cdk-local 0.160.1 → 0.161.0

package/README.md

@@ -227,7 +227,11 @@ The same overlay can redirect the AWS SDK itself. Set the SDK's standard per-ser
 
 DynamoDB and S3 calls resolve to the local endpoint; Secrets Manager, SSM Parameter Store, and everything else have no override, so they hit real AWS through your `--assume-role` / `--from-cfn-stack` credentials. The suffix is the service name uppercased (`DYNAMODB`, `S3`, `SECRETS_MANAGER`, ...); the bare `AWS_ENDPOINT_URL` (no suffix) redirects every service at once, so the per-service form is what makes the split selective. cdk-local only injects these variables — it does not run the endpoint for you; start the local server separately and point the URL at it.
 
-`host.docker.internal` resolves to the host from inside the container — Docker Desktop (macOS / Windows) provides it natively, and on Linux native dockerd `cdkl` adds the `host-gateway` alias for you on the `invoke` / `run-task` / `start-service` / `start-alb` container runs (Docker 20.10+). On an older daemon the alias is skipped; use the Docker bridge address (e.g. `http://172.17.0.1:8000`) or put the local server on the same Docker network.
+A host NAME such as `host.docker.internal` makes the JavaScript, Java and Go SDKs address S3 virtual-hosted style (`<bucket>.host.docker.internal`); for an S3-compatible endpoint, export `AWS_ENDPOINT_URL_S3=http://127.0.0.1:<port>` in your shell instead and cdk-local forwards it with the URL unchanged (see Local AWS endpoints below). `host.docker.internal` resolves to the host from inside the container — Docker Desktop (macOS / Windows) provides it natively, and on Linux native dockerd `cdkl` adds the `host-gateway` alias for you on the `invoke` / `run-task` / `start-service` / `start-alb` container runs (Docker 20.10+). On an older daemon the alias is skipped; use the Docker bridge address (e.g. `http://172.17.0.1:8000`) or put the local server on the same Docker network.
+
+### Local AWS endpoints
+
+An `AWS_ENDPOINT_URL` / `AWS_ENDPOINT_URL_<SERVICE>` exported in your shell (or a profile's `endpoint_url`) is forwarded to every workload container by default, together with your `AWS_CA_BUNDLE`; a `127.0.0.1` endpoint keeps working inside the container unchanged, TLS verification included. To run a whole command against a local AWS Emulator — cdk-local's own `--from-cfn-stack` reads included, containers given only the emulator's credentials — pass `--aws-emulator` (default `https://127.0.0.1:9297`). Rules: [docs/cli-reference.md#aws-endpoints-ca-bundles-and-credentials-inside-containers](docs/cli-reference.md#aws-endpoints-ca-bundles-and-credentials-inside-containers).
 
 ## Hot reload — `--watch`
 

package/dist/assembly-path-R96uhMm1.js

@@ -0,0 +1,208 @@
+import { t as getLogger } from "./logger-Co5XVwco.js";
+import { readlinkSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+
+//#region src/local/credential-error.ts
+const SERVICE_MESSAGE_MAX = 512;
+function stringifyThrown(err) {
+	try {
+		return err instanceof Error ? String(err.message) : String(err);
+	} catch {
+		return "[unstringifiable throw]";
+	}
+}
+function clampErrorName(err) {
+	let rawKind;
+	try {
+		rawKind = err instanceof Error ? err.name : "unknown";
+	} catch {
+		return "unknown";
+	}
+	return typeof rawKind === "string" && /^[A-Za-z0-9_.-]{1,64}$/.test(rawKind) ? rawKind : "unknown";
+}
+function clampErrorCode(err) {
+	if (!err || typeof err !== "object") return void 0;
+	let raw;
+	try {
+		raw = err.code;
+	} catch {
+		return;
+	}
+	if (typeof raw !== "string") return void 0;
+	return /^[A-Za-z0-9_.-]{1,64}$/.test(raw) ? raw : void 0;
+}
+function isAwsServiceException(err) {
+	if (!err || typeof err !== "object") return false;
+	const candidate = err;
+	try {
+		return Boolean(candidate.$metadata) && (candidate.$fault === "client" || candidate.$fault === "server");
+	} catch {
+		return false;
+	}
+}
+function flattenToOneLine(message) {
+	return message.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Cs}]/gu, " ");
+}
+function sanitizeServiceExceptionMessage(message) {
+	const points = [...flattenToOneLine(message)];
+	if (points.length <= SERVICE_MESSAGE_MAX) return points.join("");
+	return `${points.slice(0, SERVICE_MESSAGE_MAX).join("")}[... truncated; ${points.length}-character message]`;
+}
+function describeCredentialLoadFailure(err) {
+	const code = clampErrorCode(err);
+	return `${code === void 0 ? clampErrorName(err) : `${clampErrorName(err)} ${code}`}; ${stringifyThrown(err).length}-character message withheld, logged at debug level under --verbose`;
+}
+function describeAwsFailureForWarn(err, operation) {
+	if (isAwsServiceException(err)) return `${clampErrorName(err)}: ${sanitizeServiceExceptionMessage(stringifyThrown(err))}`;
+	getLogger().debug(`${operation}: the AWS SDK's own failure message was: ${flattenToOneLine(stringifyThrown(err))}`);
+	return describeCredentialLoadFailure(err);
+}
+
+//#endregion
+//#region src/utils/assembly-path.ts
+function isInside(base, candidate) {
+	const rel = relative(base, candidate);
+	if (rel === "" || rel === "..") return false;
+	if (rel.startsWith(`..${sep}`)) return false;
+	return !isAbsolute(rel);
+}
+function tryRealpath(p) {
+	try {
+		return realpathSync.native(p);
+	} catch {
+		return;
+	}
+}
+function tryReadlink(p) {
+	try {
+		return readlinkSync(p);
+	} catch {
+		return;
+	}
+}
+const MAX_LINK_HOPS = 40;
+const MAX_PATH_COMPONENTS = 1e3;
+function resolveThroughLinks(target, hops = 0, climbs = 0) {
+	const direct = tryRealpath(target);
+	if (direct !== void 0) return direct;
+	if (hops >= MAX_LINK_HOPS) return void 0;
+	if (climbs >= MAX_PATH_COMPONENTS) return void 0;
+	const parent = dirname(target);
+	if (parent === target) return void 0;
+	const realParent = resolveThroughLinks(parent, hops, climbs + 1);
+	if (realParent === void 0) return void 0;
+	const link = tryReadlink(target);
+	if (link === void 0) return join(realParent, basename(target));
+	return resolveThroughLinks(resolve(realParent, link), hops + 1, climbs);
+}
+function resolveAssemblyPath(dir, candidate, options) {
+	const base = resolve(dir);
+	const bound = options?.containWithin === void 0 ? base : resolve(options.containWithin);
+	const joined = resolve(join(base, candidate));
+	if (!isInside(bound, joined)) return {
+		contained: false,
+		escape: "lexical",
+		path: joined
+	};
+	const realBound = resolveThroughLinks(bound);
+	if (realBound !== void 0) {
+		const realTarget = resolveThroughLinks(joined);
+		if (realTarget !== void 0 && !isInside(realBound, realTarget)) return {
+			contained: false,
+			escape: "symlink",
+			path: joined,
+			realPath: realTarget
+		};
+	}
+	return {
+		contained: true,
+		path: joined
+	};
+}
+function absoluteAssemblyPathEscape(bound, absolutePath) {
+	const resolvedBound = resolve(bound);
+	const target = resolve(absolutePath);
+	const lexicallyOutside = !isInside(resolvedBound, target) && target !== resolvedBound;
+	const realBound = resolveThroughLinks(resolvedBound);
+	const realTarget = resolveThroughLinks(target);
+	const reallyOutside = realBound === void 0 || realTarget === void 0 ? void 0 : !isInside(realBound, realTarget) && realTarget !== realBound;
+	if (lexicallyOutside) {
+		if (reallyOutside === false) return void 0;
+		return {
+			contained: false,
+			escape: "lexical",
+			path: target
+		};
+	}
+	if (reallyOutside === true) return {
+		contained: false,
+		escape: "symlink",
+		path: target,
+		realPath: realTarget
+	};
+}
+function namesTheSameDirectory(bound, candidate) {
+	const resolvedBound = resolve(bound);
+	const target = resolve(candidate);
+	if (target === resolvedBound) return true;
+	const realBound = resolveThroughLinks(resolvedBound);
+	const realTarget = resolveThroughLinks(target);
+	return realBound !== void 0 && realTarget !== void 0 && realBound === realTarget;
+}
+function assemblyPathEscape(base, bound, candidate) {
+	if (isAbsolute(candidate)) return absoluteAssemblyPathEscape(bound, candidate);
+	const resolved = resolveAssemblyPath(base, candidate, { containWithin: bound });
+	if (resolved.contained || namesTheSameDirectory(bound, resolved.path)) return void 0;
+	return resolved;
+}
+function renderAssemblyPathEscape(escape, dir, action, provenanceOverride) {
+	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
+	const base = resolve(dir);
+	const realBase = resolveThroughLinks(base) ?? base;
+	const shownPath = displayUntrustedValue(escape.path);
+	const shownBase = displayUntrustedValue(base);
+	if (escape.escape === "symlink") {
+		if (escape.realPath === realBase) return `resolves to ${shownPath}, a symbolic link to the directory ${shownBase} itself rather than to a path inside it. ${provenance}`;
+		return `resolves to ${shownPath}, which leads through a symbolic link to ${displayUntrustedValue(escape.realPath)}, outside ${shownBase}. ${provenance}`;
+	}
+	if (escape.path === base) return `names the directory ${shownBase} itself rather than a path inside it. ${provenance}`;
+	return `resolves to ${shownPath}, outside ${shownBase}. ${provenance}`;
+}
+const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Point}\u02b0-\u02ff\u0374\u0559\u07f4\u07f5\ua78b\ua78c\uff9e\uff9f])[\p{L}\p{N}]$`, "u");
+const COMBINING_MARK = /^\p{M}$/u;
+const DEFAULT_IGNORABLE = /^\p{Default_Ignorable_Code_Point}$/u;
+const BARE_PUNCTUATION = /^[/\\._~+@:=-]$/;
+function classify(chars) {
+	let afterLetter = false;
+	return chars.map((ch) => {
+		if (DEFAULT_IGNORABLE.test(ch)) {
+			afterLetter = false;
+			return "escaped";
+		}
+		if (COMBINING_MARK.test(ch)) return afterLetter ? "bare" : "escaped";
+		afterLetter = VISIBLE_LETTER.test(ch);
+		if (afterLetter || BARE_PUNCTUATION.test(ch)) return "bare";
+		return ch >= " " && ch <= "~" ? "shown" : "escaped";
+	});
+}
+function displayUntrustedValue(value) {
+	const clean = sanitizeServiceExceptionMessage(value);
+	const chars = Array.from(clean);
+	const kinds = classify(chars);
+	if (clean === value && chars.length > 0 && kinds.every((k) => k === "bare")) return clean;
+	let body = "";
+	chars.forEach((ch, i) => {
+		if (ch === "\"" || ch === "\\") body += `\\${ch}`;
+		else if (kinds[i] !== "escaped") body += ch;
+		else for (let u = 0; u < ch.length; u++) body += `\\u${ch.charCodeAt(u).toString(16).padStart(4, "0")}`;
+	});
+	return `"${body}"`;
+}
+const PASTEABLE_COMMAND_ARG = /^[A-Za-z0-9][A-Za-z0-9~_.-]*$/;
+function isPasteableCommandArg(value) {
+	return PASTEABLE_COMMAND_ARG.test(value) && displayUntrustedValue(value) === value;
+}
+
+//#endregion
+export { namesTheSameDirectory as a, clampErrorName as c, flattenToOneLine as d, isAwsServiceException as f, isPasteableCommandArg as i, describeAwsFailureForWarn as l, stringifyThrown as m, assemblyPathEscape as n, renderAssemblyPathEscape as o, sanitizeServiceExceptionMessage as p, displayUntrustedValue as r, resolveAssemblyPath as s, absoluteAssemblyPathEscape as t, describeCredentialLoadFailure as u };
+//# sourceMappingURL=assembly-path-R96uhMm1.js.map

package/dist/assembly-path-R96uhMm1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assembly-path-R96uhMm1.js","names":[],"sources":["../src/local/credential-error.ts","../src/utils/assembly-path.ts"],"mappings":";;;;;AA6LA,MAAM,sBAAsB;AA2B5B,SAAgB,gBAAgB,KAAsB;CACpD,IAAI;EACF,OAAO,eAAe,QAAQ,OAAO,IAAI,OAAO,IAAI,OAAO,GAAG;CAChE,QAAQ;EACN,OAAO;CACT;AACF;AA0BA,SAAgB,eAAe,KAAsB;CAMnD,IAAI;CACJ,IAAI;EACF,UAAU,eAAe,QAAQ,IAAI,OAAO;CAC9C,QAAQ;EACN,OAAO;CACT;CACA,OAAO,OAAO,YAAY,YAAY,yBAAyB,KAAK,OAAO,IACvE,UACA;AACN;AA4BA,SAAgB,eAAe,KAAkC;CAC/D,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,IAAI;CACJ,IAAI;EACF,MAAO,IAA2B;CACpC,QAAQ;EACN;CACF;CACA,IAAI,OAAO,QAAQ,UAAU,OAAO;CACpC,OAAO,yBAAyB,KAAK,GAAG,IAAI,MAAM;AACpD;AAoBA,SAAgB,sBAAsB,KAAuB;CAC3D,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,MAAM,YAAY;CAClB,IAAI;EACF,OACE,QAAQ,UAAU,SAAS,MAC1B,UAAU,WAAW,YAAY,UAAU,WAAW;CAE3D,QAAQ;EAIN,OAAO;CACT;AACF;AAkCA,SAAgB,iBAAiB,SAAyB;CACxD,OAAO,QAAQ,QAAQ,sCAAsC,GAAG;AAClE;AAqBA,SAAgB,gCAAgC,SAAyB;CASvE,MAAM,SAAS,CAAC,GAAG,iBAAiB,OAAO,CAAC;CAC5C,IAAI,OAAO,UAAU,qBAAqB,OAAO,OAAO,KAAK,EAAE;CAC/D,OAAO,GAAG,OAAO,MAAM,GAAG,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE,kBAAkB,OAAO,OAAO;AAC1F;AAoDA,SAAgB,8BAA8B,KAAsB;CAClE,MAAM,OAAO,eAAe,GAAG;CAE/B,OAAO,GADM,SAAS,SAAY,eAAe,GAAG,IAAI,GAAG,eAAe,GAAG,EAAE,GAAG,OACnE,IAAI,gBAAgB,GAAG,CAAC,CAAC,OAAO;AACjD;AAsCA,SAAgB,0BAA0B,KAAc,WAA2B;CACjF,IAAI,sBAAsB,GAAG,GAC3B,OAAO,GAAG,eAAe,GAAG,EAAE,IAAI,gCAAgC,gBAAgB,GAAG,CAAC;CAExF,UAAU,CAAC,CAAC,MACV,GAAG,UAAU,2CAA2C,iBAAiB,gBAAgB,GAAG,CAAC,GAC/F;CACA,OAAO,8BAA8B,GAAG;AAC1C;;;;ACzbA,SAAS,SAAS,MAAc,WAA4B;CAC1D,MAAM,MAAM,SAAS,MAAM,SAAS;CACpC,IAAI,QAAQ,MAAM,QAAQ,MAAM,OAAO;CACvC,IAAI,IAAI,WAAW,KAAK,KAAK,GAAG,OAAO;CAKvC,OAAO,CAAC,WAAW,GAAG;AACxB;AAaA,SAAS,YAAY,GAA+B;CAClD,IAAI;EACF,OAAO,aAAa,OAAO,CAAC;CAC9B,QAAQ;EACN;CACF;AACF;AAGA,SAAS,YAAY,GAA+B;CAClD,IAAI;EACF,OAAO,aAAa,CAAC;CACvB,QAAQ;EACN;CACF;AACF;AASA,MAAM,gBAAgB;AAkBtB,MAAM,sBAAsB;AA8B5B,SAAS,oBAAoB,QAAgB,OAAO,GAAG,SAAS,GAAuB;CACrF,MAAM,SAAS,YAAY,MAAM;CACjC,IAAI,WAAW,QAAW,OAAO;CACjC,IAAI,QAAQ,eAAe,OAAO;CAClC,IAAI,UAAU,qBAAqB,OAAO;CAE1C,MAAM,SAAS,QAAQ,MAAM;CAG7B,IAAI,WAAW,QAAQ,OAAO;CAI9B,MAAM,aAAa,oBAAoB,QAAQ,MAAM,SAAS,CAAC;CAC/D,IAAI,eAAe,QAAW,OAAO;CAErC,MAAM,OAAO,YAAY,MAAM;CAC/B,IAAI,SAAS,QAGX,OAAO,KAAK,YAAY,SAAS,MAAM,CAAC;CAO1C,OAAO,oBAAoB,QAAQ,YAAY,IAAI,GAAG,OAAO,GAAG,MAAM;AACxE;AAuBA,SAAgB,oBACd,KACA,WACA,SAsBsB;CACtB,MAAM,OAAO,QAAQ,GAAG;CACxB,MAAM,QAAQ,SAAS,kBAAkB,SAAY,OAAO,QAAQ,QAAQ,aAAa;CACzF,MAAM,SAAS,QAAQ,KAAK,MAAM,SAAS,CAAC;CAE5C,IAAI,CAAC,SAAS,OAAO,MAAM,GACzB,OAAO;EAAE,WAAW;EAAO,QAAQ;EAAW,MAAM;CAAO;CAK7D,MAAM,YAAY,oBAAoB,KAAK;CAC3C,IAAI,cAAc,QAAW;EAC3B,MAAM,aAAa,oBAAoB,MAAM;EAC7C,IAAI,eAAe,UAAa,CAAC,SAAS,WAAW,UAAU,GAC7D,OAAO;GAAE,WAAW;GAAO,QAAQ;GAAW,MAAM;GAAQ,UAAU;EAAW;CAErF;CAEA,OAAO;EAAE,WAAW;EAAM,MAAM;CAAO;AACzC;AAiDA,SAAgB,2BACd,OACA,cACgC;CAChC,MAAM,gBAAgB,QAAQ,KAAK;CACnC,MAAM,SAAS,QAAQ,YAAY;CACnC,MAAM,mBAAmB,CAAC,SAAS,eAAe,MAAM,KAAK,WAAW;CAExE,MAAM,YAAY,oBAAoB,aAAa;CACnD,MAAM,aAAa,oBAAoB,MAAM;CAC7C,MAAM,gBACJ,cAAc,UAAa,eAAe,SACtC,SACA,CAAC,SAAS,WAAW,UAAU,KAAK,eAAe;CAEzD,IAAI,kBAAkB;EAGpB,IAAI,kBAAkB,OAAO,OAAO;EACpC,OAAO;GAAE,WAAW;GAAO,QAAQ;GAAW,MAAM;EAAO;CAC7D;CACA,IAAI,kBAAkB,MACpB,OAAO;EAAE,WAAW;EAAO,QAAQ;EAAW,MAAM;EAAQ,UAAU;CAAY;AAGtF;AAkBA,SAAgB,sBAAsB,OAAe,WAA4B;CAC/E,MAAM,gBAAgB,QAAQ,KAAK;CACnC,MAAM,SAAS,QAAQ,SAAS;CAChC,IAAI,WAAW,eAAe,OAAO;CACrC,MAAM,YAAY,oBAAoB,aAAa;CACnD,MAAM,aAAa,oBAAoB,MAAM;CAC7C,OAAO,cAAc,UAAa,eAAe,UAAa,cAAc;AAC9E;AAaA,SAAgB,mBACd,MACA,OACA,WACgC;CAChC,IAAI,WAAW,SAAS,GAAG,OAAO,2BAA2B,OAAO,SAAS;CAC7E,MAAM,WAAW,oBAAoB,MAAM,WAAW,EAAE,eAAe,MAAM,CAAC;CAC9E,IAAI,SAAS,aAAa,sBAAsB,OAAO,SAAS,IAAI,GAAG,OAAO;CAC9E,OAAO;AACT;AAcA,SAAgB,yBACd,QACA,KACA,QACA,oBACQ;CACR,MAAM,aACJ,sBACA,sLAEiB,OAAO;CAC1B,MAAM,OAAO,QAAQ,GAAG;CAMxB,MAAM,WAAW,oBAAoB,IAAI,KAAK;CAG9C,MAAM,YAAY,sBAAsB,OAAO,IAAI;CACnD,MAAM,YAAY,sBAAsB,IAAI;CAC5C,IAAI,OAAO,WAAW,WAAW;EAC/B,IAAI,OAAO,aAAa,UACtB,OACE,eAAe,UAAU,qCACtB,UAAU,2CAA2C;EAG5D,OACE,eAAe,UAAU,2CACtB,sBAAsB,OAAO,QAAQ,EAAE,YAAY,UAAU,IAAI;CAExE;CACA,IAAI,OAAO,SAAS,MAClB,OAAO,uBAAuB,UAAU,wCAAwC;CAElF,OAAO,eAAe,UAAU,YAAY,UAAU,IAAI;AAC5D;AAYA,MAAM,iBAAiB,IAAI,OACzB,OAAO,GAAG,qHACV,GACF;AAOA,MAAM,iBAAiB;AAUvB,MAAM,oBAAoB;AAO1B,MAAM,mBAAmB;AAYzB,SAAS,SAAS,OAA+D;CAC/E,IAAI,cAAc;CAClB,OAAO,MAAM,KAAK,OAAO;EACvB,IAAI,kBAAkB,KAAK,EAAE,GAAG;GAC9B,cAAc;GACd,OAAO;EACT;EACA,IAAI,eAAe,KAAK,EAAE,GAAG,OAAO,cAAc,SAAS;EAC3D,cAAc,eAAe,KAAK,EAAE;EACpC,IAAI,eAAe,iBAAiB,KAAK,EAAE,GAAG,OAAO;EACrD,OAAO,MAAM,OAAO,MAAM,MAAM,UAAU;CAC5C,CAAC;AACH;AA8BA,SAAgB,sBAAsB,OAAuB;CAC3D,MAAM,QAAQ,gCAAgC,KAAK;CAGnD,MAAM,QAAQ,MAAM,KAAK,KAAK;CAC9B,MAAM,QAAQ,SAAS,KAAK;CAC5B,IAAI,UAAU,SAAS,MAAM,SAAS,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM,GAAG,OAAO;CACpF,IAAI,OAAO;CACX,MAAM,SAAS,IAAI,MAAM;EACvB,IAAI,OAAO,QAAO,OAAO,MAAM,QAAQ,KAAK;OACvC,IAAI,MAAM,OAAO,WAAW,QAAQ;OAEvC,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,QAAQ,KAC7B,QAAQ,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CAGjE,CAAC;CACD,OAAO,IAAI,KAAK;AAClB;AASA,MAAM,wBAAwB;AAW9B,SAAgB,sBAAsB,OAAwB;CAC5D,OAAO,sBAAsB,KAAK,KAAK,KAAK,sBAAsB,KAAK,MAAM;AAC/E"}

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { Bn as createLocalStartAlbCommand, Dr as createLocalInvokeAgentCoreCommand, Kn as createLocalStartServiceCommand, O as createLocalStartMicrovmCommand, Qr as createLocalInvokeCommand, Yn as createLocalRunTaskCommand, a as createLocalStudioCommand, dt as createLocalStartWebFunctionCommand, ei as createLocalStartApiCommand, pt as createLocalStartAgentCoreCommand, w as createLocalListCommand, xt as createLocalStartCloudFrontCommand } from "./local-studio-Ur6enHho.js";
+import { Bn as createLocalStartAlbCommand, Dr as createLocalInvokeAgentCoreCommand, Kn as createLocalStartServiceCommand, O as createLocalStartMicrovmCommand, Qr as createLocalInvokeCommand, Yn as createLocalRunTaskCommand, a as createLocalStudioCommand, dt as createLocalStartWebFunctionCommand, ei as createLocalStartApiCommand, pt as createLocalStartAgentCoreCommand, w as createLocalListCommand, xt as createLocalStartCloudFrontCommand } from "./local-studio-DNWiPLme.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.160.1");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.161.0");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalInvokeAgentCoreCommand());
 program.addCommand(createLocalStartApiCommand());

package/dist/{docker-cmd-CoZdbeos.js → docker-cmd-Cjg3jGYF.js}

@@ -1,228 +1,10 @@
+import { t as __exportAll } from "./rolldown-runtime-w6R9maHv.js";
 import { c as getEmbedConfig, t as getLogger } from "./logger-Co5XVwco.js";
-import { existsSync, readlinkSync, realpathSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { r as displayUntrustedValue } from "./assembly-path-R96uhMm1.js";
+import { existsSync } from "node:fs";
 import { spinner } from "@clack/prompts";
 import { spawn } from "node:child_process";
 
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) {
-		__defProp(target, name, {
-			get: all[name],
-			enumerable: true
-		});
-	}
-	if (!no_symbols) {
-		__defProp(target, Symbol.toStringTag, { value: "Module" });
-	}
-	return target;
-};
-
-//#endregion
-//#region src/local/credential-error.ts
-const SERVICE_MESSAGE_MAX = 512;
-function stringifyThrown(err) {
-	try {
-		return err instanceof Error ? String(err.message) : String(err);
-	} catch {
-		return "[unstringifiable throw]";
-	}
-}
-function clampErrorName(err) {
-	let rawKind;
-	try {
-		rawKind = err instanceof Error ? err.name : "unknown";
-	} catch {
-		return "unknown";
-	}
-	return typeof rawKind === "string" && /^[A-Za-z0-9_.-]{1,64}$/.test(rawKind) ? rawKind : "unknown";
-}
-function clampErrorCode(err) {
-	if (!err || typeof err !== "object") return void 0;
-	let raw;
-	try {
-		raw = err.code;
-	} catch {
-		return;
-	}
-	if (typeof raw !== "string") return void 0;
-	return /^[A-Za-z0-9_.-]{1,64}$/.test(raw) ? raw : void 0;
-}
-function isAwsServiceException(err) {
-	if (!err || typeof err !== "object") return false;
-	const candidate = err;
-	try {
-		return Boolean(candidate.$metadata) && (candidate.$fault === "client" || candidate.$fault === "server");
-	} catch {
-		return false;
-	}
-}
-function flattenToOneLine(message) {
-	return message.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Cs}]/gu, " ");
-}
-function sanitizeServiceExceptionMessage(message) {
-	const points = [...flattenToOneLine(message)];
-	if (points.length <= SERVICE_MESSAGE_MAX) return points.join("");
-	return `${points.slice(0, SERVICE_MESSAGE_MAX).join("")}[... truncated; ${points.length}-character message]`;
-}
-function describeCredentialLoadFailure(err) {
-	const code = clampErrorCode(err);
-	return `${code === void 0 ? clampErrorName(err) : `${clampErrorName(err)} ${code}`}; ${stringifyThrown(err).length}-character message withheld, logged at debug level under --verbose`;
-}
-function describeAwsFailureForWarn(err, operation) {
-	if (isAwsServiceException(err)) return `${clampErrorName(err)}: ${sanitizeServiceExceptionMessage(stringifyThrown(err))}`;
-	getLogger().debug(`${operation}: the AWS SDK's own failure message was: ${flattenToOneLine(stringifyThrown(err))}`);
-	return describeCredentialLoadFailure(err);
-}
-
-//#endregion
-//#region src/utils/assembly-path.ts
-function isInside(base, candidate) {
-	const rel = relative(base, candidate);
-	if (rel === "" || rel === "..") return false;
-	if (rel.startsWith(`..${sep}`)) return false;
-	return !isAbsolute(rel);
-}
-function tryRealpath(p) {
-	try {
-		return realpathSync.native(p);
-	} catch {
-		return;
-	}
-}
-function tryReadlink(p) {
-	try {
-		return readlinkSync(p);
-	} catch {
-		return;
-	}
-}
-const MAX_LINK_HOPS = 40;
-const MAX_PATH_COMPONENTS = 1e3;
-function resolveThroughLinks(target, hops = 0, climbs = 0) {
-	const direct = tryRealpath(target);
-	if (direct !== void 0) return direct;
-	if (hops >= MAX_LINK_HOPS) return void 0;
-	if (climbs >= MAX_PATH_COMPONENTS) return void 0;
-	const parent = dirname(target);
-	if (parent === target) return void 0;
-	const realParent = resolveThroughLinks(parent, hops, climbs + 1);
-	if (realParent === void 0) return void 0;
-	const link = tryReadlink(target);
-	if (link === void 0) return join(realParent, basename(target));
-	return resolveThroughLinks(resolve(realParent, link), hops + 1, climbs);
-}
-function resolveAssemblyPath(dir, candidate, options) {
-	const base = resolve(dir);
-	const bound = options?.containWithin === void 0 ? base : resolve(options.containWithin);
-	const joined = resolve(join(base, candidate));
-	if (!isInside(bound, joined)) return {
-		contained: false,
-		escape: "lexical",
-		path: joined
-	};
-	const realBound = resolveThroughLinks(bound);
-	if (realBound !== void 0) {
-		const realTarget = resolveThroughLinks(joined);
-		if (realTarget !== void 0 && !isInside(realBound, realTarget)) return {
-			contained: false,
-			escape: "symlink",
-			path: joined,
-			realPath: realTarget
-		};
-	}
-	return {
-		contained: true,
-		path: joined
-	};
-}
-function absoluteAssemblyPathEscape(bound, absolutePath) {
-	const resolvedBound = resolve(bound);
-	const target = resolve(absolutePath);
-	const lexicallyOutside = !isInside(resolvedBound, target) && target !== resolvedBound;
-	const realBound = resolveThroughLinks(resolvedBound);
-	const realTarget = resolveThroughLinks(target);
-	const reallyOutside = realBound === void 0 || realTarget === void 0 ? void 0 : !isInside(realBound, realTarget) && realTarget !== realBound;
-	if (lexicallyOutside) {
-		if (reallyOutside === false) return void 0;
-		return {
-			contained: false,
-			escape: "lexical",
-			path: target
-		};
-	}
-	if (reallyOutside === true) return {
-		contained: false,
-		escape: "symlink",
-		path: target,
-		realPath: realTarget
-	};
-}
-function namesTheSameDirectory(bound, candidate) {
-	const resolvedBound = resolve(bound);
-	const target = resolve(candidate);
-	if (target === resolvedBound) return true;
-	const realBound = resolveThroughLinks(resolvedBound);
-	const realTarget = resolveThroughLinks(target);
-	return realBound !== void 0 && realTarget !== void 0 && realBound === realTarget;
-}
-function assemblyPathEscape(base, bound, candidate) {
-	if (isAbsolute(candidate)) return absoluteAssemblyPathEscape(bound, candidate);
-	const resolved = resolveAssemblyPath(base, candidate, { containWithin: bound });
-	if (resolved.contained || namesTheSameDirectory(bound, resolved.path)) return void 0;
-	return resolved;
-}
-function renderAssemblyPathEscape(escape, dir, action, provenanceOverride) {
-	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
-	const base = resolve(dir);
-	const realBase = resolveThroughLinks(base) ?? base;
-	const shownPath = displayUntrustedValue(escape.path);
-	const shownBase = displayUntrustedValue(base);
-	if (escape.escape === "symlink") {
-		if (escape.realPath === realBase) return `resolves to ${shownPath}, a symbolic link to the directory ${shownBase} itself rather than to a path inside it. ${provenance}`;
-		return `resolves to ${shownPath}, which leads through a symbolic link to ${displayUntrustedValue(escape.realPath)}, outside ${shownBase}. ${provenance}`;
-	}
-	if (escape.path === base) return `names the directory ${shownBase} itself rather than a path inside it. ${provenance}`;
-	return `resolves to ${shownPath}, outside ${shownBase}. ${provenance}`;
-}
-const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Point}\u02b0-\u02ff\u0374\u0559\u07f4\u07f5\ua78b\ua78c\uff9e\uff9f])[\p{L}\p{N}]$`, "u");
-const COMBINING_MARK = /^\p{M}$/u;
-const DEFAULT_IGNORABLE = /^\p{Default_Ignorable_Code_Point}$/u;
-const BARE_PUNCTUATION = /^[/\\._~+@:=-]$/;
-function classify(chars) {
-	let afterLetter = false;
-	return chars.map((ch) => {
-		if (DEFAULT_IGNORABLE.test(ch)) {
-			afterLetter = false;
-			return "escaped";
-		}
-		if (COMBINING_MARK.test(ch)) return afterLetter ? "bare" : "escaped";
-		afterLetter = VISIBLE_LETTER.test(ch);
-		if (afterLetter || BARE_PUNCTUATION.test(ch)) return "bare";
-		return ch >= " " && ch <= "~" ? "shown" : "escaped";
-	});
-}
-function displayUntrustedValue(value) {
-	const clean = sanitizeServiceExceptionMessage(value);
-	const chars = Array.from(clean);
-	const kinds = classify(chars);
-	if (clean === value && chars.length > 0 && kinds.every((k) => k === "bare")) return clean;
-	let body = "";
-	chars.forEach((ch, i) => {
-		if (ch === "\"" || ch === "\\") body += `\\${ch}`;
-		else if (kinds[i] !== "escaped") body += ch;
-		else for (let u = 0; u < ch.length; u++) body += `\\u${ch.charCodeAt(u).toString(16).padStart(4, "0")}`;
-	});
-	return `"${body}"`;
-}
-const PASTEABLE_COMMAND_ARG = /^[A-Za-z0-9][A-Za-z0-9~_.-]*$/;
-function isPasteableCommandArg(value) {
-	return PASTEABLE_COMMAND_ARG.test(value) && displayUntrustedValue(value) === value;
-}
-
-//#endregion
 //#region src/utils/docker-cmd.ts
 var docker_cmd_exports = /* @__PURE__ */ __exportAll({
 	DOCKER_CLIENT_ENV_KEYS: () => DOCKER_CLIENT_ENV_KEYS,
@@ -530,5 +312,5 @@ function isMalformedEnvKey(key) {
 }
 
 //#endregion
-export { sanitizeServiceExceptionMessage as C, isAwsServiceException as S, resolveAssemblyPath as _, isDockerClientEnvKey as a, describeCredentialLoadFailure as b, runDockerStreaming as c, absoluteAssemblyPathEscape as d, assemblyPathEscape as f, renderAssemblyPathEscape as g, namesTheSameDirectory as h, getDockerCmd as i, spawnStreaming as l, isPasteableCommandArg as m, finchSecretArgvRefusal as n, isMalformedEnvKey as o, displayUntrustedValue as p, formatDockerLoginError as r, runDockerForeground as s, docker_cmd_exports as t, warnFinchArgvExposure as u, clampErrorName as v, stringifyThrown as w, flattenToOneLine as x, describeAwsFailureForWarn as y };
-//# sourceMappingURL=docker-cmd-CoZdbeos.js.map
+export { isDockerClientEnvKey as a, runDockerStreaming as c, getDockerCmd as i, spawnStreaming as l, finchSecretArgvRefusal as n, isMalformedEnvKey as o, formatDockerLoginError as r, runDockerForeground as s, docker_cmd_exports as t, warnFinchArgvExposure as u };
+//# sourceMappingURL=docker-cmd-Cjg3jGYF.js.map

package/dist/docker-cmd-Cjg3jGYF.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-cmd-Cjg3jGYF.js","names":["createSpinner"],"sources":["../src/utils/docker-cmd.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAgB,eAAuB;CACrC,MAAM,WAAW,QAAQ,IAAI;CAC7B,OAAO,YAAY,SAAS,SAAS,IAAI,WAAW;AACtD;AAmBA,SAAgB,gBACd,MAAc,aAAa,GAC3B,WAA4B,QAAQ,UAC3B;CACT,IAAI,aAAa,YAAY,aAAa,SAAS,OAAO;CAC1D,MAAM,QAAQ,IAAI,MAAM,OAAO,CAAC,CAAC,IAAI,KAAK,GAAE,CAAE,YAAY;CAC1D,OAAO,SAAS,WAAW,SAAS;AACtC;AASA,SAAgB,4BAAoC;CAClD,OAAO,GAAG,eAAe,CAAC,CAAC,UAAU;AACvC;AAEA,SAAS,uBAAgC;CACvC,MAAM,IAAI,QAAQ,IAAI,0BAA0B;CAChD,OAAO,MAAM,UAAa,CAAC,KAAK,MAAM,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC;AACzE;AAsBA,SAAgB,uBACd,aACA,SACoB;CACpB,IAAI,YAAY,WAAW,KAAK,CAAC,gBAAgB,KAAK,qBAAqB,GAAG,OAAO;CACrF,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,WAAW,CAAC;CACtC,OACE,GAAG,QAAQ,MAAM,GAAG,sBAAsB,QAAQ,IAAI,EAAE,kCACrD,MAAM,IAAI,qBAAqB,CAAC,CAAC,KAAK,IAAI,EAAE,wVAK5C,0BAA0B,EAAE;AAEnC;AAGA,MAAM,kCAAkB,IAAI,IAAY;AAaxC,SAAgB,sBAAsB,MAA+B;CACnE,IAAI,KAAK,WAAW,KAAK,CAAC,gBAAgB,GAAG;CAC7C,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK;CACtC,MAAM,QAAQ,KAAK,UAAU,KAAK;CAClC,IAAI,gBAAgB,IAAI,KAAK,GAAG;CAChC,gBAAgB,IAAI,KAAK;CACzB,UAAU,CAAC,CAAC,KACV,0DAA0D,MAAM,IAAI,qBAAqB,CAAC,CAAC,KAAK,IAAI,EAAE,yNAIxG;AACF;AAkFA,eAAsB,mBACpB,MACA,UAA4B,CAAC,GACP;CACtB,OAAO,eAAe,aAAa,GAAG,MAAM,OAAO;AACrD;AASA,SAAgB,oBAAoB,KAAa,KAAiC;CAChF,IAAI,QAAQ,UAAa,CAAC,WAAW,GAAG,GACtC,OACE,qBAAqB,sBAAsB,GAAG,EAAE,0BAC7C,sBAAsB,GAAG,EAAE;CAGlC,MAAM,gBAAgB,QAAQ,IAAI,kBAAkB,OAAO,QAAQ;CACnE,MAAM,WAAW,sBAAsB,GAAG;CAC1C,OAAO,gBACH,8BAA8B,SAAS,sCAC1B,SAAS,kDACtB,8BAA8B,SAAS;AAE7C;AAOA,eAAsB,eACpB,KACA,MACA,UAA4B,CAAC,GACP;CACtB,MAAM,aAAa,QAAQ,cAAc,UAAU,CAAC,CAAC,SAAS,MAAM;CACpE,MAAM,MAAM,QAAQ,MAAM,SAAS,QAAQ,GAAG,IAAI;CAClD,MAAM,OAAO,qBAAqB,QAAQ,eAAe,UAAU;CAEnE,OAAO,IAAI,SAAsB,SAAS,WAAW;EAQnD,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,KAAK,MAAM;IACvB,KAAK,QAAQ;IACb;IACA,OAAO;KAAC,QAAQ,QAAQ,SAAS;KAAU;KAAQ;IAAM;GAC3D,CAAC;EACH,SAAS,KAAK;GACZ,oBAAoB,MAAM,QAAQ,aAAa;GAC/C,OAAO,GAAY;GACnB;EACF;EAEA,MAAM,eAAyB,CAAC;EAChC,MAAM,eAAyB,CAAC;EAEhC,MAAM,OAAQ,GAAG,SAAS,UAAkB;GAC1C,aAAa,KAAK,KAAK;GAKvB,IAAI,YAAY,QAAQ,OAAO,MAAM,KAAK;EAC5C,CAAC;EACD,MAAM,OAAQ,GAAG,SAAS,UAAkB;GAC1C,aAAa,KAAK,KAAK;GACvB,IAAI,YAAY,QAAQ,OAAO,MAAM,KAAK;EAC5C,CAAC;EAED,MAAM,KAAK,UAAU,QAA+B;GAClD,oBAAoB,MAAM,QAAQ,aAAa;GAC/C,IAAI,IAAI,SAAS,UACf,OAAO,IAAI,MAAM,oBAAoB,KAAK,QAAQ,GAAG,CAAC,CAAC;QAClD;IAKL,MAAM,0BAAU,IAAI,MAClB,qBAAqB,sBAAsB,GAAG,EAAE,IAAI,IAAI,QAAQ,cAAc,EAChF;IACA,IAAI,IAAI,SAAS,QAAW,QAAQ,OAAO,IAAI;IAC/C,OAAO,OAAO;GAChB;EACF,CAAC;EAED,MAAM,KAAK,UAAU,SAAS;GAC5B,MAAM,SAAS,OAAO,OAAO,YAAY,CAAC,CAAC,SAAS,OAAO;GAC3D,MAAM,SAAS,OAAO,OAAO,YAAY,CAAC,CAAC,SAAS,OAAO;GAC3D,IAAI,SAAS,GAAG;IACd,oBAAoB,MAAM,QAAQ,aAAa;IAC/C,QAAQ;KAAE;KAAQ;IAAO,CAAC;GAC5B,OAAO;IACL,oBAAoB,MAAM,QAAQ,aAAa;IAM/C,MAAM,UACJ,OAAO,KAAK,KACZ,OAAO,KAAK,KACZ,GAAG,sBAAsB,GAAG,EAAE,oBAAoB;IACpD,MAAM,MAAM,IAAI,MAAM,OAAO;IAC7B,IAAI,SAAS;IACb,IAAI,SAAS;IACb,IAAI,WAAW;IACf,OAAO,GAAG;GACZ;EACF,CAAC;EAED,IAAI,QAAQ,UAAU,QAAW;GAQ/B,MAAM,MAAO,GAAG,eAAe,CAE/B,CAAC;GACD,MAAM,MAAO,MAAM,QAAQ,KAAK;GAChC,MAAM,MAAO,IAAI;EACnB;CACF,CAAC;AACH;AAaA,SAAS,qBACP,OACA,YAC0B;CAC1B,IAAI,UAAU,UAAa,cAAc,QAAQ,OAAO,UAAU,MAAM,OAAO;CAC/E,MAAM,OAAOA,QAAc;CAC3B,KAAK,MAAM,KAAK;CAChB,OAAO;AACT;AAEA,SAAS,oBAAoB,MAAgC,OAAiC;CAO5F,IAAI,SAAS,QAAW;CACxB,KAAK,KAAK,SAAS,EAAE;AACvB;AAsBA,eAAsB,oBACpB,MACA,UAA6B,CAAC,GACf;CACf,OAAO,gBAAgB,aAAa,GAAG,MAAM,OAAO;AACtD;AAuBA,eAAsB,gBACpB,KACA,MACA,UAA6B,CAAC,GACf;CACf,MAAM,MAAM,QAAQ,MAAM,SAAS,QAAQ,GAAG,IAAI;CAClD,OAAO,IAAI,SAAe,SAAS,WAAW;EAC5C,MAAM,QAAQ,MAAM,KAAK,MAAM;GAC7B,KAAK,QAAQ;GACb;GAKA,OAAO;IAAC;IAAW;IAAG;GAAS;EACjC,CAAC;EACD,MAAM,KAAK,UAAU,QAA+B;GAClD,IAAI,IAAI,SAAS,UACf,OAAO,IAAI,MAAM,oBAAoB,KAAK,QAAQ,GAAG,CAAC,CAAC;QAGvD,uBAAO,IAAI,MAAM,GAAG,sBAAsB,GAAG,EAAE,WAAW,IAAI,QAAQ,eAAe,CAAC;EAE1F,CAAC;EACD,MAAM,KAAK,UAAU,SAAS;GAC5B,IAAI,SAAS,GACX,QAAQ;QAER,uBAAO,IAAI,MAAM,GAAG,IAAI,oBAAoB,MAAM,CAAC;EAEvD,CAAC;CACH,CAAC;AACH;AAwBA,SAAgB,uBAAuB,QAAgB,UAA0B;CAC/E,MAAM,UAAU,OAAO,KAAK;CAI5B,IAFE,QAAQ,SAAS,gCAAgC,KACjD,QAAQ,SAAS,0BAA0B,GAE3C,OACE,mRAEoE,eAAe,CAAC,CAAC,YAAY,kEAC/D,SAAS,8CAA8C,eAAe,CAAC,CAAC,YAAY,6MAG3F;CAG/B,OAAO;AACT;AAEA,SAAS,SAAS,WAAkE;CAClF,MAAM,SAA4B,EAAE,GAAG,QAAQ,IAAI;CACnD,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,SAAS,GAC3C,IAAI,MAAM,QACR,OAAO,OAAO;MAEd,OAAO,KAAK;CAGhB,OAAO;AACT;AA2BA,MAAa,yCAA8C,IAAI,IAAI;CAMjE;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CACA;CACA;CAWA;CACA;CAKA;CAQA;CACA;CAYA;CACA;CACA;CACA;CACA;CACA;CACA;CAMA;CACA;CACA;CACA;CAIA;CACA;CACA;CAKA;CACA;CACA;CACA;CACA;CAKA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAMA;CACA;CACA;CAWA;CACA;CACA;CACA;CACA;CACA;CACA;CAiBA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAIA;CAMA;CACA;CACA;CACA;CAKA;CACA;CAcA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CAIA;CACA;CAWA;CACA;CACA;CACA;CACA;CACA;CAKA;CASA;CACA;CACA;CACA;CACA;CACA;CACA;CAIA;CACA;CACA;CAKA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,+BAAoD,IAAI,IAC5D,CAAC,GAAG,sBAAsB,CAAC,CAAC,KAAK,MAAM,EAAE,YAAY,CAAC,CACxD;AA0BA,MAAa,6BAAgD;CAC3D;CACA;CACA;CACA;CACA;AACF;AAeA,MAAa,sDAA2D,IAAI,IAAI,CAC9E,4BACF,CAAC;AAWD,SAAgB,qBAAqB,KAAsB;CACzD,MAAM,QAAQ,IAAI,YAAY;CAC9B,IAAI,6BAA6B,IAAI,KAAK,GAAG,OAAO;CACpD,IAAI,oCAAoC,IAAI,KAAK,GAAG,OAAO;CAC3D,OAAO,2BAA2B,MAAM,WAAW,MAAM,WAAW,MAAM,CAAC;AAC7E;AAWA,MAAM,sBAAsB;AAa5B,SAAgB,kBAAkB,KAAsB;CACtD,OAAO,CAAC,oBAAoB,KAAK,GAAG;AACtC"}