cdk-local 0.160.0 → 0.161.0

package/dist/workload-aws-wiring-BIxf0jtl.js

@@ -0,0 +1,916 @@
+import { t as __exportAll } from "./rolldown-runtime-w6R9maHv.js";
+import { c as getEmbedConfig, t as getLogger } from "./logger-Co5XVwco.js";
+import { r as displayUntrustedValue, u as describeCredentialLoadFailure } from "./assembly-path-R96uhMm1.js";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { Agent, get, request } from "node:http";
+import { Agent as Agent$1, get as get$1, request as request$1 } from "node:https";
+import { rootCertificates } from "node:tls";
+import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
+import { NodeHttpHandler } from "@smithy/node-http-handler";
+import { Agent as Agent$2 } from "agent-base";
+import { HttpProxyAgent } from "http-proxy-agent";
+import { HttpsProxyAgent } from "https-proxy-agent";
+import { getProxyForUrl } from "proxy-from-env";
+import * as path$1 from "node:path";
+import { homedir, tmpdir } from "node:os";
+
+//#region src/utils/url-authority.ts
+const IPV6_LITERAL_CHARS = /^[0-9A-Fa-f:.]+$/;
+function formatHostForAuthority(host) {
+	const inner = host.length > 1 && host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+	if (!inner.includes(":")) return host;
+	const zoneAt = inner.indexOf("%");
+	const literal = zoneAt === -1 ? inner : inner.slice(0, zoneAt);
+	if (!IPV6_LITERAL_CHARS.test(literal)) return host;
+	return `[${literal}]`;
+}
+function formatAuthority(host, port) {
+	return `${formatHostForAuthority(host)}:${port}`;
+}
+function hostFromAuthority(authority) {
+	if (authority.startsWith("[")) {
+		const close = authority.indexOf("]");
+		if (close === -1) return "";
+		const afterBracket = authority.slice(close + 1);
+		if (afterBracket !== "" && !/^:\d+$/.test(afterBracket)) return "";
+		return authority.slice(1, close);
+	}
+	const firstColon = authority.indexOf(":");
+	if (firstColon === -1) return authority;
+	if (authority.includes(":", firstColon + 1)) return "";
+	return authority.slice(0, firstColon);
+}
+
+//#endregion
+//#region src/utils/loopback-host.ts
+function normaliseHostLiteral(hostname) {
+	return hostname.trim().replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
+}
+function isLoopbackLiteral(h) {
+	if (h === "localhost") return true;
+	if (h === "::1" || h === "0:0:0:0:0:0:0:1") return true;
+	const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(h);
+	if (mapped) return parseInt(mapped[1], 16) >> 8 === 127;
+	const dotted = /^(?:::ffff:)?(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
+	if (!dotted) return false;
+	const octets = dotted.slice(1).map(Number);
+	if (octets.some((o) => o > 255)) return false;
+	return octets[0] === 127;
+}
+function isWildcardLiteral(h) {
+	return h === "0.0.0.0" || h === "::" || h === "0:0:0:0:0:0:0:0" || h === "::ffff:0.0.0.0" || h === "::ffff:0:0";
+}
+function isLoopbackHostname(hostname) {
+	return isLoopbackLiteral(normaliseHostLiteral(hostname));
+}
+function isWildcardHostname(hostname) {
+	return isWildcardLiteral(normaliseHostLiteral(hostname));
+}
+function isLoopbackHost(hostname) {
+	const h = normaliseHostLiteral(hostname).replace(/\.$/, "");
+	return h.endsWith(".localhost") || isLoopbackLiteral(h) || isWildcardLiteral(h);
+}
+
+//#endregion
+//#region src/utils/aws-proxy.ts
+const AGENT_OPTS = {
+	keepAlive: true,
+	maxSockets: 50
+};
+function isProxyEnvConfigured() {
+	return PROXY_ENV_VARIABLES.some((key) => Boolean(process.env[key]));
+}
+const PROXY_ENV_VARIABLES = [
+	"https_proxy",
+	"HTTPS_PROXY",
+	"http_proxy",
+	"HTTP_PROXY",
+	"all_proxy",
+	"ALL_PROXY"
+];
+function isSpeakableProxyEnvValue(value) {
+	return !value.includes("://") || isSpeakableProxy(value.trim());
+}
+const AWS_ENDPOINT_PROBES = ["https://sts.amazonaws.com", "http://sts.amazonaws.com"];
+function everySetProxyEnvValueIsUnspeakable() {
+	const set = PROXY_ENV_VARIABLES.map((key) => process.env[key] ?? "").filter((v) => v !== "");
+	return set.length > 0 && !set.some(isSpeakableProxyEnvValue);
+}
+const warnedProxySchemes = /* @__PURE__ */ new Set();
+function proxySchemeOf(proxyUrl) {
+	const match = /^([a-z][a-z0-9+.-]{0,31}):\/\//i.exec(proxyUrl);
+	return match ? match[1].toLowerCase() : "(unrecognized)";
+}
+function isSpeakableProxy(proxyUrl) {
+	return /^https?:\/\//i.test(proxyUrl);
+}
+function warnUnspeakableProxy(proxyUrl) {
+	const scheme = proxySchemeOf(proxyUrl);
+	if (warnedProxySchemes.has(scheme)) return;
+	try {
+		getLogger().child("aws-proxy").warn(`Unsupported proxy scheme "${scheme}" — cdk-local speaks HTTP CONNECT proxies only, so requests it would carry go DIRECT instead of through the proxy. Set HTTPS_PROXY / HTTP_PROXY / ALL_PROXY to an http:// or https:// proxy URL. (The proxy URL is withheld here: it can carry credentials.)`);
+	} catch {
+		return;
+	}
+	warnedProxySchemes.add(scheme);
+}
+function resolveProxyForTarget(targetHref) {
+	const proxyUrl = getProxyForUrl(targetHref).trim();
+	if (proxyUrl === "") return "";
+	if (isSpeakableProxy(proxyUrl)) return proxyUrl;
+	warnUnspeakableProxy(proxyUrl);
+	return "";
+}
+var EnvRoutingProxyAgent = class extends Agent$2 {
+	proxyAgents = /* @__PURE__ */ new Map();
+	directHttpAgent = new Agent(AGENT_OPTS);
+	directHttpsAgent = new Agent$1(AGENT_OPTS);
+	constructor() {
+		super(AGENT_OPTS);
+	}
+	connect(_req, options) {
+		const secure = options.secureEndpoint;
+		const host = options.host ?? "localhost";
+		const port = options.port || (secure ? 443 : 80);
+		const proxyUrl = resolveProxyForTarget(`${secure ? "https" : "http"}://${formatAuthority(host, port)}`);
+		if (!proxyUrl) return secure ? this.directHttpsAgent : this.directHttpAgent;
+		const key = `${secure ? "https" : "http"}|${proxyUrl}`;
+		let agent = this.proxyAgents.get(key);
+		if (!agent) {
+			agent = secure ? new HttpsProxyAgent(proxyUrl, AGENT_OPTS) : new HttpProxyAgent(proxyUrl, AGENT_OPTS);
+			this.proxyAgents.set(key, agent);
+		}
+		return agent;
+	}
+	destroy() {
+		for (const agent of this.proxyAgents.values()) agent.destroy();
+		this.proxyAgents.clear();
+		this.directHttpAgent.destroy();
+		this.directHttpsAgent.destroy();
+		super.destroy();
+	}
+};
+let endpointOverride;
+function setAwsEndpointOverride(o) {
+	endpointOverride = o;
+}
+function getAwsEndpointOverride() {
+	return endpointOverride;
+}
+function endpointOverrideClientConfig(o) {
+	const httpsAgent = new Agent$1({
+		keepAlive: true,
+		...o.caPem ? { ca: [...rootCertificates, o.caPem] } : {}
+	});
+	const creds = o.credentials;
+	return {
+		endpoint: o.endpoint,
+		requestHandler: new NodeHttpHandler({ httpsAgent }),
+		...creds ? { credentials: async () => ({
+			accessKeyId: creds.accessKeyId,
+			secretAccessKey: creds.secretAccessKey,
+			...creds.sessionToken ? { sessionToken: creds.sessionToken } : {}
+		}) } : {}
+	};
+}
+function buildProxyRequestHandler() {
+	const agent = new EnvRoutingProxyAgent();
+	return new NodeHttpHandler({
+		httpAgent: agent,
+		httpsAgent: agent
+	});
+}
+function buildProxyClientConfig(opts = {}) {
+	if (endpointOverride) return endpointOverrideClientConfig(endpointOverride);
+	if (!isProxyEnvConfigured()) return {};
+	if (everySetProxyEnvValueIsUnspeakable()) {
+		for (const probe of AWS_ENDPOINT_PROBES) resolveProxyForTarget(probe);
+		return {};
+	}
+	const profile = opts.profile;
+	let chain;
+	const credentials = async (identityProperties) => {
+		chain ??= (async () => {
+			const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
+			return defaultProvider({
+				...profile ? { profile } : {},
+				clientConfig: { requestHandler: buildProxyRequestHandler() }
+			});
+		})().catch((err) => {
+			chain = void 0;
+			throw err;
+		});
+		return (await chain)(identityProperties);
+	};
+	return {
+		requestHandler: buildProxyRequestHandler(),
+		credentials
+	};
+}
+const MAX_FETCH_REDIRECTS = 20;
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
+	204,
+	205,
+	304
+]);
+const REQUEST_STALL_TIMEOUT_MS = 3e5;
+function isRedirectStatus(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function parseHttpUrl(href) {
+	const parsed = new URL(href);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new TypeError(`Unsupported protocol for a proxied request: "${parsed.protocol}"`);
+	return parsed;
+}
+function getThroughAgent(url, agent, timeoutMs = REQUEST_STALL_TIMEOUT_MS) {
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		let timer;
+		let rearm = () => void 0;
+		const succeed = (value) => {
+			if (settled) return;
+			settled = true;
+			if (timer) clearTimeout(timer);
+			resolve(value);
+		};
+		const fail = (err) => {
+			if (settled) return;
+			settled = true;
+			if (timer) clearTimeout(timer);
+			reject(err);
+		};
+		const req = (url.protocol === "https:" ? request$1 : request)(url, {
+			agent,
+			headers: {
+				accept: "*/*",
+				"accept-encoding": "identity"
+			}
+		}, (res) => {
+			rearm();
+			const chunks = [];
+			res.on("data", (chunk) => {
+				rearm();
+				chunks.push(chunk);
+			});
+			res.on("error", fail);
+			res.on("end", () => {
+				if (res.statusCode === void 0) {
+					fail(/* @__PURE__ */ new Error("Malformed HTTP response: no status code"));
+					return;
+				}
+				succeed({
+					status: res.statusCode,
+					statusText: res.statusMessage ?? "",
+					headers: res.headers,
+					body: Buffer.concat(chunks)
+				});
+			});
+		});
+		req.on("error", fail);
+		rearm = () => {
+			if (settled) return;
+			if (timer) clearTimeout(timer);
+			timer = setTimeout(() => {
+				req.destroy();
+				fail(/* @__PURE__ */ new Error(`Proxied request stalled for ${timeoutMs} ms with no progress`));
+			}, timeoutMs);
+			timer.unref?.();
+		};
+		rearm();
+		req.end();
+	});
+}
+function decodeContentEncoding(raw) {
+	const header = raw.headers["content-encoding"];
+	const encoding = (Array.isArray(header) ? header.join(",") : header ?? "").trim().toLowerCase();
+	if (encoding === "" || encoding === "identity") return {
+		body: raw.body,
+		decoded: false
+	};
+	try {
+		if (encoding === "gzip" || encoding === "x-gzip") return {
+			body: gunzipSync(raw.body),
+			decoded: true
+		};
+		if (encoding === "deflate" || encoding === "x-deflate") return {
+			body: inflateSync(raw.body),
+			decoded: true
+		};
+		if (encoding === "br") return {
+			body: brotliDecompressSync(raw.body),
+			decoded: true
+		};
+	} catch {
+		return {
+			body: raw.body,
+			decoded: false
+		};
+	}
+	return {
+		body: raw.body,
+		decoded: false
+	};
+}
+function toWebResponse(raw) {
+	if (raw.status < 200 || raw.status > 599) throw new Error(`Unsupported HTTP status in response: ${raw.status}`);
+	const { body, decoded } = decodeContentEncoding(raw);
+	const headers = new Headers();
+	for (const [name, value] of Object.entries(raw.headers)) {
+		if (value === void 0) continue;
+		if (decoded && (name === "content-encoding" || name === "content-length")) continue;
+		if (Array.isArray(value)) for (const one of value) headers.append(name, one);
+		else headers.append(name, value);
+	}
+	return new Response(NULL_BODY_STATUSES.has(raw.status) ? null : body, {
+		status: raw.status,
+		statusText: raw.statusText.replace(/[^\t\x20-\x7e\x80-\xff]/g, ""),
+		headers
+	});
+}
+async function proxyAwareFetch(url, opts = {}) {
+	if (!isProxyEnvConfigured()) return globalThis.fetch(url);
+	let target = parseHttpUrl(url);
+	for (let hop = 0;; hop++) {
+		if (isLoopbackHost(target.hostname) || resolveProxyForTarget(target.href) === "") return globalThis.fetch(target.href);
+		const agent = new EnvRoutingProxyAgent();
+		let raw;
+		try {
+			raw = await getThroughAgent(target, agent, opts.timeoutMs);
+		} finally {
+			agent.destroy();
+		}
+		const location = raw.headers["location"];
+		if (!isRedirectStatus(raw.status) || typeof location !== "string" || location === "") return toWebResponse(raw);
+		if (hop >= MAX_FETCH_REDIRECTS) throw new Error(`Too many redirects (more than ${MAX_FETCH_REDIRECTS})`);
+		target = parseHttpUrl(new URL(location, target).href);
+	}
+}
+
+//#endregion
+//#region src/utils/workload-identity.ts
+function copyCredentials(c) {
+	return c ? {
+		accessKeyId: c.accessKeyId,
+		secretAccessKey: c.secretAccessKey,
+		...c.sessionToken ? { sessionToken: c.sessionToken } : {}
+	} : void 0;
+}
+let record;
+let stripWarned = false;
+const SECOND_ASSUME_MESSAGE = "A role was already assumed in this process; refusing to assume a second one. Pass --role-arn once.";
+function recordAssumedRole(caller, role) {
+	if (record !== void 0) throw new Error(SECOND_ASSUME_MESSAGE);
+	record = {
+		caller: copyCredentials(caller),
+		role: copyCredentials(role)
+	};
+}
+function assumedRoleRecorded() {
+	return record !== void 0;
+}
+function readEnvCallerCredentials(env = process.env) {
+	const accessKeyId = env["AWS_ACCESS_KEY_ID"];
+	const secretAccessKey = env["AWS_SECRET_ACCESS_KEY"];
+	if (!accessKeyId || !secretAccessKey) return void 0;
+	const sessionToken = env["AWS_SESSION_TOKEN"];
+	return {
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	};
+}
+function resetWorkloadIdentity() {
+	record = void 0;
+	stripWarned = false;
+}
+function callerRecord() {
+	return getEmbedConfig().workloadIdentity === "caller" ? record : void 0;
+}
+const MULTIPLE_CREDENTIAL_SOURCES_WARNING = "Multiple credential sources detected";
+const chainLogger = {
+	debug: () => {},
+	info: () => {},
+	warn: (...args) => {
+		const text = args.map(String).join(" ");
+		if (text.includes(MULTIPLE_CREDENTIAL_SOURCES_WARNING)) return;
+		getLogger().warn(text);
+	},
+	error: (...args) => {
+		getLogger().error(args.map(String).join(" "));
+	}
+};
+function callerChainWithoutEnv(proxied) {
+	let chain;
+	return async (identityProperties) => {
+		chain ??= (async () => {
+			const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
+			return defaultProvider({
+				profile: "default",
+				logger: chainLogger,
+				...proxied ? { clientConfig: { requestHandler: buildProxyRequestHandler() } } : {}
+			});
+		})().catch((err) => {
+			chain = void 0;
+			throw err;
+		});
+		return (await chain)(identityProperties);
+	};
+}
+function workloadClientConfig(opts = {}) {
+	const base = buildProxyClientConfig({ profile: opts.profile });
+	const rec = callerRecord();
+	if (!rec) return base;
+	if (base.endpoint !== void 0) return base;
+	if (opts.profile || process.env["AWS_PROFILE"]) return base;
+	if (rec.caller) {
+		const caller = rec.caller;
+		const credentials = async () => ({
+			accessKeyId: caller.accessKeyId,
+			secretAccessKey: caller.secretAccessKey,
+			...caller.sessionToken ? { sessionToken: caller.sessionToken } : {}
+		});
+		return {
+			...base,
+			credentials
+		};
+	}
+	return {
+		...base,
+		credentials: callerChainWithoutEnv(base.requestHandler !== void 0)
+	};
+}
+function workloadStsClientConfig(args) {
+	return {
+		...workloadClientConfig({ profile: args.profile }),
+		...args.region && { region: args.region },
+		...args.profile && { profile: args.profile }
+	};
+}
+function deployAccountStsClientConfig(args) {
+	const role = callerRecord()?.role;
+	if (!role) return {
+		...buildProxyClientConfig({ profile: args.profile }),
+		...args.region && { region: args.region },
+		...args.profile && { profile: args.profile }
+	};
+	const credentials = async () => ({
+		accessKeyId: role.accessKeyId,
+		secretAccessKey: role.secretAccessKey,
+		...role.sessionToken ? { sessionToken: role.sessionToken } : {}
+	});
+	return {
+		...buildProxyClientConfig(),
+		...args.region && { region: args.region },
+		...args.profile && { profile: args.profile },
+		credentials
+	};
+}
+function accountLookupStsClientConfig(args) {
+	return args.readFromCfnStack ? workloadStsClientConfig({
+		region: args.region,
+		profile: args.profile
+	}) : deployAccountStsClientConfig({
+		region: args.region,
+		profile: args.profile
+	});
+}
+function applyWorkloadEnvCredentials(env) {
+	const rec = callerRecord();
+	if (!rec) return "unchanged";
+	if (rec.caller) {
+		env["AWS_ACCESS_KEY_ID"] = rec.caller.accessKeyId;
+		env["AWS_SECRET_ACCESS_KEY"] = rec.caller.secretAccessKey;
+		if (rec.caller.sessionToken) env["AWS_SESSION_TOKEN"] = rec.caller.sessionToken;
+		else delete env["AWS_SESSION_TOKEN"];
+		return "restored";
+	}
+	delete env["AWS_ACCESS_KEY_ID"];
+	delete env["AWS_SECRET_ACCESS_KEY"];
+	delete env["AWS_SESSION_TOKEN"];
+	return "stripped";
+}
+function warnWorkloadCredentialsStripped() {
+	if (stripWarned) return;
+	stripWarned = true;
+	getLogger().warn("The --role-arn role is not handed to the emulated workload, and your shell had no static AWS credentials to hand it instead, so the container receives none. Pass --profile <name>, or export static credentials, to give it an identity.");
+}
+
+//#endregion
+//#region src/local/workload-aws-wiring.ts
+var workload_aws_wiring_exports = /* @__PURE__ */ __exportAll({
+	AUTH_OFF_PLACEHOLDER_CREDENTIALS: () => AUTH_OFF_PLACEHOLDER_CREDENTIALS,
+	CA_TRUST_ENV_KEYS: () => CA_TRUST_ENV_KEYS,
+	DEFAULT_AWS_EMULATOR_URL: () => DEFAULT_AWS_EMULATOR_URL,
+	EMULATOR_SCRUBBED_ENV_KEYS: () => EMULATOR_SCRUBBED_ENV_KEYS,
+	activateWorkloadAwsWiring: () => activateWorkloadAwsWiring,
+	applyWorkloadAwsWiringToEnv: () => applyWorkloadAwsWiringToEnv,
+	awsEmulatorEnvName: () => awsEmulatorEnvName,
+	collectHostEndpointOverrides: () => collectHostEndpointOverrides,
+	effectiveLoopbackPorts: () => effectiveLoopbackPorts,
+	getActiveWorkloadAwsWiring: () => getActiveWorkloadAwsWiring,
+	getContainerCaBundlePath: () => getContainerCaBundlePath,
+	parseAwsEndpoint: () => parseAwsEndpoint,
+	parseIniSections: () => parseIniSections,
+	probeAwsEmulatorHealth: () => probeAwsEmulatorHealth,
+	readEmulatorRunFiles: () => readEmulatorRunFiles,
+	readProfileEndpointSettings: () => readProfileEndpointSettings,
+	resolveAwsEmulatorOption: () => resolveAwsEmulatorOption,
+	resolveHostDefaultCredentials: () => resolveHostDefaultCredentials,
+	resolveWorkloadAwsWiring: () => resolveWorkloadAwsWiring,
+	setActiveWorkloadAwsWiring: () => setActiveWorkloadAwsWiring,
+	writeCaBundleFile: () => writeCaBundleFile
+});
+const CA_TRUST_ENV_KEYS = [
+	"AWS_CA_BUNDLE",
+	"NODE_EXTRA_CA_CERTS",
+	"REQUESTS_CA_BUNDLE",
+	"SSL_CERT_FILE"
+];
+const EMULATOR_SCRUBBED_ENV_KEYS = [
+	"AWS_PROFILE",
+	"AWS_DEFAULT_PROFILE",
+	"AWS_SHARED_CREDENTIALS_FILE",
+	"AWS_CONFIG_FILE",
+	"AWS_WEB_IDENTITY_TOKEN_FILE",
+	"AWS_ROLE_ARN",
+	"AWS_ROLE_SESSION_NAME",
+	"AWS_CONTAINER_CREDENTIALS_FULL_URI",
+	"AWS_CONTAINER_AUTHORIZATION_TOKEN"
+];
+const CREDENTIAL_KEYS = [
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_SESSION_TOKEN"
+];
+function parseAwsEndpoint(value, label = "--aws-emulator") {
+	let u;
+	try {
+		u = new URL(value);
+	} catch {
+		throw new Error(`${label} ${displayUntrustedValue(value)} is not a URL (expected e.g. https://127.0.0.1:9297).`);
+	}
+	if (u.protocol !== "https:" && u.protocol !== "http:") throw new Error(`${label} must be an http(s) URL, got ${displayUntrustedValue(value)}.`);
+	if (u.username || u.password || u.search || u.hash || u.pathname !== "/" && u.pathname !== "") throw new Error(`${label} must be a bare scheme://host:port URL (no credentials, path or query), got ${displayUntrustedValue(value)}.`);
+	const port = u.port ? Number(u.port) : u.protocol === "https:" ? 443 : 80;
+	const hostname = u.hostname.replace(/^\[|\]$/g, "");
+	return {
+		url: `${u.protocol}//${u.host}`,
+		hostname,
+		port,
+		loopback: isLoopbackHostname(u.hostname)
+	};
+}
+function parseIniSections(text) {
+	const out = {};
+	let current;
+	for (const raw of text.split(/\r?\n/)) {
+		const line = raw.trim();
+		if (line === "" || line.startsWith("#") || line.startsWith(";")) continue;
+		const sec = /^\[\s*(.+?)\s*\]$/.exec(line);
+		if (sec) {
+			current = Object.create(null);
+			Object.defineProperty(out, sec[1], {
+				value: current,
+				enumerable: true,
+				configurable: true,
+				writable: true
+			});
+			continue;
+		}
+		const eq = line.indexOf("=");
+		if (current && eq > 0) {
+			const k = line.slice(0, eq).trim();
+			Object.defineProperty(current, k, {
+				value: line.slice(eq + 1).trim(),
+				enumerable: true,
+				configurable: true,
+				writable: true
+			});
+		}
+	}
+	return out;
+}
+function readEmulatorRunFiles(port, homeDir = homedir()) {
+	const dir = path$1.join(homeDir, ".aws", "emulator", String(port));
+	const present = existsSync(dir);
+	const result = {
+		dir,
+		present
+	};
+	if (!present) return result;
+	try {
+		const sections = parseIniSections(readFileSync(path$1.join(dir, "emulator_credentials"), "utf8"));
+		const def = sections["default"] ?? Object.values(sections)[0];
+		if (def?.["aws_access_key_id"] && def["aws_secret_access_key"]) result.credentials = {
+			accessKeyId: def["aws_access_key_id"],
+			secretAccessKey: def["aws_secret_access_key"],
+			...def["aws_session_token"] ? { sessionToken: def["aws_session_token"] } : {}
+		};
+	} catch {}
+	const ca = path$1.join(dir, "ca.pem");
+	if (existsSync(ca)) result.caPath = ca;
+	return result;
+}
+const AUTH_OFF_PLACEHOLDER_CREDENTIALS = Object.freeze({
+	accessKeyId: "EMULATORAUTHOFF00000",
+	secretAccessKey: "0000000000000000000000000000000000000000"
+});
+function profileName(env, profile) {
+	return profile || env["AWS_PROFILE"] || env["AWS_DEFAULT_PROFILE"] || "default";
+}
+function readProfileEndpointSettings(env, profile, homeDir = homedir()) {
+	const file = env["AWS_CONFIG_FILE"] || path$1.join(homeDir, ".aws", "config");
+	let sections;
+	try {
+		sections = parseIniSections(readFileSync(file, "utf8"));
+	} catch {
+		return {};
+	}
+	const name = profileName(env, profile);
+	const sec = name === "default" ? sections["default"] ?? sections["profile default"] : sections[`profile ${name}`];
+	if (!sec) return {};
+	return {
+		...sec["endpoint_url"] ? { endpointUrl: sec["endpoint_url"] } : {},
+		...sec["ca_bundle"] ? { caBundle: sec["ca_bundle"] } : {}
+	};
+}
+function collectHostEndpointOverrides(env, opts = {}) {
+	if ((env["AWS_IGNORE_CONFIGURED_ENDPOINT_URLS"] ?? "").toLowerCase() === "true") return {};
+	const out = {};
+	for (const [k, v] of Object.entries(env)) {
+		if (v === void 0 || v === "") continue;
+		if (k === "AWS_ENDPOINT_URL" || /^AWS_ENDPOINT_URL_[A-Z0-9_]+$/.test(k)) out[k] = v;
+	}
+	if (out["AWS_ENDPOINT_URL"] === void 0) {
+		const fromProfile = readProfileEndpointSettings(env, opts.profile, opts.homeDir).endpointUrl;
+		if (fromProfile) out["AWS_ENDPOINT_URL"] = fromProfile;
+	}
+	for (const [k, v] of Object.entries(out)) try {
+		parseAwsEndpoint(v, k);
+	} catch {
+		getLogger().warn(`${k} is not an http(s) URL; it is not forwarded to workload containers.`);
+		delete out[k];
+	}
+	return out;
+}
+function getContainerCaBundlePath() {
+	return `${getEmbedConfig().awsBindMountPath}/ca-bundle.pem`;
+}
+function expandHome(p, homeDir) {
+	return p === "~" ? homeDir : p.startsWith("~/") ? path$1.join(homeDir, p.slice(2)) : p;
+}
+function writeCaBundleFile(source) {
+	let pem;
+	try {
+		pem = readFileSync(source, "utf8");
+	} catch (err) {
+		throw new Error(`CA bundle ${displayUntrustedValue(source)} cannot be read (${err.code ?? "error"}).`);
+	}
+	const certs = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+	if (!certs) throw new Error(`CA bundle ${displayUntrustedValue(source)} contains no PEM certificate.`);
+	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().productName}-ca-`));
+	const hostPath = path$1.join(dir, "ca-bundle.pem");
+	writeFileSync(hostPath, `${certs.join("\n")}\n${rootCertificates.join("\n")}\n`, { mode: 420 });
+	return {
+		hostPath,
+		dispose: () => rmSync(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+const DEFAULT_AWS_EMULATOR_URL = "https://127.0.0.1:9297";
+function probeAwsEmulatorHealth(url, caPath) {
+	return new Promise((resolve) => {
+		let ca;
+		try {
+			ca = caPath ? [...rootCertificates, readFileSync(caPath, "utf8")] : void 0;
+		} catch {
+			ca = void 0;
+		}
+		const target = `${url}/__admin/health`;
+		const onResponse = (res) => {
+			res.resume();
+			resolve(res.statusCode === 200 ? void 0 : `HTTP_${res.statusCode ?? 0}`);
+		};
+		const req = target.startsWith("https:") ? get$1(target, {
+			timeout: 3e3,
+			...ca ? { ca } : {}
+		}, onResponse) : get(target, { timeout: 3e3 }, onResponse);
+		req.on("timeout", () => {
+			req.destroy();
+			resolve("ETIMEDOUT");
+		});
+		req.on("error", (e) => resolve(e.code ?? "ERROR"));
+	});
+}
+function describeEmulatorUnreachable(ep, reason) {
+	return `--aws-emulator ${ep.url}: no AWS Emulator answers its health check at ${ep.url}/__admin/health (${reason}). Check that it is running on port ${ep.port} (\`aws-emulator -p ${ep.port}\`, or its Docker image published with \`-p 127.0.0.1:${ep.port}:${ep.port}\`), that the URL's port matches, and that it listens on an address this machine reaches (\`-b\`).`;
+}
+async function resolveWorkloadAwsWiring(opts) {
+	const env = opts.env ?? process.env;
+	const homeDir = opts.homeDir ?? homedir();
+	const disposers = [];
+	const dispose = () => {
+		for (const d of disposers.splice(0)) try {
+			d();
+		} catch {}
+	};
+	const caMount = (source) => {
+		const file = writeCaBundleFile(expandHome(source, homeDir));
+		disposers.push(file.dispose);
+		const containerPath = getContainerCaBundlePath();
+		const caEnv = {};
+		for (const k of CA_TRUST_ENV_KEYS) caEnv[k] = containerPath;
+		return {
+			hostPath: file.hostPath,
+			mounts: [{
+				hostPath: file.hostPath,
+				containerPath
+			}],
+			env: caEnv
+		};
+	};
+	try {
+		if (opts.awsEmulator) {
+			const ep = parseAwsEndpoint(opts.awsEmulator === true ? DEFAULT_AWS_EMULATOR_URL : opts.awsEmulator, "--aws-emulator");
+			if (ep.hostname === "localhost") {
+				ep.hostname = "127.0.0.1";
+				ep.url = ep.url.replace("//localhost", "//127.0.0.1");
+			}
+			const run = readEmulatorRunFiles(ep.port, homeDir);
+			const caSource = opts.caBundle || run.caPath || env["AWS_CA_BUNDLE"];
+			const failure = await (opts.probeHealth ?? probeAwsEmulatorHealth)(ep.url, caSource ? expandHome(caSource, homeDir) : void 0);
+			if (failure) throw new Error(describeEmulatorUnreachable(ep, failure));
+			let credentials;
+			if (run.credentials) credentials = run.credentials;
+			else {
+				credentials = AUTH_OFF_PLACEHOLDER_CREDENTIALS;
+				getLogger().info(`--aws-emulator: ${path$1.join(run.dir, "emulator_credentials")} not found but the emulator is healthy, so it runs with --auth off; workload containers get placeholder credentials.`);
+			}
+			const ca = caSource && ep.url.startsWith("https:") ? caMount(caSource) : void 0;
+			return {
+				mode: "emulator",
+				emulatorEndpoint: ep,
+				env: {
+					AWS_ENDPOINT_URL: ep.url,
+					AWS_EC2_METADATA_DISABLED: "true",
+					AWS_DISABLE_HOST_PREFIX_INJECTION: "true",
+					...ca?.env ?? {}
+				},
+				scrubEnvKeys: EMULATOR_SCRUBBED_ENV_KEYS,
+				mounts: ca?.mounts ?? [],
+				loopbackPorts: ep.loopback ? [ep.port] : [],
+				probeHealth: ca !== void 0,
+				...ca ? { caHostPath: ca.hostPath } : {},
+				emulatorCredentials: credentials,
+				dispose
+			};
+		}
+		const endpoints = collectHostEndpointOverrides(env, {
+			profile: opts.profile,
+			homeDir
+		});
+		let ca;
+		if (opts.caBundle) ca = caMount(opts.caBundle);
+		else {
+			const hostCa = env["AWS_CA_BUNDLE"] || readProfileEndpointSettings(env, opts.profile, homeDir).caBundle;
+			if (hostCa) try {
+				ca = caMount(hostCa);
+			} catch (err) {
+				getLogger().warn(`${err.message} It is not mounted into workload containers.`);
+			}
+		}
+		const ports = /* @__PURE__ */ new Set();
+		for (const v of Object.values(endpoints)) {
+			const ep = parseAwsEndpoint(v);
+			if (ep.loopback) ports.add(ep.port);
+		}
+		return {
+			mode: "forward",
+			env: {
+				...endpoints,
+				...ca?.env ?? {}
+			},
+			scrubEnvKeys: [],
+			mounts: ca?.mounts ?? [],
+			loopbackPorts: [...ports].sort((a, b) => a - b),
+			probeHealth: false,
+			...ca ? { caHostPath: ca.hostPath } : {},
+			dispose
+		};
+	} catch (err) {
+		dispose();
+		throw err;
+	}
+}
+function effectiveLoopbackPorts(env, wiring) {
+	const used = /* @__PURE__ */ new Set();
+	for (const [k, v] of Object.entries(env)) {
+		if (k !== "AWS_ENDPOINT_URL" && !k.startsWith("AWS_ENDPOINT_URL_")) continue;
+		try {
+			const ep = parseAwsEndpoint(v, k);
+			if (ep.loopback) used.add(ep.port);
+		} catch {}
+	}
+	return wiring.loopbackPorts.filter((p) => used.has(p));
+}
+function applyWorkloadAwsWiringToEnv(env, wiring, defaultCredentials) {
+	const out = {};
+	for (const [k, v] of Object.entries(env)) Object.defineProperty(out, k, {
+		value: v,
+		enumerable: true,
+		configurable: true,
+		writable: true
+	});
+	const setCreds = (c) => {
+		for (const k of CREDENTIAL_KEYS) delete out[k];
+		if (!c) return;
+		out["AWS_ACCESS_KEY_ID"] = c.accessKeyId;
+		out["AWS_SECRET_ACCESS_KEY"] = c.secretAccessKey;
+		if (c.sessionToken) out["AWS_SESSION_TOKEN"] = c.sessionToken;
+	};
+	if (wiring.mode === "emulator") {
+		for (const k of wiring.scrubEnvKeys) delete out[k];
+		Object.assign(out, wiring.env);
+		setCreds(wiring.emulatorCredentials);
+	} else {
+		for (const [k, v] of Object.entries(wiring.env)) if (out[k] === void 0) out[k] = v;
+		if (defaultCredentials && !out["AWS_ACCESS_KEY_ID"]) setCreds(defaultCredentials);
+	}
+	if (out["AWS_REGION"] && !out["AWS_DEFAULT_REGION"]) out["AWS_DEFAULT_REGION"] = out["AWS_REGION"];
+	return out;
+}
+async function resolveHostDefaultCredentials(opts = {}) {
+	const name = assumedRoleRecorded() ? profileName(process.env, opts.profile) : opts.profile;
+	const key = `${assumedRoleRecorded() ? "noenv" : "chain"}:${name ?? ""}`;
+	const miss = chainMisses.get(key);
+	if (miss !== void 0 && Date.now() - miss < CHAIN_MISS_TTL_MS) return void 0;
+	let provider = chainProviders.get(key);
+	if (!provider) {
+		const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
+		provider = defaultProvider(name ? { profile: name } : {});
+		chainProviders.set(key, provider);
+	}
+	try {
+		const c = await provider();
+		chainMisses.delete(key);
+		return {
+			accessKeyId: c.accessKeyId,
+			secretAccessKey: c.secretAccessKey,
+			...c.sessionToken ? { sessionToken: c.sessionToken } : {}
+		};
+	} catch (err) {
+		chainMisses.set(key, Date.now());
+		getLogger().debug(`No credentials from the host default chain for workload containers: ${describeCredentialLoadFailure(err)}`);
+		return;
+	}
+}
+const CHAIN_MISS_TTL_MS = 6e4;
+const chainProviders = /* @__PURE__ */ new Map();
+const chainMisses = /* @__PURE__ */ new Map();
+let active;
+let exitHookInstalled = false;
+function getActiveWorkloadAwsWiring() {
+	return active;
+}
+function setActiveWorkloadAwsWiring(wiring) {
+	if (active && active !== wiring) active.dispose();
+	active = wiring;
+	if (wiring && !exitHookInstalled) {
+		exitHookInstalled = true;
+		process.once("exit", () => active?.dispose());
+	}
+}
+function awsEmulatorEnvName() {
+	const { envPrefix } = getEmbedConfig();
+	return envPrefix === "CDKL" ? "CDK_LOCAL_AWS_EMULATOR" : `${envPrefix}_AWS_EMULATOR`;
+}
+function resolveAwsEmulatorOption(flag, env = process.env) {
+	if (typeof flag === "string" && flag !== "") return flag;
+	if (flag === true) return true;
+	const raw = (env[awsEmulatorEnvName()] ?? "").trim();
+	if (raw === "" || /^(0|false)$/i.test(raw)) return void 0;
+	return /^(1|true)$/i.test(raw) ? true : raw;
+}
+async function activateWorkloadAwsWiring(options) {
+	const wiring = await resolveWorkloadAwsWiring({
+		awsEmulator: resolveAwsEmulatorOption(options.awsEmulator),
+		caBundle: options.caBundle,
+		profile: options.profile
+	});
+	setActiveWorkloadAwsWiring(wiring);
+	if (wiring.mode === "emulator" && wiring.emulatorEndpoint) {
+		setAwsEndpointOverride({
+			endpoint: wiring.emulatorEndpoint.url,
+			...wiring.caHostPath ? { caPem: readFileSync(wiring.caHostPath, "utf8") } : {},
+			...wiring.emulatorCredentials ? { credentials: wiring.emulatorCredentials } : {}
+		});
+		getLogger().info(`Using AWS Emulator at ${wiring.emulatorEndpoint.url} for cdk-local's AWS calls and every workload container.`);
+	} else setAwsEndpointOverride(void 0);
+	return wiring;
+}
+
+//#endregion
+export { warnWorkloadCredentialsStripped as A, formatAuthority as B, accountLookupStsClientConfig as C, readEnvCallerCredentials as D, deployAccountStsClientConfig as E, isProxyEnvConfigured as F, hostFromAuthority as H, proxyAwareFetch as I, setAwsEndpointOverride as L, workloadStsClientConfig as M, buildProxyClientConfig as N, recordAssumedRole as O, getAwsEndpointOverride as P, isLoopbackHostname as R, SECOND_ASSUME_MESSAGE as S, assumedRoleRecorded as T, formatHostForAuthority as V, resolveHostDefaultCredentials as _, activateWorkloadAwsWiring as a, workload_aws_wiring_exports as b, collectHostEndpointOverrides as c, getContainerCaBundlePath as d, parseAwsEndpoint as f, resolveAwsEmulatorOption as g, readProfileEndpointSettings as h, EMULATOR_SCRUBBED_ENV_KEYS as i, workloadClientConfig as j, resetWorkloadIdentity as k, effectiveLoopbackPorts as l, readEmulatorRunFiles as m, CA_TRUST_ENV_KEYS as n, applyWorkloadAwsWiringToEnv as o, probeAwsEmulatorHealth as p, DEFAULT_AWS_EMULATOR_URL as r, awsEmulatorEnvName as s, AUTH_OFF_PLACEHOLDER_CREDENTIALS as t, getActiveWorkloadAwsWiring as u, resolveWorkloadAwsWiring as v, applyWorkloadEnvCredentials as w, writeCaBundleFile as x, setActiveWorkloadAwsWiring as y, isWildcardHostname as z };
+//# sourceMappingURL=workload-aws-wiring-BIxf0jtl.js.map