cdk-local 0.160.1 → 0.161.0

package/dist/docker-runner-CnXQIUjd.js

@@ -0,0 +1,1810 @@
+import { t as __exportAll } from "./rolldown-runtime-w6R9maHv.js";
+import { a as displayIdent, c as getEmbedConfig, s as displayToolOutput, t as getLogger } from "./logger-Co5XVwco.js";
+import { D as readEnvCallerCredentials, M as workloadStsClientConfig, N as buildProxyClientConfig, O as recordAssumedRole, S as SECOND_ASSUME_MESSAGE, T as assumedRoleRecorded, _ as resolveHostDefaultCredentials, l as effectiveLoopbackPorts, o as applyWorkloadAwsWiringToEnv, u as getActiveWorkloadAwsWiring } from "./workload-aws-wiring-BIxf0jtl.js";
+import { a as namesTheSameDirectory, d as flattenToOneLine, i as isPasteableCommandArg, l as describeAwsFailureForWarn, n as assemblyPathEscape, o as renderAssemblyPathEscape, r as displayUntrustedValue, s as resolveAssemblyPath, t as absoluteAssemblyPathEscape } from "./assembly-path-R96uhMm1.js";
+import { a as isDockerClientEnvKey, c as runDockerStreaming, i as getDockerCmd, l as spawnStreaming, n as finchSecretArgvRefusal, o as isMalformedEnvKey, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure } from "./docker-cmd-Cjg3jGYF.js";
+import { existsSync, readlinkSync, realpathSync } from "node:fs";
+import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
+import { createHash, randomBytes } from "node:crypto";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { homedir } from "node:os";
+import { execFile, spawn } from "node:child_process";
+import { createServer } from "node:net";
+import { StringDecoder } from "node:string_decoder";
+import { promisify } from "node:util";
+import { ECRClient, GetAuthorizationTokenCommand } from "@aws-sdk/client-ecr";
+
+//#region src/utils/profile-resolver.ts
+async function resolveProfileCredentials(profile) {
+	const sts = new STSClient(buildStsClientConfig({ profile }));
+	try {
+		const credsProvider = sts.config.credentials;
+		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
+		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) {
+			const ssoHint = isPasteableCommandArg(profile) ? "Check `aws sso login --profile " + profile + "` for SSO profiles" : "For an SSO profile, run `aws sso login` for that profile (the command is not written out because the name as rendered may not be the one your shell would act on)";
+			throw new Error(`--profile ${displayUntrustedValue(profile)}: credential provider chain resolved without usable credentials. ${ssoHint}, or check \`~/.aws/credentials\` / \`~/.aws/config\` for regular profiles.`);
+		}
+		let region;
+		try {
+			const regionProvider = sts.config.region;
+			const resolved = typeof regionProvider === "function" ? await regionProvider() : regionProvider;
+			if (typeof resolved === "string" && resolved.length > 0) region = resolved;
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			if (!(/region is missing/i.test(msg) || /could not resolve region/i.test(msg) || /no region in config/i.test(msg) || /region.*not.*set/i.test(msg))) throw err;
+			region = void 0;
+		}
+		return {
+			accessKeyId: creds.accessKeyId,
+			secretAccessKey: creds.secretAccessKey,
+			...creds.sessionToken && { sessionToken: creds.sessionToken },
+			...region && { region }
+		};
+	} finally {
+		sts.destroy();
+	}
+}
+function buildStsClientConfig(args) {
+	return {
+		...buildProxyClientConfig({ profile: args.profile }),
+		...args.region && { region: args.region },
+		...args.profile && { profile: args.profile }
+	};
+}
+
+//#endregion
+//#region src/utils/role-arn.ts
+const IAM_ROLE_ARN_MAX_LENGTH = 2048;
+const IAM_ROLE_ARN_PATTERN = /^arn:[A-Za-z0-9-]+:iam::[0-9]+:role\/[!-~]+$/;
+function isIamRoleArn(value) {
+	if (typeof value !== "string") return false;
+	if (value.length > 2048) return false;
+	return IAM_ROLE_ARN_PATTERN.test(value);
+}
+const REJECTED_ARN_PREVIEW_MAX = 128;
+function describeRejectedRoleArn(value) {
+	if (typeof value !== "string") return `a non-string ${typeof value} value`;
+	const points = [...flattenToOneLine(value)];
+	return `"${points.length <= REJECTED_ARN_PREVIEW_MAX ? points.join("") : `${points.slice(0, REJECTED_ARN_PREVIEW_MAX).join("")}...`}" (${points.length} characters)`;
+}
+function refusedRoleArnMessage(value) {
+	return `AssumeRole refused: the role ARN is not a well-formed IAM role ARN (expected arn:<partition>:iam::<account>:role/<name>, at most ${IAM_ROLE_ARN_MAX_LENGTH} characters): ${describeRejectedRoleArn(value)}. Nothing was sent to STS.`;
+}
+var AssumeRoleFailure = class AssumeRoleFailure extends Error {
+	detail;
+	constructor(message, detail) {
+		super(message);
+		this.name = "AssumeRoleFailure";
+		this.detail = detail;
+		Object.setPrototypeOf(this, AssumeRoleFailure.prototype);
+	}
+};
+async function assumeRoleCredentials(opts) {
+	if (!isIamRoleArn(opts.roleArn)) {
+		const detail = `the role ARN is not well-formed: ${describeRejectedRoleArn(opts.roleArn)}`;
+		const message = refusedRoleArnMessage(opts.roleArn);
+		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, detail);
+	}
+	const sts = new STSClient(workloadStsClientConfig({
+		region: opts.region,
+		profile: opts.profile
+	}));
+	const shownArn = flattenToOneLine(opts.roleArn);
+	let response;
+	try {
+		response = await sts.send(new AssumeRoleCommand({
+			RoleArn: opts.roleArn,
+			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-${opts.sessionNameSuffix}-${Date.now()}`,
+			DurationSeconds: 3600
+		}));
+	} catch (err) {
+		const detail = describeAwsFailureForWarn(err, "STS AssumeRole");
+		const message = `AssumeRole(${shownArn}) failed: ${detail}`;
+		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, detail);
+	} finally {
+		sts.destroy();
+	}
+	const creds = response.Credentials;
+	if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) {
+		const message = `AssumeRole(${shownArn}) returned no usable credentials.`;
+		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, "the response carried no usable credentials");
+	}
+	return {
+		accessKeyId: creds.AccessKeyId,
+		secretAccessKey: creds.SecretAccessKey,
+		sessionToken: creds.SessionToken
+	};
+}
+async function applyRoleArnIfSet(opts) {
+	const roleArn = opts.roleArn || process.env[`${getEmbedConfig().envPrefix}_ROLE_ARN`];
+	if (!roleArn) return;
+	if (!isIamRoleArn(roleArn)) throw new Error(refusedRoleArnMessage(roleArn));
+	if (assumedRoleRecorded() && getEmbedConfig().workloadIdentity === "caller") throw new Error(SECOND_ASSUME_MESSAGE);
+	const logger = getLogger().child("role-arn");
+	const shownArn = flattenToOneLine(roleArn);
+	logger.debug(`Assuming role ${shownArn}...`);
+	const sts = new STSClient(buildStsClientConfig({
+		region: opts.region,
+		profile: opts.profile
+	}));
+	let response;
+	try {
+		response = await sts.send(new AssumeRoleCommand({
+			RoleArn: roleArn,
+			RoleSessionName: `${getEmbedConfig().binaryName}-${Date.now()}`,
+			DurationSeconds: 3600
+		}));
+	} catch (err) {
+		throw new Error(`AssumeRole(${shownArn}) failed: ${describeAwsFailureForWarn(err, "STS AssumeRole")}`);
+	} finally {
+		sts.destroy();
+	}
+	if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${shownArn}`);
+	const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
+	if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${shownArn}`);
+	if (!assumedRoleRecorded()) recordAssumedRole(readEnvCallerCredentials(), {
+		accessKeyId: AccessKeyId,
+		secretAccessKey: SecretAccessKey,
+		sessionToken: SessionToken
+	});
+	process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
+	process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
+	process.env["AWS_SESSION_TOKEN"] = SessionToken;
+	logger.info(`Assumed role ${shownArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
+}
+
+//#endregion
+//#region src/utils/own-keys.ts
+function defineOwnKey(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
+}
+
+//#endregion
+//#region src/utils/error-handler.ts
+var CdkLocalError = class CdkLocalError extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.code = code;
+		this.cause = cause;
+		this.name = "CdkLocalError";
+		Object.setPrototypeOf(this, CdkLocalError.prototype);
+	}
+};
+var LocalInvokeBuildError = class LocalInvokeBuildError extends CdkLocalError {
+	constructor(message, cause) {
+		super(message, "LOCAL_INVOKE_BUILD_ERROR", cause);
+		this.name = "LocalInvokeBuildError";
+		Object.setPrototypeOf(this, LocalInvokeBuildError.prototype);
+	}
+};
+var RouteDiscoveryError = class RouteDiscoveryError extends CdkLocalError {
+	constructor(message, cause) {
+		super(message, "ROUTE_DISCOVERY_ERROR", cause);
+		this.name = "RouteDiscoveryError";
+		Object.setPrototypeOf(this, RouteDiscoveryError.prototype);
+	}
+};
+var LocalStartServiceError = class LocalStartServiceError extends CdkLocalError {
+	constructor(message, cause) {
+		super(message, "LOCAL_START_SERVICE_ERROR", cause);
+		this.name = "LocalStartServiceError";
+		Object.setPrototypeOf(this, LocalStartServiceError.prototype);
+	}
+};
+var TargetSelectionCancelledError = class TargetSelectionCancelledError extends CdkLocalError {
+	silent = true;
+	exitCode = 130;
+	constructor() {
+		super("Target selection cancelled.", "TARGET_SELECTION_CANCELLED");
+		this.name = "TargetSelectionCancelledError";
+		Object.setPrototypeOf(this, TargetSelectionCancelledError.prototype);
+	}
+};
+var InteractiveTtyRequiredError = class InteractiveTtyRequiredError extends CdkLocalError {
+	constructor(message) {
+		super(message, "INTERACTIVE_TTY_REQUIRED");
+		this.name = "InteractiveTtyRequiredError";
+		Object.setPrototypeOf(this, InteractiveTtyRequiredError.prototype);
+	}
+};
+function isCdkLocalError(error) {
+	return error instanceof CdkLocalError;
+}
+function formatError(error) {
+	if (isCdkLocalError(error)) {
+		let message = `${error.name}: ${error.message}`;
+		if (error.cause) message += `\nCaused by: ${error.cause.message}`;
+		return message;
+	}
+	if (error instanceof Error) return `${error.name}: ${error.message}`;
+	return String(error);
+}
+function handleError(error) {
+	const logger = getLogger();
+	if (!(error instanceof CdkLocalError && error.silent)) logger.error(formatError(error));
+	if (error instanceof Error && error.stack) logger.debug("Stack trace:", error.stack);
+	const customExitCode = error instanceof CdkLocalError ? error.exitCode : void 0;
+	const exitCode = typeof customExitCode === "number" ? customExitCode : 1;
+	process.exit(exitCode);
+}
+function withErrorHandling(fn) {
+	return async (...args) => {
+		try {
+			await fn(...args);
+		} catch (error) {
+			handleError(error);
+		}
+	};
+}
+
+//#endregion
+//#region src/local/intrinsic-image.ts
+function formatStateRemedy(context) {
+	if (context?.stateLoadFailureMessage) return `the state-source attempt failed: ${context.stateLoadFailureMessage}; verify the stack name (try --from-cfn-stack <deployed-name> if it differs from the synthesized name) and that --region / --profile target the right account`;
+	return "pass --from-cfn-stack to load the deployed stack state";
+}
+const PARTITION_TABLE = [
+	{
+		regionPrefix: "cn-",
+		partition: "aws-cn",
+		urlSuffix: "amazonaws.com.cn"
+	},
+	{
+		regionPrefix: "us-gov-",
+		partition: "aws-us-gov",
+		urlSuffix: "amazonaws.com"
+	},
+	{
+		regionPrefix: "us-isob-",
+		partition: "aws-iso-b",
+		urlSuffix: "sc2s.sgov.gov"
+	},
+	{
+		regionPrefix: "us-isof-",
+		partition: "aws-iso-f",
+		urlSuffix: "csp.hci.ic.gov"
+	},
+	{
+		regionPrefix: "us-iso-",
+		partition: "aws-iso",
+		urlSuffix: "c2s.ic.gov"
+	},
+	{
+		regionPrefix: "eu-isoe-",
+		partition: "aws-iso-e",
+		urlSuffix: "cloud.adc-e.uk"
+	},
+	{
+		regionPrefix: "eusc-",
+		partition: "aws-eusc",
+		urlSuffix: "amazonaws.eu"
+	}
+];
+function derivePartitionAndUrlSuffix(region) {
+	const normalized = region.toLowerCase();
+	for (const row of PARTITION_TABLE) if (normalized.startsWith(row.regionPrefix)) return {
+		partition: row.partition,
+		urlSuffix: row.urlSuffix
+	};
+	return {
+		partition: "aws",
+		urlSuffix: "amazonaws.com"
+	};
+}
+function derivePseudoParametersFromRegion(region, accountId) {
+	if (!region || typeof region !== "string" || region.length === 0) return void 0;
+	const { partition, urlSuffix } = derivePartitionAndUrlSuffix(region);
+	return {
+		...accountId !== void 0 && { accountId },
+		region,
+		partition,
+		urlSuffix
+	};
+}
+function tryResolveImageFnJoin(raw, resources, context) {
+	if (!raw || typeof raw !== "object") return { kind: "not-applicable" };
+	const arg = raw["Fn::Join"];
+	if (arg === void 0) return { kind: "not-applicable" };
+	if (!Array.isArray(arg) || arg.length !== 2 || !Array.isArray(arg[1])) return {
+		kind: "unsupported-join",
+		reason: "Fn::Join must be [delimiter, [elements]]"
+	};
+	const [delimiter, elements] = arg;
+	if (typeof delimiter !== "string") return {
+		kind: "unsupported-join",
+		reason: `Fn::Join delimiter must be a string, got ${typeof delimiter}`
+	};
+	const repoLogicalId = findEcrRepositoryRefInTree(elements, resources);
+	const stateResources = context?.stateResources;
+	if (repoLogicalId && !stateResources) return {
+		kind: "needs-state",
+		repoLogicalId
+	};
+	const parts = [];
+	for (const element of elements) {
+		const r = resolveImageIntrinsic(element, resources, context);
+		if (r === void 0) {
+			if (!repoLogicalId) return { kind: "not-applicable" };
+			return {
+				kind: "unsupported-join",
+				reason: "one or more Fn::Join elements could not be resolved"
+			};
+		}
+		parts.push(r);
+	}
+	return {
+		kind: "resolved",
+		uri: parts.join(delimiter)
+	};
+}
+function findEcrRepositoryRefInTree(node, resources) {
+	if (node === null || node === void 0) return void 0;
+	if (typeof node === "string" || typeof node === "number" || typeof node === "boolean") return;
+	if (Array.isArray(node)) {
+		for (const item of node) {
+			const hit = findEcrRepositoryRefInTree(item, resources);
+			if (hit) return hit;
+		}
+		return;
+	}
+	if (typeof node !== "object") return void 0;
+	const obj = node;
+	if (typeof obj["Ref"] === "string") {
+		const target = obj["Ref"];
+		if (resources[target]?.Type === "AWS::ECR::Repository") return target;
+		return;
+	}
+	const getAtt = obj["Fn::GetAtt"];
+	if (getAtt !== void 0) {
+		let lid;
+		if (Array.isArray(getAtt) && typeof getAtt[0] === "string") lid = getAtt[0];
+		else if (typeof getAtt === "string") lid = getAtt.split(".")[0];
+		if (lid && resources[lid]?.Type === "AWS::ECR::Repository") return lid;
+		return;
+	}
+	for (const value of Object.values(obj)) {
+		const hit = findEcrRepositoryRefInTree(value, resources);
+		if (hit) return hit;
+	}
+}
+function resolveImageIntrinsic(node, resources, context) {
+	const v = resolveImageIntrinsicAny(node, resources, context);
+	if (typeof v === "string") return v;
+	if (typeof v === "number" || typeof v === "boolean") return String(v);
+}
+function resolveImageIntrinsicAny(node, resources, context) {
+	if (node === null || node === void 0) return void 0;
+	if (typeof node === "string" || typeof node === "number" || typeof node === "boolean") return node;
+	if (Array.isArray(node)) return;
+	if (typeof node !== "object") return void 0;
+	const obj = node;
+	const keys = Object.keys(obj);
+	if (keys.length !== 1) return void 0;
+	const intrinsic = keys[0];
+	const arg = obj[intrinsic];
+	if (intrinsic === "Ref") {
+		if (typeof arg !== "string") return void 0;
+		if (arg.startsWith("AWS::")) {
+			const p = context?.pseudoParameters;
+			if (!p) return void 0;
+			if (arg === "AWS::URLSuffix") return p.urlSuffix;
+			if (arg === "AWS::Partition") return p.partition;
+			if (arg === "AWS::Region") return p.region;
+			if (arg === "AWS::AccountId") return p.accountId;
+			return;
+		}
+		if (resources[arg]?.Type !== "AWS::ECR::Repository") return void 0;
+		const stateEntry = context?.stateResources?.[arg];
+		if (!stateEntry) return void 0;
+		return stateEntry.physicalId;
+	}
+	if (intrinsic === "Fn::GetAtt") {
+		let logicalId;
+		let attr;
+		if (Array.isArray(arg) && arg.length === 2 && typeof arg[0] === "string" && typeof arg[1] === "string") {
+			logicalId = arg[0];
+			attr = arg[1];
+		} else if (typeof arg === "string") {
+			const dot = arg.indexOf(".");
+			if (dot > 0 && dot < arg.length - 1) {
+				logicalId = arg.slice(0, dot);
+				attr = arg.slice(dot + 1);
+			}
+		}
+		if (!logicalId || !attr) return void 0;
+		if (resources[logicalId]?.Type !== "AWS::ECR::Repository") return void 0;
+		const cached = context?.stateResources?.[logicalId]?.attributes?.[attr];
+		if (typeof cached === "string" && cached.length > 0) return cached;
+		const physicalId = context?.stateResources?.[logicalId]?.physicalId;
+		const p = context?.pseudoParameters;
+		if (physicalId && p?.region && p.accountId) {
+			if (attr === "Arn" && p.partition) return `arn:${p.partition}:ecr:${p.region}:${p.accountId}:repository/${physicalId}`;
+			if (attr === "RepositoryUri" && p.urlSuffix) return `${p.accountId}.dkr.ecr.${p.region}.${p.urlSuffix}/${physicalId}`;
+		}
+		return;
+	}
+	if (intrinsic === "Fn::Split") {
+		if (!Array.isArray(arg) || arg.length !== 2) return void 0;
+		const argArr = arg;
+		const delim = argArr[0];
+		if (typeof delim !== "string") return void 0;
+		const src = resolveImageIntrinsicAny(argArr[1], resources, context);
+		if (typeof src !== "string") return void 0;
+		return src.split(delim);
+	}
+	if (intrinsic === "Fn::Select") {
+		if (!Array.isArray(arg) || arg.length !== 2) return void 0;
+		const argArr = arg;
+		const rawIndex = argArr[0];
+		let index;
+		if (typeof rawIndex === "number") index = rawIndex;
+		else if (typeof rawIndex === "string" && /^-?\d+$/.test(rawIndex)) index = Number.parseInt(rawIndex, 10);
+		if (index === void 0 || !Number.isFinite(index)) return void 0;
+		const list = resolveImageIntrinsicAny(argArr[1], resources, context);
+		if (Array.isArray(list)) {
+			if (index < 0 || index >= list.length) return void 0;
+			const picked = list[index];
+			if (typeof picked === "string") return picked;
+			return;
+		}
+		if (Array.isArray(argArr[1])) {
+			const listLiteral = argArr[1];
+			if (index < 0 || index >= listLiteral.length) return void 0;
+			return resolveImageIntrinsic(listLiteral[index], resources, context);
+		}
+		return;
+	}
+	if (intrinsic === "Fn::Join") {
+		if (!Array.isArray(arg) || arg.length !== 2) return void 0;
+		const [delim, parts] = arg;
+		if (typeof delim !== "string" || !Array.isArray(parts)) return void 0;
+		const resolved = [];
+		for (const part of parts) {
+			const r = resolveImageIntrinsic(part, resources, context);
+			if (r === void 0) return void 0;
+			resolved.push(r);
+		}
+		return resolved.join(delim);
+	}
+	if (intrinsic === "Fn::Sub") {
+		let template;
+		if (typeof arg === "string") template = arg;
+		else if (Array.isArray(arg) && typeof arg[0] === "string") template = arg[0];
+		if (template === void 0) return void 0;
+		const out = substituteImagePlaceholders(template, resources, context);
+		if (out.includes("${")) return void 0;
+		return out;
+	}
+}
+function substituteImagePlaceholders(flat, resources, context) {
+	if (!flat.includes("${")) return flat;
+	return flat.replace(/\$\{([^}]+)\}/g, (full, key) => {
+		if (context?.pseudoParameters) {
+			if (key === "AWS::AccountId" && context.pseudoParameters.accountId) return context.pseudoParameters.accountId;
+			if (key === "AWS::Region" && context.pseudoParameters.region) return context.pseudoParameters.region;
+			if (key === "AWS::Partition" && context.pseudoParameters.partition) return context.pseudoParameters.partition;
+			if (key === "AWS::URLSuffix" && context.pseudoParameters.urlSuffix) return context.pseudoParameters.urlSuffix;
+		}
+		if (context?.stateResources) {
+			const dot = key.indexOf(".");
+			const logicalId = dot === -1 ? key : key.slice(0, dot);
+			const refResource = resources[logicalId];
+			const stateEntry = context.stateResources[logicalId];
+			if (refResource?.Type === "AWS::ECR::Repository" && stateEntry) {
+				if (dot === -1) return stateEntry.physicalId;
+				const attr = key.slice(dot + 1);
+				const cached = stateEntry.attributes?.[attr];
+				if (typeof cached === "string") return cached;
+			}
+		}
+		return full;
+	});
+}
+
+//#endregion
+//#region src/local/ecr-uri.ts
+const FIPS_AND_DUAL_STACK_PARTITIONS = ["aws", "aws-us-gov"];
+const ECR_REGISTRY_HOST_FORMS = [
+	{ labels: "dkr.ecr" },
+	{
+		labels: "dkr.ecr-fips",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	},
+	{
+		labels: "dkr-ecr",
+		fixedUrlSuffix: "on.aws",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	},
+	{
+		labels: "dkr-ecr-fips",
+		fixedUrlSuffix: "on.aws",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	}
+];
+const ECR_HOST_FORM_BY_LABELS = new Map(ECR_REGISTRY_HOST_FORMS.map((f) => [f.labels, f]));
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+const ECR_URI_HOST_REGEX = new RegExp(`^(\\d{12})\\.(${[...ECR_REGISTRY_HOST_FORMS].sort((a, b) => b.labels.length - a.labels.length).map((f) => escapeRegExp(f.labels)).join("|")})\\.([^./]+)\\.([^/]+)/`, "i");
+const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+const REGION_SHAPE = /^(?:(?:us|eu|ap|sa|ca|me|af|il|mx)-[a-z0-9]+-[0-9]+|cn-[a-z0-9]+-[0-9]+|us-gov-[a-z0-9]+-[0-9]+|us-iso-[a-z0-9]+-[0-9]+|us-isob-[a-z0-9]+-[0-9]+|eu-isoe-[a-z0-9]+-[0-9]+|us-isof-[a-z0-9]+-[0-9]+|eusc-[a-z]+-[a-z0-9]+-[0-9]+)$/;
+const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
+function foldAsciiUpperCase(value) {
+	return value.replace(/[A-Z]+/g, (run) => run.toLowerCase());
+}
+function isRegistryHostComponent(component) {
+	return component.includes(".") || component.includes(":") || component === "localhost";
+}
+function canonicalizeImageUriHost(imageUri) {
+	const slash = imageUri.indexOf("/");
+	if (slash < 0) return imageUri;
+	const host = imageUri.slice(0, slash);
+	if (!isRegistryHostComponent(host)) return imageUri;
+	return foldAsciiUpperCase(host) + imageUri.slice(slash);
+}
+function parseEcrRegistryHost(imageUri) {
+	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	if (!m) return void 0;
+	const [, accountId, rawLabels, rawRegion, rawSuffix] = m;
+	if (!CANONICAL_REGION_SEGMENT.test(rawRegion)) return void 0;
+	if (!CANONICAL_URL_SUFFIX.test(rawSuffix)) return void 0;
+	const form = ECR_HOST_FORM_BY_LABELS.get(foldAsciiUpperCase(rawLabels));
+	if (!form) return void 0;
+	const region = foldAsciiUpperCase(rawRegion);
+	if (!REGION_SHAPE.test(region)) return void 0;
+	const suffix = foldAsciiUpperCase(rawSuffix);
+	const partition = derivePartitionAndUrlSuffix(region);
+	if (form.partitions && !form.partitions.includes(partition.partition)) return void 0;
+	if (suffix !== (form.fixedUrlSuffix ?? partition.urlSuffix)) return void 0;
+	return {
+		accountId,
+		region,
+		registryHost: `${accountId}.${form.labels}.${region}.${suffix}`,
+		form
+	};
+}
+
+//#endregion
+//#region src/utils/docker-argv-redaction.ts
+const REDACTED_ARGV_VALUE = "***";
+const ARGV_VALUE_BEARING_FLAGS = /* @__PURE__ */ new Set([
+	"-e",
+	"--env",
+	"--opt",
+	"--label",
+	"--build-arg"
+]);
+const ARGV_PARAM_LIST_FLAGS = /* @__PURE__ */ new Set(["--cache-from", "--cache-to"]);
+const ARGV_PARAM_LIST_LOCATOR_PARAMS = /* @__PURE__ */ new Set([
+	"type",
+	"mode",
+	"compression",
+	"compression-level",
+	"force-compression",
+	"ignore-error",
+	"image-manifest",
+	"oci-mediatypes",
+	"timeout",
+	"ref",
+	"dest",
+	"src",
+	"digest",
+	"tag",
+	"region",
+	"bucket",
+	"name",
+	"prefix",
+	"manifests_prefix",
+	"blobs_prefix",
+	"use_path_style",
+	"upload_parallelism",
+	"touch_refresh",
+	"account_name",
+	"scope"
+]);
+const ARGV_PARAM_LIST_URL_PARAMS = /* @__PURE__ */ new Set([
+	"account_url",
+	"endpoint_url",
+	"url",
+	"url_v2"
+]);
+function redactUrlLocator(value) {
+	if (value === "") return value;
+	const authority = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\//.exec(value);
+	if (authority === null) return REDACTED_ARGV_VALUE;
+	const prefix = authority[0];
+	let rest = value.slice(prefix.length);
+	const lastAt = rest.lastIndexOf("@");
+	if (lastAt >= 0) rest = `${REDACTED_ARGV_VALUE}${rest.slice(lastAt)}`;
+	else {
+		const host = rest.split(/[/?#]/)[0];
+		const ipv6 = /^\[[0-9A-Fa-f:.]+\]/.exec(host);
+		const bare = ipv6 ? host.slice(ipv6[0].length) : host;
+		if (/:(?!\d{1,5}$)/.test(bare)) return REDACTED_ARGV_VALUE;
+	}
+	for (const delimiter of ["?", "#"]) {
+		const at = rest.indexOf(delimiter);
+		if (at >= 0) rest = `${rest.slice(0, at)}${delimiter}${REDACTED_ARGV_VALUE}`;
+	}
+	return `${prefix}${rest}`;
+}
+function maskArgvFlagValue(flag, value) {
+	if (ARGV_VALUE_BEARING_FLAGS.has(flag)) {
+		const eqIdx = value.indexOf("=");
+		return eqIdx >= 0 ? `${value.substring(0, eqIdx)}=${REDACTED_ARGV_VALUE}` : void 0;
+	}
+	if (ARGV_PARAM_LIST_FLAGS.has(flag)) {
+		let masked = false;
+		const rawParts = value.split(",");
+		const parts = rawParts.map((part, index) => {
+			if (part === "") return part;
+			if (masked) return REDACTED_ARGV_VALUE;
+			const eqIdx = part.indexOf("=");
+			if (eqIdx < 0) {
+				if (index === 0) return part;
+				masked = true;
+				return REDACTED_ARGV_VALUE;
+			}
+			const name = part.substring(0, eqIdx);
+			const normalized = name.trim().toLowerCase();
+			if (ARGV_PARAM_LIST_URL_PARAMS.has(normalized)) {
+				if (rawParts.slice(index + 1).some((later) => later.includes("@"))) {
+					masked = true;
+					return `${name}=${REDACTED_ARGV_VALUE}`;
+				}
+				const rawUrl = part.substring(eqIdx + 1);
+				const safeUrl = redactUrlLocator(rawUrl);
+				if (safeUrl === rawUrl) return part;
+				masked = true;
+				return `${name}=${safeUrl}`;
+			}
+			if (ARGV_PARAM_LIST_LOCATOR_PARAMS.has(normalized)) return part;
+			masked = true;
+			return `${name}=${REDACTED_ARGV_VALUE}`;
+		});
+		return masked ? parts.join(",") : void 0;
+	}
+}
+function maskAttachedShortFlag(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	let chosen;
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) {
+		if (flag.length !== 2 || !flag.startsWith("-") || flag[1] === "-") continue;
+		const at = arg.indexOf(flag[1], 1);
+		if (at < 0 || at === arg.length - 1) continue;
+		if (chosen === void 0 || at < chosen.at) chosen = {
+			at,
+			flag
+		};
+	}
+	if (chosen === void 0) return void 0;
+	const masked = maskArgvFlagValue(chosen.flag, arg.slice(chosen.at + 1));
+	return masked === void 0 ? void 0 : `${arg.slice(0, chosen.at + 1)}${masked}`;
+}
+function trailingShortFlagOfCluster(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	const last = arg[arg.length - 1];
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) if (flag.length === 2 && flag.startsWith("-") && flag[1] !== "-" && flag[1] === last) return flag;
+}
+function redactDockerArgvValues(args) {
+	const out = [];
+	for (let i = 0; i < args.length; i++) {
+		const cur = args[i];
+		const joinedEq = cur.indexOf("=");
+		if (joinedEq > 0) {
+			const maskedJoined = maskArgvFlagValue(cur.substring(0, joinedEq), cur.substring(joinedEq + 1));
+			if (maskedJoined !== void 0) {
+				out.push(`${cur.substring(0, joinedEq)}=${maskedJoined}`);
+				continue;
+			}
+		}
+		const maskedAttached = maskAttachedShortFlag(cur);
+		if (maskedAttached !== void 0) {
+			out.push(maskedAttached);
+			continue;
+		}
+		const next = args[i + 1];
+		if (typeof next === "string") {
+			const maskedNext = maskArgvFlagValue(ARGV_VALUE_BEARING_FLAGS.has(cur) ? cur : trailingShortFlagOfCluster(cur) ?? cur, next);
+			if (maskedNext !== void 0) {
+				out.push(cur, maskedNext);
+				i++;
+				continue;
+			}
+		}
+		out.push(cur);
+	}
+	return out;
+}
+function describeExitWithoutArgv(err) {
+	const e = err;
+	if (typeof e?.signal === "string" && e.signal !== "") return `killed by ${e.signal}`;
+	if (typeof e?.code === "number") return `exited with code ${e.code}`;
+	if (typeof e?.code === "string" && e.code !== "") return `failed (${e.code})`;
+	return "failed with no output";
+}
+
+//#endregion
+//#region src/assets/asset-source-path.ts
+function resolveAssetSourcePath(opts) {
+	const { manifestDir, value, assetOutdir, field, subject, action, wrapError } = opts;
+	const shownValue = displayUntrustedValue(value);
+	if (isAbsolute(value) && opts.absolute !== "fold") {
+		const absolute = resolve(value);
+		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
+		if (escape !== void 0 && opts.absolute === "honour") throw wrapError(`${subject} has an absolute ${field}=${shownValue} which ` + renderAssemblyPathEscape(escape, assetOutdir, action));
+		if (escape !== void 0) {
+			const refusal = originScopeRefusal(absolute, assetOutdir);
+			if (refusal !== void 0) throw wrapError(`${subject} has an absolute ${field}=${shownValue} which ${refusal}. An absolute ${field} is accepted only as a cdk synth --no-staging source folder: a directory inside your project (the git work tree holding the output directory, or the current directory when it contains the output directory or is a git work-tree root), not under a credential or version-control directory. Refusing to ${action}.`);
+			warnAbsoluteOutsideAssembly(opts, absolute, escape);
+			return absolute;
+		}
+		if (namesTheSameDirectory(assetOutdir, absolute)) warnWholeAssemblyAsSource(opts, absolute);
+		return absolute;
+	}
+	const resolved = resolveAssemblyPath(manifestDir, value, { containWithin: assetOutdir });
+	if (resolved.contained) return resolved.path;
+	if (namesTheSameDirectory(assetOutdir, resolved.path)) {
+		warnWholeAssemblyAsSource(opts, resolved.path);
+		return resolved.path;
+	}
+	throw wrapError(`${subject} has ${field}=${shownValue} which ` + renderAssemblyPathEscape(resolved, assetOutdir, action));
+}
+function broadRootReason(root, assetOutdir) {
+	if (root === resolve("/")) return "names the filesystem root";
+	if (containsOrIs(root, realPath(homedir()))) return "names your home directory or a directory containing it";
+	if (containsOrIs(root, realPath(assetOutdir))) return "names a directory containing the app's output directory";
+}
+function originScopeRefusal(absolute, assetOutdir) {
+	const root = realPath(absolute);
+	const broad = broadRootReason(root, assetOutdir);
+	if (broad !== void 0) return broad;
+	const projects = projectRoots(assetOutdir);
+	let hidden;
+	let isProjectRoot = false;
+	for (const project of projects) {
+		const rel = relative(project, root);
+		if (rel === "") isProjectRoot = true;
+		if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) continue;
+		const dotted = rel.split(sep).find((c) => CREDENTIAL_DIR_NAMES.has(c.toLowerCase()));
+		if (dotted === void 0) return void 0;
+		hidden = dotted;
+	}
+	if (isProjectRoot) return "is your project root itself; name a folder inside it";
+	if (hidden !== void 0) return `passes through the credential / version-control directory ${displayUntrustedValue(hidden)} inside your project`;
+	const shown = projects.map((p) => displayUntrustedValue(p)).join(" or ");
+	return projects.length === 0 ? "is outside any usable project root (the current directory and the git work tree are too broad to scope it)" : `resolves to ${displayUntrustedValue(root)}, outside your project (${shown})`;
+}
+const CREDENTIAL_DIR_NAMES = /* @__PURE__ */ new Set([
+	".git",
+	".hg",
+	".svn",
+	".ssh",
+	".aws",
+	".gnupg",
+	".docker",
+	".kube",
+	".config",
+	".azure",
+	".gcloud",
+	".terraform",
+	".npm",
+	".pnpm-store",
+	".yarn",
+	".cache",
+	".local"
+]);
+function projectRoots(assetOutdir) {
+	const roots = [];
+	const usable = (p) => p !== resolve("/") && !containsOrIs(p, realPath(homedir()));
+	const cwd = realPath(process.cwd());
+	const outdir = realPath(assetOutdir);
+	if (usable(cwd) && (containsOrIs(cwd, outdir) || existsSync(join(cwd, ".git")))) roots.push(cwd);
+	let dir = outdir;
+	for (;;) {
+		if (existsSync(join(dir, ".git"))) {
+			if (usable(dir) && !roots.includes(dir)) roots.push(dir);
+			break;
+		}
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return roots;
+}
+function containsOrIs(outer, inner) {
+	const rel = relative(outer, inner);
+	return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function realPath(p, hops = 0) {
+	const abs = resolve(p);
+	try {
+		return realpathSync.native(abs);
+	} catch {
+		const parent = dirname(abs);
+		if (parent === abs) return abs;
+		const realParent = realPath(parent, hops);
+		let link;
+		try {
+			link = readlinkSync(abs);
+		} catch {
+			link = void 0;
+		}
+		if (link !== void 0 && hops < 40) return realPath(resolve(realParent, link), hops + 1);
+		return join(realParent, basename(abs));
+	}
+}
+const warnedAbsoluteOutside = /* @__PURE__ */ new Set();
+function warnAbsoluteOutsideAssembly(opts, absolute, escape) {
+	const logger = getLogger().child("assets");
+	const line = `${opts.subject} has an absolute ${opts.field} pointing outside the assembly: ` + displayUntrustedValue(absolute) + (escape.escape === "symlink" ? ` (through a symbolic link to ${displayUntrustedValue(escape.realPath)})` : "") + `. ${getEmbedConfig().productName} will ${opts.sink}. ` + (escape.escape === "lexical" ? "This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted." : "No CDK synth writes this, so treat this assembly as untrusted unless you made that link yourself.");
+	if (warnedAbsoluteOutside.has(line)) {
+		logger.debug(line);
+		return;
+	}
+	warnedAbsoluteOutside.add(line);
+	logger.warn(line);
+}
+const warnedWholeAssembly = /* @__PURE__ */ new Set();
+function warnWholeAssemblyAsSource(opts, outdir) {
+	const logger = getLogger().child("assets");
+	const line = `${opts.subject} has ${opts.field} naming the assembly's output directory ITSELF: ${displayUntrustedValue(outdir)}. ${getEmbedConfig().productName} will ${opts.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`;
+	if (warnedWholeAssembly.has(line)) {
+		logger.debug(line);
+		return;
+	}
+	warnedWholeAssembly.add(line);
+	logger.warn(line);
+}
+
+//#endregion
+//#region src/assets/docker-cache-option.ts
+function cacheOptionToFlag(option) {
+	let flag = `type=${option.type}`;
+	if (option.params) for (const [k, v] of Object.entries(option.params)) flag += `,${k}=${v}`;
+	return flag;
+}
+
+//#endregion
+//#region src/assets/buildkit-passthrough-warnings.ts
+function candidateHostPaths(value, opts) {
+	const out = [];
+	for (const part of value.split(",")) {
+		const eq = part.indexOf("=");
+		if (eq < 0) {
+			const bare = part.trim();
+			if (bare.length > 0) out.push({
+				path: bare,
+				write: opts.bareIsWrite
+			});
+			continue;
+		}
+		const key = part.slice(0, eq).trim().toLowerCase();
+		const v = part.slice(eq + 1).trim();
+		if (v.length === 0) continue;
+		if (key !== "src" && key !== "source" && key !== "dest") continue;
+		out.push({
+			path: v,
+			write: key === "dest"
+		});
+	}
+	return out;
+}
+function hostPathsOf(source) {
+	const refs = [];
+	if (source.dockerFile) refs.push({
+		field: "dockerFile",
+		where: "dockerFile",
+		path: source.dockerFile,
+		write: false
+	});
+	for (const [k, v] of Object.entries(source.dockerBuildContexts ?? {})) {
+		const rendered = `${k}=${v}`;
+		const contextPath = rendered.slice(rendered.indexOf("=") + 1).trim().replace(/^oci-layout:\/\//, "");
+		if (contextPath.length === 0) continue;
+		refs.push({
+			field: "dockerBuildContexts",
+			where: k,
+			path: contextPath,
+			write: false
+		});
+	}
+	const ssh = source.dockerBuildSsh ?? "";
+	const sshEq = ssh.indexOf("=");
+	(sshEq < 0 ? [] : ssh.slice(sshEq + 1).split(",")).forEach((entry, i) => {
+		const p = entry.trim();
+		if (p.length > 0) refs.push({
+			field: "dockerBuildSsh",
+			where: String(i),
+			path: p,
+			write: false
+		});
+	});
+	for (const [k, v] of Object.entries(source.dockerBuildSecrets ?? {})) for (const { path: p, write } of candidateHostPaths(`id=${k},${v}`, { bareIsWrite: false })) refs.push({
+		field: "dockerBuildSecrets",
+		where: k,
+		path: p,
+		write
+	});
+	(source.cacheFrom ?? []).forEach((c, i) => {
+		for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(c), { bareIsWrite: false })) refs.push({
+			field: "cacheFrom",
+			where: String(i),
+			path: p,
+			write
+		});
+	});
+	if (source.cacheTo) for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(source.cacheTo), { bareIsWrite: false })) refs.push({
+		field: "cacheTo",
+		where: "cacheTo",
+		path: p,
+		write
+	});
+	(source.dockerOutputs ?? []).forEach((o, i) => {
+		for (const { path: p, write } of candidateHostPaths(o, { bareIsWrite: true })) refs.push({
+			field: "dockerOutputs",
+			where: String(i),
+			path: p,
+			write
+		});
+	});
+	return refs;
+}
+const warnedPassthroughs = /* @__PURE__ */ new Set();
+function warnEscapingBuildKitPaths(source, base, bound) {
+	const logger = getLogger().child("assets");
+	for (const ref of hostPathsOf(source)) {
+		const escape = assemblyPathEscape(base, bound, ref.path);
+		if (escape === void 0) continue;
+		const verb = ref.write ? "WRITE to" : "read";
+		const line = `Docker asset ${ref.field}` + (ref.where === ref.field ? "" : `[${displayUntrustedValue(ref.where)}]`) + ` names a host path outside the assembly, which ` + renderAssemblyPathEscape(escape, bound, "load", `${getEmbedConfig().productName} will ${verb} it during the image build, matching the CDK CLI — a pre-synthesized assembly is trusted input. If you did not produce this assembly, that is a host path it chose and the CloudFormation template does not show.`);
+		if (warnedPassthroughs.has(line)) {
+			logger.debug(line);
+			continue;
+		}
+		warnedPassthroughs.add(line);
+		logger.warn(line);
+	}
+}
+
+//#endregion
+//#region src/assets/docker-build.ts
+const warnedExecutables = /* @__PURE__ */ new Set();
+function warnManifestExecutable(cmd, executable, cwd) {
+	const logger = getLogger().child("docker-build");
+	const key = JSON.stringify([cwd, executable]);
+	if (warnedExecutables.has(key)) {
+		logger.debug(`source.executable already announced this process: ${displayUntrustedValue(cmd)} (cwd=${displayUntrustedValue(cwd)})`);
+		return;
+	}
+	warnedExecutables.add(key);
+	const argCount = executable.length - 1;
+	logger.warn(`Docker asset source.executable runs a command this asset manifest chose, on this machine: ${displayUntrustedValue(cmd)}` + (argCount > 0 ? ` (with ${argCount} argument(s); --verbose shows them)` : "") + `. ${getEmbedConfig().productName} runs it, matching the CDK CLI — a pre-synthesized assembly is trusted input. Note that this means running a local command against a pre-synthesized assembly DOES execute code from it, which the CloudFormation template does not show.`);
+}
+async function buildDockerImage(asset, cdkOutDir, options) {
+	const source = asset.source;
+	const logger = getLogger().child("docker-build");
+	const assetOutdir = options.assetOutdir ?? cdkOutDir;
+	const contextDirectory = (directory, sink) => resolveAssetSourcePath({
+		manifestDir: cdkOutDir,
+		value: directory,
+		assetOutdir,
+		absolute: "fold",
+		field: "source.directory",
+		subject: "Docker image asset",
+		action: "build it",
+		sink,
+		wrapError: (message) => new LocalInvokeBuildError(message)
+	});
+	if (source.executable && source.executable.length > 0) {
+		const [cmd, ...args] = source.executable;
+		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
+		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
+		logger.debug(`Building Docker image via executable: ${displayUntrustedValue(redactDockerArgvValues(source.executable).join(" "))} (cwd=${displayUntrustedValue(cwd)})`);
+		warnManifestExecutable(cmd, source.executable, cwd);
+		let result;
+		try {
+			result = await spawnStreaming(cmd, args, { cwd });
+		} catch (err) {
+			const e = err;
+			throw options.wrapError(displayToolOutput(e.stderr || e.message || String(err)));
+		}
+		const tag = result.stdout.trim();
+		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${displayUntrustedValue(cmd)}`);
+		return tag;
+	}
+	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (fields present: ${displayUntrustedValue(Object.keys(source).join(", ") || "none")})`);
+	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
+	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
+	const contextDir = contextDirectory(source.directory, `send that directory to docker build as the context of an image ${getEmbedConfig().productName} then runs locally`);
+	buildArgs.push(".");
+	warnEscapingBuildKitPaths(source, contextDir, assetOutdir);
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).map((a) => displayUntrustedValue(a)).join(" ")} (cwd=${displayUntrustedValue(contextDir)})`);
+	try {
+		await runDockerStreaming(buildArgs, {
+			cwd: contextDir,
+			env: { BUILDX_NO_DEFAULT_ATTESTATIONS: "1" },
+			...options.progressLabel !== void 0 && { progressLabel: options.progressLabel }
+		});
+	} catch (err) {
+		const e = err;
+		throw options.wrapError(displayToolOutput(e.stderr || e.message || String(err)));
+	}
+	return options.tag;
+}
+function buildDockerBuildCommand(source, tag, platformOverride) {
+	const args = [
+		"build",
+		"--tag",
+		tag
+	];
+	if (source.dockerBuildArgs) for (const [k, v] of Object.entries(source.dockerBuildArgs)) args.push("--build-arg", `${k}=${v}`);
+	if (source.dockerBuildContexts) for (const [k, v] of Object.entries(source.dockerBuildContexts)) args.push("--build-context", `${k}=${v}`);
+	if (source.dockerBuildSecrets) for (const [k, v] of Object.entries(source.dockerBuildSecrets)) args.push("--secret", `id=${k},${v}`);
+	if (source.dockerBuildSsh) args.push("--ssh", source.dockerBuildSsh);
+	if (source.dockerBuildTarget) args.push("--target", source.dockerBuildTarget);
+	if (source.dockerFile) args.push("--file", source.dockerFile);
+	if (source.networkMode) args.push("--network", source.networkMode);
+	const platform = platformOverride ?? source.platform;
+	if (platform) args.push("--platform", platform);
+	if (source.dockerOutputs) for (const output of source.dockerOutputs) args.push(`--output=${output}`);
+	if (source.cacheFrom) for (const c of source.cacheFrom) args.push("--cache-from", cacheOptionToFlag(c));
+	if (source.cacheTo) args.push("--cache-to", cacheOptionToFlag(source.cacheTo));
+	if (source.cacheDisabled) args.push("--no-cache");
+	return args;
+}
+
+//#endregion
+//#region src/local/ecr-puller.ts
+function parseEcrUri(imageUri) {
+	const host = parseEcrRegistryHost(imageUri);
+	if (!host) return void 0;
+	const canonicalUri = canonicalizeImageUriHost(imageUri);
+	const m = /^([^:]+):(.+)$/.exec(canonicalUri.slice(canonicalUri.indexOf("/") + 1));
+	if (!m) return void 0;
+	return {
+		accountId: host.accountId,
+		region: host.region,
+		repository: m[1],
+		tag: m[2],
+		canonicalUri,
+		registryHost: host.registryHost
+	};
+}
+const ASSUMED_ROLE_CACHE = /* @__PURE__ */ new Map();
+const CALLER_IDENTITY_CACHE = /* @__PURE__ */ new Map();
+const STS_CREDENTIAL_SAFETY_MARGIN_MS = 300 * 1e3;
+function isCredentialFresh(creds) {
+	if (!creds.expiration) return false;
+	return creds.expiration.getTime() - Date.now() > STS_CREDENTIAL_SAFETY_MARGIN_MS;
+}
+async function pullEcrImage(imageUri, options) {
+	const logger = getLogger().child("ecr-puller");
+	const parsed = parseEcrUri(imageUri);
+	if (!parsed) throw new LocalInvokeBuildError(`Image URI ${displayUntrustedValue(imageUri)} is not an ECR URI. ${getEmbedConfig().cliName} invoke v1 only authenticates against ECR for the deployed-image fallback path.`);
+	const canonicalUri = parsed.canonicalUri;
+	const callerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
+	if (options.skipPull) {
+		logger.info(`Skipping ECR pull (--no-pull). Verifying ${canonicalUri} is in local cache...`);
+		await verifyImageInLocalCache(canonicalUri);
+		return canonicalUri;
+	}
+	const callerIdentityKey = `${options.profile ?? "_noprofile"}|${callerRegion ?? "_unset"}`;
+	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
+	if (callerAccount === void 0) {
+		const sts = new STSClient(buildStsClientConfig({
+			region: callerRegion,
+			profile: options.profile
+		}));
+		try {
+			const identity = await sts.send(new GetCallerIdentityCommand({}));
+			if (!identity.Account) throw new LocalInvokeBuildError("STS GetCallerIdentity returned no Account. Verify your AWS credentials.");
+			callerAccount = identity.Account;
+			CALLER_IDENTITY_CACHE.set(callerIdentityKey, callerAccount);
+		} catch (err) {
+			if (err instanceof LocalInvokeBuildError) throw err;
+			throw new LocalInvokeBuildError(`STS GetCallerIdentity failed while preparing the ECR pull: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity (ECR pull)")}. Verify your AWS credentials.`);
+		} finally {
+			sts.destroy();
+		}
+	}
+	const crossAccount = callerAccount !== parsed.accountId;
+	const crossRegion = callerRegion !== void 0 && callerRegion !== parsed.region;
+	let assumed;
+	if (options.ecrRoleArn) {
+		const cacheKey = `${options.profile ?? "_noprofile"}|${options.ecrRoleArn}|${callerRegion ?? "_unset"}`;
+		const cached = ASSUMED_ROLE_CACHE.get(cacheKey);
+		if (cached && isCredentialFresh(cached)) {
+			assumed = cached;
+			logger.debug(`Reusing cached AssumeRole credentials for ${options.ecrRoleArn}`);
+		} else {
+			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, options.profile, logger);
+			ASSUMED_ROLE_CACHE.set(cacheKey, assumed);
+			logger.info(`Assumed role ${options.ecrRoleArn} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
+		}
+	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
+	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
+	const ecr = new ECRClient({
+		...buildProxyClientConfig({ profile: options.profile }),
+		region: parsed.region,
+		...assumed ? { credentials: assumed } : options.profile ? { profile: options.profile } : {}
+	});
+	try {
+		await ecrLogin(ecr, {
+			accountId: parsed.accountId,
+			region: parsed.region,
+			registryHost: parsed.registryHost
+		});
+	} finally {
+		ecr.destroy();
+	}
+	logger.info(`Pulling ${canonicalUri}...`);
+	try {
+		await runDockerForeground(["pull", canonicalUri]);
+	} catch (err) {
+		throw new LocalInvokeBuildError(`docker pull ${canonicalUri} failed: ${err.message}`);
+	}
+	return canonicalUri;
+}
+async function assumeRoleForEcr(roleArn, callerRegion, profile, logger) {
+	if (!isIamRoleArn(roleArn)) throw new LocalInvokeBuildError(refusedRoleArnMessage(roleArn));
+	logger.debug(`Assuming role ${roleArn} for ECR pull...`);
+	const sts = new STSClient(workloadStsClientConfig({
+		region: callerRegion,
+		profile
+	}));
+	try {
+		const creds = (await sts.send(new AssumeRoleCommand({
+			RoleArn: roleArn,
+			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-ecr-${Date.now()}`,
+			DurationSeconds: 3600
+		}))).Credentials;
+		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError(`AssumeRole(${roleArn}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
+		return {
+			accessKeyId: creds.AccessKeyId,
+			secretAccessKey: creds.SecretAccessKey,
+			sessionToken: creds.SessionToken,
+			...creds.Expiration && { expiration: creds.Expiration }
+		};
+	} catch (err) {
+		if (err instanceof LocalInvokeBuildError) throw err;
+		const reason = describeAwsFailureForWarn(err, "STS AssumeRole (ECR pull)");
+		throw new LocalInvokeBuildError(`Failed to assume role ${flattenToOneLine(roleArn)} for ECR pull: ${reason}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
+	} finally {
+		sts.destroy();
+	}
+}
+async function ecrLogin(client, target) {
+	const { accountId, region, registryHost } = target;
+	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region}, host=${registryHost})`);
+	const authData = (await client.send(new GetAuthorizationTokenCommand({})).catch((err) => {
+		throw new LocalInvokeBuildError(`ECR GetAuthorizationToken failed (account=${accountId}, region=${region}): ${describeAwsFailureForWarn(err, "ECR GetAuthorizationToken")}. Verify the credentials can call ecr:GetAuthorizationToken.`);
+	})).authorizationData?.[0];
+	if (!authData?.authorizationToken) throw new LocalInvokeBuildError("Failed to get ECR authorization token");
+	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
+	if (!username || password === void 0) throw new LocalInvokeBuildError("ECR authorization token has unexpected shape (missing username/password)");
+	const endpoint = `https://${registryHost}`;
+	try {
+		await runDockerStreaming([
+			"login",
+			"--username",
+			username,
+			"--password-stdin",
+			endpoint
+		], { input: password });
+	} catch (err) {
+		const e = err;
+		throw new LocalInvokeBuildError(`ECR login failed: ${formatDockerLoginError(e.stderr || e.message || String(err), endpoint)}`);
+	}
+}
+async function verifyImageInLocalCache(imageUri) {
+	try {
+		await runDockerStreaming([
+			"image",
+			"inspect",
+			imageUri
+		]);
+	} catch {
+		throw new LocalInvokeBuildError(`Image ${displayUntrustedValue(imageUri)} is not in the local docker cache and --no-pull was set. Either remove --no-pull (${getEmbedConfig().productName} will pull from ECR) or pre-pull the image manually with \`docker pull\`.`);
+	}
+}
+async function isImageInLocalCache(imageRef) {
+	try {
+		await runDockerStreaming([
+			"image",
+			"inspect",
+			imageRef
+		]);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+//#region src/local/docker-image-builder.ts
+async function buildContainerImage(asset, cdkOutDir, options) {
+	const tag = computeLocalTag(asset.source);
+	const platform = architectureToPlatform(options.architecture);
+	const logger = getLogger().child("local-invoke-build");
+	if (options.noBuild === true) {
+		logger.info(`Skipping docker build (--no-build). Verifying ${tag} is in local registry...`);
+		if (!await isImageInLocalCache(tag)) throw new LocalInvokeBuildError(`image ${displayIdent(tag)} not in local registry and --no-build is set; remove --no-build or run \`docker build\` manually first.`);
+		logger.debug(`Local tag ${tag} is cached; skipping build.`);
+		return tag;
+	}
+	logger.info(`Building container image (platform=${platform})...`);
+	logger.debug(`Local tag: ${tag}`);
+	const actualTag = await buildDockerImage(asset, cdkOutDir, {
+		tag,
+		platform,
+		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for container Lambda asset (${displayUntrustedValue(asset.source.directory ?? asset.source.executable?.[0] ?? "")}): ${stderr}`),
+		progressLabel: `Building container image (platform=${platform})`,
+		...options.assetOutdir !== void 0 && { assetOutdir: options.assetOutdir }
+	});
+	if (actualTag !== tag) {
+		logger.debug(`Re-tagging executable-built image ${displayIdent(actualTag)} → ${displayIdent(tag)}`);
+		try {
+			await runDockerStreaming([
+				"tag",
+				actualTag,
+				tag
+			]);
+		} catch (err) {
+			const e = err;
+			throw new LocalInvokeBuildError(`docker tag failed re-tagging ${displayIdent(actualTag)} → ${displayIdent(tag)}: ${displayToolOutput(e.stderr?.trim() || e.message || String(err))}`);
+		}
+	}
+	return tag;
+}
+function architectureToPlatform(architecture) {
+	return architecture === "arm64" ? "linux/arm64" : "linux/amd64";
+}
+function hostPlatform() {
+	return process.arch === "arm64" ? "linux/arm64" : "linux/amd64";
+}
+const warnedEmulatedPlatforms = /* @__PURE__ */ new Set();
+function warnIfEmulatedPlatform(platform, opts = {}) {
+	if (!platform) return;
+	const host = hostPlatform();
+	if (platform === host) return;
+	if (warnedEmulatedPlatforms.has(platform)) return;
+	warnedEmulatedPlatforms.add(platform);
+	const logger = opts.logger ?? getLogger();
+	const what = opts.label ? `${displayIdent(opts.label)} ` : "";
+	logger.warn(`Running ${what}under ${platform} emulation on a ${host} host (the declared architecture differs from the host). Emulation is slower and some compiled binaries can fail under it. If the container does not run correctly, enable Rosetta for x86/amd64 emulation in your Docker engine settings, or build the function for ${host}.`);
+}
+function computeLocalTag(source) {
+	const hash = createHash("sha256");
+	pushField(hash, "directory", source.directory ?? "");
+	pushField(hash, "executable", (source.executable ?? []).join(" "));
+	pushField(hash, "dockerFile", source.dockerFile ?? "");
+	pushField(hash, "dockerBuildTarget", source.dockerBuildTarget ?? "");
+	pushField(hash, "networkMode", source.networkMode ?? "");
+	pushField(hash, "platform", source.platform ?? "");
+	pushField(hash, "dockerBuildSsh", source.dockerBuildSsh ?? "");
+	pushField(hash, "cacheDisabled", source.cacheDisabled ? "1" : "0");
+	pushMap(hash, "dockerBuildArgs", source.dockerBuildArgs);
+	pushMap(hash, "dockerBuildContexts", source.dockerBuildContexts);
+	pushMap(hash, "dockerBuildSecrets", source.dockerBuildSecrets);
+	pushField(hash, "dockerOutputs", (source.dockerOutputs ?? []).join(""));
+	pushField(hash, "cacheFrom", (source.cacheFrom ?? []).map((o) => JSON.stringify(o)).join(""));
+	pushField(hash, "cacheTo", source.cacheTo ? JSON.stringify(source.cacheTo) : "");
+	return `${getEmbedConfig().resourceNamePrefix}-invoke-${hash.digest("hex").slice(0, 16)}`;
+}
+function pushField(hash, name, value) {
+	hash.update(name);
+	hash.update("=");
+	hash.update(value);
+	hash.update("\0");
+}
+function pushMap(hash, name, value) {
+	hash.update(name);
+	hash.update("={");
+	if (value) for (const [k, v] of Object.entries(value)) {
+		hash.update(k);
+		hash.update("=");
+		hash.update(v);
+		hash.update(";");
+	}
+	hash.update("}\0");
+}
+
+//#endregion
+//#region src/local/loopback-forwarder.ts
+const execFileAsync$1 = promisify(execFile);
+const LOOPBACK_FORWARDER_IMAGE = "public.ecr.aws/docker/library/node:22-alpine@sha256:1314fb30ec37592d5845e5a160d522c0e680972aa534549940b8d73bde88481a";
+const FORWARDER_CA_PATH = "/cdkl-forwarder/ca.pem";
+const STATUS_PREFIX = "CDKL-FWD";
+const LOOPBACK_FORWARDER_SCRIPT = `
+const net=require('net'),dns=require('dns'),fs=require('fs'),https=require('https');
+const ports=process.argv[1].split(',').map(Number),mode=process.argv[2],ca=process.argv[3];
+const out=(s)=>process.stdout.write('${STATUS_PREFIX} '+s+'\\n');
+function gateway(){try{for(const l of fs.readFileSync('/proc/net/route','utf8').split('\\n').slice(1)){const f=l.trim().split(/\\s+/);if(f[1]==='00000000'&&f[2]&&f[2]!=='00000000'){return [3,2,1,0].map(i=>parseInt(f[2].substr(i*2,2),16)).join('.');}}}catch(e){}return undefined;}
+function listen(port,host,up){return new Promise((res)=>{const s=net.createServer((c)=>{const u=net.connect(port,up);c.pipe(u);u.pipe(c);u.on('error',()=>c.destroy());c.on('error',()=>u.destroy());});s.once('error',(e)=>res(e.code||'ERROR'));s.listen(port,host,()=>res(undefined));});}
+function tcpProbe(port,up){return new Promise((res)=>{const c=net.connect(port,up);c.setTimeout(5000,()=>{c.destroy();res('ETIMEDOUT');});c.once('connect',()=>{c.destroy();res(undefined);});c.once('error',(e)=>res(e.code||'ERROR'));});}
+function healthProbe(port){return new Promise((res)=>{const r=https.get({host:'127.0.0.1',port,path:'/__admin/health',ca:fs.readFileSync(ca),timeout:5000},(m)=>{m.resume();res(m.statusCode===200?undefined:'HTTP_'+m.statusCode);});r.on('timeout',()=>{r.destroy();res('ETIMEDOUT');});r.on('error',(e)=>res(e.code||'ERROR'));});}
+dns.lookup('host.docker.internal',{family:4},async(err,addr)=>{
+const up=err?gateway():addr;
+if(!up){out('FAIL '+ports[0]+' NO_UPSTREAM none');return;}
+for(const p of ports){const e=await listen(p,'127.0.0.1',up);if(e){out('FAIL '+p+' LISTEN_'+e+' '+up);return;}await listen(p,'::1',up);}
+for(const p of ports){const e=await tcpProbe(p,up);if(e){out('FAIL '+p+' '+e+' '+up);return;}}
+if(mode==='health'&&ca){const e=await healthProbe(ports[0]);if(e){out('FAIL '+ports[0]+' '+e+' '+up);return;}}
+out('READY '+up);
+});
+`;
+function parseForwarderStatus(logs) {
+	for (const raw of logs.split("\n")) {
+		const line = raw.trim();
+		if (!line.startsWith(`${STATUS_PREFIX} `)) continue;
+		const parts = line.slice(9).split(" ");
+		if (parts[0] === "READY") return {
+			ok: true,
+			...parts[1] ? { upstream: parts[1] } : {}
+		};
+		if (parts[0] === "FAIL") {
+			const port = Number(parts[1]);
+			return {
+				ok: false,
+				...Number.isInteger(port) ? { failedPort: port } : {},
+				...parts[2] ? { reason: parts[2] } : {},
+				...parts[3] && parts[3] !== "none" ? { upstream: parts[3] } : {}
+			};
+		}
+	}
+}
+function buildLoopbackForwarderDockerArgs(opts) {
+	const ns = `container:${opts.workloadContainer}`;
+	const args = [
+		"run",
+		"-d",
+		"--rm",
+		"--name",
+		opts.name,
+		"--network",
+		ns,
+		"--pid",
+		ns
+	];
+	if (opts.caHostPath) args.push("-v", `${opts.caHostPath}:${FORWARDER_CA_PATH}:ro`);
+	args.push("--entrypoint", "node", LOOPBACK_FORWARDER_IMAGE, "-e", LOOPBACK_FORWARDER_SCRIPT, opts.ports.join(","), opts.probe === "health" && opts.caHostPath ? "health" : "tcp", ...opts.caHostPath ? [FORWARDER_CA_PATH] : []);
+	return args;
+}
+let imageReady;
+let pullFailure;
+const PULL_FAILURE_TTL_MS = 6e4;
+async function ensureForwarderImage() {
+	if (pullFailure && Date.now() - pullFailure.at < PULL_FAILURE_TTL_MS) throw pullFailure.error;
+	imageReady ??= (async () => {
+		try {
+			await execFileAsync$1(getDockerCmd(), [
+				"image",
+				"inspect",
+				LOOPBACK_FORWARDER_IMAGE
+			]);
+		} catch {
+			await pullImage(LOOPBACK_FORWARDER_IMAGE, false);
+		}
+	})().catch((err) => {
+		imageReady = void 0;
+		pullFailure = {
+			at: Date.now(),
+			error: err
+		};
+		throw err;
+	});
+	return imageReady;
+}
+async function startLoopbackForwarder(opts) {
+	const logger = getLogger().child("forwarder");
+	await ensureForwarderImage();
+	const name = `${getEmbedConfig().resourceNamePrefix}-awsfwd-${process.pid}-${randomBytes(4).toString("hex")}`;
+	const args = buildLoopbackForwarderDockerArgs({
+		...opts,
+		name
+	});
+	logger.debug(`Starting loopback forwarder ${name} for ports ${opts.ports.join(",")}`);
+	try {
+		await execFileAsync$1(getDockerCmd(), args);
+	} catch (error) {
+		throw new Error(`Could not start the loopback forwarder container: ${displayToolOutput(error.stderr?.trim() || describeExitWithoutArgv(error))}`);
+	}
+	const deadline = Date.now() + (opts.timeoutMs ?? 2e4);
+	for (;;) {
+		let logs = "";
+		try {
+			const r = await execFileAsync$1(getDockerCmd(), ["logs", name]);
+			logs = `${r.stdout}\n${r.stderr}`;
+		} catch (error) {
+			throw new Error(`The loopback forwarder container exited before reporting: ${displayToolOutput(error.stderr?.trim() || describeExitWithoutArgv(error))}`);
+		}
+		const status = parseForwarderStatus(logs);
+		if (status) {
+			logger.debug(status.ok ? `Loopback forwarder ${name} ready (upstream ${status.upstream ?? "?"})` : `Loopback forwarder ${name} failed: port ${status.failedPort} ${status.reason}`);
+			return {
+				name,
+				...status
+			};
+		}
+		if (Date.now() > deadline) {
+			await execFileAsync$1(getDockerCmd(), [
+				"rm",
+				"-f",
+				name
+			]).catch(() => void 0);
+			throw new Error("The loopback forwarder container did not report readiness in time.");
+		}
+		await new Promise((r) => setTimeout(r, 100));
+	}
+}
+function describeForwarderFailure(result, endpointLabel) {
+	const port = result.failedPort ?? 0;
+	const via = result.upstream ? ` via ${result.upstream}:${port}` : "";
+	const reason = result.reason ?? "unknown";
+	if (reason.startsWith("LISTEN_")) return `${endpointLabel}: the workload container already uses port ${port} on its loopback, so cdk-local cannot forward 127.0.0.1:${port} to the host. Run the endpoint on another port.`;
+	if (reason.startsWith("HTTP_") || reason.includes("CERT") || reason === "DEPTH_ZERO_SELF_SIGNED_CERT") return `${endpointLabel}: containers reach port ${port}${via}, but its health check failed (${reason}). Check that the endpoint on port ${port} is the one whose CA cdk-local mounted (a restart issues a new certificate).`;
+	return `${endpointLabel}: containers cannot reach port ${port} on the host${via} (${reason}). cdk-local forwards 127.0.0.1:${port} inside each workload container to the host, so the endpoint must also accept connections from the Docker network. On Docker Desktop, publish it on the host's 127.0.0.1 (\`-p 127.0.0.1:${port}:${port}\`). On Linux, publish it on 127.0.0.1 AND on the Docker bridge gateway: run the emulator's Docker image with \`-p 127.0.0.1:${port}:${port} -p ${result.upstream && /^\d+\.\d+\.\d+\.\d+$/.test(result.upstream) && !result.upstream.startsWith("192.168.65.") ? result.upstream : "<docker bridge gateway, e.g. 172.17.0.1>"}:${port}:${port}\` (a native install listens on one address only, so it cannot serve this machine and containers at once). Do not bind 0.0.0.0 on a host: that opens it to your network.`;
+}
+
+//#endregion
+//#region src/local/docker-runner.ts
+var docker_runner_exports = /* @__PURE__ */ __exportAll({
+	DockerRunnerError: () => DockerRunnerError,
+	MAX_HELD_LINE_CHARS: () => MAX_HELD_LINE_CHARS,
+	PREFIX_CONTAINER_OUTPUT_ENV: () => PREFIX_CONTAINER_OUTPUT_ENV,
+	SENSITIVE_ENV_KEYS: () => SENSITIVE_ENV_KEYS,
+	appendEnvFlags: () => appendEnvFlags,
+	attachLoopbackForwarder: () => attachLoopbackForwarder,
+	createPrefixedLineRelay: () => createPrefixedLineRelay,
+	describeRefusedSensitiveEnvKeys: () => describeRefusedSensitiveEnvKeys,
+	ensureDockerAvailable: () => ensureDockerAvailable,
+	execEnvForSecrets: () => execEnvForSecrets,
+	pickFreePort: () => pickFreePort,
+	prepareLoopbackForwarder: () => prepareLoopbackForwarder,
+	pullImage: () => pullImage,
+	removeContainer: () => removeContainer,
+	runDetached: () => runDetached,
+	streamLogs: () => streamLogs,
+	withWorkloadAwsWiring: () => withWorkloadAwsWiring
+});
+const execFileAsync = promisify(execFile);
+var DockerRunnerError = class DockerRunnerError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "DockerRunnerError";
+		Object.setPrototypeOf(this, DockerRunnerError.prototype);
+	}
+};
+async function pullImage(image, skipPull, platform) {
+	const logger = getLogger().child("docker");
+	if (skipPull) {
+		logger.debug(`Skipping docker pull for ${displayIdent(image)} (--no-pull)`);
+		return;
+	}
+	const platformArgs = platform ? ["--platform", platform] : [];
+	if (getLogger().getLevel() === "debug") {
+		logger.info(`Pulling ${displayIdent(image)}${platform ? ` (${displayIdent(platform)})` : ""}...`);
+		try {
+			await runDockerForeground([
+				"pull",
+				...platformArgs,
+				image
+			]);
+		} catch (err) {
+			const e = err;
+			throw new DockerRunnerError(`docker pull ${displayIdent(image)} failed: ${e.message}`);
+		}
+		return;
+	}
+	logger.debug(`Pulling ${displayIdent(image)} (silent — pass --verbose to stream progress)`);
+	try {
+		await runDockerStreaming([
+			"pull",
+			...platformArgs,
+			image
+		], {
+			streamLive: false,
+			progressLabel: `Pulling ${displayIdent(image)}`
+		});
+	} catch (err) {
+		const e = err;
+		if (e.exitCode === void 0 || e.exitCode === null) throw new DockerRunnerError(`docker pull ${displayIdent(image)} failed: ${displayToolOutput(e.message ?? String(err))}`);
+		const detail = e.stderr?.trim() || e.stdout?.trim() || "(no output)";
+		throw new DockerRunnerError(`docker pull ${displayIdent(image)} exited with code ${e.exitCode}: ${displayToolOutput(detail)}`);
+	}
+}
+async function runDetached(opts) {
+	const wiring = getActiveWorkloadAwsWiring();
+	if (!wiring) return runDetachedContainer(opts);
+	const wired = await withWorkloadAwsWiring(opts, wiring);
+	const ports = opts.network === "host" ? [] : effectiveLoopbackPorts(wired.env, wiring);
+	if (ports.length > 0) await prepareLoopbackForwarder(wiring);
+	const id = await runDetachedContainer(wired);
+	await attachLoopbackForwarder(id, wiring, ports);
+	return id;
+}
+async function withWorkloadAwsWiring(opts, wiring) {
+	const defaults = wiring.mode === "forward" && !opts.env["AWS_ACCESS_KEY_ID"] ? await resolveHostDefaultCredentials() : void 0;
+	const env = applyWorkloadAwsWiringToEnv(opts.env, wiring, defaults);
+	const credsPath = `${getEmbedConfig().awsBindMountPath}/credentials`;
+	const extra = (opts.extraMounts ?? []).filter((m) => wiring.mode !== "emulator" || m.containerPath !== credsPath);
+	const taken = new Set([...opts.mounts, ...extra].map((m) => m.containerPath));
+	for (const m of wiring.mounts) if (!taken.has(m.containerPath)) extra.push({
+		...m,
+		readOnly: true
+	});
+	return {
+		...opts,
+		env,
+		extraMounts: extra
+	};
+}
+async function prepareLoopbackForwarder(wiring) {
+	try {
+		await ensureForwarderImage();
+	} catch (err) {
+		if (wiring.mode === "emulator") throw new DockerRunnerError(`--aws-emulator: the loopback forwarder image could not be pulled: ${err.message}`);
+	}
+}
+const warnedForwarderPorts = /* @__PURE__ */ new Set();
+function warnForwarderOnce(key, message) {
+	if (warnedForwarderPorts.has(key)) return;
+	warnedForwarderPorts.add(key);
+	getLogger().warn(message);
+}
+async function isContainerRunning(containerId) {
+	try {
+		const { stdout } = await execFileAsync(getDockerCmd(), [
+			"inspect",
+			"-f",
+			"{{.State.Running}}",
+			containerId
+		]);
+		return stdout.trim() === "true";
+	} catch (err) {
+		return !/no such (object|container)/i.test(err.stderr ?? "");
+	}
+}
+const forwardedPortsByContainer = /* @__PURE__ */ new Map();
+async function attachLoopbackForwarder(containerId, wiring, ports = forwardedPortsByContainer.get(containerId) ?? wiring.loopbackPorts) {
+	forwardedPortsByContainer.set(containerId, ports);
+	if (ports.length === 0) return;
+	const label = wiring.mode === "emulator" ? `--aws-emulator ${wiring.emulatorEndpoint?.url ?? ""}` : "The AWS endpoint override (AWS_ENDPOINT_URL*)";
+	let result;
+	try {
+		result = await startLoopbackForwarder({
+			workloadContainer: containerId,
+			ports,
+			probe: wiring.probeHealth ? "health" : "tcp",
+			...wiring.caHostPath ? { caHostPath: wiring.caHostPath } : {}
+		});
+	} catch (err) {
+		if (!await isContainerRunning(containerId)) return;
+		const message = `${label}: ${err.message}`;
+		if (wiring.mode === "emulator") {
+			await removeContainer(containerId);
+			throw new DockerRunnerError(message);
+		}
+		warnForwarderOnce("start", message);
+		return;
+	}
+	if (result.ok) return;
+	const message = describeForwarderFailure(result, label);
+	if (wiring.mode === "emulator") {
+		await removeContainer(containerId);
+		throw new DockerRunnerError(message);
+	}
+	warnForwarderOnce(String(result.failedPort ?? 0), message);
+}
+async function runDetachedContainer(opts) {
+	const args = opts.autoRemove === false ? ["run", "-d"] : [
+		"run",
+		"-d",
+		"--rm"
+	];
+	if (opts.name) args.push("--name", opts.name);
+	if (opts.network) args.push("--network", opts.network);
+	if (opts.platform) {
+		args.push("--platform", opts.platform);
+		warnIfEmulatedPlatform(opts.platform, opts.name ? { label: opts.name } : {});
+	}
+	if (opts.extraHosts) for (const entry of opts.extraHosts) args.push("--add-host", `${entry.host}:${entry.ip}`);
+	const host = opts.host ?? "127.0.0.1";
+	args.push("-p", `${host}:${opts.hostPort}:${opts.containerPort ?? 8080}`);
+	if (opts.debugPort !== void 0) args.push("-p", `${host}:${opts.debugPort}:${opts.debugPort}`);
+	for (const extra of opts.extraPorts ?? []) args.push("-p", `${host}:${extra.hostPort}:${extra.containerPort}`);
+	for (const mount of opts.mounts) {
+		const ro = mount.readOnly ? ":ro" : "";
+		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
+	}
+	if (opts.extraMounts) for (const mount of opts.extraMounts) {
+		const ro = mount.readOnly ? ":ro" : "";
+		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
+	}
+	const sensitiveKeys = opts.sensitiveEnvKeys && opts.sensitiveEnvKeys.size > 0 ? /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...opts.sensitiveEnvKeys]) : SENSITIVE_ENV_KEYS;
+	const { passthrough: passthroughEnv, collisions } = appendEnvFlags(args, opts.env, sensitiveKeys);
+	if (opts.tmpfs) args.push("--tmpfs", `${opts.tmpfs.target}:rw,size=${opts.tmpfs.sizeMb}m`);
+	if (opts.workingDir) args.push("--workdir", opts.workingDir);
+	let entryPointTail = [];
+	if (opts.entryPoint && opts.entryPoint.length > 0) {
+		args.push("--entrypoint", opts.entryPoint[0]);
+		entryPointTail = opts.entryPoint.slice(1);
+	}
+	args.push(opts.image, ...entryPointTail, ...opts.cmd);
+	const logger = getLogger().child("docker");
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(args).map((a) => displayUntrustedValue(a)).join(" ")}`);
+	if (collisions.length > 0) logger.warn(describeRefusedSensitiveEnvKeys(`Container for image ${displayUntrustedValue(opts.image)}`, collisions));
+	const forwardedKeys = Object.keys(passthroughEnv);
+	const refusal = finchSecretArgvRefusal(forwardedKeys.filter((k) => opts.sensitiveEnvKeys?.has(k)), {
+		label: "Container for image",
+		name: opts.image
+	});
+	if (refusal !== void 0) throw new DockerRunnerError(refusal);
+	warnFinchArgvExposure(forwardedKeys);
+	try {
+		const { stdout } = await execFileAsync(getDockerCmd(), args, {
+			maxBuffer: 10 * 1024 * 1024,
+			...execEnvForSecrets(passthroughEnv)
+		});
+		return stdout.trim();
+	} catch (error) {
+		throw new DockerRunnerError(`docker run failed: ${displayToolOutput(error.stderr?.trim() || describeExitWithoutArgv(error))}`);
+	}
+}
+const PREFIX_CONTAINER_OUTPUT_ENV = "CDKL_PREFIX_CONTAINER_OUTPUT";
+const MAX_HELD_LINE_CHARS = 64 * 1024;
+function createPrefixedLineRelay(prefix, out) {
+	const decoder = new StringDecoder("utf8");
+	let pending = "";
+	const emit = (text) => {
+		let nl = text.indexOf("\n");
+		if (nl !== -1) nl += pending.length;
+		pending += text;
+		while (nl !== -1) {
+			out.write(`${prefix}${pending.slice(0, nl + 1)}`);
+			pending = pending.slice(nl + 1);
+			nl = pending.indexOf("\n");
+		}
+		while (pending.length >= MAX_HELD_LINE_CHARS) {
+			const high = pending.charCodeAt(MAX_HELD_LINE_CHARS - 1);
+			const cut = high >= 55296 && high <= 56319 ? MAX_HELD_LINE_CHARS - 1 : MAX_HELD_LINE_CHARS;
+			out.write(`${prefix}${pending.slice(0, cut)}\n`);
+			pending = pending.slice(cut);
+		}
+	};
+	return {
+		push: (chunk) => emit(decoder.write(chunk)),
+		flush: () => {
+			emit(decoder.end());
+			if (pending.length > 0) {
+				out.write(`${prefix}${pending}\n`);
+				pending = "";
+			}
+		}
+	};
+}
+function streamLogs(containerId, opts = {}) {
+	const proc = spawn(getDockerCmd(), [
+		"logs",
+		"-f",
+		containerId
+	], { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] });
+	if (opts.onOutput) {
+		const tap = opts.onOutput;
+		proc.stdout?.on("data", (chunk) => tap(chunk));
+		proc.stderr?.on("data", (chunk) => tap(chunk));
+	}
+	let flush = () => void 0;
+	if (opts.prefix !== void 0 || process.env["CDKL_PREFIX_CONTAINER_OUTPUT"] === "1") {
+		const tag = opts.prefix ?? `[${flattenToOneLine(containerId.slice(0, 12)).replace(/[\]\s]/g, "_")}] `;
+		const stdoutRelay = createPrefixedLineRelay(tag, process.stdout);
+		const stderrRelay = createPrefixedLineRelay(tag, process.stderr);
+		proc.stdout?.on("data", (chunk) => stdoutRelay.push(chunk));
+		proc.stderr?.on("data", (chunk) => stderrRelay.push(chunk));
+		flush = () => {
+			stdoutRelay.flush();
+			stderrRelay.flush();
+		};
+		proc.on("close", () => flush());
+	} else {
+		proc.stdout?.on("data", (chunk) => process.stdout.write(chunk));
+		proc.stderr?.on("data", (chunk) => process.stderr.write(chunk));
+	}
+	proc.on("error", () => {});
+	return () => {
+		flush();
+		if (!proc.killed) proc.kill("SIGTERM");
+	};
+}
+async function removeContainer(containerId) {
+	if (!containerId) return;
+	const logger = getLogger().child("docker");
+	try {
+		await execFileAsync(getDockerCmd(), [
+			"rm",
+			"-f",
+			containerId
+		]);
+		logger.debug(`Removed container ${containerId}`);
+	} catch (error) {
+		const err = error;
+		logger.debug(`docker rm -f ${containerId} failed: ${err.stderr || err.message || String(error)}`);
+	}
+}
+async function ensureDockerAvailable() {
+	const cmd = getDockerCmd();
+	try {
+		await execFileAsync(cmd, [
+			"version",
+			"--format",
+			"{{.Server.Version}}"
+		]);
+	} catch (error) {
+		const err = error;
+		if (err.code === "ENOENT") throw new DockerRunnerError(`${cmd} is not installed or not on PATH. ${getEmbedConfig().cliName} invoke needs Docker (or a compatible CLI specified via CDK_DOCKER) — install it and retry.`);
+		throw new DockerRunnerError(`${cmd} daemon is not reachable: ${err.stderr?.trim() || err.message || String(error)}. Start Docker Desktop / the docker daemon and retry.`);
+	}
+}
+function pickFreePort() {
+	return new Promise((resolvePort, rejectPort) => {
+		const server = createServer();
+		server.unref();
+		server.on("error", rejectPort);
+		server.listen(0, "127.0.0.1", () => {
+			const address = server.address();
+			if (!address || typeof address === "string") {
+				server.close();
+				rejectPort(/* @__PURE__ */ new Error("Could not allocate a host port"));
+				return;
+			}
+			const port = address.port;
+			server.close(() => resolvePort(port));
+		});
+	});
+}
+const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_SESSION_TOKEN"
+]);
+function appendEnvFlags(args, env, sensitiveKeys) {
+	const passthrough = {};
+	const collisions = [];
+	for (const [k, v] of Object.entries(env)) if (sensitiveKeys.has(k)) {
+		if (isMalformedEnvKey(k) || isDockerClientEnvKey(k)) {
+			collisions.push(k);
+			continue;
+		}
+		args.push("-e", k);
+		defineOwnKey(passthrough, k, v);
+	} else args.push("-e", `${k}=${v}`);
+	return {
+		passthrough,
+		collisions
+	};
+}
+function describeRefusedSensitiveEnvKeys(subject, keys) {
+	return `${subject}: sensitive env var(s) ${keys.map(displayUntrustedValue).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack that client; a malformed name cannot form a valid environment variable). Rename the variable if the container needs it.`;
+}
+function execEnvForSecrets(passthrough) {
+	const keys = Object.keys(passthrough).filter((k) => !isMalformedEnvKey(k) && !isDockerClientEnvKey(k));
+	if (keys.length === 0) return {};
+	const env = { ...process.env };
+	for (const k of keys) defineOwnKey(env, k, passthrough[k]);
+	return { env };
+}
+
+//#endregion
+export { parseEcrRegistryHost as A, RouteDiscoveryError as B, warnIfEmulatedPlatform as C, buildDockerImage as D, pullEcrImage as E, tryResolveImageFnJoin as F, applyRoleArnIfSet as G, withErrorHandling as H, CdkLocalError as I, isIamRoleArn as J, assumeRoleCredentials as K, InteractiveTtyRequiredError as L, derivePseudoParametersFromRegion as M, formatStateRemedy as N, resolveAssetSourcePath as O, substituteImagePlaceholders as P, LocalInvokeBuildError as R, buildContainerImage as S, parseEcrUri as T, defineOwnKey as U, TargetSelectionCancelledError as V, AssumeRoleFailure as W, buildStsClientConfig as X, refusedRoleArnMessage as Y, resolveProfileCredentials as Z, buildLoopbackForwarderDockerArgs as _, describeRefusedSensitiveEnvKeys as a, startLoopbackForwarder as b, execEnvForSecrets as c, pullImage as d, removeContainer as f, LOOPBACK_FORWARDER_IMAGE as g, withWorkloadAwsWiring as h, attachLoopbackForwarder as i, derivePartitionAndUrlSuffix as j, describeExitWithoutArgv as k, pickFreePort as l, streamLogs as m, SENSITIVE_ENV_KEYS as n, docker_runner_exports as o, runDetached as p, describeRejectedRoleArn as q, appendEnvFlags as r, ensureDockerAvailable as s, DockerRunnerError as t, prepareLoopbackForwarder as u, describeForwarderFailure as v, isImageInLocalCache as w, architectureToPlatform as x, ensureForwarderImage as y, LocalStartServiceError as z };
+//# sourceMappingURL=docker-runner-CnXQIUjd.js.map