cdk-local 0.162.1 → 0.163.0

package/dist/{workload-identity-ITM3p2Ed.js → workload-identity-D5zkhVcF.js}

@@ -1,7 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-w6R9maHv.js";
 import { c as getEmbedConfig, t as getLogger } from "./logger-Co5XVwco.js";
 import { r as displayUntrustedValue, u as describeCredentialLoadFailure } from "./assembly-path-R96uhMm1.js";
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { createHash, generateKeyPairSync, randomBytes, sign } from "node:crypto";
 import { Agent, get, request } from "node:http";
 import { Agent as Agent$1, get as get$1, request as request$1 } from "node:https";
 import { rootCertificates } from "node:tls";
@@ -157,6 +158,9 @@ function setAwsEndpointOverride(o) {
 function getAwsEndpointOverride() {
 	return endpointOverride;
 }
+function awsEndpointOverrideClientConfig(o) {
+	return endpointOverrideClientConfig(o);
+}
 function endpointOverrideClientConfig(o) {
 	const httpsAgent = new Agent$1({
 		keepAlive: true,
@@ -346,6 +350,543 @@ async function proxyAwareFetch(url, opts = {}) {
 	}
 }
 
+//#endregion
+//#region src/local/aws-emulator-mixed-mode.ts
+const AWS_EMULATOR_SENTINEL = "aws-emulator";
+const MIXED_MODE_RESIGN_PORT = 47297;
+const ENDPOINT_KEY = /^AWS_ENDPOINT_URL(?:_([A-Z0-9_]+))?$/;
+function isAwsEmulatorSentinel(key, value) {
+	return typeof value === "string" && value.trim() === "aws-emulator" && ENDPOINT_KEY.test(key);
+}
+function findAwsEmulatorSentinels(overrides) {
+	const found = [];
+	if (!overrides || typeof overrides !== "object") return found;
+	for (const [section, map] of Object.entries(overrides)) {
+		if (!map || typeof map !== "object" || Array.isArray(map)) continue;
+		for (const [key, value] of Object.entries(map)) {
+			if (!isAwsEmulatorSentinel(key, value)) continue;
+			found.push({
+				section,
+				key,
+				service: ENDPOINT_KEY.exec(key)[1] ?? ""
+			});
+		}
+	}
+	return found;
+}
+function readAwsEmulatorSentinelsFromFile(filePath) {
+	if (!filePath) return [];
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(filePath, "utf8"));
+	} catch {
+		return [];
+	}
+	return findAwsEmulatorSentinels(parsed);
+}
+function validateAwsEmulatorSentinels(sentinels, awsEmulatorOn, envVarName = "CDK_LOCAL_AWS_EMULATOR") {
+	const first = sentinels[0];
+	if (!first) return;
+	const where = (s) => `${s.key} under ${displayUntrustedValue(s.section)}`;
+	const bare = sentinels.find((s) => s.service === "");
+	if (bare) throw new Error(`--env-vars sets ${where(bare)} to "${AWS_EMULATOR_SENTINEL}", but the sentinel routes ONE service (AWS_ENDPOINT_URL_<SERVICE>). To send every service to AWS Emulator, use --aws-emulator without a sentinel.`);
+	if (!awsEmulatorOn) throw new Error(`--env-vars sets ${where(first)} to "${AWS_EMULATOR_SENTINEL}", which needs --aws-emulator [url] (or ${envVarName}) to name the AWS Emulator to route it to.`);
+}
+function emulatedServicesOf(sentinels) {
+	return [...new Set(sentinels.map((s) => s.service).filter((s) => s !== ""))].sort();
+}
+const SERVICE_NAMESPACE_ALIASES = {
+	EVENTBRIDGE: ["EVENTS"],
+	SFN: ["STEPFUNCTIONS"],
+	CLOUDWATCHLOGS: ["LOGS"],
+	COGNITOIDENTITYPROVIDER: ["COGNITO"],
+	COGNITOIDENTITY: ["COGNITO"],
+	FIREHOSE: ["KINESISFIREHOSE"],
+	OPENSEARCH: ["OPENSEARCHSERVICE"],
+	ELASTICSEARCHSERVICE: ["ELASTICSEARCH"]
+};
+function resourceTypeMatchesEmulatedService(resourceType, services) {
+	const ns = /^AWS::([A-Za-z0-9]+)::/.exec(resourceType)?.[1]?.toUpperCase();
+	if (!ns) return false;
+	return services.some((s) => {
+		const id = s.replace(/_/g, "").toUpperCase();
+		return id === ns || (SERVICE_NAMESPACE_ALIASES[id] ?? []).includes(ns);
+	});
+}
+function createMixedModeStateProvider(opts) {
+	const { real, emulator, emulatedServices } = opts;
+	const swaps = /* @__PURE__ */ new Map();
+	const warned = /* @__PURE__ */ new Set();
+	const swap = (v) => swaps.get(v) ?? v;
+	const provider = {
+		label: real.label,
+		async load(stackName, synthRegion) {
+			const [r, e] = await Promise.all([real.load(stackName, synthRegion), emulator.load(stackName, synthRegion)]);
+			if (!e) {
+				if (r && !warned.has(stackName)) {
+					if (Object.values(r.resources).some((res) => resourceTypeMatchesEmulatedService(res.resourceType, emulatedServices))) {
+						warned.add(stackName);
+						const why = emulator.getLastLoadError?.();
+						getLogger().warn(`${real.label}: stack ${displayUntrustedValue(stackName)} could not be read from AWS Emulator${why ? ` (${why})` : ""}; resources of the emulated services (${emulatedServices.join(", ")}) keep their real AWS names. Override them with --env-vars, or deploy the stack into the emulator.`);
+					}
+				}
+				return r;
+			}
+			const emulated = (res) => resourceTypeMatchesEmulatedService(res.resourceType, emulatedServices);
+			if (!r) {
+				const resources = {};
+				for (const [id, res] of Object.entries(e.resources)) if (emulated(res)) resources[id] = res;
+				return {
+					resources,
+					outputs: { ...e.outputs },
+					region: e.region
+				};
+			}
+			const resources = { ...r.resources };
+			for (const [id, res] of Object.entries(e.resources)) {
+				if (!emulated(res)) continue;
+				const realRes = r.resources[id];
+				if (realRes?.physicalId && res.physicalId && realRes.physicalId !== res.physicalId) swaps.set(realRes.physicalId, res.physicalId);
+				resources[id] = res;
+			}
+			const outputs = {};
+			for (const [k, v] of Object.entries(e.outputs)) outputs[k] = v;
+			for (const [k, v] of Object.entries(r.outputs)) outputs[k] = swap(v);
+			return {
+				resources,
+				outputs,
+				region: r.region
+			};
+		},
+		buildCrossStackResolver: (region) => real.buildCrossStackResolver(region),
+		dispose() {
+			try {
+				real.dispose();
+			} finally {
+				emulator.dispose();
+			}
+		}
+	};
+	if (real.resolveDeployedFunctionEnv) {
+		const fn = real.resolveDeployedFunctionEnv.bind(real);
+		provider.resolveDeployedFunctionEnv = async (id) => {
+			const env = await fn(id);
+			if (!env) return env;
+			const out = {};
+			for (const [k, v] of Object.entries(env)) out[k] = swap(v);
+			return out;
+		};
+	}
+	if (real.resolveLambdaExecutionRoleArn) provider.resolveLambdaExecutionRoleArn = real.resolveLambdaExecutionRoleArn.bind(real);
+	if (real.resolveAgentCoreRuntimeRoleArn) provider.resolveAgentCoreRuntimeRoleArn = real.resolveAgentCoreRuntimeRoleArn.bind(real);
+	if (real.resolveTemplateSsmParameters) provider.resolveTemplateSsmParameters = real.resolveTemplateSsmParameters.bind(real);
+	if (real.getLastLoadError) provider.getLastLoadError = real.getLastLoadError.bind(real);
+	return provider;
+}
+
+//#endregion
+//#region src/local/mixed-mode-tls.ts
+function der(tag, content) {
+	const n = content.length;
+	let len;
+	if (n < 128) len = Buffer.from([n]);
+	else {
+		const bytes = [];
+		for (let v = n; v > 0; v = Math.floor(v / 256)) bytes.unshift(v & 255);
+		len = Buffer.from([128 | bytes.length, ...bytes]);
+	}
+	return Buffer.concat([
+		Buffer.from([tag]),
+		len,
+		content
+	]);
+}
+const seq = (...parts) => der(48, Buffer.concat(parts));
+const set = (...parts) => der(49, Buffer.concat(parts));
+const octets = (b) => der(4, b);
+const bits = (b, unused = 0) => der(3, Buffer.concat([Buffer.from([unused]), b]));
+const bool = (v) => der(1, Buffer.from([v ? 255 : 0]));
+const utf8 = (s) => der(12, Buffer.from(s, "utf8"));
+const explicit = (n, inner) => der(160 + n, inner);
+function integer(b) {
+	let v = b;
+	while (v.length > 1 && v[0] === 0 && (v[1] & 128) === 0) v = v.subarray(1);
+	if ((v[0] & 128) !== 0) v = Buffer.concat([Buffer.from([0]), v]);
+	return der(2, v);
+}
+function oid(dotted) {
+	const parts = dotted.split(".").map(Number);
+	const out = [40 * parts[0] + parts[1]];
+	for (const p of parts.slice(2)) {
+		const stack = [p & 127];
+		for (let v = Math.floor(p / 128); v > 0; v = Math.floor(v / 128)) stack.unshift(v & 127 | 128);
+		out.push(...stack);
+	}
+	return der(6, Buffer.from(out));
+}
+function utcTime(d) {
+	const p = (n) => String(n).padStart(2, "0");
+	const s = p(d.getUTCFullYear() % 100) + p(d.getUTCMonth() + 1) + p(d.getUTCDate()) + p(d.getUTCHours()) + p(d.getUTCMinutes()) + p(d.getUTCSeconds()) + "Z";
+	return der(23, Buffer.from(s, "ascii"));
+}
+const OID_ECDSA_SHA256 = "1.2.840.10045.4.3.2";
+const OID_CN = "2.5.4.3";
+const OID_SKI = "2.5.29.14";
+const OID_KEY_USAGE = "2.5.29.15";
+const OID_SAN = "2.5.29.17";
+const OID_BASIC_CONSTRAINTS = "2.5.29.19";
+const OID_AKI = "2.5.29.35";
+const OID_EKU = "2.5.29.37";
+const OID_NAME_CONSTRAINTS = "2.5.29.30";
+const OID_SERVER_AUTH = "1.3.6.1.5.5.7.3.1";
+const name = (cn) => seq(set(seq(oid(OID_CN), utf8(cn))));
+function extension(id, critical, value) {
+	return seq(oid(id), ...critical ? [bool(true)] : [], octets(value));
+}
+function keyIdentifier(spkiDer) {
+	const point = spkiDer.subarray(spkiDer.length - 65);
+	return createHash("sha1").update(point).digest();
+}
+function serialNumber() {
+	const b = randomBytes(16);
+	b[0] = b[0] & 127 | 1;
+	return b;
+}
+function issue(spec) {
+	const sigAlg = seq(oid(OID_ECDSA_SHA256));
+	const spki = spec.publicKey.export({
+		type: "spki",
+		format: "der"
+	});
+	const tbs = seq(explicit(0, integer(Buffer.from([2]))), integer(serialNumber()), sigAlg, name(spec.issuer), seq(utcTime(spec.notBefore), utcTime(spec.notAfter)), name(spec.subject), spki, explicit(3, seq(...spec.extensions)));
+	const signature = sign("sha256", tbs, spec.signingKey);
+	return `-----BEGIN CERTIFICATE-----\n${seq(tbs, sigAlg, bits(signature)).toString("base64").replace(/(.{64})/g, "$1\n").replace(/\n$/, "")}\n-----END CERTIFICATE-----\n`;
+}
+function createMixedModeTlsMaterials(now = /* @__PURE__ */ new Date(), leafDnsNames = ["localhost"]) {
+	const notBefore = /* @__PURE__ */ new Date(now.getTime() - 3600 * 1e3);
+	const notAfter = new Date(now.getTime() + 720 * 60 * 60 * 1e3);
+	const ca = generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+	const leaf = generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+	const caKeyId = keyIdentifier(ca.publicKey.export({
+		type: "spki",
+		format: "der"
+	}));
+	const leafKeyId = keyIdentifier(leaf.publicKey.export({
+		type: "spki",
+		format: "der"
+	}));
+	const aki = (id) => seq(der(128, id));
+	const caCn = `cdk-local mixed-mode CA ${randomBytes(4).toString("hex")}`;
+	const caCertPem = issue({
+		subject: caCn,
+		issuer: caCn,
+		publicKey: ca.publicKey,
+		signingKey: ca.privateKey,
+		notBefore,
+		notAfter,
+		extensions: [
+			extension(OID_BASIC_CONSTRAINTS, true, seq(bool(true), integer(Buffer.from([0])))),
+			extension(OID_KEY_USAGE, true, bits(Buffer.from([6]), 1)),
+			extension(OID_SKI, false, octets(caKeyId)),
+			extension(OID_AKI, false, aki(caKeyId)),
+			extension(OID_NAME_CONSTRAINTS, true, seq(der(160, Buffer.concat([
+				seq(der(135, Buffer.from([
+					127,
+					0,
+					0,
+					1,
+					255,
+					255,
+					255,
+					255
+				]))),
+				seq(der(135, Buffer.from([
+					...new Array(15).fill(0),
+					1,
+					...new Array(16).fill(255)
+				]))),
+				seq(der(130, Buffer.from("localhost", "ascii")))
+			]))))
+		]
+	});
+	const san = seq(der(135, Buffer.from([
+		127,
+		0,
+		0,
+		1
+	])), der(135, Buffer.from([
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		1
+	])), ...leafDnsNames.map((n) => der(130, Buffer.from(n, "ascii"))));
+	return {
+		caCertPem,
+		certPem: issue({
+			subject: "127.0.0.1",
+			issuer: caCn,
+			publicKey: leaf.publicKey,
+			signingKey: ca.privateKey,
+			notBefore,
+			notAfter,
+			extensions: [
+				extension(OID_BASIC_CONSTRAINTS, true, seq()),
+				extension(OID_KEY_USAGE, true, bits(Buffer.from([128]), 7)),
+				extension(OID_EKU, false, seq(oid(OID_SERVER_AUTH))),
+				extension(OID_SAN, false, san),
+				extension(OID_SKI, false, octets(leafKeyId)),
+				extension(OID_AKI, false, aki(caKeyId))
+			]
+		}),
+		keyPem: leaf.privateKey.export({
+			type: "pkcs8",
+			format: "pem"
+		}).toString()
+	};
+}
+
+//#endregion
+//#region src/local/emulator-resign-sidecar.ts
+const MIXED_MODE_RESIGN_BODY_CAP_BYTES = 100 * 1024 * 1024;
+const RESIGN_SIDECAR_CORE = String.raw`
+var crypto=require('crypto');
+function sha256hex(b){return crypto.createHash('sha256').update(b).digest('hex');}
+function hmac(k,s){return crypto.createHmac('sha256',k).update(s,'utf8').digest();}
+function uriEncode(s){return encodeURIComponent(s).replace(/[!'()*]/g,function(c){return '%'+c.charCodeAt(0).toString(16).toUpperCase();});}
+function safeDecode(s){try{return decodeURIComponent(s);}catch(e){return s;}}
+function canonicalPath(rawPath,service){
+  var p=rawPath||'/';
+  if(service==='s3')return p;
+  var segs=[];
+  p.split('/').forEach(function(s){if(s===''||s==='.')return;if(s==='..')segs.pop();else segs.push(s);});
+  var n=(p.charAt(0)==='/'?'/':'')+segs.join('/')+(segs.length>0&&p.charAt(p.length-1)==='/'?'/':'');
+  return uriEncode(n).replace(/%2F/g,'/');
+}
+function splitQuery(q){
+  if(!q)return [];
+  return q.split('&').filter(function(x){return x!=='';}).map(function(part){
+    var i=part.indexOf('=');
+    return {raw:part,k:safeDecode(i<0?part:part.slice(0,i)),v:i<0?'':safeDecode(part.slice(i+1))};
+  });
+}
+function canonicalQuery(pairs){
+  return pairs.map(function(p){return [uriEncode(p.k),uriEncode(p.v)];})
+    .sort(function(a,b){return a[0]<b[0]?-1:a[0]>b[0]?1:a[1]<b[1]?-1:a[1]>b[1]?1:0;})
+    .map(function(e){return e[0]+'='+e[1];}).join('&');
+}
+var PRESIGN_PARAMS=new Set(['x-amz-algorithm','x-amz-credential','x-amz-date','x-amz-expires','x-amz-signedheaders','x-amz-signature','x-amz-security-token']);
+function parseCredentialScope(algo,credential){
+  var parts=String(credential).split('/');
+  if(algo==='AWS4-HMAC-SHA256'&&parts.length>=5)return {region:parts[parts.length-3],service:parts[parts.length-2]};
+  if(algo==='AWS4-ECDSA-P256-SHA256'&&parts.length>=4)return {service:parts[parts.length-2]};
+  return undefined;
+}
+function parseAuthScope(authorization){
+  var m=/^\s*(AWS4-HMAC-SHA256|AWS4-ECDSA-P256-SHA256)\s+(.*)$/.exec(String(authorization));
+  if(!m)return undefined;
+  var c=/Credential=([^,\s]+)/.exec(m[2]);
+  return c?parseCredentialScope(m[1],c[1]):undefined;
+}
+var DROP_HEADERS=new Set(['authorization','host','connection','keep-alive','proxy-authorization','proxy-connection','te','trailer','transfer-encoding','upgrade','expect','content-length','x-amz-date','x-amz-security-token','x-amz-content-sha256','x-amz-decoded-content-length','x-amz-trailer']);
+function upstreamHeaders(incoming){
+  var out=Object.create(null);
+  Object.keys(incoming).forEach(function(k){var lk=k.toLowerCase();if(DROP_HEADERS.has(lk))return;var v=incoming[k];if(v===undefined)return;out[lk]=Array.isArray(v)?v.join(', '):String(v);});
+  return out;
+}
+function isAwsChunked(headers){
+  var sha=String(headers['x-amz-content-sha256']||'');
+  return sha.indexOf('STREAMING-')===0||/(^|,)\s*aws-chunked\s*(,|$)/i.test(String(headers['content-encoding']||''));
+}
+function stripAwsChunked(ce){
+  if(!ce)return undefined;
+  var rest=String(ce).split(',').map(function(s){return s.trim();}).filter(function(s){return s!==''&&s.toLowerCase()!=='aws-chunked';});
+  return rest.length?rest.join(', '):undefined;
+}
+function decodeAwsChunked(buf){
+  var pos=0,parts=[],trailers=Object.create(null);
+  for(;;){
+    var eol=buf.indexOf('\r\n',pos);
+    if(eol<0)throw new Error('aws-chunked body: missing chunk header');
+    var size=parseInt(buf.toString('latin1',pos,eol).split(';')[0].trim(),16);
+    if(!(size>=0))throw new Error('aws-chunked body: bad chunk size');
+    pos=eol+2;
+    if(size===0)break;
+    if(pos+size+2>buf.length)throw new Error('aws-chunked body: truncated chunk');
+    parts.push(buf.subarray(pos,pos+size));
+    pos+=size;
+    if(buf[pos]!==13||buf[pos+1]!==10)throw new Error('aws-chunked body: missing chunk terminator');
+    pos+=2;
+  }
+  while(pos<buf.length){
+    var e=buf.indexOf('\r\n',pos),end=e<0?buf.length:e;
+    var line=buf.toString('latin1',pos,end);
+    pos=end+2;
+    if(line==='')break;
+    var c=line.indexOf(':');
+    if(c<=0)continue;
+    var k=line.slice(0,c).trim().toLowerCase();
+    if(k==='x-amz-trailer-signature')continue;
+    var v=line.slice(c+1).trim();
+    if(!/^[!#$%&'*+.^_|~0-9a-z-]+$/.test(k)||/[^	 -~]/.test(v))throw new Error('aws-chunked body: invalid trailer');
+    trailers[k]=v;
+  }
+  return {body:Buffer.concat(parts),trailers:trailers};
+}
+function tooLargeByHeaders(headers,cap){
+  var decoded=Number(headers['x-amz-decoded-content-length']);
+  if(decoded>cap)return decoded;
+  var raw=Number(headers['content-length']);
+  if(raw>rawCap(cap))return raw;
+  return 0;
+}
+function rawCap(cap){return cap+Math.max(1048576,Math.floor(cap/100));}
+function signRequest(o){
+  var amzDate=o.now.toISOString().replace(/[:-]|\.\d{3}/g,''),date=amzDate.slice(0,8),h=o.headers;
+  h['x-amz-date']=amzDate;
+  h['x-amz-content-sha256']=sha256hex(o.body);
+  if(o.creds.sessionToken)h['x-amz-security-token']=o.creds.sessionToken;
+  var names=Object.keys(h).filter(function(n){return n==='host'||n==='content-type'||n==='content-md5'||n.indexOf('x-amz-')===0;}).sort();
+  var canonHeaders=names.map(function(n){return n+':'+String(h[n]).trim().replace(/\s+/g,' ')+'\n';}).join('');
+  var signed=names.join(';');
+  var creq=[o.method,canonicalPath(o.path,o.service),canonicalQuery(splitQuery(o.query)),canonHeaders,signed,h['x-amz-content-sha256']].join('\n');
+  var scope=date+'/'+o.region+'/'+o.service+'/aws4_request';
+  var sts=['AWS4-HMAC-SHA256',amzDate,scope,sha256hex(creq)].join('\n');
+  var k=hmac(hmac(hmac(hmac('AWS4'+o.creds.secretAccessKey,date),o.region),o.service),'aws4_request');
+  var sig=crypto.createHmac('sha256',k).update(sts,'utf8').digest('hex');
+  h['authorization']='AWS4-HMAC-SHA256 Credential='+o.creds.accessKeyId+'/'+scope+', SignedHeaders='+signed+', Signature='+sig;
+  return h;
+}
+function prepareResign(req,body,cfg,now){
+  var url=String(req.url||'/'),qi=url.indexOf('?');
+  var path=qi<0?url:url.slice(0,qi),query=qi<0?'':url.slice(qi+1);
+  var incoming=req.headers,scope,signedRequest=false;
+  var pairs=splitQuery(query),cred,algo;
+  pairs.forEach(function(p){var lk=p.k.toLowerCase();if(lk==='x-amz-credential')cred=p.v;if(lk==='x-amz-algorithm')algo=p.v;});
+  // Presign parameters (a real token or signature among them) never go upstream,
+  // whether or not the request ALSO carries a header signature.
+  query=pairs.filter(function(p){return !PRESIGN_PARAMS.has(p.k.toLowerCase());}).map(function(p){return p.raw;}).join('&');
+  if(incoming['authorization']!==undefined){
+    signedRequest=true;
+    scope=parseAuthScope(incoming['authorization']);
+  }else if(cred!==undefined){
+    signedRequest=true;
+    scope=parseCredentialScope(algo||'AWS4-HMAC-SHA256',cred);
+  }
+  if(signedRequest&&!scope)return {error:{status:400,code:'IncompleteSignature',message:'cdk-local mixed mode: the request signature has no credential scope the AWS Emulator re-signing sidecar can read.'}};
+  var service=scope?scope.service:undefined;
+  var headers=upstreamHeaders(incoming);
+  if(isAwsChunked(incoming)){
+    var decoded;
+    try{decoded=decodeAwsChunked(body);}catch(e){return {error:{status:400,code:'IncompleteBody',message:'cdk-local mixed mode: '+e.message+'.'}};}
+    body=decoded.body;
+    Object.keys(decoded.trailers).forEach(function(k){if(!DROP_HEADERS.has(k))headers[k]=decoded.trailers[k];});
+    var ce=stripAwsChunked(headers['content-encoding']);
+    if(ce===undefined)delete headers['content-encoding'];else headers['content-encoding']=ce;
+  }
+  if(body.length>cfg.capBytes)return {error:tooLargeError(body.length,cfg.capBytes,service)};
+  headers['host']=cfg.upstreamHost;
+  headers['content-length']=String(body.length);
+  if(signedRequest){
+    var regionSet=incoming['x-amz-region-set'];
+    pairs.forEach(function(p){if(p.k.toLowerCase()==='x-amz-region-set'&&regionSet===undefined)regionSet=p.v;});
+    var region=scope.region||String(regionSet||'').split(',')[0].trim()||cfg.region||'us-east-1';
+    if(region==='*')region=cfg.region||'us-east-1';
+    signRequest({method:String(req.method||'GET'),path:path,query:query,headers:headers,body:body,region:region,service:service,creds:cfg.credentials,now:now});
+  }
+  return {path:query?path+'?'+query:path,headers:headers,body:body,service:service};
+}
+function tooLargeError(size,cap,service){
+  return {status:413,code:service==='s3'?'EntityTooLarge':'RequestEntityTooLargeException',message:'cdk-local mixed mode: the request body ('+size+' bytes) is over the '+cap+'-byte cap of the AWS Emulator re-signing sidecar, which holds a body in memory to sign it. Upload a large S3 object with multipart upload (each part under the cap), e.g. boto3 upload_file or @aws-sdk/lib-storage.'};
+}
+function errorBody(err,service){
+  if(service==='s3'||service===undefined)return {type:'application/xml',text:'<?xml version="1.0" encoding="UTF-8"?><Error><Code>'+err.code+'</Code><Message>'+err.message.replace(/&/g,'&amp;').replace(/</g,'&lt;')+'</Message></Error>'};
+  return {type:'application/x-amz-json-1.0',text:JSON.stringify({__type:err.code,message:err.message})};
+}
+`;
+const RESIGN_SIDECAR_SERVER = String.raw`
+function startResigner(cfgPath){return new Promise(function(done){
+  var fs=require('fs'),https=require('https'),http=require('http'),tls=require('tls');
+  var cfg;
+  try{cfg=JSON.parse(fs.readFileSync(cfgPath,'utf8'));}catch(e){done({error:'CONFIG_'+(e.code||'ERROR')});return;}
+  var up=new URL(cfg.upstream),secure=up.protocol==='https:',mod=secure?https:http;
+  cfg.upstreamHost=up.host;
+  var agentOpts={keepAlive:true};
+  if(secure&&cfg.upstreamCaPem)agentOpts.ca=tls.rootCertificates.concat([cfg.upstreamCaPem]);
+  var agent=new mod.Agent(agentOpts);
+  function send(resp,status,err,service){
+    if(resp.headersSent){resp.destroy();return;}
+    var b=errorBody(err,service);
+    resp.writeHead(status,{'content-type':b.type,'content-length':Buffer.byteLength(b.text),'connection':'close'});
+    resp.end(b.text);
+  }
+  function serviceOf(req){
+    var s=parseAuthScope(req.headers['authorization']||'');
+    if(!s){var m=/[?&]X-Amz-Credential=([^&]*)/i.exec(String(req.url||''));if(m)s=parseCredentialScope('AWS4-HMAC-SHA256',safeDecode(m[1]));}
+    return s?s.service:undefined;
+  }
+  // Bodies held at once, across concurrent requests: twice the per-request cap.
+  // Each held byte is charged twice: building the request body briefly keeps
+  // two copies alive (the received chunks while they are joined, then the
+  // joined body while an aws-chunked body is decoded), so the charged total
+  // bounds the real peak by inflightCap.
+  var inflight=0,inflightCap=2*rawCap(cfg.capBytes);
+  function handle(req,resp){
+    // held counts toward inflight until the response is over; seen is the
+    // body size for the 413 message.
+    var chunks=[],held=0,seen=0,over=false,busy=false,limit=rawCap(cfg.capBytes);
+    var drop=function(){inflight-=2*held;held=0;chunks=[];};
+    req.on('data',function(c){seen+=c.length;if(over||busy)return;if(seen>limit){over=true;drop();return;}if(inflight+2*c.length>inflightCap){busy=true;drop();return;}held+=c.length;inflight+=2*c.length;chunks.push(c);});
+    req.on('error',function(){drop();resp.destroy();});
+    resp.on('close',drop);
+    req.on('end',function(){
+      if(busy){send(resp,503,{code:'SlowDown',message:'cdk-local mixed mode: the AWS Emulator re-signing sidecar is holding too many request bodies at once; retry.'},serviceOf(req));return;}
+      if(over){process.stdout.write('CDKL-RESIGN rejected a streamed request body over the cap without holding it\n');send(resp,413,tooLargeError(seen,cfg.capBytes,serviceOf(req)),serviceOf(req));return;}
+      var p;
+      var joined=Buffer.concat(chunks);chunks=[];
+      try{p=prepareResign(req,joined,cfg,new Date());}catch(e){p={error:{status:400,code:'InvalidRequest',message:'cdk-local mixed mode: the request could not be re-signed.'}};}
+      joined=null;
+      if(p.error){if(p.error.status===413)process.stdout.write('CDKL-RESIGN rejected a request body over the cap\n');send(resp,p.error.status,p.error,serviceOf(req));return;}
+      var r;
+      try{r=mod.request({host:up.hostname.replace(/^\[|\]$/g,''),port:up.port||(secure?443:80),method:req.method,path:p.path,headers:p.headers,agent:agent},function(ur){
+        var h={};
+        Object.keys(ur.headers).forEach(function(k){if(k==='connection'||k==='keep-alive'||k==='transfer-encoding')return;h[k]=ur.headers[k];});
+        resp.writeHead(ur.statusCode||502,h);
+        ur.pipe(resp);
+        ur.on('error',function(){resp.destroy();});
+      });}catch(e){send(resp,400,{code:'InvalidRequest',message:'cdk-local mixed mode: the request has a header the AWS Emulator re-signing sidecar cannot forward.'},p.service);return;}
+      // A client that hangs up (an aborted GetObject) frees the upstream socket too.
+      resp.on('close',function(){if(!resp.writableFinished)r.destroy();});
+      r.setTimeout(300000,function(){r.destroy(Object.assign(new Error('upstream timeout'),{code:'ETIMEDOUT'}));});
+      r.on('error',function(e){process.stdout.write('CDKL-RESIGN upstream error '+(e.code||'ERROR')+'\n');send(resp,502,{code:'BadGateway',message:'cdk-local mixed mode: the AWS Emulator at '+cfg.upstream+' did not answer ('+(e.code||'ERROR')+').'},p.service);});
+      r.end(p.body);
+    });
+  }
+  var srv=https.createServer({key:cfg.keyPem,cert:cfg.certPem},handle);
+  srv.on('checkContinue',function(req,resp){
+    var n=tooLargeByHeaders(req.headers,cfg.capBytes);
+    if(n>0){process.stdout.write('CDKL-RESIGN rejected a request body over the cap\n');send(resp,413,tooLargeError(n,cfg.capBytes,serviceOf(req)),serviceOf(req));req.resume();return;}
+    resp.writeContinue();
+    handle(req,resp);
+  });
+  srv.once('error',function(e){done({error:e.code||'ERROR',port:cfg.port});});
+  // Loopback only: it signs with the emulator's keys for whoever connects.
+  srv.listen(cfg.port,'127.0.0.1',function(){done({port:cfg.port,address:srv.address().address});});
+});}
+`;
+const RESIGN_SIDECAR_SCRIPT = RESIGN_SIDECAR_CORE + RESIGN_SIDECAR_SERVER;
+
 //#endregion
 //#region src/local/workload-aws-wiring.ts
 var workload_aws_wiring_exports = /* @__PURE__ */ __exportAll({
@@ -355,6 +896,7 @@ var workload_aws_wiring_exports = /* @__PURE__ */ __exportAll({
 	EMULATOR_SCRUBBED_ENV_KEYS: () => EMULATOR_SCRUBBED_ENV_KEYS,
 	HOST_CA_TRUST_ENV_KEYS: () => HOST_CA_TRUST_ENV_KEYS,
 	HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS: () => HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS,
+	STALE_RESIGN_DIR_AGE_MS: () => STALE_RESIGN_DIR_AGE_MS,
 	activateWorkloadAwsWiring: () => activateWorkloadAwsWiring,
 	applyWorkloadAwsWiringToEnv: () => applyWorkloadAwsWiringToEnv,
 	awsEmulatorEnvName: () => awsEmulatorEnvName,
@@ -365,6 +907,7 @@ var workload_aws_wiring_exports = /* @__PURE__ */ __exportAll({
 	getContainerCaBundlePath: () => getContainerCaBundlePath,
 	getContainerJavaTruststorePath: () => getContainerJavaTruststorePath,
 	javaTruststoreToolOptions: () => javaTruststoreToolOptions,
+	loopbackForwarderPlan: () => loopbackForwarderPlan,
 	mergeJavaToolOptions: () => mergeJavaToolOptions,
 	parseAwsEndpoint: () => parseAwsEndpoint,
 	parseIniSections: () => parseIniSections,
@@ -375,6 +918,7 @@ var workload_aws_wiring_exports = /* @__PURE__ */ __exportAll({
 	resolveHostDefaultCredentials: () => resolveHostDefaultCredentials,
 	resolveWorkloadAwsWiring: () => resolveWorkloadAwsWiring,
 	setActiveWorkloadAwsWiring: () => setActiveWorkloadAwsWiring,
+	sweepStaleResignDirs: () => sweepStaleResignDirs,
 	writeCaBundleFile: () => writeCaBundleFile
 });
 const CA_TRUST_ENV_KEYS = [
@@ -559,15 +1103,20 @@ function getContainerCaBundlePath() {
 function expandHome(p, homeDir) {
 	return p === "~" ? homeDir : p.startsWith("~/") ? path$1.join(homeDir, p.slice(2)) : p;
 }
-function writeCaBundleFile(source) {
-	let pem;
-	try {
-		pem = readFileSync(source, "utf8");
-	} catch (err) {
-		throw new Error(`CA bundle ${displayUntrustedValue(source)} cannot be read (${err.code ?? "error"}).`);
+function writeCaBundleFile(source, extraCertsPem = []) {
+	const certs = [];
+	if (source !== void 0) {
+		let pem;
+		try {
+			pem = readFileSync(source, "utf8");
+		} catch (err) {
+			throw new Error(`CA bundle ${displayUntrustedValue(source)} cannot be read (${err.code ?? "error"}).`);
+		}
+		const found = pemCertificates(pem);
+		if (found.length === 0) throw new Error(`CA bundle ${displayUntrustedValue(source)} contains no PEM certificate.`);
+		certs.push(...found);
 	}
-	const certs = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
-	if (!certs) throw new Error(`CA bundle ${displayUntrustedValue(source)} contains no PEM certificate.`);
+	for (const extra of extraCertsPem) certs.push(...pemCertificates(extra));
 	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().productName}-ca-`));
 	const hostPath = path$1.join(dir, "ca-bundle.pem");
 	writeFileSync(hostPath, `${certs.join("\n")}\n${rootCertificates.join("\n")}\n`, { mode: 420 });
@@ -579,6 +1128,9 @@ function writeCaBundleFile(source) {
 		})
 	};
 }
+function pemCertificates(pem) {
+	return pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) ?? [];
+}
 const DEFAULT_AWS_EMULATOR_URL = "https://127.0.0.1:9297";
 function probeAwsEmulatorHealth(url, caPath) {
 	return new Promise((resolve) => {
@@ -607,6 +1159,108 @@ function probeAwsEmulatorHealth(url, caPath) {
 function describeEmulatorUnreachable(ep, reason) {
 	return `--aws-emulator ${ep.url}: no AWS Emulator answers its health check at ${ep.url}/__admin/health (${reason}). Check that it is running on port ${ep.port} (\`aws-emulator -p ${ep.port}\`, or its Docker image published with \`-p 127.0.0.1:${ep.port}:${ep.port}\`), that the URL's port matches, and that it listens on an address this machine reaches (\`-b\`).`;
 }
+const STALE_RESIGN_DIR_AGE_MS = 10800 * 1e3;
+function sweepStaleResignDirs(now = Date.now(), dir = tmpdir()) {
+	const removed = [];
+	const prefix = `${getEmbedConfig().productName}-resign-`;
+	const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
+	let names;
+	try {
+		names = readdirSync(dir);
+	} catch {
+		return removed;
+	}
+	for (const name of names) {
+		if (!name.startsWith(prefix)) continue;
+		const full = path$1.join(dir, name);
+		try {
+			const st = lstatSync(full);
+			if (!st.isDirectory() || uid !== void 0 && st.uid !== uid) continue;
+			if (now - st.mtimeMs < 108e5) continue;
+			const pid = Number(readFileSync(path$1.join(full, "owner.pid"), "utf8").trim());
+			if (!Number.isInteger(pid) || pid <= 0 || processAlive(pid)) continue;
+			rmSync(full, {
+				recursive: true,
+				force: true
+			});
+			removed.push(full);
+		} catch {}
+	}
+	return removed;
+}
+function processAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return err.code === "EPERM";
+	}
+}
+function resolveMixedModeWiring(args) {
+	const { ep, services, credentials, caSources, disposers } = args;
+	const caPems = [];
+	for (const source of caSources) try {
+		caPems.push(...pemCertificates(readFileSync(source, "utf8")));
+	} catch (err) {
+		throw new Error(`--aws-emulator: the CA bundle ${displayUntrustedValue(source)} cannot be read (${err.code ?? "error"}).`);
+	}
+	const upstreamCaPem = caPems.length > 0 ? caPems.join("\n") : void 0;
+	const tls = createMixedModeTlsMaterials();
+	const bundle = writeCaBundleFile(void 0, [...caPems, tls.caCertPem]);
+	disposers.push(bundle.dispose);
+	sweepStaleResignDirs();
+	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().productName}-resign-`));
+	disposers.push(() => rmSync(dir, {
+		recursive: true,
+		force: true
+	}));
+	writeFileSync(path$1.join(dir, "owner.pid"), String(process.pid), { mode: 384 });
+	const resignConfigHostPath = path$1.join(dir, "resign.json");
+	const config = {
+		port: MIXED_MODE_RESIGN_PORT,
+		upstream: ep.url,
+		...upstreamCaPem ? { upstreamCaPem } : {},
+		certPem: tls.certPem,
+		keyPem: tls.keyPem,
+		credentials: {
+			accessKeyId: credentials.accessKeyId,
+			secretAccessKey: credentials.secretAccessKey,
+			...credentials.sessionToken ? { sessionToken: credentials.sessionToken } : {}
+		},
+		capBytes: MIXED_MODE_RESIGN_BODY_CAP_BYTES,
+		...args.region ? { region: args.region } : {}
+	};
+	writeFileSync(resignConfigHostPath, JSON.stringify(config), { mode: 384 });
+	const containerPath = getContainerCaBundlePath();
+	const trust = {};
+	for (const k of CA_TRUST_ENV_KEYS) trust[k] = containerPath;
+	return {
+		mode: "forward",
+		mixed: {
+			services,
+			emulatorEndpoint: ep,
+			resignPort: MIXED_MODE_RESIGN_PORT,
+			resignEndpoint: `https://127.0.0.1:${MIXED_MODE_RESIGN_PORT}`,
+			resignConfigHostPath,
+			emulatorClientOverride: {
+				endpoint: ep.url,
+				...upstreamCaPem ? { caPem: upstreamCaPem } : {},
+				credentials: config.credentials
+			}
+		},
+		env: trust,
+		scrubEnvKeys: [],
+		mounts: [{
+			hostPath: bundle.hostPath,
+			containerPath
+		}],
+		loopbackPorts: ep.loopback ? [ep.port, MIXED_MODE_RESIGN_PORT] : [MIXED_MODE_RESIGN_PORT],
+		probeHealth: true,
+		caHostPath: bundle.hostPath,
+		...args.skipPull ? { skipPull: true } : {},
+		dispose: args.dispose
+	};
+}
 async function resolveWorkloadAwsWiring(opts) {
 	const env = opts.env ?? process.env;
 	const homeDir = opts.homeDir ?? homedir();
@@ -640,14 +1294,30 @@ async function resolveWorkloadAwsWiring(opts) {
 			}
 			const run = readEmulatorRunFiles(ep.port, homeDir);
 			const caSource = opts.caBundle || run.caPath || env["AWS_CA_BUNDLE"];
-			const failure = await (opts.probeHealth ?? probeAwsEmulatorHealth)(ep.url, caSource ? expandHome(caSource, homeDir) : void 0);
+			const mixedServices = emulatedServicesOf(opts.awsEmulatorSentinels ?? []);
+			const probeCa = mixedServices.length > 0 ? run.caPath || caSource : caSource;
+			const failure = await (opts.probeHealth ?? probeAwsEmulatorHealth)(ep.url, probeCa ? expandHome(probeCa, homeDir) : void 0);
 			if (failure) throw new Error(describeEmulatorUnreachable(ep, failure));
 			let credentials;
 			if (run.credentials) credentials = run.credentials;
 			else {
 				credentials = AUTH_OFF_PLACEHOLDER_CREDENTIALS;
-				getLogger().info(`--aws-emulator: ${path$1.join(run.dir, "emulator_credentials")} not found but the emulator is healthy, so it runs with --auth off; workload containers get placeholder credentials.`);
+				getLogger().info(`--aws-emulator: ${path$1.join(run.dir, "emulator_credentials")} not found but the emulator is healthy, ` + (mixedServices.length > 0 ? "so it runs with --auth off; the re-signing sidecar signs with placeholder credentials." : "so it runs with --auth off; workload containers get placeholder credentials."));
 			}
+			if (mixedServices.length > 0) return resolveMixedModeWiring({
+				ep,
+				services: mixedServices,
+				credentials,
+				caSources: [...new Set([
+					ep.url.startsWith("https:") ? run.caPath : void 0,
+					opts.caBundle,
+					env["AWS_CA_BUNDLE"]
+				].filter((c) => typeof c === "string" && c !== "").map((c) => expandHome(c, homeDir)))],
+				disposers,
+				dispose,
+				skipPull: opts.skipPull,
+				region: env["AWS_REGION"] || env["AWS_DEFAULT_REGION"] || void 0
+			});
 			const ca = caSource && ep.url.startsWith("https:") ? caMount(caSource) : void 0;
 			let java;
 			if (run.truststorePath && ep.url.startsWith("https:")) {
@@ -736,8 +1406,18 @@ function effectiveLoopbackPorts(env, wiring) {
 			if (ep.loopback) used.add(ep.port);
 		} catch {}
 	}
+	const mixed = wiring.mixed;
+	if (mixed && used.has(mixed.resignPort) && mixed.emulatorEndpoint.loopback) used.add(mixed.emulatorEndpoint.port);
 	return wiring.loopbackPorts.filter((p) => used.has(p));
 }
+function loopbackForwarderPlan(wiring, ports) {
+	const mixed = wiring.mixed;
+	if (!mixed || !ports.includes(mixed.resignPort)) return { ports: [...ports] };
+	return {
+		ports: ports.filter((p) => p !== mixed.resignPort),
+		resignConfigHostPath: mixed.resignConfigHostPath
+	};
+}
 function applyWorkloadAwsWiringToEnv(env, wiring, defaultCredentials) {
 	const out = {};
 	for (const [k, v] of Object.entries(env)) Object.defineProperty(out, k, {
@@ -746,6 +1426,11 @@ function applyWorkloadAwsWiringToEnv(env, wiring, defaultCredentials) {
 		configurable: true,
 		writable: true
 	});
+	for (const [k, v] of Object.entries(out)) {
+		if (!isAwsEmulatorSentinel(k, v)) continue;
+		if (!wiring.mixed || k === "AWS_ENDPOINT_URL") throw new Error(`${k}="${AWS_EMULATOR_SENTINEL}" reached a workload container outside mixed mode. The sentinel is read from the --env-vars file, on an AWS_ENDPOINT_URL_<SERVICE> variable, and needs --aws-emulator [url].`);
+		out[k] = wiring.mixed.resignEndpoint;
+	}
 	const setCreds = (c) => {
 		for (const k of CREDENTIAL_KEYS) delete out[k];
 		if (!c) return;
@@ -824,14 +1509,21 @@ function resolveAwsEmulatorOption(flag, env = process.env) {
 	return /^(1|true)$/i.test(raw) ? true : raw;
 }
 async function activateWorkloadAwsWiring(options) {
+	const awsEmulator = resolveAwsEmulatorOption(options.awsEmulator);
+	const sentinels = readAwsEmulatorSentinelsFromFile(options.envVars);
+	validateAwsEmulatorSentinels(sentinels, awsEmulator !== void 0, awsEmulatorEnvName());
 	const wiring = await resolveWorkloadAwsWiring({
-		awsEmulator: resolveAwsEmulatorOption(options.awsEmulator),
+		awsEmulator,
 		caBundle: options.caBundle,
 		profile: options.profile,
-		skipPull: options.pull === false
+		skipPull: options.pull === false,
+		awsEmulatorSentinels: sentinels
 	});
 	setActiveWorkloadAwsWiring(wiring);
-	if (wiring.mode === "emulator" && wiring.emulatorEndpoint) {
+	if (wiring.mixed) {
+		setAwsEndpointOverride(void 0);
+		getLogger().info(`Mixed mode: ${wiring.mixed.services.join(", ")} go to AWS Emulator at ${wiring.mixed.emulatorEndpoint.url} (re-signed with its keys); every other AWS call uses your real credentials.`);
+	} else if (wiring.mode === "emulator" && wiring.emulatorEndpoint) {
 		setAwsEndpointOverride({
 			endpoint: wiring.emulatorEndpoint.url,
 			...wiring.caHostPath ? { caPem: readFileSync(wiring.caHostPath, "utf8") } : {},
@@ -994,5 +1686,5 @@ function warnWorkloadCredentialsStripped() {
 }
 
 //#endregion
-export { probeAwsEmulatorHealth as A, getAwsEndpointOverride as B, effectiveLoopbackPorts as C, javaTruststoreToolOptions as D, getContainerJavaTruststorePath as E, resolveWorkloadAwsWiring as F, isWildcardHostname as G, proxyAwareFetch as H, setActiveWorkloadAwsWiring as I, hostFromAuthority as J, formatAuthority as K, workload_aws_wiring_exports as L, readProfileEndpointSettings as M, resolveAwsEmulatorOption as N, mergeJavaToolOptions as O, resolveHostDefaultCredentials as P, writeCaBundleFile as R, displayEndpointValue as S, getContainerCaBundlePath as T, setAwsEndpointOverride as U, isProxyEnvConfigured as V, isLoopbackHostname as W, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as _, deployAccountStsClientConfig as a, awsEmulatorEnvName as b, resetWorkloadIdentity as c, workloadStsClientConfig as d, AUTH_OFF_PLACEHOLDER_CREDENTIALS as f, HOST_CA_TRUST_ENV_KEYS as g, EMULATOR_SCRUBBED_ENV_KEYS as h, assumedRoleRecorded as i, readEmulatorRunFiles as j, parseAwsEndpoint as k, warnWorkloadCredentialsStripped as l, DEFAULT_AWS_EMULATOR_URL as m, accountLookupStsClientConfig as n, readEnvCallerCredentials as o, CA_TRUST_ENV_KEYS as p, formatHostForAuthority as q, applyWorkloadEnvCredentials as r, recordAssumedRole as s, SECOND_ASSUME_MESSAGE as t, workloadClientConfig as u, activateWorkloadAwsWiring as v, getActiveWorkloadAwsWiring as w, collectHostEndpointOverrides as x, applyWorkloadAwsWiringToEnv as y, buildProxyClientConfig as z };
-//# sourceMappingURL=workload-identity-ITM3p2Ed.js.map
+export { buildProxyClientConfig as $, parseAwsEndpoint as A, MIXED_MODE_RESIGN_BODY_CAP_BYTES as B, effectiveLoopbackPorts as C, javaTruststoreToolOptions as D, getContainerJavaTruststorePath as E, resolveHostDefaultCredentials as F, createMixedModeStateProvider as G, createMixedModeTlsMaterials as H, resolveWorkloadAwsWiring as I, isAwsEmulatorSentinel as J, emulatedServicesOf as K, setActiveWorkloadAwsWiring as L, readEmulatorRunFiles as M, readProfileEndpointSettings as N, loopbackForwarderPlan as O, resolveAwsEmulatorOption as P, awsEndpointOverrideClientConfig as Q, workload_aws_wiring_exports as R, displayEndpointValue as S, getContainerCaBundlePath as T, AWS_EMULATOR_SENTINEL as U, RESIGN_SIDECAR_SCRIPT as V, MIXED_MODE_RESIGN_PORT as W, resourceTypeMatchesEmulatedService as X, readAwsEmulatorSentinelsFromFile as Y, validateAwsEmulatorSentinels as Z, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as _, deployAccountStsClientConfig as a, isWildcardHostname as at, awsEmulatorEnvName as b, resetWorkloadIdentity as c, hostFromAuthority as ct, workloadStsClientConfig as d, getAwsEndpointOverride as et, AUTH_OFF_PLACEHOLDER_CREDENTIALS as f, HOST_CA_TRUST_ENV_KEYS as g, EMULATOR_SCRUBBED_ENV_KEYS as h, assumedRoleRecorded as i, isLoopbackHostname as it, probeAwsEmulatorHealth as j, mergeJavaToolOptions as k, warnWorkloadCredentialsStripped as l, DEFAULT_AWS_EMULATOR_URL as m, accountLookupStsClientConfig as n, proxyAwareFetch as nt, readEnvCallerCredentials as o, formatAuthority as ot, CA_TRUST_ENV_KEYS as p, findAwsEmulatorSentinels as q, applyWorkloadEnvCredentials as r, setAwsEndpointOverride as rt, recordAssumedRole as s, formatHostForAuthority as st, SECOND_ASSUME_MESSAGE as t, isProxyEnvConfigured as tt, workloadClientConfig as u, activateWorkloadAwsWiring as v, getActiveWorkloadAwsWiring as w, collectHostEndpointOverrides as x, applyWorkloadAwsWiringToEnv as y, writeCaBundleFile as z };
+//# sourceMappingURL=workload-identity-D5zkhVcF.js.map