimiter, elements] = arg;
-	if (typeof delimiter !== "string") return {
-		kind: "unsupported-join",
-		reason: `Fn::Join delimiter must be a string, got ${typeof delimiter}`
-	};
-	const repoLogicalId = findEcrRepositoryRefInTree(elements, resources);
-	const stateResources = context?.stateResources;
-	if (repoLogicalId && !stateResources) return {
-		kind: "needs-state",
-		repoLogicalId
-	};
-	const parts = [];
-	for (const element of elements) {
-		const r = resolveImageIntrinsic(element, resources, context);
-		if (r === void 0) {
-			if (!repoLogicalId) return { kind: "not-applicable" };
-			return {
-				kind: "unsupported-join",
-				reason: "one or more Fn::Join elements could not be resolved"
-			};
-		}
-		parts.push(r);
-	}
-	return {
-		kind: "resolved",
-		uri: parts.join(delimiter)
-	};
-}
-function findEcrRepositoryRefInTree(node, resources) {
-	if (node === null || node === void 0) return void 0;
-	if (typeof node === "string" || typeof node === "number" || typeof node === "boolean") return;
-	if (Array.isArray(node)) {
-		for (const item of node) {
-			const hit = findEcrRepositoryRefInTree(item, resources);
-			if (hit) return hit;
-		}
-		return;
-	}
-	if (typeof node !== "object") return void 0;
-	const obj = node;
-	if (typeof obj["Ref"] === "string") {
-		const target = obj["Ref"];
-		if (resources[target]?.Type === "AWS::ECR::Repository") return target;
-		return;
-	}
-	const getAtt = obj["Fn::GetAtt"];
-	if (getAtt !== void 0) {
-		let lid;
-		if (Array.isArray(getAtt) && typeof getAtt[0] === "string") lid = getAtt[0];
-		else if (typeof getAtt === "string") lid = getAtt.split(".")[0];
-		if (lid && resources[lid]?.Type === "AWS::ECR::Repository") return lid;
-		return;
-	}
-	for (const value of Object.values(obj)) {
-		const hit = findEcrRepositoryRefInTree(value, resources);
-		if (hit) return hit;
-	}
-}
-function resolveImageIntrinsic(node, resources, context) {
-	const v = resolveImageIntrinsicAny(node, resources, context);
-	if (typeof v === "string") return v;
-	if (typeof v === "number" || typeof v === "boolean") return String(v);
-}
-function resolveImageIntrinsicAny(node, resources, context) {
-	if (node === null || node === void 0) return void 0;
-	if (typeof node === "string" || typeof node === "number" || typeof node === "boolean") return node;
-	if (Array.isArray(node)) return;
-	if (typeof node !== "object") return void 0;
-	const obj = node;
-	const keys = Object.keys(obj);
-	if (keys.length !== 1) return void 0;
-	const intrinsic = keys[0];
-	const arg = obj[intrinsic];
-	if (intrinsic === "Ref") {
-		if (typeof arg !== "string") return void 0;
-		if (arg.startsWith("AWS::")) {
-			const p = context?.pseudoParameters;
-			if (!p) return void 0;
-			if (arg === "AWS::URLSuffix") return p.urlSuffix;
-			if (arg === "AWS::Partition") return p.partition;
-			if (arg === "AWS::Region") return p.region;
-			if (arg === "AWS::AccountId") return p.accountId;
-			return;
-		}
-		if (resources[arg]?.Type !== "AWS::ECR::Repository") return void 0;
-		const stateEntry = context?.stateResources?.[arg];
-		if (!stateEntry) return void 0;
-		return stateEntry.physicalId;
-	}
-	if (intrinsic === "Fn::GetAtt") {
-		let logicalId;
-		let attr;
-		if (Array.isArray(arg) && arg.length === 2 && typeof arg[0] === "string" && typeof arg[1] === "string") {
-			logicalId = arg[0];
-			attr = arg[1];
-		} else if (typeof arg === "string") {
-			const dot = arg.indexOf(".");
-			if (dot > 0 && dot < arg.length - 1) {
-				logicalId = arg.slice(0, dot);
-				attr = arg.slice(dot + 1);
-			}
-		}
-		if (!logicalId || !attr) return void 0;
-		if (resources[logicalId]?.Type !== "AWS::ECR::Repository") return void 0;
-		const cached = context?.stateResources?.[logicalId]?.attributes?.[attr];
-		if (typeof cached === "string" && cached.length > 0) return cached;
-		const physicalId = context?.stateResources?.[logicalId]?.physicalId;
-		const p = context?.pseudoParameters;
-		if (physicalId && p?.region && p.accountId) {
-			if (attr === "Arn" && p.partition) return `arn:${p.partition}:ecr:${p.region}:${p.accountId}:repository/${physicalId}`;
-			if (attr === "RepositoryUri" && p.urlSuffix) return `${p.accountId}.dkr.ecr.${p.region}.${p.urlSuffix}/${physicalId}`;
-		}
-		return;
-	}
-	if (intrinsic === "Fn::Split") {
-		if (!Array.isArray(arg) || arg.length !== 2) return void 0;
-		const argArr = arg;
-		const delim = argArr[0];
-		if (typeof delim !== "string") return void 0;
-		const src = resolveImageIntrinsicAny(argArr[1], resources, context);
-		if (typeof src !== "string") return void 0;
-		return src.split(delim);
-	}
-	if (intrinsic === "Fn::Select") {
-		if (!Array.isArray(arg) || arg.length !== 2) return void 0;
-		const argArr = arg;
-		const rawIndex = argArr[0];
-		let index;
-		if (typeof rawIndex === "number") index = rawIndex;
-		else if (typeof rawIndex === "string" && /^-?\d+$/.test(rawIndex)) index = Number.parseInt(rawIndex, 10);
-		if (index === void 0 || !Number.isFinite(index)) return void 0;
-		const list = resolveImageIntrinsicAny(argArr[1], resources, context);
-		if (Array.isArray(list)) {
-			if (index < 0 || index >= list.length) return void 0;
-			const picked = list[index];
-			if (typeof picked === "string") return picked;
-			return;
-		}
-		if (Array.isArray(argArr[1])) {
-			const listLiteral = argArr[1];
-			if (index < 0 || index >= listLiteral.length) return void 0;
-			return resolveImageIntrinsic(listLiteral[index], resources, context);
-		}
-		return;
-	}
-	if (intrinsic === "Fn::Join") {
-		if (!Array.isArray(arg) || arg.length !== 2) return void 0;
-		const [delim, parts] = arg;
-		if (typeof delim !== "string" || !Array.isArray(parts)) return void 0;
-		const resolved = [];
-		for (const part of parts) {
-			const r = resolveImageIntrinsic(part, resources, context);
-			if (r === void 0) return void 0;
-			resolved.push(r);
-		}
-		return resolved.join(delim);
-	}
-	if (intrinsic === "Fn::Sub") {
-		let template;
-		if (typeof arg === "string") template = arg;
-		else if (Array.isArray(arg) && typeof arg[0] === "string") template = arg[0];
-		if (template === void 0) return void 0;
-		const out = substituteImagePlaceholders(template, resources, context);
-		if (out.includes("${")) return void 0;
-		return out;
-	}
-}
-function substituteImagePlaceholders(flat, resources, context) {
-	if (!flat.includes("${")) return flat;
-	return flat.replace(/\$\{([^}]+)\}/g, (full, key) => {
-		if (context?.pseudoParameters) {
-			if (key === "AWS::AccountId" && context.pseudoParameters.accountId) return context.pseudoParameters.accountId;
-			if (key === "AWS::Region" && context.pseudoParameters.region) return context.pseudoParameters.region;
-			if (key === "AWS::Partition" && context.pseudoParameters.partition) return context.pseudoParameters.partition;
-			if (key === "AWS::URLSuffix" && context.pseudoParameters.urlSuffix) return context.pseudoParameters.urlSuffix;
-		}
-		if (context?.stateResources) {
-			const dot = key.indexOf(".");
-			const logicalId = dot === -1 ? key : key.slice(0, dot);
-			const refResource = resources[logicalId];
-			const stateEntry = context.stateResources[logicalId];
-			if (refResource?.Type === "AWS::ECR::Repository" && stateEntry) {
-				if (dot === -1) return stateEntry.physicalId;
-				const attr = key.slice(dot + 1);
-				const cached = stateEntry.attributes?.[attr];
-				if (typeof cached === "string") return cached;
-			}
-		}
-		return full;
-	});
-}
-
-//#endregion
-//#region src/utils/stringify.ts
-function stringifyValue(value) {
-	switch (typeof value) {
-		case "string": return value;
-		case "number":
-		case "boolean":
-		case "bigint": return String(value);
-		case "symbol": return value.toString();
-		case "undefined": return "undefined";
-		case "function": return value.name ? `[Function: ${value.name}]` : "[Function]";
-		case "object":
-			if (value === null) return "null";
-			try {
-				const json = JSON.stringify(value);
-				if (json !== void 0) return json;
-			} catch {}
-			return Object.prototype.toString.call(value);
-	}
-}
-
-//#endregion
-//#region src/local/lambda-resolver.ts
-function resolveLambdaArchitecture(props, logicalId) {
-	const arches = props["Architectures"];
-	if (Array.isArray(arches) && arches.length > 0) {
-		const first = arches[0];
-		if (first === "arm64") return "arm64";
-		if (first === "x86_64") return "x86_64";
-		throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} has unsupported Architectures value ${displayIdent(String(first))}. ${getEmbedConfig().cliName} supports x86_64 and arm64.`);
-	}
-	return "x86_64";
+
+//#endregion
+//#region src/local/lambda-resolver.ts
+function resolveLambdaArchitecture(props, logicalId) {
+	const arches = props["Architectures"];
+	if (Array.isArray(arches) && arches.length > 0) {
+		const first = arches[0];
+		if (first === "arm64") return "arm64";
+		if (first === "x86_64") return "x86_64";
+		throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} has unsupported Architectures value ${displayIdent(String(first))}. ${getEmbedConfig().cliName} supports x86_64 and arm64.`);
+	}
+	return "x86_64";
 }
 var LocalInvokeResolutionError = class LocalInvokeResolutionError extends Error {
 	constructor(message) {
@@ -4838,69 +3888,6 @@ function applyDeployedEnvFallback(resolvedEnv, unresolved, deployedEnv) {
 	};
 }
 
-//#endregion
-//#region src/local/ecr-uri.ts
-const FIPS_AND_DUAL_STACK_PARTITIONS = ["aws", "aws-us-gov"];
-const ECR_REGISTRY_HOST_FORMS = [
-	{ labels: "dkr.ecr" },
-	{
-		labels: "dkr.ecr-fips",
-		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
-	},
-	{
-		labels: "dkr-ecr",
-		fixedUrlSuffix: "on.aws",
-		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
-	},
-	{
-		labels: "dkr-ecr-fips",
-		fixedUrlSuffix: "on.aws",
-		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
-	}
-];
-const ECR_HOST_FORM_BY_LABELS = new Map(ECR_REGISTRY_HOST_FORMS.map((f) => [f.labels, f]));
-function escapeRegExp(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-const ECR_URI_HOST_REGEX = new RegExp(`^(\\d{12})\\.(${[...ECR_REGISTRY_HOST_FORMS].sort((a, b) => b.labels.length - a.labels.length).map((f) => escapeRegExp(f.labels)).join("|")})\\.([^./]+)\\.([^/]+)/`, "i");
-const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
-const REGION_SHAPE = /^(?:(?:us|eu|ap|sa|ca|me|af|il|mx)-[a-z0-9]+-[0-9]+|cn-[a-z0-9]+-[0-9]+|us-gov-[a-z0-9]+-[0-9]+|us-iso-[a-z0-9]+-[0-9]+|us-isob-[a-z0-9]+-[0-9]+|eu-isoe-[a-z0-9]+-[0-9]+|us-isof-[a-z0-9]+-[0-9]+|eusc-[a-z]+-[a-z0-9]+-[0-9]+)$/;
-const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
-function foldAsciiUpperCase(value) {
-	return value.replace(/[A-Z]+/g, (run) => run.toLowerCase());
-}
-function isRegistryHostComponent(component) {
-	return component.includes(".") || component.includes(":") || component === "localhost";
-}
-function canonicalizeImageUriHost(imageUri) {
-	const slash = imageUri.indexOf("/");
-	if (slash < 0) return imageUri;
-	const host = imageUri.slice(0, slash);
-	if (!isRegistryHostComponent(host)) return imageUri;
-	return foldAsciiUpperCase(host) + imageUri.slice(slash);
-}
-function parseEcrRegistryHost(imageUri) {
-	const m = ECR_URI_HOST_REGEX.exec(imageUri);
-	if (!m) return void 0;
-	const [, accountId, rawLabels, rawRegion, rawSuffix] = m;
-	if (!CANONICAL_REGION_SEGMENT.test(rawRegion)) return void 0;
-	if (!CANONICAL_URL_SUFFIX.test(rawSuffix)) return void 0;
-	const form = ECR_HOST_FORM_BY_LABELS.get(foldAsciiUpperCase(rawLabels));
-	if (!form) return void 0;
-	const region = foldAsciiUpperCase(rawRegion);
-	if (!REGION_SHAPE.test(region)) return void 0;
-	const suffix = foldAsciiUpperCase(rawSuffix);
-	const partition = derivePartitionAndUrlSuffix(region);
-	if (form.partitions && !form.partitions.includes(partition.partition)) return void 0;
-	if (suffix !== (form.fixedUrlSuffix ?? partition.urlSuffix)) return void 0;
-	return {
-		accountId,
-		region,
-		registryHost: `${accountId}.${form.labels}.${region}.${suffix}`,
-		form
-	};
-}
-
 //#endregion
 //#region src/local/ecs-task-resolver.ts
 var EcsTaskResolutionError = class EcsTaskResolutionError extends Error {
@@ -5635,1136 +4622,140 @@ async function applyCrossStackResolverToTask(task, context) {
 		if (Array.isArray(c["Secrets"])) for (const entry of c["Secrets"]) {
 			if (!entry || typeof entry !== "object") continue;
 			const e = entry;
-			const sName = pickString(e["Name"]);
-			const valueFromRaw = e["ValueFrom"];
-			if (!sName) continue;
-			if (typeof valueFromRaw === "string" && valueFromRaw.length > 0) continue;
-			if (container.secrets.some((s) => s.name === sName)) continue;
-			if (!isCrossStackIntrinsic(valueFromRaw)) continue;
-			const sub = await substituteAgainstStateAsync(valueFromRaw, secretContext);
-			if (sub.kind === "literal" && typeof sub.value === "string" && sub.value.length > 0) {
-				container.secrets.push({
-					name: sName,
-					valueFrom: sub.value
-				});
-				resolvedSecretNames.add(sName);
-			}
-		}
-		if (resolvedEnvKeys.size > 0 || resolvedSecretNames.size > 0) {
-			container.warnings = container.warnings.filter((w) => {
-				for (const k of resolvedEnvKeys) if (w.startsWith(`Environment ${displayIdent(k)} dropped:`)) return false;
-				for (const k of resolvedSecretNames) if (w.startsWith(`Secret ${displayIdent(k)} dropped:`)) return false;
-				return true;
-			});
-			task.warnings = task.warnings.filter((w) => {
-				for (const k of resolvedEnvKeys) if (w.startsWith(`Container ${displayIdent(containerName)}: Environment ${displayIdent(k)} dropped:`)) return false;
-				for (const k of resolvedSecretNames) if (w.startsWith(`Container ${displayIdent(containerName)}: Secret ${displayIdent(k)} dropped:`)) return false;
-				return true;
-			});
-		}
-	}
-}
-
-//#endregion
-//#region src/local/runtime-image.ts
-const SUPPORTED_RUNTIMES = {
-	"nodejs18.x": {
-		image: "public.ecr.aws/lambda/nodejs:18",
-		fileExtension: ".js"
-	},
-	"nodejs20.x": {
-		image: "public.ecr.aws/lambda/nodejs:20",
-		fileExtension: ".js"
-	},
-	"nodejs22.x": {
-		image: "public.ecr.aws/lambda/nodejs:22",
-		fileExtension: ".js"
-	},
-	"nodejs24.x": {
-		image: "public.ecr.aws/lambda/nodejs:24",
-		fileExtension: ".js"
-	},
-	"python3.11": {
-		image: "public.ecr.aws/lambda/python:3.11",
-		fileExtension: ".py"
-	},
-	"python3.12": {
-		image: "public.ecr.aws/lambda/python:3.12",
-		fileExtension: ".py"
-	},
-	"python3.13": {
-		image: "public.ecr.aws/lambda/python:3.13",
-		fileExtension: ".py"
-	},
-	"python3.14": {
-		image: "public.ecr.aws/lambda/python:3.14",
-		fileExtension: ".py"
-	},
-	"ruby3.2": {
-		image: "public.ecr.aws/lambda/ruby:3.2",
-		fileExtension: ".rb"
-	},
-	"ruby3.3": {
-		image: "public.ecr.aws/lambda/ruby:3.3",
-		fileExtension: ".rb"
-	},
-	"java8.al2": {
-		image: "public.ecr.aws/lambda/java:8.al2",
-		fileExtension: null
-	},
-	java11: {
-		image: "public.ecr.aws/lambda/java:11",
-		fileExtension: null
-	},
-	java17: {
-		image: "public.ecr.aws/lambda/java:17",
-		fileExtension: null
-	},
-	java21: {
-		image: "public.ecr.aws/lambda/java:21",
-		fileExtension: null
-	},
-	dotnet6: {
-		image: "public.ecr.aws/lambda/dotnet:6",
-		fileExtension: null
-	},
-	dotnet8: {
-		image: "public.ecr.aws/lambda/dotnet:8",
-		fileExtension: null
-	},
-	"provided.al2": {
-		image: "public.ecr.aws/lambda/provided:al2",
-		fileExtension: null
-	},
-	"provided.al2023": {
-		image: "public.ecr.aws/lambda/provided:al2023",
-		fileExtension: null
-	}
-};
-var UnsupportedRuntimeError = class UnsupportedRuntimeError extends Error {
-	runtime;
-	constructor(runtime, message) {
-		super(message);
-		this.runtime = runtime;
-		this.name = "UnsupportedRuntimeError";
-		Object.setPrototypeOf(this, UnsupportedRuntimeError.prototype);
-	}
-};
-function resolveRuntimeImage(runtime) {
-	return resolveRuntimeSpec(runtime).image;
-}
-function resolveRuntimeFileExtension(runtime) {
-	const spec = resolveRuntimeSpec(runtime);
-	if (spec.fileExtension === null) throw new UnsupportedRuntimeError(runtime, `Inline 'Code.ZipFile' is not supported for runtime ${displayIdent(runtime)}. The Lambda Handler shape for this runtime names a compiled artifact (a JVM class, a .NET assembly, or — for the OS-only \`provided.*\` runtimes — an arbitrary \`bootstrap\` binary) that cannot be expressed as a single inline source file. Use \`lambda.Code.fromAsset(<dir>)\` with a directory containing the compiled output (.class hierarchy / JAR / DLL / native binary).`);
-	return spec.fileExtension;
-}
-function resolveRuntimeSpec(runtime) {
-	if (typeof runtime !== "string" || runtime.length === 0) throw new UnsupportedRuntimeError(String(runtime), "Lambda function has no Runtime property. This branch is only reached for ZIP Lambdas; container-image Lambdas (Code.ImageUri) take a different code path that does not consult the Runtime property.");
-	const spec = SUPPORTED_RUNTIMES[runtime];
-	if (spec) return spec;
-	if (runtime === "go1.x") throw new UnsupportedRuntimeError(runtime, "Runtime 'go1.x' was deprecated by AWS Lambda on 2024-01-08 and is no longer available. Migrate to the OS-only runtime: build your Go program as a `bootstrap` binary and set the CDK runtime to `lambda.Runtime.PROVIDED_AL2023` (or `lambda.Runtime.PROVIDED_AL2`). See https://docs.aws.amazon.com/lambda/latest/dg/lambda-golang.html");
-	throw new UnsupportedRuntimeError(runtime, `Unknown runtime ${displayIdent(runtime)}. ${getEmbedConfig().cliName} invoke supports nodejs18.x / nodejs20.x / nodejs22.x / nodejs24.x / python3.11 / python3.12 / python3.13 / python3.14 / ruby3.2 / ruby3.3 / java8.al2 / java11 / java17 / java21 / dotnet6 / dotnet8 / provided.al2 / provided.al2023.`);
-}
-function resolveRuntimeCodeMountPath(runtime) {
-	resolveRuntimeSpec(runtime);
-	if (runtime === "provided.al2" || runtime === "provided.al2023") return "/var/runtime";
-	return "/var/task";
-}
-
-//#endregion
-//#region src/utils/docker-argv-redaction.ts
-const REDACTED_ARGV_VALUE = "***";
-const ARGV_VALUE_BEARING_FLAGS = /* @__PURE__ */ new Set([
-	"-e",
-	"--env",
-	"--opt",
-	"--label",
-	"--build-arg"
-]);
-const ARGV_PARAM_LIST_FLAGS = /* @__PURE__ */ new Set(["--cache-from", "--cache-to"]);
-const ARGV_PARAM_LIST_LOCATOR_PARAMS = /* @__PURE__ */ new Set([
-	"type",
-	"mode",
-	"compression",
-	"compression-level",
-	"force-compression",
-	"ignore-error",
-	"image-manifest",
-	"oci-mediatypes",
-	"timeout",
-	"ref",
-	"dest",
-	"src",
-	"digest",
-	"tag",
-	"region",
-	"bucket",
-	"name",
-	"prefix",
-	"manifests_prefix",
-	"blobs_prefix",
-	"use_path_style",
-	"upload_parallelism",
-	"touch_refresh",
-	"account_name",
-	"scope"
-]);
-const ARGV_PARAM_LIST_URL_PARAMS = /* @__PURE__ */ new Set([
-	"account_url",
-	"endpoint_url",
-	"url",
-	"url_v2"
-]);
-function redactUrlLocator(value) {
-	if (value === "") return value;
-	const authority = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\//.exec(value);
-	if (authority === null) return REDACTED_ARGV_VALUE;
-	const prefix = authority[0];
-	let rest = value.slice(prefix.length);
-	const lastAt = rest.lastIndexOf("@");
-	if (lastAt >= 0) rest = `${REDACTED_ARGV_VALUE}${rest.slice(lastAt)}`;
-	else {
-		const host = rest.split(/[/?#]/)[0];
-		const ipv6 = /^\[[0-9A-Fa-f:.]+\]/.exec(host);
-		const bare = ipv6 ? host.slice(ipv6[0].length) : host;
-		if (/:(?!\d{1,5}$)/.test(bare)) return REDACTED_ARGV_VALUE;
-	}
-	for (const delimiter of ["?", "#"]) {
-		const at = rest.indexOf(delimiter);
-		if (at >= 0) rest = `${rest.slice(0, at)}${delimiter}${REDACTED_ARGV_VALUE}`;
-	}
-	return `${prefix}${rest}`;
-}
-function maskArgvFlagValue(flag, value) {
-	if (ARGV_VALUE_BEARING_FLAGS.has(flag)) {
-		const eqIdx = value.indexOf("=");
-		return eqIdx >= 0 ? `${value.substring(0, eqIdx)}=${REDACTED_ARGV_VALUE}` : void 0;
-	}
-	if (ARGV_PARAM_LIST_FLAGS.has(flag)) {
-		let masked = false;
-		const rawParts = value.split(",");
-		const parts = rawParts.map((part, index) => {
-			if (part === "") return part;
-			if (masked) return REDACTED_ARGV_VALUE;
-			const eqIdx = part.indexOf("=");
-			if (eqIdx < 0) {
-				if (index === 0) return part;
-				masked = true;
-				return REDACTED_ARGV_VALUE;
-			}
-			const name = part.substring(0, eqIdx);
-			const normalized = name.trim().toLowerCase();
-			if (ARGV_PARAM_LIST_URL_PARAMS.has(normalized)) {
-				if (rawParts.slice(index + 1).some((later) => later.includes("@"))) {
-					masked = true;
-					return `${name}=${REDACTED_ARGV_VALUE}`;
-				}
-				const rawUrl = part.substring(eqIdx + 1);
-				const safeUrl = redactUrlLocator(rawUrl);
-				if (safeUrl === rawUrl) return part;
-				masked = true;
-				return `${name}=${safeUrl}`;
-			}
-			if (ARGV_PARAM_LIST_LOCATOR_PARAMS.has(normalized)) return part;
-			masked = true;
-			return `${name}=${REDACTED_ARGV_VALUE}`;
-		});
-		return masked ? parts.join(",") : void 0;
-	}
-}
-function maskAttachedShortFlag(arg) {
-	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
-	let chosen;
-	for (const flag of ARGV_VALUE_BEARING_FLAGS) {
-		if (flag.length !== 2 || !flag.startsWith("-") || flag[1] === "-") continue;
-		const at = arg.indexOf(flag[1], 1);
-		if (at < 0 || at === arg.length - 1) continue;
-		if (chosen === void 0 || at < chosen.at) chosen = {
-			at,
-			flag
-		};
-	}
-	if (chosen === void 0) return void 0;
-	const masked = maskArgvFlagValue(chosen.flag, arg.slice(chosen.at + 1));
-	return masked === void 0 ? void 0 : `${arg.slice(0, chosen.at + 1)}${masked}`;
-}
-function trailingShortFlagOfCluster(arg) {
-	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
-	const last = arg[arg.length - 1];
-	for (const flag of ARGV_VALUE_BEARING_FLAGS) if (flag.length === 2 && flag.startsWith("-") && flag[1] !== "-" && flag[1] === last) return flag;
-}
-function redactDockerArgvValues(args) {
-	const out = [];
-	for (let i = 0; i < args.length; i++) {
-		const cur = args[i];
-		const joinedEq = cur.indexOf("=");
-		if (joinedEq > 0) {
-			const maskedJoined = maskArgvFlagValue(cur.substring(0, joinedEq), cur.substring(joinedEq + 1));
-			if (maskedJoined !== void 0) {
-				out.push(`${cur.substring(0, joinedEq)}=${maskedJoined}`);
-				continue;
-			}
-		}
-		const maskedAttached = maskAttachedShortFlag(cur);
-		if (maskedAttached !== void 0) {
-			out.push(maskedAttached);
-			continue;
-		}
-		const next = args[i + 1];
-		if (typeof next === "string") {
-			const maskedNext = maskArgvFlagValue(ARGV_VALUE_BEARING_FLAGS.has(cur) ? cur : trailingShortFlagOfCluster(cur) ?? cur, next);
-			if (maskedNext !== void 0) {
-				out.push(cur, maskedNext);
-				i++;
-				continue;
-			}
-		}
-		out.push(cur);
-	}
-	return out;
-}
-function describeExitWithoutArgv(err) {
-	const e = err;
-	if (typeof e?.signal === "string" && e.signal !== "") return `killed by ${e.signal}`;
-	if (typeof e?.code === "number") return `exited with code ${e.code}`;
-	if (typeof e?.code === "string" && e.code !== "") return `failed (${e.code})`;
-	return "failed with no output";
-}
-
-//#endregion
-//#region src/assets/asset-source-path.ts
-function resolveAssetSourcePath(opts) {
-	const { manifestDir, value, assetOutdir, field, subject, action, wrapError } = opts;
-	const shownValue = displayUntrustedValue(value);
-	if (isAbsolute(value) && opts.absolute !== "fold") {
-		const absolute = resolve(value);
-		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
-		if (escape !== void 0 && opts.absolute === "honour") throw wrapError(`${subject} has an absolute ${field}=${shownValue} which ` + renderAssemblyPathEscape(escape, assetOutdir, action));
-		if (escape !== void 0) {
-			const refusal = originScopeRefusal(absolute, assetOutdir);
-			if (refusal !== void 0) throw wrapError(`${subject} has an absolute ${field}=${shownValue} which ${refusal}. An absolute ${field} is accepted only as a cdk synth --no-staging source folder: a directory inside your project (the git work tree holding the output directory, or the current directory when it contains the output directory or is a git work-tree root), not under a credential or version-control directory. Refusing to ${action}.`);
-			warnAbsoluteOutsideAssembly(opts, absolute, escape);
-			return absolute;
-		}
-		if (namesTheSameDirectory(assetOutdir, absolute)) warnWholeAssemblyAsSource(opts, absolute);
-		return absolute;
-	}
-	const resolved = resolveAssemblyPath(manifestDir, value, { containWithin: assetOutdir });
-	if (resolved.contained) return resolved.path;
-	if (namesTheSameDirectory(assetOutdir, resolved.path)) {
-		warnWholeAssemblyAsSource(opts, resolved.path);
-		return resolved.path;
-	}
-	throw wrapError(`${subject} has ${field}=${shownValue} which ` + renderAssemblyPathEscape(resolved, assetOutdir, action));
-}
-function broadRootReason(root, assetOutdir) {
-	if (root === resolve("/")) return "names the filesystem root";
-	if (containsOrIs(root, realPath(homedir()))) return "names your home directory or a directory containing it";
-	if (containsOrIs(root, realPath(assetOutdir))) return "names a directory containing the app's output directory";
-}
-function originScopeRefusal(absolute, assetOutdir) {
-	const root = realPath(absolute);
-	const broad = broadRootReason(root, assetOutdir);
-	if (broad !== void 0) return broad;
-	const projects = projectRoots(assetOutdir);
-	let hidden;
-	let isProjectRoot = false;
-	for (const project of projects) {
-		const rel = relative(project, root);
-		if (rel === "") isProjectRoot = true;
-		if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) continue;
-		const dotted = rel.split(sep).find((c) => CREDENTIAL_DIR_NAMES.has(c.toLowerCase()));
-		if (dotted === void 0) return void 0;
-		hidden = dotted;
-	}
-	if (isProjectRoot) return "is your project root itself; name a folder inside it";
-	if (hidden !== void 0) return `passes through the credential / version-control directory ${displayUntrustedValue(hidden)} inside your project`;
-	const shown = projects.map((p) => displayUntrustedValue(p)).join(" or ");
-	return projects.length === 0 ? "is outside any usable project root (the current directory and the git work tree are too broad to scope it)" : `resolves to ${displayUntrustedValue(root)}, outside your project (${shown})`;
-}
-const CREDENTIAL_DIR_NAMES = /* @__PURE__ */ new Set([
-	".git",
-	".hg",
-	".svn",
-	".ssh",
-	".aws",
-	".gnupg",
-	".docker",
-	".kube",
-	".config",
-	".azure",
-	".gcloud",
-	".terraform",
-	".npm",
-	".pnpm-store",
-	".yarn",
-	".cache",
-	".local"
-]);
-function projectRoots(assetOutdir) {
-	const roots = [];
-	const usable = (p) => p !== resolve("/") && !containsOrIs(p, realPath(homedir()));
-	const cwd = realPath(process.cwd());
-	const outdir = realPath(assetOutdir);
-	if (usable(cwd) && (containsOrIs(cwd, outdir) || existsSync(join(cwd, ".git")))) roots.push(cwd);
-	let dir = outdir;
-	for (;;) {
-		if (existsSync(join(dir, ".git"))) {
-			if (usable(dir) && !roots.includes(dir)) roots.push(dir);
-			break;
-		}
-		const parent = dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return roots;
-}
-function containsOrIs(outer, inner) {
-	const rel = relative(outer, inner);
-	return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
-}
-function realPath(p, hops = 0) {
-	const abs = resolve(p);
-	try {
-		return realpathSync.native(abs);
-	} catch {
-		const parent = dirname(abs);
-		if (parent === abs) return abs;
-		const realParent = realPath(parent, hops);
-		let link;
-		try {
-			link = readlinkSync(abs);
-		} catch {
-			link = void 0;
-		}
-		if (link !== void 0 && hops < 40) return realPath(resolve(realParent, link), hops + 1);
-		return join(realParent, basename(abs));
-	}
-}
-const warnedAbsoluteOutside = /* @__PURE__ */ new Set();
-function warnAbsoluteOutsideAssembly(opts, absolute, escape) {
-	const logger = getLogger().child("assets");
-	const line = `${opts.subject} has an absolute ${opts.field} pointing outside the assembly: ` + displayUntrustedValue(absolute) + (escape.escape === "symlink" ? ` (through a symbolic link to ${displayUntrustedValue(escape.realPath)})` : "") + `. ${getEmbedConfig().productName} will ${opts.sink}. ` + (escape.escape === "lexical" ? "This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted." : "No CDK synth writes this, so treat this assembly as untrusted unless you made that link yourself.");
-	if (warnedAbsoluteOutside.has(line)) {
-		logger.debug(line);
-		return;
-	}
-	warnedAbsoluteOutside.add(line);
-	logger.warn(line);
-}
-const warnedWholeAssembly = /* @__PURE__ */ new Set();
-function warnWholeAssemblyAsSource(opts, outdir) {
-	const logger = getLogger().child("assets");
-	const line = `${opts.subject} has ${opts.field} naming the assembly's output directory ITSELF: ${displayUntrustedValue(outdir)}. ${getEmbedConfig().productName} will ${opts.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`;
-	if (warnedWholeAssembly.has(line)) {
-		logger.debug(line);
-		return;
-	}
-	warnedWholeAssembly.add(line);
-	logger.warn(line);
-}
-
-//#endregion
-//#region src/assets/docker-cache-option.ts
-function cacheOptionToFlag(option) {
-	let flag = `type=${option.type}`;
-	if (option.params) for (const [k, v] of Object.entries(option.params)) flag += `,${k}=${v}`;
-	return flag;
-}
-
-//#endregion
-//#region src/assets/buildkit-passthrough-warnings.ts
-function candidateHostPaths(value, opts) {
-	const out = [];
-	for (const part of value.split(",")) {
-		const eq = part.indexOf("=");
-		if (eq < 0) {
-			const bare = part.trim();
-			if (bare.length > 0) out.push({
-				path: bare,
-				write: opts.bareIsWrite
-			});
-			continue;
-		}
-		const key = part.slice(0, eq).trim().toLowerCase();
-		const v = part.slice(eq + 1).trim();
-		if (v.length === 0) continue;
-		if (key !== "src" && key !== "source" && key !== "dest") continue;
-		out.push({
-			path: v,
-			write: key === "dest"
-		});
-	}
-	return out;
-}
-function hostPathsOf(source) {
-	const refs = [];
-	if (source.dockerFile) refs.push({
-		field: "dockerFile",
-		where: "dockerFile",
-		path: source.dockerFile,
-		write: false
-	});
-	for (const [k, v] of Object.entries(source.dockerBuildContexts ?? {})) {
-		const rendered = `${k}=${v}`;
-		const contextPath = rendered.slice(rendered.indexOf("=") + 1).trim().replace(/^oci-layout:\/\//, "");
-		if (contextPath.length === 0) continue;
-		refs.push({
-			field: "dockerBuildContexts",
-			where: k,
-			path: contextPath,
-			write: false
-		});
-	}
-	const ssh = source.dockerBuildSsh ?? "";
-	const sshEq = ssh.indexOf("=");
-	(sshEq < 0 ? [] : ssh.slice(sshEq + 1).split(",")).forEach((entry, i) => {
-		const p = entry.trim();
-		if (p.length > 0) refs.push({
-			field: "dockerBuildSsh",
-			where: String(i),
-			path: p,
-			write: false
-		});
-	});
-	for (const [k, v] of Object.entries(source.dockerBuildSecrets ?? {})) for (const { path: p, write } of candidateHostPaths(`id=${k},${v}`, { bareIsWrite: false })) refs.push({
-		field: "dockerBuildSecrets",
-		where: k,
-		path: p,
-		write
-	});
-	(source.cacheFrom ?? []).forEach((c, i) => {
-		for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(c), { bareIsWrite: false })) refs.push({
-			field: "cacheFrom",
-			where: String(i),
-			path: p,
-			write
-		});
-	});
-	if (source.cacheTo) for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(source.cacheTo), { bareIsWrite: false })) refs.push({
-		field: "cacheTo",
-		where: "cacheTo",
-		path: p,
-		write
-	});
-	(source.dockerOutputs ?? []).forEach((o, i) => {
-		for (const { path: p, write } of candidateHostPaths(o, { bareIsWrite: true })) refs.push({
-			field: "dockerOutputs",
-			where: String(i),
-			path: p,
-			write
-		});
-	});
-	return refs;
-}
-const warnedPassthroughs = /* @__PURE__ */ new Set();
-function warnEscapingBuildKitPaths(source, base, bound) {
-	const logger = getLogger().child("assets");
-	for (const ref of hostPathsOf(source)) {
-		const escape = assemblyPathEscape(base, bound, ref.path);
-		if (escape === void 0) continue;
-		const verb = ref.write ? "WRITE to" : "read";
-		const line = `Docker asset ${ref.field}` + (ref.where === ref.field ? "" : `[${displayUntrustedValue(ref.where)}]`) + ` names a host path outside the assembly, which ` + renderAssemblyPathEscape(escape, bound, "load", `${getEmbedConfig().productName} will ${verb} it during the image build, matching the CDK CLI — a pre-synthesized assembly is trusted input. If you did not produce this assembly, that is a host path it chose and the CloudFormation template does not show.`);
-		if (warnedPassthroughs.has(line)) {
-			logger.debug(line);
-			continue;
-		}
-		warnedPassthroughs.add(line);
-		logger.warn(line);
-	}
-}
-
-//#endregion
-//#region src/assets/docker-build.ts
-const warnedExecutables = /* @__PURE__ */ new Set();
-function warnManifestExecutable(cmd, executable, cwd) {
-	const logger = getLogger().child("docker-build");
-	const key = JSON.stringify([cwd, executable]);
-	if (warnedExecutables.has(key)) {
-		logger.debug(`source.executable already announced this process: ${displayUntrustedValue(cmd)} (cwd=${displayUntrustedValue(cwd)})`);
-		return;
-	}
-	warnedExecutables.add(key);
-	const argCount = executable.length - 1;
-	logger.warn(`Docker asset source.executable runs a command this asset manifest chose, on this machine: ${displayUntrustedValue(cmd)}` + (argCount > 0 ? ` (with ${argCount} argument(s); --verbose shows them)` : "") + `. ${getEmbedConfig().productName} runs it, matching the CDK CLI — a pre-synthesized assembly is trusted input. Note that this means running a local command against a pre-synthesized assembly DOES execute code from it, which the CloudFormation template does not show.`);
-}
-async function buildDockerImage(asset, cdkOutDir, options) {
-	const source = asset.source;
-	const logger = getLogger().child("docker-build");
-	const assetOutdir = options.assetOutdir ?? cdkOutDir;
-	const contextDirectory = (directory, sink) => resolveAssetSourcePath({
-		manifestDir: cdkOutDir,
-		value: directory,
-		assetOutdir,
-		absolute: "fold",
-		field: "source.directory",
-		subject: "Docker image asset",
-		action: "build it",
-		sink,
-		wrapError: (message) => new LocalInvokeBuildError(message)
-	});
-	if (source.executable && source.executable.length > 0) {
-		const [cmd, ...args] = source.executable;
-		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
-		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
-		logger.debug(`Building Docker image via executable: ${displayUntrustedValue(redactDockerArgvValues(source.executable).join(" "))} (cwd=${displayUntrustedValue(cwd)})`);
-		warnManifestExecutable(cmd, source.executable, cwd);
-		let result;
-		try {
-			result = await spawnStreaming(cmd, args, { cwd });
-		} catch (err) {
-			const e = err;
-			throw options.wrapError(displayToolOutput(e.stderr || e.message || String(err)));
-		}
-		const tag = result.stdout.trim();
-		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${displayUntrustedValue(cmd)}`);
-		return tag;
-	}
-	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (fields present: ${displayUntrustedValue(Object.keys(source).join(", ") || "none")})`);
-	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
-	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
-	const contextDir = contextDirectory(source.directory, `send that directory to docker build as the context of an image ${getEmbedConfig().productName} then runs locally`);
-	buildArgs.push(".");
-	warnEscapingBuildKitPaths(source, contextDir, assetOutdir);
-	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).map((a) => displayUntrustedValue(a)).join(" ")} (cwd=${displayUntrustedValue(contextDir)})`);
-	try {
-		await runDockerStreaming(buildArgs, {
-			cwd: contextDir,
-			env: { BUILDX_NO_DEFAULT_ATTESTATIONS: "1" },
-			...options.progressLabel !== void 0 && { progressLabel: options.progressLabel }
-		});
-	} catch (err) {
-		const e = err;
-		throw options.wrapError(displayToolOutput(e.stderr || e.message || String(err)));
-	}
-	return options.tag;
-}
-function buildDockerBuildCommand(source, tag, platformOverride) {
-	const args = [
-		"build",
-		"--tag",
-		tag
-	];
-	if (source.dockerBuildArgs) for (const [k, v] of Object.entries(source.dockerBuildArgs)) args.push("--build-arg", `${k}=${v}`);
-	if (source.dockerBuildContexts) for (const [k, v] of Object.entries(source.dockerBuildContexts)) args.push("--build-context", `${k}=${v}`);
-	if (source.dockerBuildSecrets) for (const [k, v] of Object.entries(source.dockerBuildSecrets)) args.push("--secret", `id=${k},${v}`);
-	if (source.dockerBuildSsh) args.push("--ssh", source.dockerBuildSsh);
-	if (source.dockerBuildTarget) args.push("--target", source.dockerBuildTarget);
-	if (source.dockerFile) args.push("--file", source.dockerFile);
-	if (source.networkMode) args.push("--network", source.networkMode);
-	const platform = platformOverride ?? source.platform;
-	if (platform) args.push("--platform", platform);
-	if (source.dockerOutputs) for (const output of source.dockerOutputs) args.push(`--output=${output}`);
-	if (source.cacheFrom) for (const c of source.cacheFrom) args.push("--cache-from", cacheOptionToFlag(c));
-	if (source.cacheTo) args.push("--cache-to", cacheOptionToFlag(source.cacheTo));
-	if (source.cacheDisabled) args.push("--no-cache");
-	return args;
-}
-
-//#endregion
-//#region src/local/ecr-puller.ts
-function parseEcrUri(imageUri) {
-	const host = parseEcrRegistryHost(imageUri);
-	if (!host) return void 0;
-	const canonicalUri = canonicalizeImageUriHost(imageUri);
-	const m = /^([^:]+):(.+)$/.exec(canonicalUri.slice(canonicalUri.indexOf("/") + 1));
-	if (!m) return void 0;
-	return {
-		accountId: host.accountId,
-		region: host.region,
-		repository: m[1],
-		tag: m[2],
-		canonicalUri,
-		registryHost: host.registryHost
-	};
-}
-const ASSUMED_ROLE_CACHE = /* @__PURE__ */ new Map();
-const CALLER_IDENTITY_CACHE = /* @__PURE__ */ new Map();
-const STS_CREDENTIAL_SAFETY_MARGIN_MS = 300 * 1e3;
-function isCredentialFresh(creds) {
-	if (!creds.expiration) return false;
-	return creds.expiration.getTime() - Date.now() > STS_CREDENTIAL_SAFETY_MARGIN_MS;
-}
-async function pullEcrImage(imageUri, options) {
-	const logger = getLogger().child("ecr-puller");
-	const parsed = parseEcrUri(imageUri);
-	if (!parsed) throw new LocalInvokeBuildError(`Image URI ${displayUntrustedValue(imageUri)} is not an ECR URI. ${getEmbedConfig().cliName} invoke v1 only authenticates against ECR for the deployed-image fallback path.`);
-	const canonicalUri = parsed.canonicalUri;
-	const callerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
-	if (options.skipPull) {
-		logger.info(`Skipping ECR pull (--no-pull). Verifying ${canonicalUri} is in local cache...`);
-		await verifyImageInLocalCache(canonicalUri);
-		return canonicalUri;
-	}
-	const callerIdentityKey = `${options.profile ?? "_noprofile"}|${callerRegion ?? "_unset"}`;
-	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
-	if (callerAccount === void 0) {
-		const sts = new STSClient(buildStsClientConfig({
-			region: callerRegion,
-			profile: options.profile
-		}));
-		try {
-			const identity = await sts.send(new GetCallerIdentityCommand({}));
-			if (!identity.Account) throw new LocalInvokeBuildError("STS GetCallerIdentity returned no Account. Verify your AWS credentials.");
-			callerAccount = identity.Account;
-			CALLER_IDENTITY_CACHE.set(callerIdentityKey, callerAccount);
-		} catch (err) {
-			if (err instanceof LocalInvokeBuildError) throw err;
-			throw new LocalInvokeBuildError(`STS GetCallerIdentity failed while preparing the ECR pull: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity (ECR pull)")}. Verify your AWS credentials.`);
-		} finally {
-			sts.destroy();
-		}
-	}
-	const crossAccount = callerAccount !== parsed.accountId;
-	const crossRegion = callerRegion !== void 0 && callerRegion !== parsed.region;
-	let assumed;
-	if (options.ecrRoleArn) {
-		const cacheKey = `${options.profile ?? "_noprofile"}|${options.ecrRoleArn}|${callerRegion ?? "_unset"}`;
-		const cached = ASSUMED_ROLE_CACHE.get(cacheKey);
-		if (cached && isCredentialFresh(cached)) {
-			assumed = cached;
-			logger.debug(`Reusing cached AssumeRole credentials for ${options.ecrRoleArn}`);
-		} else {
-			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, options.profile, logger);
-			ASSUMED_ROLE_CACHE.set(cacheKey, assumed);
-			logger.info(`Assumed role ${options.ecrRoleArn} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
-		}
-	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
-	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
-	const ecr = new ECRClient({
-		...buildProxyClientConfig({ profile: options.profile }),
-		region: parsed.region,
-		...assumed ? { credentials: assumed } : options.profile ? { profile: options.profile } : {}
-	});
-	try {
-		await ecrLogin(ecr, {
-			accountId: parsed.accountId,
-			region: parsed.region,
-			registryHost: parsed.registryHost
-		});
-	} finally {
-		ecr.destroy();
-	}
-	logger.info(`Pulling ${canonicalUri}...`);
-	try {
-		await runDockerForeground(["pull", canonicalUri]);
-	} catch (err) {
-		throw new LocalInvokeBuildError(`docker pull ${canonicalUri} failed: ${err.message}`);
-	}
-	return canonicalUri;
-}
-async function assumeRoleForEcr(roleArn, callerRegion, profile, logger) {
-	if (!isIamRoleArn(roleArn)) throw new LocalInvokeBuildError(refusedRoleArnMessage(roleArn));
-	logger.debug(`Assuming role ${roleArn} for ECR pull...`);
-	const sts = new STSClient(workloadStsClientConfig({
-		region: callerRegion,
-		profile
-	}));
-	try {
-		const creds = (await sts.send(new AssumeRoleCommand({
-			RoleArn: roleArn,
-			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-ecr-${Date.now()}`,
-			DurationSeconds: 3600
-		}))).Credentials;
-		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError(`AssumeRole(${roleArn}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
-		return {
-			accessKeyId: creds.AccessKeyId,
-			secretAccessKey: creds.SecretAccessKey,
-			sessionToken: creds.SessionToken,
-			...creds.Expiration && { expiration: creds.Expiration }
-		};
-	} catch (err) {
-		if (err instanceof LocalInvokeBuildError) throw err;
-		const reason = describeAwsFailureForWarn(err, "STS AssumeRole (ECR pull)");
-		throw new LocalInvokeBuildError(`Failed to assume role ${flattenToOneLine(roleArn)} for ECR pull: ${reason}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
-	} finally {
-		sts.destroy();
-	}
-}
-async function ecrLogin(client, target) {
-	const { accountId, region, registryHost } = target;
-	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region}, host=${registryHost})`);
-	const authData = (await client.send(new GetAuthorizationTokenCommand({})).catch((err) => {
-		throw new LocalInvokeBuildError(`ECR GetAuthorizationToken failed (account=${accountId}, region=${region}): ${describeAwsFailureForWarn(err, "ECR GetAuthorizationToken")}. Verify the credentials can call ecr:GetAuthorizationToken.`);
-	})).authorizationData?.[0];
-	if (!authData?.authorizationToken) throw new LocalInvokeBuildError("Failed to get ECR authorization token");
-	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
-	if (!username || password === void 0) throw new LocalInvokeBuildError("ECR authorization token has unexpected shape (missing username/password)");
-	const endpoint = `https://${registryHost}`;
-	try {
-		await runDockerStreaming([
-			"login",
-			"--username",
-			username,
-			"--password-stdin",
-			endpoint
-		], { input: password });
-	} catch (err) {
-		const e = err;
-		throw new LocalInvokeBuildError(`ECR login failed: ${formatDockerLoginError(e.stderr || e.message || String(err), endpoint)}`);
-	}
-}
-async function verifyImageInLocalCache(imageUri) {
-	try {
-		await runDockerStreaming([
-			"image",
-			"inspect",
-			imageUri
-		]);
-	} catch {
-		throw new LocalInvokeBuildError(`Image ${displayUntrustedValue(imageUri)} is not in the local docker cache and --no-pull was set. Either remove --no-pull (${getEmbedConfig().productName} will pull from ECR) or pre-pull the image manually with \`docker pull\`.`);
-	}
-}
-async function isImageInLocalCache(imageRef) {
-	try {
-		await runDockerStreaming([
-			"image",
-			"inspect",
-			imageRef
-		]);
-		return true;
-	} catch {
-		return false;
-	}
-}
-
-//#endregion
-//#region src/local/docker-image-builder.ts
-async function buildContainerImage(asset, cdkOutDir, options) {
-	const tag = computeLocalTag(asset.source);
-	const platform = architectureToPlatform(options.architecture);
-	const logger = getLogger().child("local-invoke-build");
-	if (options.noBuild === true) {
-		logger.info(`Skipping docker build (--no-build). Verifying ${tag} is in local registry...`);
-		if (!await isImageInLocalCache(tag)) throw new LocalInvokeBuildError(`image ${displayIdent(tag)} not in local registry and --no-build is set; remove --no-build or run \`docker build\` manually first.`);
-		logger.debug(`Local tag ${tag} is cached; skipping build.`);
-		return tag;
-	}
-	logger.info(`Building container image (platform=${platform})...`);
-	logger.debug(`Local tag: ${tag}`);
-	const actualTag = await buildDockerImage(asset, cdkOutDir, {
-		tag,
-		platform,
-		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for container Lambda asset (${displayUntrustedValue(asset.source.directory ?? asset.source.executable?.[0] ?? "")}): ${stderr}`),
-		progressLabel: `Building container image (platform=${platform})`,
-		...options.assetOutdir !== void 0 && { assetOutdir: options.assetOutdir }
-	});
-	if (actualTag !== tag) {
-		logger.debug(`Re-tagging executable-built image ${displayIdent(actualTag)} → ${displayIdent(tag)}`);
-		try {
-			await runDockerStreaming([
-				"tag",
-				actualTag,
-				tag
-			]);
-		} catch (err) {
-			const e = err;
-			throw new LocalInvokeBuildError(`docker tag failed re-tagging ${displayIdent(actualTag)} → ${displayIdent(tag)}: ${displayToolOutput(e.stderr?.trim() || e.message || String(err))}`);
-		}
-	}
-	return tag;
-}
-function architectureToPlatform(architecture) {
-	return architecture === "arm64" ? "linux/arm64" : "linux/amd64";
-}
-function hostPlatform() {
-	return process.arch === "arm64" ? "linux/arm64" : "linux/amd64";
-}
-const warnedEmulatedPlatforms = /* @__PURE__ */ new Set();
-function warnIfEmulatedPlatform(platform, opts = {}) {
-	if (!platform) return;
-	const host = hostPlatform();
-	if (platform === host) return;
-	if (warnedEmulatedPlatforms.has(platform)) return;
-	warnedEmulatedPlatforms.add(platform);
-	const logger = opts.logger ?? getLogger();
-	const what = opts.label ? `${displayIdent(opts.label)} ` : "";
-	logger.warn(`Running ${what}under ${platform} emulation on a ${host} host (the declared architecture differs from the host). Emulation is slower and some compiled binaries can fail under it. If the container does not run correctly, enable Rosetta for x86/amd64 emulation in your Docker engine settings, or build the function for ${host}.`);
-}
-function computeLocalTag(source) {
-	const hash = createHash("sha256");
-	pushField(hash, "directory", source.directory ?? "");
-	pushField(hash, "executable", (source.executable ?? []).join(" "));
-	pushField(hash, "dockerFile", source.dockerFile ?? "");
-	pushField(hash, "dockerBuildTarget", source.dockerBuildTarget ?? "");
-	pushField(hash, "networkMode", source.networkMode ?? "");
-	pushField(hash, "platform", source.platform ?? "");
-	pushField(hash, "dockerBuildSsh", source.dockerBuildSsh ?? "");
-	pushField(hash, "cacheDisabled", source.cacheDisabled ? "1" : "0");
-	pushMap(hash, "dockerBuildArgs", source.dockerBuildArgs);
-	pushMap(hash, "dockerBuildContexts", source.dockerBuildContexts);
-	pushMap(hash, "dockerBuildSecrets", source.dockerBuildSecrets);
-	pushField(hash, "dockerOutputs", (source.dockerOutputs ?? []).join(""));
-	pushField(hash, "cacheFrom", (source.cacheFrom ?? []).map((o) => JSON.stringify(o)).join(""));
-	pushField(hash, "cacheTo", source.cacheTo ? JSON.stringify(source.cacheTo) : "");
-	return `${getEmbedConfig().resourceNamePrefix}-invoke-${hash.digest("hex").slice(0, 16)}`;
-}
-function pushField(hash, name, value) {
-	hash.update(name);
-	hash.update("=");
-	hash.update(value);
-	hash.update("\0");
-}
-function pushMap(hash, name, value) {
-	hash.update(name);
-	hash.update("={");
-	if (value) for (const [k, v] of Object.entries(value)) {
-		hash.update(k);
-		hash.update("=");
-		hash.update(v);
-		hash.update(";");
-	}
-	hash.update("}\0");
-}
-
-//#endregion
-//#region src/local/docker-runner.ts
-const execFileAsync$7 = promisify(execFile);
-var DockerRunnerError = class DockerRunnerError extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "DockerRunnerError";
-		Object.setPrototypeOf(this, DockerRunnerError.prototype);
-	}
-};
-async function pullImage(image, skipPull, platform) {
-	const logger = getLogger().child("docker");
-	if (skipPull) {
-		logger.debug(`Skipping docker pull for ${displayIdent(image)} (--no-pull)`);
-		return;
-	}
-	const platformArgs = platform ? ["--platform", platform] : [];
-	if (getLogger().getLevel() === "debug") {
-		logger.info(`Pulling ${displayIdent(image)}${platform ? ` (${displayIdent(platform)})` : ""}...`);
-		try {
-			await runDockerForeground([
-				"pull",
-				...platformArgs,
-				image
-			]);
-		} catch (err) {
-			const e = err;
-			throw new DockerRunnerError(`docker pull ${displayIdent(image)} failed: ${e.message}`);
-		}
-		return;
-	}
-	logger.debug(`Pulling ${displayIdent(image)} (silent — pass --verbose to stream progress)`);
-	try {
-		await runDockerStreaming([
-			"pull",
-			...platformArgs,
-			image
-		], {
-			streamLive: false,
-			progressLabel: `Pulling ${displayIdent(image)}`
-		});
-	} catch (err) {
-		const e = err;
-		if (e.exitCode === void 0 || e.exitCode === null) throw new DockerRunnerError(`docker pull ${displayIdent(image)} failed: ${displayToolOutput(e.message ?? String(err))}`);
-		const detail = e.stderr?.trim() || e.stdout?.trim() || "(no output)";
-		throw new DockerRunnerError(`docker pull ${displayIdent(image)} exited with code ${e.exitCode}: ${displayToolOutput(detail)}`);
-	}
-}
-async function runDetached(opts) {
-	const args = opts.autoRemove === false ? ["run", "-d"] : [
-		"run",
-		"-d",
-		"--rm"
-	];
-	if (opts.name) args.push("--name", opts.name);
-	if (opts.network) args.push("--network", opts.network);
-	if (opts.platform) {
-		args.push("--platform", opts.platform);
-		warnIfEmulatedPlatform(opts.platform, opts.name ? { label: opts.name } : {});
-	}
-	if (opts.extraHosts) for (const entry of opts.extraHosts) args.push("--add-host", `${entry.host}:${entry.ip}`);
-	const host = opts.host ?? "127.0.0.1";
-	args.push("-p", `${host}:${opts.hostPort}:${opts.containerPort ?? 8080}`);
-	if (opts.debugPort !== void 0) args.push("-p", `${host}:${opts.debugPort}:${opts.debugPort}`);
-	for (const extra of opts.extraPorts ?? []) args.push("-p", `${host}:${extra.hostPort}:${extra.containerPort}`);
-	for (const mount of opts.mounts) {
-		const ro = mount.readOnly ? ":ro" : "";
-		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
-	}
-	if (opts.extraMounts) for (const mount of opts.extraMounts) {
-		const ro = mount.readOnly ? ":ro" : "";
-		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
-	}
-	const sensitiveKeys = opts.sensitiveEnvKeys && opts.sensitiveEnvKeys.size > 0 ? /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...opts.sensitiveEnvKeys]) : SENSITIVE_ENV_KEYS;
-	const { passthrough: passthroughEnv, collisions } = appendEnvFlags(args, opts.env, sensitiveKeys);
-	if (opts.tmpfs) args.push("--tmpfs", `${opts.tmpfs.target}:rw,size=${opts.tmpfs.sizeMb}m`);
-	if (opts.workingDir) args.push("--workdir", opts.workingDir);
-	let entryPointTail = [];
-	if (opts.entryPoint && opts.entryPoint.length > 0) {
-		args.push("--entrypoint", opts.entryPoint[0]);
-		entryPointTail = opts.entryPoint.slice(1);
-	}
-	args.push(opts.image, ...entryPointTail, ...opts.cmd);
-	const logger = getLogger().child("docker");
-	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(args).map((a) => displayUntrustedValue(a)).join(" ")}`);
-	if (collisions.length > 0) logger.warn(describeRefusedSensitiveEnvKeys(`Container for image ${displayUntrustedValue(opts.image)}`, collisions));
-	const forwardedKeys = Object.keys(passthroughEnv);
-	const refusal = finchSecretArgvRefusal(forwardedKeys.filter((k) => opts.sensitiveEnvKeys?.has(k)), {
-		label: "Container for image",
-		name: opts.image
-	});
-	if (refusal !== void 0) throw new DockerRunnerError(refusal);
-	warnFinchArgvExposure(forwardedKeys);
-	try {
-		const { stdout } = await execFileAsync$7(getDockerCmd(), args, {
-			maxBuffer: 10 * 1024 * 1024,
-			...execEnvForSecrets(passthroughEnv)
-		});
-		return stdout.trim();
-	} catch (error) {
-		throw new DockerRunnerError(`docker run failed: ${displayToolOutput(error.stderr?.trim() || describeExitWithoutArgv(error))}`);
-	}
-}
-const PREFIX_CONTAINER_OUTPUT_ENV = "CDKL_PREFIX_CONTAINER_OUTPUT";
-const MAX_HELD_LINE_CHARS = 64 * 1024;
-function createPrefixedLineRelay(prefix, out) {
-	const decoder = new StringDecoder("utf8");
-	let pending = "";
-	const emit = (text) => {
-		let nl = text.indexOf("\n");
-		if (nl !== -1) nl += pending.length;
-		pending += text;
-		while (nl !== -1) {
-			out.write(`${prefix}${pending.slice(0, nl + 1)}`);
-			pending = pending.slice(nl + 1);
-			nl = pending.indexOf("\n");
-		}
-		while (pending.length >= MAX_HELD_LINE_CHARS) {
-			const high = pending.charCodeAt(MAX_HELD_LINE_CHARS - 1);
-			const cut = high >= 55296 && high <= 56319 ? MAX_HELD_LINE_CHARS - 1 : MAX_HELD_LINE_CHARS;
-			out.write(`${prefix}${pending.slice(0, cut)}\n`);
-			pending = pending.slice(cut);
-		}
-	};
-	return {
-		push: (chunk) => emit(decoder.write(chunk)),
-		flush: () => {
-			emit(decoder.end());
-			if (pending.length > 0) {
-				out.write(`${prefix}${pending}\n`);
-				pending = "";
+			const sName = pickString(e["Name"]);
+			const valueFromRaw = e["ValueFrom"];
+			if (!sName) continue;
+			if (typeof valueFromRaw === "string" && valueFromRaw.length > 0) continue;
+			if (container.secrets.some((s) => s.name === sName)) continue;
+			if (!isCrossStackIntrinsic(valueFromRaw)) continue;
+			const sub = await substituteAgainstStateAsync(valueFromRaw, secretContext);
+			if (sub.kind === "literal" && typeof sub.value === "string" && sub.value.length > 0) {
+				container.secrets.push({
+					name: sName,
+					valueFrom: sub.value
+				});
+				resolvedSecretNames.add(sName);
 			}
 		}
-	};
-}
-function streamLogs(containerId, opts = {}) {
-	const proc = spawn(getDockerCmd(), [
-		"logs",
-		"-f",
-		containerId
-	], { stdio: [
-		"ignore",
-		"pipe",
-		"pipe"
-	] });
-	if (opts.onOutput) {
-		const tap = opts.onOutput;
-		proc.stdout?.on("data", (chunk) => tap(chunk));
-		proc.stderr?.on("data", (chunk) => tap(chunk));
-	}
-	let flush = () => void 0;
-	if (opts.prefix !== void 0 || process.env["CDKL_PREFIX_CONTAINER_OUTPUT"] === "1") {
-		const tag = opts.prefix ?? `[${flattenToOneLine(containerId.slice(0, 12)).replace(/[\]\s]/g, "_")}] `;
-		const stdoutRelay = createPrefixedLineRelay(tag, process.stdout);
-		const stderrRelay = createPrefixedLineRelay(tag, process.stderr);
-		proc.stdout?.on("data", (chunk) => stdoutRelay.push(chunk));
-		proc.stderr?.on("data", (chunk) => stderrRelay.push(chunk));
-		flush = () => {
-			stdoutRelay.flush();
-			stderrRelay.flush();
-		};
-		proc.on("close", () => flush());
-	} else {
-		proc.stdout?.on("data", (chunk) => process.stdout.write(chunk));
-		proc.stderr?.on("data", (chunk) => process.stderr.write(chunk));
+		if (resolvedEnvKeys.size > 0 || resolvedSecretNames.size > 0) {
+			container.warnings = container.warnings.filter((w) => {
+				for (const k of resolvedEnvKeys) if (w.startsWith(`Environment ${displayIdent(k)} dropped:`)) return false;
+				for (const k of resolvedSecretNames) if (w.startsWith(`Secret ${displayIdent(k)} dropped:`)) return false;
+				return true;
+			});
+			task.warnings = task.warnings.filter((w) => {
+				for (const k of resolvedEnvKeys) if (w.startsWith(`Container ${displayIdent(containerName)}: Environment ${displayIdent(k)} dropped:`)) return false;
+				for (const k of resolvedSecretNames) if (w.startsWith(`Container ${displayIdent(containerName)}: Secret ${displayIdent(k)} dropped:`)) return false;
+				return true;
+			});
+		}
 	}
-	proc.on("error", () => {});
-	return () => {
-		flush();
-		if (!proc.killed) proc.kill("SIGTERM");
-	};
 }
-async function removeContainer(containerId) {
-	if (!containerId) return;
-	const logger = getLogger().child("docker");
-	try {
-		await execFileAsync$7(getDockerCmd(), [
-			"rm",
-			"-f",
-			containerId
-		]);
-		logger.debug(`Removed container ${containerId}`);
-	} catch (error) {
-		const err = error;
-		logger.debug(`docker rm -f ${containerId} failed: ${err.stderr || err.message || String(error)}`);
+
+//#endregion
+//#region src/local/runtime-image.ts
+const SUPPORTED_RUNTIMES = {
+	"nodejs18.x": {
+		image: "public.ecr.aws/lambda/nodejs:18",
+		fileExtension: ".js"
+	},
+	"nodejs20.x": {
+		image: "public.ecr.aws/lambda/nodejs:20",
+		fileExtension: ".js"
+	},
+	"nodejs22.x": {
+		image: "public.ecr.aws/lambda/nodejs:22",
+		fileExtension: ".js"
+	},
+	"nodejs24.x": {
+		image: "public.ecr.aws/lambda/nodejs:24",
+		fileExtension: ".js"
+	},
+	"python3.11": {
+		image: "public.ecr.aws/lambda/python:3.11",
+		fileExtension: ".py"
+	},
+	"python3.12": {
+		image: "public.ecr.aws/lambda/python:3.12",
+		fileExtension: ".py"
+	},
+	"python3.13": {
+		image: "public.ecr.aws/lambda/python:3.13",
+		fileExtension: ".py"
+	},
+	"python3.14": {
+		image: "public.ecr.aws/lambda/python:3.14",
+		fileExtension: ".py"
+	},
+	"ruby3.2": {
+		image: "public.ecr.aws/lambda/ruby:3.2",
+		fileExtension: ".rb"
+	},
+	"ruby3.3": {
+		image: "public.ecr.aws/lambda/ruby:3.3",
+		fileExtension: ".rb"
+	},
+	"java8.al2": {
+		image: "public.ecr.aws/lambda/java:8.al2",
+		fileExtension: null
+	},
+	java11: {
+		image: "public.ecr.aws/lambda/java:11",
+		fileExtension: null
+	},
+	java17: {
+		image: "public.ecr.aws/lambda/java:17",
+		fileExtension: null
+	},
+	java21: {
+		image: "public.ecr.aws/lambda/java:21",
+		fileExtension: null
+	},
+	dotnet6: {
+		image: "public.ecr.aws/lambda/dotnet:6",
+		fileExtension: null
+	},
+	dotnet8: {
+		image: "public.ecr.aws/lambda/dotnet:8",
+		fileExtension: null
+	},
+	"provided.al2": {
+		image: "public.ecr.aws/lambda/provided:al2",
+		fileExtension: null
+	},
+	"provided.al2023": {
+		image: "public.ecr.aws/lambda/provided:al2023",
+		fileExtension: null
 	}
-}
-async function ensureDockerAvailable() {
-	const cmd = getDockerCmd();
-	try {
-		await execFileAsync$7(cmd, [
-			"version",
-			"--format",
-			"{{.Server.Version}}"
-		]);
-	} catch (error) {
-		const err = error;
-		if (err.code === "ENOENT") throw new DockerRunnerError(`${cmd} is not installed or not on PATH. ${getEmbedConfig().cliName} invoke needs Docker (or a compatible CLI specified via CDK_DOCKER) — install it and retry.`);
-		throw new DockerRunnerError(`${cmd} daemon is not reachable: ${err.stderr?.trim() || err.message || String(error)}. Start Docker Desktop / the docker daemon and retry.`);
+};
+var UnsupportedRuntimeError = class UnsupportedRuntimeError extends Error {
+	runtime;
+	constructor(runtime, message) {
+		super(message);
+		this.runtime = runtime;
+		this.name = "UnsupportedRuntimeError";
+		Object.setPrototypeOf(this, UnsupportedRuntimeError.prototype);
 	}
+};
+function resolveRuntimeImage(runtime) {
+	return resolveRuntimeSpec(runtime).image;
 }
-function pickFreePort() {
-	return new Promise((resolvePort, rejectPort) => {
-		const server = createServer$2();
-		server.unref();
-		server.on("error", rejectPort);
-		server.listen(0, "127.0.0.1", () => {
-			const address = server.address();
-			if (!address || typeof address === "string") {
-				server.close();
-				rejectPort(/* @__PURE__ */ new Error("Could not allocate a host port"));
-				return;
-			}
-			const port = address.port;
-			server.close(() => resolvePort(port));
-		});
-	});
-}
-const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
-	"AWS_ACCESS_KEY_ID",
-	"AWS_SECRET_ACCESS_KEY",
-	"AWS_SESSION_TOKEN"
-]);
-function appendEnvFlags(args, env, sensitiveKeys) {
-	const passthrough = {};
-	const collisions = [];
-	for (const [k, v] of Object.entries(env)) if (sensitiveKeys.has(k)) {
-		if (isMalformedEnvKey(k) || isDockerClientEnvKey(k)) {
-			collisions.push(k);
-			continue;
-		}
-		args.push("-e", k);
-		defineOwnKey(passthrough, k, v);
-	} else args.push("-e", `${k}=${v}`);
-	return {
-		passthrough,
-		collisions
-	};
+function resolveRuntimeFileExtension(runtime) {
+	const spec = resolveRuntimeSpec(runtime);
+	if (spec.fileExtension === null) throw new UnsupportedRuntimeError(runtime, `Inline 'Code.ZipFile' is not supported for runtime ${displayIdent(runtime)}. The Lambda Handler shape for this runtime names a compiled artifact (a JVM class, a .NET assembly, or — for the OS-only \`provided.*\` runtimes — an arbitrary \`bootstrap\` binary) that cannot be expressed as a single inline source file. Use \`lambda.Code.fromAsset(<dir>)\` with a directory containing the compiled output (.class hierarchy / JAR / DLL / native binary).`);
+	return spec.fileExtension;
 }
-function describeRefusedSensitiveEnvKeys(subject, keys) {
-	return `${subject}: sensitive env var(s) ${keys.map(displayUntrustedValue).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack that client; a malformed name cannot form a valid environment variable). Rename the variable if the container needs it.`;
+function resolveRuntimeSpec(runtime) {
+	if (typeof runtime !== "string" || runtime.length === 0) throw new UnsupportedRuntimeError(String(runtime), "Lambda function has no Runtime property. This branch is only reached for ZIP Lambdas; container-image Lambdas (Code.ImageUri) take a different code path that does not consult the Runtime property.");
+	const spec = SUPPORTED_RUNTIMES[runtime];
+	if (spec) return spec;
+	if (runtime === "go1.x") throw new UnsupportedRuntimeError(runtime, "Runtime 'go1.x' was deprecated by AWS Lambda on 2024-01-08 and is no longer available. Migrate to the OS-only runtime: build your Go program as a `bootstrap` binary and set the CDK runtime to `lambda.Runtime.PROVIDED_AL2023` (or `lambda.Runtime.PROVIDED_AL2`). See https://docs.aws.amazon.com/lambda/latest/dg/lambda-golang.html");
+	throw new UnsupportedRuntimeError(runtime, `Unknown runtime ${displayIdent(runtime)}. ${getEmbedConfig().cliName} invoke supports nodejs18.x / nodejs20.x / nodejs22.x / nodejs24.x / python3.11 / python3.12 / python3.13 / python3.14 / ruby3.2 / ruby3.3 / java8.al2 / java11 / java17 / java21 / dotnet6 / dotnet8 / provided.al2 / provided.al2023.`);
 }
-function execEnvForSecrets(passthrough) {
-	const keys = Object.keys(passthrough).filter((k) => !isMalformedEnvKey(k) && !isDockerClientEnvKey(k));
-	if (keys.length === 0) return {};
-	const env = { ...process.env };
-	for (const k of keys) defineOwnKey(env, k, passthrough[k]);
-	return { env };
+function resolveRuntimeCodeMountPath(runtime) {
+	resolveRuntimeSpec(runtime);
+	if (runtime === "provided.al2" || runtime === "provided.al2023") return "/var/runtime";
+	return "/var/task";
 }
 
 //#endregion
@@ -6850,6 +4841,10 @@ function extractHashFromImageUri(imageUri) {
 //#endregion
 //#region src/local/rie-client.ts
 const INVOKE_PATH = "/2015-03-31/functions/function/invocations";
+const NOT_AN_RIE_STATUS = /* @__PURE__ */ new Set([404, 405]);
+function notAnRieError(url, status) {
+	return /* @__PURE__ */ new Error(`The container answered the invoke at ${url} with HTTP ${status}, which the Lambda Runtime Interface Emulator never sends for that path: something else is listening on the container's port 8080 (the function's own server?). Check the container logs.`);
+}
 async function waitForRieReady(host, port, timeoutMs = 5e3) {
 	const deadline = Date.now() + timeoutMs;
 	let lastError;
@@ -6910,6 +4905,7 @@ async function invokeRie(host, port, event, timeoutMs) {
 		clearTimeout(timer);
 	}
 	const raw = await response.text();
+	if (NOT_AN_RIE_STATUS.has(response.status)) throw notAnRieError(url, response.status);
 	let payload = raw;
 	try {
 		payload = JSON.parse(raw);
@@ -6965,6 +4961,11 @@ async function invokeRieStreaming(host, port, event, timeoutMs) {
 		if (err.name === "AbortError") throw new Error(`RIE streaming invoke at ${url} timed out after ${timeoutMs}ms. The handler may be hung; check container logs.`);
 		throw err;
 	}
+	if (NOT_AN_RIE_STATUS.has(response.status)) {
+		clearTimeout(timer);
+		await response.body?.cancel().catch(() => void 0);
+		throw notAnRieError(url, response.status);
+	}
 	if (!response.body) {
 		clearTimeout(timer);
 		throw new Error(`RIE streaming invoke at ${url} returned no response body.`);
@@ -8856,11 +6857,11 @@ function createContainerPool(specs, options) {
 		} else containerId = await runDetached({
 			image: spec.image,
 			mounts: [],
-			...spec.profileCredentialsFile && { extraMounts: [{
+			extraMounts: [...spec.rieMount ? [spec.rieMount] : [], ...spec.profileCredentialsFile ? [{
 				hostPath: spec.profileCredentialsFile.hostPath,
 				containerPath: spec.profileCredentialsFile.containerPath,
 				readOnly: true
-			}] },
+			}] : []],
 			env: spec.env,
 			...spec.sensitiveEnvKeys !== void 0 && { sensitiveEnvKeys: spec.sensitiveEnvKeys },
 			cmd: spec.command,
@@ -9077,6 +7078,209 @@ function clampConcurrency(input) {
 	return Math.min(MAX_PER_LAMBDA_CONCURRENCY, Math.max(MIN_PER_LAMBDA_CONCURRENCY, Math.trunc(input)));
 }
 
+//#endregion
+//#region src/utils/cache-home.ts
+function userCacheHome(env = process.env, home = homedir) {
+	const product = getEmbedConfig().productName.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^\.*$/, "-");
+	const xdg = env["XDG_CACHE_HOME"];
+	if (xdg !== void 0 && isAbsolute(xdg)) return join(xdg, product);
+	let dir;
+	try {
+		dir = home();
+	} catch {
+		return;
+	}
+	return isAbsolute(dir) ? join(dir, ".cache", product) : void 0;
+}
+
+//#endregion
+//#region src/local/rie-mount.ts
+const RIE_CONTAINER_PATH = "/var/rapid/aws-lambda-rie";
+const RIE_SOURCE_IMAGE = "public.ecr.aws/lambda/provided:al2023";
+const RIE_SOURCE_PATH = "/usr/local/bin/aws-lambda-rie";
+const RIE_BASENAME = "aws-lambda-rie";
+const ELF_MACHINE_BY_PLATFORM = {
+	"linux/amd64": 62,
+	"linux/arm64": 183
+};
+function rieCacheDirectory(env = process.env) {
+	const root = userCacheHome(env);
+	return root === void 0 ? void 0 : join(root, "lambda-rie");
+}
+const inFlight = /* @__PURE__ */ new Map();
+const warnedNoBinary = /* @__PURE__ */ new Set();
+async function resolveRieWrap(input) {
+	const logger = getLogger().child("rie");
+	let program;
+	try {
+		const own = nonEmpty(input.entryPoint) && nonEmpty(input.command) ? {
+			entrypoint: [],
+			cmd: []
+		} : await inspectImageEntrypointCmd(input.image);
+		const entryPoint = nonEmpty(input.entryPoint) ? [...input.entryPoint] : own.entrypoint;
+		const cmd = nonEmpty(input.command) ? [...input.command] : own.cmd;
+		program = [...entryPoint, ...cmd];
+	} catch (err) {
+		logger.warn(`Could not read the ENTRYPOINT / CMD of image ${displayUntrustedValue(input.image)} (${messageOf(err)}), so no Lambda Runtime Interface Emulator is mounted into it; it runs as built.`);
+		return;
+	}
+	const ownRie = program.find(isRieExecutable);
+	if (ownRie !== void 0) {
+		logger.debug(`Image ${displayUntrustedValue(input.image)} already runs ${displayUntrustedValue(ownRie)}; not mounting another RIE`);
+		return;
+	}
+	let hostPath;
+	try {
+		hostPath = await ensureRieBinary(input.platform, input.skipPull === true);
+	} catch (err) {
+		if (!warnedNoBinary.has(input.platform)) {
+			warnedNoBinary.add(input.platform);
+			logger.warn(`Could not mount the Lambda Runtime Interface Emulator into ${displayUntrustedValue(input.platform)} container-image functions (${messageOf(err)}). They run as built, so only images that ship their own emulator (the AWS Lambda base images do) can be invoked.`);
+		} else logger.debug(`RIE mount skipped for ${displayUntrustedValue(input.image)}: ${messageOf(err)}`);
+		return;
+	}
+	return {
+		mount: {
+			hostPath,
+			containerPath: RIE_CONTAINER_PATH,
+			readOnly: true
+		},
+		entryPoint: [RIE_CONTAINER_PATH],
+		cmd: program
+	};
+}
+function isRieExecutable(path) {
+	return basename(path).startsWith(RIE_BASENAME);
+}
+function messageOf(err) {
+	return displayToolOutput(err instanceof Error ? err.message : String(err));
+}
+function nonEmpty(v) {
+	return v !== void 0 && v.length > 0;
+}
+async function inspectImageEntrypointCmd(image) {
+	let stdout;
+	try {
+		({stdout} = await runDockerStreaming([
+			"image",
+			"inspect",
+			"--format",
+			"{{json .Config}}",
+			image
+		], { streamLive: false }));
+	} catch (err) {
+		throw new Error(`docker image inspect failed: ${messageOf(err)}`);
+	}
+	const config = JSON.parse(stdout.trim());
+	return {
+		entrypoint: stringArray(config?.Entrypoint),
+		cmd: stringArray(config?.Cmd)
+	};
+}
+function stringArray(v) {
+	return Array.isArray(v) && v.every((s) => typeof s === "string") ? v : [];
+}
+async function ensureRieBinary(platform, skipPull) {
+	const machine = ELF_MACHINE_BY_PLATFORM[platform];
+	if (machine === void 0) throw new Error(`unsupported platform '${platform}'`);
+	const root = rieCacheDirectory();
+	if (root === void 0) throw new Error("no cache directory (HOME is not set)");
+	const target = join(root, platform.replace("/", "-"), RIE_BASENAME);
+	if (!isMountableHostPath(target)) throw new Error(`the cache path ${displayUntrustedValue(target)} contains ':'`);
+	let run = inFlight.get(target);
+	if (run === void 0) {
+		run = (async () => {
+			if (await isRegularFile(target) && await isElfFor(target, machine)) return target;
+			await extractRie(platform, target, machine, skipPull);
+			return target;
+		})();
+		inFlight.set(target, run);
+		run.catch(() => inFlight.delete(target));
+	}
+	return run;
+}
+function isMountableHostPath(path, pathApi = nodePath) {
+	return !path.slice(pathApi.parse(path).root.length).includes(":");
+}
+async function isRegularFile(path) {
+	try {
+		return (await promises.lstat(path)).isFile();
+	} catch {
+		return false;
+	}
+}
+async function isElfFor(path, machine) {
+	let handle;
+	try {
+		handle = await promises.open(path, "r");
+		const header = Buffer.alloc(20);
+		const { bytesRead } = await handle.read(header, 0, 20, 0);
+		return bytesRead === 20 && header.readUInt32BE(0) === 2135247942 && header.readUInt16LE(18) === machine;
+	} catch {
+		return false;
+	} finally {
+		await handle?.close().catch(() => void 0);
+	}
+}
+async function extractRie(platform, target, machine, skipPull) {
+	getLogger().child("rie").info(skipPull ? `Copying the Lambda Runtime Interface Emulator for ${platform} out of the local ${RIE_SOURCE_IMAGE} image (one time)...` : `Fetching the Lambda Runtime Interface Emulator for ${platform} from ${RIE_SOURCE_IMAGE} (one time)...`);
+	const dir = dirname(target);
+	await promises.mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	if (!skipPull) try {
+		await runDockerStreaming([
+			"pull",
+			"--platform",
+			platform,
+			RIE_SOURCE_IMAGE
+		], { streamLive: false });
+	} catch (err) {
+		throw new Error(`docker pull failed: ${messageOf(err)}`);
+	}
+	const createArgs = [
+		"create",
+		"--name",
+		`${getEmbedConfig().resourceNamePrefix}-rie-extract-${process.pid}-${randomBytes(4).toString("hex")}`,
+		...skipPull ? ["--pull", "never"] : [],
+		"--platform",
+		platform,
+		RIE_SOURCE_IMAGE
+	];
+	let containerId;
+	try {
+		containerId = (await runDockerStreaming(createArgs, { streamLive: false })).stdout.trim();
+	} catch (err) {
+		throw new Error(`docker create failed: ${messageOf(err)}` + (skipPull ? ` (--no-pull: pull ${RIE_SOURCE_IMAGE} once, or run ${getEmbedConfig().binaryName} without --no-pull)` : ""));
+	}
+	const tmp = join(dir, `.${RIE_BASENAME}.${process.pid}.${randomBytes(4).toString("hex")}`);
+	try {
+		try {
+			await runDockerStreaming([
+				"cp",
+				`${containerId}:${RIE_SOURCE_PATH}`,
+				tmp
+			], { streamLive: false });
+		} catch (err) {
+			throw new Error(`docker cp failed: ${messageOf(err)}`);
+		}
+		if (!await isRegularFile(tmp) || !await isElfFor(tmp, machine)) throw new Error(`the copied ${RIE_SOURCE_PATH} is not a ${platform} executable`);
+		await promises.chmod(tmp, 493);
+		await promises.rename(tmp, target);
+	} finally {
+		await promises.rm(tmp, {
+			force: true,
+			recursive: true
+		}).catch(() => void 0);
+		await runDockerStreaming([
+			"rm",
+			"-f",
+			containerId
+		], { streamLive: false }).catch(() => void 0);
+	}
+}
+
 //#endregion
 //#region src/local/api-gateway-event.ts
 const MOCK_ACCOUNT_ID = "123456789012";
@@ -12337,8 +10541,8 @@ function getContainerAwsCredentialsPath() {
 async function writeProfileCredentialsFile(profileName, creds) {
 	if (profileName === "") throw new Error("writeProfileCredentialsFile: profile name must not be empty.");
 	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name ${displayUntrustedValue(profileName)} contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
-	const dir = await mkdtemp(path$1.join(tmpdir(), `${getEmbedConfig().productName}-profile-creds-`));
-	const hostPath = path$1.join(dir, "credentials");
+	const dir = await mkdtemp(nodePath.join(tmpdir(), `${getEmbedConfig().productName}-profile-creds-`));
+	const hostPath = nodePath.join(dir, "credentials");
 	const lines = [
 		`[${profileName}]`,
 		`aws_access_key_id = ${creds.accessKeyId}`,
@@ -12381,6 +10585,7 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 	const normalizedAssumeRole = normalizeStartApiAssumeRole(options.assumeRole, options.assumeRoleAuto ?? false);
 	if (normalizedAssumeRole === void 0) delete options.assumeRole;
 	else options.assumeRole = normalizedAssumeRole;
+	await activateWorkloadAwsWiring(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region,
@@ -12791,8 +10996,8 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 }
 function createWatchPredicates(args) {
 	const { watchRoot, output, watchConfig } = args;
-	const toRel = (abs) => path$1.relative(watchRoot, abs).split(path$1.sep).join("/");
-	const outputRel = toRel(path$1.resolve(watchRoot, output));
+	const toRel = (abs) => nodePath.relative(watchRoot, abs).split(nodePath.sep).join("/");
+	const outputRel = toRel(nodePath.resolve(watchRoot, output));
 	const excludePatterns = [
 		...outputRel !== "" && !outputRel.startsWith("..") ? [outputRel] : [],
 		"node_modules",
@@ -13159,13 +11364,24 @@ async function buildContainerSpec(args) {
 			containerPath: profileCredsFile.containerPath
 		} }
 	};
+	const rie = await resolveRieWrap({
+		image: imageRef,
+		platform,
+		entryPoint: lambda.imageConfig.entryPoint,
+		command: lambda.imageConfig.command,
+		skipPull
+	});
 	return {
 		kind: "image",
 		lambda,
 		image: imageRef,
 		platform,
-		command: lambda.imageConfig.command ?? [],
-		...lambda.imageConfig.entryPoint !== void 0 && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
+		command: rie ? rie.cmd : lambda.imageConfig.command ?? [],
+		...rie && {
+			entryPoint: rie.entryPoint,
+			rieMount: rie.mount
+		},
+		...!rie && lambda.imageConfig.entryPoint !== void 0 && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
 		...lambda.imageConfig.workingDirectory !== void 0 && { workingDir: lambda.imageConfig.workingDirectory },
 		env: dockerEnv,
 		...sensitiveEnvKeys && { sensitiveEnvKeys },
@@ -13198,7 +11414,7 @@ async function resolveContainerImageForStartApi(lambda, skipPull, profile, optio
 async function resolveLocalBuildPlan$1(lambda) {
 	const manifestPath = lambda.stack.assetManifestPath;
 	if (!manifestPath) return void 0;
-	const cdkOutDir = path$1.dirname(manifestPath);
+	const cdkOutDir = nodePath.dirname(manifestPath);
 	const manifest = await new AssetManifestLoader().loadStackManifest(lambda.stack, cdkOutDir);
 	if (!manifest) return void 0;
 	const entry = getDockerImageBySourceHash(manifest, lambda.imageUri);
@@ -13228,7 +11444,7 @@ async function materializeLambdaLayers$1(layers, layerTmpDirs, layerRoleArn) {
 		});
 	}
 	if (flat.length === 1) return flat[0].assetPath;
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-start-api-layers-`));
+	const dir = mkdtempSync(nodePath.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-start-api-layers-`));
 	try {
 		for (const layer of flat) copyLayerTreeLastWins(layer.assetPath, dir);
 	} catch (error) {
@@ -13369,10 +11585,10 @@ function materializeInlineCode$2(handler, source, fileExtension, tmpDirsOut) {
 	const lastDot = handler.lastIndexOf(".");
 	if (lastDot <= 0) throw new Error(`Handler ${displayUntrustedValue(handler)} is malformed: expected '<modulePath>.<exportName>'.`);
 	const modulePath = handler.substring(0, lastDot);
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-start-api-`));
+	const dir = mkdtempSync(nodePath.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-start-api-`));
 	tmpDirsOut.add(dir);
-	const filePath = path$1.join(dir, `${modulePath}${fileExtension}`);
-	mkdirSync(path$1.dirname(filePath), { recursive: true });
+	const filePath = nodePath.join(dir, `${modulePath}${fileExtension}`);
+	mkdirSync(nodePath.dirname(filePath), { recursive: true });
 	writeFileSync(filePath, source, "utf-8");
 	return dir;
 }
@@ -13661,6 +11877,7 @@ function createLocalStartApiCommand(opts = {}) {
 	return startApi;
 }
 function addStartApiSpecificOptions(cmd) {
+	addAwsEndpointOptions(cmd);
 	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(new Option("--all-stacks", "Serve every stack's API in a multi-stack app (each API on its own port) instead of erroring out. Mutually exclusive with a positional target subset, --stack, and an explicit --from-cfn-stack <name>; the bare --from-cfn-stack flag stays compatible (binds each routed stack to its own CFn stack).").default(false)).addOption(new Option("--warm", "Pre-start one container per Lambda at server boot").default(false)).addOption(new Option("--per-lambda-concurrency <n>", "Pool size cap per Lambda (default 2, max 4)").default("2")).addOption(new Option("--no-pull", "Skip docker pull (cached image)")).addOption(new Option("--no-build", "Skip docker build on every container Lambda local-asset build (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ZIP Lambdas and the IMAGE ECR-pull path. Compatible with --no-pull.")).addOption(new Option("--container-host <host>", "IP the host uses to bind/probe the RIE port (must be a numeric IP — `docker run -p <ip>:<port>:8080` rejects hostnames). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--debug-port-base <port>", "Reserve a contiguous --debug-port range (one per Lambda)")).addOption(new Option("--debug-port <port>", "Alias of --debug-port-base for parity with `cdkl invoke --debug-port`. Reserves a contiguous --debug-port range (one per Lambda) starting at <port>.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries on the container-Lambda ECR-pull fallback. Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--assume-role <arn-or-pair>", "Assume the Lambda's execution role and forward STS-issued temp creds. Two forms: (1) `--assume-role <arn>` sets a single global default ARN used for every routed Lambda; (2) `--assume-role <LogicalId>=<arn>` (repeatable) is a per-Lambda override (wins over the global default and over --assume-role-auto for the named Lambda). Pair with --assume-role-auto to auto-resolve every other Lambda. Precedence: per-Lambda > (--assume-role-auto OR global default) > unset (developer creds passed through).").argParser((raw, prev) => parseAssumeRoleToken(raw, prev))).addOption(new Option("--assume-role-auto", "Auto-resolve EACH routed Lambda's own execution role per-Lambda (literal ARN / Fn::GetAtt against template / --from-cfn-stack state). Slower boot — one STS call per Lambda — but the right shape when each Lambda's deployed role differs. Mutually exclusive with `--assume-role <arn>` (global default); errors at boot. Compatible with `--assume-role <LogicalId>=<arn>` per-Lambda overrides — the map wins for named Lambdas, auto-resolve handles the rest.").default(false)).addOption(new Option("--watch", "Hot-reload: re-synth + re-discover routes when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). Off by default; the server keeps the previous version serving when synth fails mid-reload.").default(false)).addOption(new Option("--stage <name>", "Select an API Gateway Stage by its 'StageName'. Default: the first Stage attached to each API. Drives event.stageVariables for both REST v1 and HTTP API v2. NOTE: For HTTP API v2 routes, requestContext.stage is always '$default' regardless of this flag (AWS-side limitation — HTTP API only exposes one stage to the integration event); only event.stageVariables is affected for v2 routes. For REST v1 routes the selected StageName is also threaded into requestContext.stage.")).addOption(new Option("--api <id>", "DEPRECATED — use the positional <targets...> argument instead. Accepts a SINGLE identifier; for a subset pass multiple positional targets. Same accepted forms (bare logical id, stack-qualified, Construct path, ancestor prefix). Will be removed in a future major release.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in Lambda env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name per routed stack; pass an explicit value when a single CFn stack should serve every routed stack. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--mtls-truststore <path>", `PEM-encoded CA bundle for client-certificate verification (mutual TLS). When set, the local server switches from HTTP to HTTPS and the TLS handshake rejects clients whose certificate doesn't chain to one of these CAs. Verified certs are surfaced on the Lambda event under requestContext.identity.clientCert (REST v1) / requestContext.authentication.clientCert (HTTP API v2). Must be set together with --mtls-cert + --mtls-key; partial flag sets are rejected. Generate a CA + server + client cert for local dev: openssl req -x509 -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.pem -subj "/CN=${getEmbedConfig().resourceNamePrefix}-ca" -days 365; openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-csr.pem -subj "/CN=localhost"; openssl x509 -req -in server-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365; openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-csr.pem -subj "/CN=client"; openssl x509 -req -in client-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365; curl --cacert ca.pem --cert client-cert.pem --key client-key.pem https://localhost:<port>/...`)).addOption(new Option("--mtls-cert <path>", "PEM-encoded server certificate for mutual TLS. Self-signed is fine for local dev. Must be set together with --mtls-truststore + --mtls-key.")).addOption(new Option("--mtls-key <path>", "PEM-encoded server private key matching --mtls-cert. Must be set together with --mtls-truststore + --mtls-cert.")).addOption(new Option("--strict-sigv4", "Opt-in: DENY AWS_IAM SigV4 requests that cannot be cryptographically verified (foreign access-key-id — e.g. a federated / Cognito Identity Pool / cross-account signer — OR no local AWS credentials configured) instead of the default warn-and-pass. DEFAULT off: cdk-local warn-and-passes unverifiable IAM requests with a placeholder principalId so local dev exercises app logic without reproducing an auth boundary it cannot fully emulate. OAC-fronted Function URLs always warn-and-pass regardless.").default(false));
 }
 
@@ -13726,6 +11943,7 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 		getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
 	});
 	try {
+		await activateWorkloadAwsWiring(options);
 		await applyRoleArnIfSet({
 			roleArn: options.roleArn,
 			region: options.region,
@@ -13896,7 +12114,7 @@ function materializeLambdaLayers(layers) {
 		containerPath: "/opt",
 		readOnly: true
 	} };
-	const tmpDir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-invoke-layers-`));
+	const tmpDir = mkdtempSync(nodePath.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-invoke-layers-`));
 	try {
 		for (const layer of layers) copyLayerTreeLastWins(layer.assetPath, tmpDir);
 	} catch (error) {
@@ -13936,13 +12154,21 @@ async function resolveContainerImagePlan$1(lambda, options) {
 		});
 	}
 	const tmpfs = resolveTmpfsForLambda(lambda);
+	const rie = await resolveRieWrap({
+		image: imageRef,
+		platform,
+		entryPoint: lambda.imageConfig.entryPoint,
+		command: lambda.imageConfig.command,
+		skipPull: options.pull === false
+	});
 	return {
 		image: imageRef,
 		mounts: [],
-		extraMounts: [],
-		cmd: lambda.imageConfig.command ?? [],
+		extraMounts: rie ? [rie.mount] : [],
+		cmd: rie ? rie.cmd : lambda.imageConfig.command ?? [],
 		platform,
-		...lambda.imageConfig.entryPoint && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
+		...rie && { entryPoint: rie.entryPoint },
+		...!rie && lambda.imageConfig.entryPoint && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
 		...lambda.imageConfig.workingDirectory !== void 0 && { workingDir: lambda.imageConfig.workingDirectory },
 		...tmpfs !== void 0 && { tmpfs }
 	};
@@ -14233,9 +12459,9 @@ function materializeInlineCode$1(handler, source, fileExtension) {
 	const lastDot = handler.lastIndexOf(".");
 	if (lastDot <= 0) throw new Error(`Handler ${displayUntrustedValue(handler)} is malformed: expected '<modulePath>.<exportName>'.`);
 	const modulePath = handler.substring(0, lastDot);
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-invoke-`));
-	const filePath = path$1.join(dir, `${modulePath}${fileExtension}`);
-	mkdirSync(path$1.dirname(filePath), { recursive: true });
+	const dir = mkdtempSync(nodePath.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-invoke-`));
+	const filePath = nodePath.join(dir, `${modulePath}${fileExtension}`);
+	mkdirSync(nodePath.dirname(filePath), { recursive: true });
 	writeFileSync(filePath, source, "utf-8");
 	return dir;
 }
@@ -14332,6 +12558,7 @@ function createLocalInvokeCommand(opts = {}) {
 	return invoke;
 }
 function addInvokeSpecificOptions(cmd) {
+	addAwsEndpointOptions(cmd);
 	return cmd.addOption(new Option("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option("--event-stdin", "Read event JSON from stdin").default(false)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--no-pull", "Skip docker pull. Semantics differ by code path: ZIP Lambdas skip pulling the public Lambda base image; Container Lambdas on the local-build path are a no-op (docker build does not refresh the FROM cache by default); Container Lambdas on the ECR-pull fallback skip docker pull AND error if the image is not in the local cache (re-run without --no-pull or pre-pull manually).")).addOption(new Option("--no-build", "Skip docker build on the IMAGE local-build path (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ZIP Lambdas and the IMAGE ECR-pull path. Compatible with --no-pull.")).addOption(new Option("--debug-port <port>", "Node --inspect-brk port (default: off)")).addOption(new Option("--container-host <host>", "Host IP the host uses to bind the RIE port to. Must be a numeric IP (Docker rejects hostnames here). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--assume-role [arn]", "Assume the Lambda's deployed execution role and forward STS-issued temp credentials to the container so the handler runs with the deployed function's narrow permissions. Three forms: (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) auto-resolves the function's execution role ARN from state (requires an active state source); (3) `--no-assume-role` explicitly opts out. Off by default — when omitted, the developer's shell credentials are forwarded unchanged (SAM-compatible default). STS failures degrade to a warn + dev-creds fallback.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers. Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass an explicit value when CFn stack name differs. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--response-file <path>", "Also write the raw Lambda response payload to this file. Lets a programmatic caller recover the response without parsing it out of stdout (where it interleaves with synth progress + streamed container logs). stdout output is unchanged."));
 }
 
@@ -15197,6 +13424,7 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 		getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
 	});
 	try {
+		await activateWorkloadAwsWiring(options);
 		await applyRoleArnIfSet({
 			roleArn: options.roleArn,
 			region: options.region,
@@ -16092,6 +14320,8 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	}
 	try {
 		await execFileAsync$6(dockerCmd, ["restart", containerId]);
+		const wiring = getActiveWorkloadAwsWiring();
+		if (wiring) await attachLoopbackForwarder(containerId, wiring);
 	} catch (err) {
 		throw new CdkLocalError(`softReloadAgentContainer: docker restart of '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_RESTART_FAILED");
 	}
@@ -16169,6 +14399,7 @@ function createLocalInvokeAgentCoreCommand(opts = {}) {
 	return cmd;
 }
 function addInvokeAgentCoreSpecificOptions(cmd) {
+	addAwsEndpointOptions(cmd);
 	return cmd.addOption(new Option("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option("--event-stdin", "Read event JSON from stdin").default(false)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--session-id <id>", "AgentCore runtime session id header value (default: a random UUID)")).addOption(new Option("--ws", "Stream over the HTTP-protocol agent's bidirectional /ws WebSocket endpoint (on 8080) instead of POST /invocations: send --event as the first frame and print every received frame to stdout until the agent closes. When stdin is a TTY, additionally reads stdin lines as follow-up text frames (multi-turn REPL; Ctrl-D to end). When stdin is piped / redirected / non-TTY (CI), only the initial --event frame is sent (one-shot). Force one-shot in a TTY with `cdkl ... --ws </dev/null`. Ignored for an MCP runtime.").default(false)).addOption(new Option("--bearer-token <jwt>", "Bearer JWT this command SUPPLIES (the supplier role) when the runtime declares a customJwtAuthorizer — `cdkl invoke-agentcore` is the local-dev client making the outbound call, so it always presents this token to its own invocation. Verified against the runtime's OIDC discovery URL (signature / issuer / expiry / audience) before the container starts, then forwarded to /invocations as Authorization: Bearer <jwt>. Contrast with `cdkl start-alb --bearer-token`, where the role is reversed — the ALB front-door RECEIVES inbound requests and injects this token only as a default when an inbound request has none (default-when-missing).")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign the /invocations POST with AWS SigV4 (service bedrock-agentcore) using the resolved credentials, matching the cloud default when the runtime declares no customJwtAuthorizer. Opt-in: default unsigned. Mutually exclusive with --bearer-token; ignored on a JWT-protected runtime.").default(false)).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64. Override to linux/amd64 only when iterating against an amd64 dev container locally; note the image will not run on the cloud runtime as-is.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP the host uses to bind the agent port to. Must be a numeric IP (Docker rejects hostnames here). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Per-request timeout in milliseconds. Applied to POST /invocations, POST /mcp, and the /ws open-to-close window. Raise this for long-running agent calls that exceed the default.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container so the agent runs with the deployed role. Three forms: (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's RoleArn when it is a literal ARN; (3) `--no-assume-role` opts out. Off by default — the developer's shell credentials are forwarded unchanged.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name; pass an explicit value when the CFn stack name differs.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--watch", "Re-synth and reload the agent container on CDK source changes. Only meaningful with the long-running --ws session path; single-shot POST /invocations, MCP, and A2A invocations run once and exit, so --watch is logged as a no-op WARN for them and the single shot proceeds. The active /ws socket is closed cleanly on every reload firing so the next session connects to the rebuilt container — the honest local-dev semantic.").default(false));
 }
 
@@ -16874,7 +15105,8 @@ async function runEcsTask(task, options, state) {
 		});
 		dockerCmds.set(container.name, {
 			args: built.args,
-			sensitiveEnv: built.sensitiveEnv
+			sensitiveEnv: built.sensitiveEnv,
+			loopbackPorts: built.loopbackPorts
 		});
 		if (built.collisions.length > 0) logger.warn(describeRefusedSensitiveEnvKeys(`Container ${displayUntrustedValue(container.name)}`, built.collisions));
 		for (const ep of built.publishedEndpoints) state.publishedEndpoints.push(ep);
@@ -16883,7 +15115,9 @@ async function runEcsTask(task, options, state) {
 	for (const containerName of startOrder) {
 		const container = task.containers.find((c) => c.name === containerName);
 		await awaitDependencies(container, startedByName);
-		const { args, sensitiveEnv } = dockerCmds.get(container.name);
+		const { args, sensitiveEnv, loopbackPorts } = dockerCmds.get(container.name);
+		const forwarderWiring = getActiveWorkloadAwsWiring();
+		if (loopbackPorts.length > 0 && forwarderWiring) await prepareLoopbackForwarder(forwarderWiring);
 		logger.info(`Starting container ${displayIdent(container.name)} (image=${displayIdent(imagePlan.get(container.name))})`);
 		let id;
 		warnFinchArgvExposure(Object.keys(sensitiveEnv));
@@ -16905,6 +15139,8 @@ async function runEcsTask(task, options, state) {
 			id,
 			container
 		});
+		const wiring = getActiveWorkloadAwsWiring();
+		if (wiring) await attachLoopbackForwarder(id, wiring, loopbackPorts);
 		if (!options.detach) state.logStoppers.push(attachContainerLogStreamer(`[${displayIdent(container.name)}] `, id));
 	}
 	if (options.detach) return {
@@ -17228,7 +15464,10 @@ function buildDockerRunArgs(opts) {
 			args.push("-p", `${containerHost}::${pm.containerPort}/${pm.protocol}`);
 		}
 	}
-	if (opts.profileCredentialsFile) args.push("-v", `${opts.profileCredentialsFile.hostPath}:${opts.profileCredentialsFile.containerPath}:ro`);
+	const wiring = getActiveWorkloadAwsWiring();
+	const profileCredentialsFile = wiring?.mode === "emulator" ? void 0 : opts.profileCredentialsFile;
+	if (profileCredentialsFile) args.push("-v", `${profileCredentialsFile.hostPath}:${profileCredentialsFile.containerPath}:ro`);
+	for (const m of wiring?.mounts ?? []) if (!container.mountPoints.some((mp) => mp.containerPath === m.containerPath)) args.push("-v", `${m.hostPath}:${m.containerPath}:ro`);
 	for (const mp of container.mountPoints) {
 		const v = volumeByName.get(mp.sourceVolume);
 		if (!v) continue;
@@ -17242,7 +15481,7 @@ function buildDockerRunArgs(opts) {
 			args.push("-v", `${name}:${mp.containerPath}${ro}`);
 		}
 	}
-	const finalEnv = {};
+	let finalEnv = {};
 	const metaEnv = buildMetadataEnv({
 		containerName: container.name,
 		...roleArn !== void 0 && { roleArn },
@@ -17250,10 +15489,11 @@ function buildDockerRunArgs(opts) {
 		...opts.sidecarIp !== void 0 && { sidecarIp: opts.sidecarIp }
 	});
 	Object.assign(finalEnv, metaEnv);
-	if (opts.profileCredentialsFile) {
-		finalEnv["AWS_SHARED_CREDENTIALS_FILE"] = opts.profileCredentialsFile.containerPath;
-		finalEnv["AWS_PROFILE"] = opts.profileCredentialsFile.profileName;
+	if (profileCredentialsFile) {
+		finalEnv["AWS_SHARED_CREDENTIALS_FILE"] = profileCredentialsFile.containerPath;
+		finalEnv["AWS_PROFILE"] = profileCredentialsFile.profileName;
 	}
+	if (wiring?.mode === "forward") for (const [k, v] of Object.entries(wiring.env)) defineOwnKey(finalEnv, k, v);
 	for (const [k, v] of Object.entries(container.environment)) defineOwnKey(finalEnv, k, v);
 	for (const s of secrets) defineOwnKey(finalEnv, s.name, s.value);
 	const overrides = opts.envOverrides;
@@ -17261,6 +15501,10 @@ function buildDockerRunArgs(opts) {
 		applyEnvOverrideMap(finalEnv, overrides["Parameters"]);
 		applyEnvOverrideMap(finalEnv, overrides[container.name]);
 	}
+	if (wiring) finalEnv = applyWorkloadAwsWiringToEnv(finalEnv, wiring.mode === "emulator" ? wiring : {
+		...wiring,
+		env: {}
+	});
 	const sensitiveEnvKeys = new Set(SENSITIVE_ENV_KEYS);
 	for (const s of secrets) sensitiveEnvKeys.add(s.name);
 	for (const s of container.secrets) sensitiveEnvKeys.add(s.name);
@@ -17290,7 +15534,8 @@ function buildDockerRunArgs(opts) {
 		args,
 		sensitiveEnv,
 		collisions,
-		publishedEndpoints
+		publishedEndpoints,
+		loopbackPorts: wiring ? effectiveLoopbackPorts(finalEnv, wiring) : []
 	};
 }
 function shellJoin(parts) {
@@ -18102,7 +16347,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -18115,7 +16360,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -18126,14 +16371,20 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerStopImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["stop", containerId]);
 };
 const defaultDockerStartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["start", containerId]);
+	const { getActiveWorkloadAwsWiring } = await import("./workload-aws-wiring-BIxf0jtl.js").then((n) => n.b);
+	const wiring = getActiveWorkloadAwsWiring();
+	if (wiring) {
+		const { attachLoopbackForwarder } = await import("./docker-runner-CnXQIUjd.js").then((n) => n.o);
+		await attachLoopbackForwarder(containerId, wiring);
+	}
 };
 let dockerStopImpl = defaultDockerStopImpl;
 let dockerStartImpl = defaultDockerStartImpl;
@@ -18193,7 +16444,7 @@ async function attachToSharedNetwork(containerId, plan, withAliases) {
 const defaultDockerNetworkConnectImpl = async (networkName, containerId, opts) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	const args = ["network", "connect"];
 	if (opts.ip) args.push("--ip", opts.ip);
 	for (const a of opts.aliases) args.push("--alias", a);
@@ -18204,7 +16455,7 @@ let dockerNetworkConnectImpl = defaultDockerNetworkConnectImpl;
 const defaultDockerInspectPublishesHostPortsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -18243,7 +16494,7 @@ async function disconnectOldFromSharedNetwork(oldInstance, opts = {}) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -18334,7 +16585,7 @@ const LISTEN_PROBE_SCRIPT = [
 async function dockerExecListenProbe(containerId, port, timeoutMs = 1e4) {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	try {
 		await promisify(execFile)(getDockerCmd(), [
 			"exec",
@@ -18488,7 +16739,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -18498,7 +16749,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -19854,9 +18105,9 @@ function materializeInlineCode(handler, source, fileExtension) {
 	const lastDot = handler.lastIndexOf(".");
 	if (lastDot <= 0) throw new Error(`Handler ${displayIdent(handler)} is malformed: expected '<modulePath>.<exportName>'.`);
 	const modulePath = handler.substring(0, lastDot);
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-alb-lambda-`));
-	const filePath = path$1.join(dir, `${modulePath}${fileExtension}`);
-	mkdirSync(path$1.dirname(filePath), { recursive: true });
+	const dir = mkdtempSync(nodePath.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-alb-lambda-`));
+	const filePath = nodePath.join(dir, `${modulePath}${fileExtension}`);
+	mkdirSync(nodePath.dirname(filePath), { recursive: true });
 	writeFileSync(filePath, source, "utf-8");
 	return dir;
 }
@@ -19896,7 +18147,7 @@ async function resolveContainerImagePlan(lambda, opts) {
 	let imageRef;
 	let localBuilt = false;
 	if (manifestPath) {
-		const cdkOutDir = path$1.dirname(manifestPath);
+		const cdkOutDir = nodePath.dirname(manifestPath);
 		const manifest = await new AssetManifestLoader().loadStackManifest(lambda.stack, cdkOutDir);
 		const entry = manifest ? getDockerImageBySourceHash(manifest, lambda.imageUri) : void 0;
 		if (entry) {
@@ -19916,12 +18167,20 @@ async function resolveContainerImagePlan(lambda, opts) {
 			...opts.ecrRoleArn !== void 0 && { ecrRoleArn: opts.ecrRoleArn }
 		});
 	}
+	const rie = await resolveRieWrap({
+		image: imageRef,
+		platform,
+		entryPoint: lambda.imageConfig.entryPoint,
+		command: lambda.imageConfig.command,
+		skipPull: opts.skipPull === true
+	});
 	return {
 		image: imageRef,
-		mounts: [],
-		cmd: lambda.imageConfig.command ?? [],
+		mounts: rie ? [rie.mount] : [],
+		cmd: rie ? rie.cmd : lambda.imageConfig.command ?? [],
 		platform,
-		...lambda.imageConfig.entryPoint && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
+		...rie && { entryPoint: rie.entryPoint },
+		...!rie && lambda.imageConfig.entryPoint && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
 		...lambda.imageConfig.workingDirectory !== void 0 && { workingDir: lambda.imageConfig.workingDirectory }
 	};
 }
@@ -20683,6 +18942,7 @@ async function runEcsServiceEmulator(targets, options, strategy, extraStateProvi
 		}
 	}, (err) => getLogger().warn(`service cleanup failed: ${err instanceof Error ? err.message : String(err)}`));
 	try {
+		await activateWorkloadAwsWiring(options);
 		await applyRoleArnIfSet({
 			roleArn: options.roleArn,
 			region: options.region,
@@ -21592,7 +19852,10 @@ function resolveShadowReadyTimeoutMs(options, envPrefix, env = process.env) {
 	return DEFAULT_SHADOW_READY_TIMEOUT_MS;
 }
 async function resolveSharedSidecarCredentials(options) {
+	const wiring = getActiveWorkloadAwsWiring();
+	if (wiring?.mode === "emulator") return wiring.emulatorCredentials;
 	if (options.profile) return resolveProfileCredentials(options.profile);
+	return resolveHostDefaultCredentials();
 }
 async function resolveAndBuildImageOverrides(args) {
 	const { perTarget, stacks, options, extraStateProviders, logger } = args;
@@ -21681,6 +19944,7 @@ function resolveEcsAssumeRoleOption(options) {
 	}
 }
 function addCommonEcsServiceOptions(cmd) {
+	addAwsEndpointOptions(cmd);
 	cmd.addOption(ecsClusterOption()).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1"));
 	addEcsAssumeRoleOptions(cmd);
 	cmd.addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--no-build", "Skip docker build on the local CDK-asset path for every container (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ECR-pull / public-registry images. Per-container --image-override mappings take precedence (the override tag is used as-is, --no-build does not apply). Compatible with --no-pull.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--max-tasks <n>", `Hard cap on local replica count. Caps the template DesiredCount so local dev machines don't run an unbounded number of containers. Cannot exceed ${83} due to the per-replica link-local /24 subnet allocator's range.`).default(3).argParser(parseMaxTasks)).addOption(new Option("--restart-policy <policy>", "How to react when an essential container exits. 'on-failure' (default) restarts only on non-zero exit; 'always' restarts on every exit; 'none' shuts the replica down and runs the service degraded.").default("on-failure").argParser(parseRestartPolicy)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", `Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (\`cdk deploy\`). Bare form uses the ${getEmbedConfig().binaryName} stack name; pass an explicit value when the CFn stack name differs. Fn::GetAtt in container Environment[].Value is warn-and-dropped: CFn ListStackResources does not return per-attribute values, and unlike Lambda (where \`cdkl invoke --from-cfn-stack\` recovers Fn::GetAtt from the deployed function via lambda:GetFunctionConfiguration), no ECS-side equivalent resolves attributes off a deployed task / service.`)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--no-logs", "Disable foreground streaming of each replica container stdout/stderr. By default every booted replica streams its docker logs to the host terminal with a [svc=<service> r=<replica-index> c=<container>] prefix (parity with `run-task`). Pass --no-logs for multi-replica / multi-service runs whose interleaved log volume is unreadable; `docker logs -f <id>` in a separate terminal stays available.")).addOption(new Option("--shadow-ready-timeout <ms>", `Issue #265 — milliseconds the \`--watch\` rolling primitive waits for a shadow replica's first essential-container port to accept a TCP connection before swapping Cloud Map + front-door registrations off the old replica. Defaults to 60000 (60s) which covers realistic prod-shaped Node app cold-starts (TS->JS compile, full node_modules graph, framework boot, DB pool init). Bump higher when the reload log surfaces "TCP probe <ip>:<port> did not accept within <N>ms" — typical for Java / heavy ORM init / \`--inspect-brk\` attach pauses. Honored by --watch on \`${getEmbedConfig().binaryName} start-service\` and \`${getEmbedConfig().binaryName} start-alb\`. Env var: \`${getEmbedConfig().envPrefix}_SHADOW_READY_TIMEOUT_MS\` (flag wins over env).`).argParser(parseShadowReadyTimeout));
@@ -21723,6 +19987,7 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 		await cleanupPromise;
 	};
 	try {
+		await activateWorkloadAwsWiring(options);
 		await applyRoleArnIfSet({
 			roleArn: options.roleArn,
 			region: options.region,
@@ -21976,8 +20241,11 @@ function readEnvOverridesFile(filePath) {
 	return parsed;
 }
 async function resolveSidecarCredentials(options, assumedCredentials) {
+	const wiring = getActiveWorkloadAwsWiring();
+	if (wiring?.mode === "emulator") return wiring.emulatorCredentials;
 	if (assumedCredentials) return assumedCredentials;
 	if (options.profile) return resolveProfileCredentials(options.profile);
+	return resolveHostDefaultCredentials();
 }
 function createLocalRunTaskCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
@@ -22037,6 +20305,7 @@ async function resolveRunTaskImageOverride(args) {
 	return { pinnedUncovered: pinned && uncovered.length > 0 };
 }
 function addRunTaskSpecificOptions(cmd) {
+	addAwsEndpointOptions(cmd);
 	cmd.addOption(ecsClusterOption()).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1")).addOption(new Option("--host-port <containerPort=hostPort...>", "Publish a container port on a specific host port (e.g. 80=8080); repeatable. Default: host port == container port. Use this on macOS to map a privileged container port (< 1024) to a non-privileged host port and avoid the Docker Desktop admin-password prompt."));
 	addEcsAssumeRoleOptions(cmd);
 	cmd.addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--no-build", "Skip docker build on every CDK-asset container (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ECR-pull / public-registry containers. Compatible with --no-pull.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--keep-running", "Don't docker rm -f the user containers on task exit (network + sidecar are still torn down). Use when you want to docker exec into a stopped container for post-mortems.").default(false)).addOption(new Option("--detach", "Start the containers in the background and exit (skip log streaming + auto teardown). Useful in CI smoke tests; caller manages container lifecycle.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", `Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (\`cdk deploy\`). Bare form uses the ${getEmbedConfig().binaryName} stack name; pass an explicit value when the CFn stack name differs. Fn::GetAtt in container Environment[].Value is warn-and-dropped: CFn ListStackResources does not return per-attribute values, and unlike Lambda (where \`cdkl invoke --from-cfn-stack\` recovers Fn::GetAtt from the deployed function via lambda:GetFunctionConfiguration), no ECS-side equivalent resolves attributes off a deployed task / service.`)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
@@ -25923,6 +24192,7 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 	if (options.verbose) logger.setLevel("debug");
 	const originOverrides = parseOriginOverrides(options.origin);
 	const tlsRequested = options.tls === true || options.tlsCert !== void 0 || options.tlsKey !== void 0;
+	await activateWorkloadAwsWiring(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region,
@@ -26091,6 +24361,7 @@ function createLocalStartCloudFrontCommand(opts = {}) {
 	return cmd;
 }
 function addStartCloudFrontSpecificOptions(cmd) {
+	addAwsEndpointOptions(cmd);
 	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <key=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is a KeyValueStore handle — its AWS::CloudFront::KeyValueStore resource logical id, its construct path, or its bare construct id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL / Web Function origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind to a deployed CloudFormation stack (ListStackResources). Resolves an S3 origin that has no local BucketDeployment source to its deployed bucket and serves it from real S3 on demand (the front/back-split case: files uploaded out of band), and resolves a Lambda Function URL / Lambda@Edge function's or a Web Function origin revision's env vars to the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs.")).addOption(new Option("--cache-origin", "For a deployed-S3 origin (served from real S3 under --from-cfn-stack): keep fetched objects in memory for the session instead of re-reading on every request. Faster repeat reads / fewer S3 GETs, but an out-of-band S3 content change is not reflected until a --watch reload (which clears the cache) or a restart. Off by default (every request re-reads, always current). Not CloudFront CDN caching.").default(false)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's (or a Web Function origin revision's) execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--env-vars <file>", "JSON env-var overrides for the Lambda Function URL and Lambda Web Function endpoint origins (SAM-compatible, the same file as the other commands: {\"Parameters\": {...}} for every origin, {\"<LogicalId or construct path>\": {\"KEY\": \"VALUE\"}} for one — the backing function, or the Web Function revision the endpoint serves; a null value removes the variable). Not applied to Lambda@Edge functions, which cannot carry environment variables in AWS.")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
 }
 
@@ -26479,6 +24750,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders,
 			await profileCredsFile.dispose();
 		} catch {}
 	};
+	await activateWorkloadAwsWiring(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region,
@@ -26726,6 +24998,7 @@ function createLocalStartAgentCoreCommand(opts = {}) {
 	return cmd;
 }
 function addStartAgentCoreSpecificOptions(cmd) {
+	addAwsEndpointOptions(cmd);
 	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort$2)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--watch", "Re-synth + reload the warm container in place on a CDK source change, keeping the serve up. A per-firing classifier picks rebuild (boot a fresh container, re-point the serve) vs soft-reload (docker cp + docker restart the same container) — the same pattern as start-service / invoke-agentcore --ws --watch.")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
@@ -26740,6 +25013,7 @@ async function localStartWebFunctionCommand(target, options, extraStateProviders
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	const forever = () => new Promise(() => void 0);
+	await activateWorkloadAwsWiring(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region,
@@ -26838,6 +25112,7 @@ function createLocalStartWebFunctionCommand(opts = {}) {
 	return cmd;
 }
 function addStartWebFunctionSpecificOptions(cmd) {
+	addAwsEndpointOptions(cmd);
 	return cmd.addOption(new Option("--revision <logicalId>", "Serve this WebFunctionRevision (logical ID) instead of the one the endpoint weights pick.")).addOption(new Option("--port <n>", "Local port to serve on. Default 0 (OS-assigned).").default(0).argParser(parsePort$1)).addOption(new Option("--host <ip>", "Address to publish the port on.").default("127.0.0.1")).addOption(new Option("--platform <platform>", "docker --platform for the server container. Defaults to the runtime's cloud architecture (linux/arm64 for nodejs24.x).").choices(["linux/amd64", "linux/arm64"])).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"RevisionLogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--no-pull", "Skip docker pull of the runtime base image (use the cached image)")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the server to answer HTTP. Default 60000.").default(6e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the revision's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the revision's ServiceConfig.ExecutionRoleArn: a literal ARN as written, or the Fn::GetAtt / Ref CDK synthesizes resolved against --from-cfn-stack deployed state; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
@@ -27848,6 +26123,7 @@ async function localStartMicrovmCommand(target, options, extraStateProviders, ho
 		disposeMicrovmCodeArtifact(artifact);
 	};
 	const teardown = () => teardownPromise ??= doTeardown();
+	await activateWorkloadAwsWiring(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region,
@@ -28027,6 +26303,7 @@ function createLocalStartMicrovmCommand(opts = {}) {
 	return cmd;
 }
 function addStartMicrovmSpecificOptions(cmd) {
+	addAwsEndpointOptions(cmd);
 	return cmd.addOption(new Option("--count <n>", "Number of independent MicroVMs to run, each with its own URL.").default(1).argParser(parseCount)).addOption(new Option("--run-hook-payload <string>", "The runHookPayload string delivered to each MicroVM's /run hook (max 16 KB).")).addOption(new Option("--run-hook-payload-file <path>", "Read the runHookPayload from a file (mutually exclusive with --run-hook-payload).")).addOption(new Option("--port <n>", "Local port of the first MicroVM; MicroVM i listens on <n>+i. Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Address the MicroVM URLs listen on.").default("127.0.0.1")).addOption(new Option("--platform <platform>", "docker --platform for the build and the containers. Defaults to the image's CpuConfigurations architecture.").choices(["linux/amd64", "linux/arm64"])).addOption(new Option("--proxy-port <port>", "An extra container port X-aws-proxy-port may route to (repeatable). 8080, Hooks.Port and the image's EXPOSE ports are always routable.").argParser(parseProxyPort)).addOption(new Option("--auto-resume", "Resume a suspended MicroVM on its next request instead of answering 503 (autoResumeEnabled).")).addOption(new Option("--no-build-cache", "Build the image with docker build --no-cache.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"MicrovmImageLogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--timeout <ms>", "Default deadline in milliseconds for each hook without its own <Hook>TimeoutInSeconds (/terminate defaults to 10000), and for the app to answer HTTP when there is no /ready hook. Default 60000.").default(6e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role <arn>", "Assume this role (the MicroVM's execution role, a run-microvm parameter rather than part of the template) and forward STS-issued temp credentials to the containers. Off by default: the shell credentials are forwarded.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
@@ -33359,5 +31636,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { postHook as $, deployedFillMayBeSecret as $a, parseConnectionsPath as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, discoverWebSocketApisOrThrow as Aa, applyCorsResponseHeaders as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AGENTCORE_MCP_PROTOCOL as Ba, evaluateResponseParameters as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveSsmParameters as Ca, verifyJwtViaDiscovery as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, listTargets as Da, invokeRequestAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, countTargets as Ea, evaluateCachedLambdaPolicy as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, pickRefLogicalId as Fa, matchRoute as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, derivePseudoParametersFromRegion as Ga, HOST_DOCKER_INTERNAL_GATEWAY as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, AgentCoreResolutionError as Ha, selectIntegrationResponse as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, resolveLambdaArnIntrinsic as Ia, translateLambdaResponse as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, tryResolveImageFnJoin as Ja, resolveHostGatewayExtraHosts as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, formatStateRemedy as Ka, HOST_GATEWAY_MIN_VERSION as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_A2A_PROTOCOL as La, applyAuthorizerOverlay as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, parseSelectionExpressionPath as Ma, buildCorsConfigFromCloudFrontChain as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, webSocketApiMatchesIdentifier as Na, isFunctionUrlOacFronted as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, availableWebSocketApiIdentifiers as Oa, invokeTokenAuthorizer as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, discoverRoutes as Pa, matchPreflight as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, containsDynamicReference as Qa, handleConnectionsRequest as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_AGUI_PROTOCOL as Ra, buildHttpApiV2Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, collectSsmParameterRefs as Sa, verifyJwtAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, resolveSingleTarget as Ta, computeRequestIdentityHash as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, pickAgentCoreCandidateStack as Ua, tryParseStatus as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, AGENTCORE_RUNTIME_TYPE as Va, pickResponseTemplate as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, resolveAgentCoreTarget as Wa, VtlEvaluationError as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, DynamicReferenceResolutionError as Xa, ConnectionRegistry as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, LocalInvokeBuildError as Ya, bufferToBody as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, DynamicReferenceResolver as Za, buildMgmtEndpointEnvUrl as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, rejectExplicitCfnStackWithMultipleStacks as _a, defaultCredentialsLoader as _i, pickKvsLogicalIdFromArn as _n, isProxyEnvConfigured as _o, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, resolveRuntimeCodeMountPath as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, withoutKeys as ao, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, resolveCfnStackName as ba, createJwksCache as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, EcsTaskResolutionError as ca, resolveEnvVars$1 as ci, buildEdgeRequestEvent as cn, deployAccountStsClientConfig as co, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, substituteAgainstStateAsync as da, filterRoutesByApiIdentifiers as di, httpHeadersToEdge as dn, resetWorkloadIdentity as do, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildConnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, firstUsableRegion as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, substituteEnvVarsFromState as fa, groupRoutesByServer as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, workloadClientConfig as fo, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, isCfnFlagPresent as ga, resolveServiceIntegrationParameters as gi, pickFunctionUrlLogicalIdFromOrigin as gn, buildProxyClientConfig as go, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, createLocalStateProvider as ha, resolveSelectionExpression as hi, isCloudFrontDistribution as hn, resolveProfileCredentials as ho, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, buildContainerImage as ia, createFileWatcher as ii, serveFromStaticOrigin as in, resolveDynamicReferencesInEnv as io, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, filterWebSocketApisByIdentifiers as ja, buildCorsConfigByApiId as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, discoverWebSocketApis as ka, attachAuthorizers as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, assertEcsTaskImagesResolvable as la, availableApiIdentifiers as li, buildEdgeResponseEvent as ln, readEnvCallerCredentials as lo, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, LocalStateSourceError as ma, startApiServer as mi, extractKvsAssociations as mn, buildStsClientConfig as mo, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, buildMessageEvent as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, keysOverriddenBy as no, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, resolveRuntimeFileExtension as oa, buildStageMap as oi, applyEdgeRequestResult as on, SECOND_ASSUME_MESSAGE as oo, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, substituteEnvVarsFromStateAsync as pa, readMtlsMaterialsFromDisk as pi, describeS3OriginDomain as pn, workloadStsClientConfig as po, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, substituteImagePlaceholders as qa, probeHostGatewaySupport as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, architectureToPlatform as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, parseDynamicReference as ro, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, resolveRuntimeImage as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, assumedRoleRecorded as so, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildDisconnectEvent as ta, createWatchPredicates as ti, matchBehavior as tn, keysNotFromTemplate as to, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteAgainstState as ua, filterRoutesByApiIdentifier as ui, edgeHeadersToHttp as un, recordAssumedRole as uo, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnFallbackRegion as va, buildCognitoJwksUrl as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, resolveWatchConfig as wa, buildMethodArn as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, CfnLocalStateProvider as xa, verifyCognitoJwt as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, resolveCfnRegion as ya, buildJwksUrlFromIssuer as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_HTTP_PROTOCOL as za, buildRestV1Event as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
-//# sourceMappingURL=local-studio-D1XHJoJZ.js.map
+export { postHook as $, addAwsEndpointOptions as $a, parseConnectionsPath as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, parseSelectionExpressionPath as Aa, applyCorsResponseHeaders as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AgentCoreResolutionError as Ba, evaluateResponseParameters as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveSingleTarget as Ca, verifyJwtViaDiscovery as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, discoverWebSocketApis as Da, invokeRequestAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, availableWebSocketApiIdentifiers as Ea, evaluateCachedLambdaPolicy as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, AGENTCORE_A2A_PROTOCOL as Fa, matchRoute as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, containsDynamicReference as Ga, HOST_DOCKER_INTERNAL_GATEWAY as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, resolveAgentCoreTarget as Ha, selectIntegrationResponse as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, AGENTCORE_AGUI_PROTOCOL as Ia, translateLambdaResponse as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, keysNotFromTemplate as Ja, resolveHostGatewayExtraHosts as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, deployedFillMayBeSecret as Ka, HOST_GATEWAY_MIN_VERSION as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_HTTP_PROTOCOL as La, applyAuthorizerOverlay as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, discoverRoutes as Ma, buildCorsConfigFromCloudFrontChain as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, pickRefLogicalId as Na, isFunctionUrlOacFronted as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, discoverWebSocketApisOrThrow as Oa, invokeTokenAuthorizer as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, resolveLambdaArnIntrinsic as Pa, matchPreflight as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, withoutKeys as Qa, handleConnectionsRequest as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_MCP_PROTOCOL as Ra, buildHttpApiV2Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, resolveWatchConfig as Sa, verifyJwtAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, listTargets as Ta, computeRequestIdentityHash as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, DynamicReferenceResolutionError as Ua, tryParseStatus as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, pickAgentCoreCandidateStack as Va, pickResponseTemplate as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, DynamicReferenceResolver as Wa, VtlEvaluationError as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, parseDynamicReference as Xa, ConnectionRegistry as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, keysOverriddenBy as Ya, bufferToBody as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, resolveDynamicReferencesInEnv as Za, buildMgmtEndpointEnvUrl as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveCfnRegion as _a, defaultCredentialsLoader as _i, pickKvsLogicalIdFromArn as _n, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, resolveRuntimeImage as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, collectSsmParameterRefs as ba, createJwksCache as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, substituteAgainstState as ca, resolveEnvVars$1 as ci, buildEdgeRequestEvent as cn, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, substituteEnvVarsFromStateAsync as da, filterRoutesByApiIdentifiers as di, httpHeadersToEdge as dn, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildConnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, awsEndpointOptions as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, LocalStateSourceError as fa, groupRoutesByServer as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, resolveCfnFallbackRegion as ga, resolveServiceIntegrationParameters as gi, pickFunctionUrlLogicalIdFromOrigin as gn, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, rejectExplicitCfnStackWithMultipleStacks as ha, resolveSelectionExpression as hi, isCloudFrontDistribution as hn, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, resolveRuntimeFileExtension as ia, createFileWatcher as ii, serveFromStaticOrigin as in, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, webSocketApiMatchesIdentifier as ja, buildCorsConfigByApiId as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, filterWebSocketApisByIdentifiers as ka, attachAuthorizers as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, substituteAgainstStateAsync as la, availableApiIdentifiers as li, buildEdgeResponseEvent as ln, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, isCfnFlagPresent as ma, startApiServer as mi, extractKvsAssociations as mn, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, buildMessageEvent as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, EcsTaskResolutionError as oa, buildStageMap as oi, applyEdgeRequestResult as on, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, createLocalStateProvider as pa, readMtlsMaterialsFromDisk as pi, describeS3OriginDomain as pn, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, firstUsableRegion as qa, probeHostGatewaySupport as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, resolveRuntimeCodeMountPath as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, assertEcsTaskImagesResolvable as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildDisconnectEvent as ta, createWatchPredicates as ti, matchBehavior as tn, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteEnvVarsFromState as ua, filterRoutesByApiIdentifier as ui, edgeHeadersToHttp as un, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnStackName as va, buildCognitoJwksUrl as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, countTargets as wa, buildMethodArn as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, resolveSsmParameters as xa, verifyCognitoJwt as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, CfnLocalStateProvider as ya, buildJwksUrlFromIssuer as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_RUNTIME_TYPE as za, buildRestV1Event as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
+//# sourceMappingURL=local-studio-DNWiPLme.js.map