cdk-local 0.163.4 → 0.163.6

package/dist/{local-studio-DK5chhyj.js → local-studio-BR8vPfCn.js}

@@ -1,7 +1,7 @@
 import { a as displayIdent, c as getEmbedConfig, i as STACK_REF_MAX_CODE_POINTS, o as displayStackName, s as displayToolOutput, t as getLogger, u as setEmbedConfig } from "./logger-Co5XVwco.js";
-import { $ as awsEndpointOverrideClientConfig, C as effectiveLoopbackPorts, F as resolveHostDefaultCredentials, G as createMixedModeStateProvider, b as awsEmulatorEnvName, d as workloadStsClientConfig, dt as formatAuthority, et as buildProxyClientConfig, ft as formatHostForAuthority, l as warnWorkloadCredentialsStripped, lt as isLoopbackHostname, n as accountLookupStsClientConfig, ot as proxyAwareFetch, pt as hostFromAuthority, r as applyWorkloadEnvCredentials, u as workloadClientConfig, ut as isWildcardHostname, v as activateWorkloadAwsWiring, w as getActiveWorkloadAwsWiring, y as applyWorkloadAwsWiringToEnv } from "./workload-identity-D3XdPJjV.js";
+import { C as effectiveLoopbackPorts, F as resolveHostDefaultCredentials, G as awsEndpointOverrideClientConfig, K as buildProxyClientConfig, Q as proxyAwareFetch, W as awsEmulatorRoutedServices, Y as isAwsServiceRoutedToEmulator, _t as isLoopbackHostname, b as awsEmulatorEnvName, bt as formatHostForAuthority, d as workloadStsClientConfig, gt as defineOwnKey, ht as resolveEnvVars$1, l as warnWorkloadCredentialsStripped, mt as readEnvVarsFileText, n as accountLookupStsClientConfig, pt as applyEnvOverrideMap, r as applyWorkloadEnvCredentials, rt as createMixedModeStateProvider, u as workloadClientConfig, v as activateWorkloadAwsWiring, vt as isWildcardHostname, w as getActiveWorkloadAwsWiring, xt as hostFromAuthority, y as applyWorkloadAwsWiringToEnv, yt as formatAuthority } from "./workload-identity-BOEZuEDO.js";
 import { c as clampErrorName, d as flattenToOneLine, f as isAwsServiceException, l as describeAwsFailureForWarn, m as stringifyThrown, o as renderAssemblyPathEscape, p as sanitizeServiceExceptionMessage, r as displayUntrustedValue, s as resolveAssemblyPath, t as absoluteAssemblyPathEscape, u as describeCredentialLoadFailure } from "./assembly-path-R96uhMm1.js";
-import { $ as isIamRoleArn, A as buildDockerImage, B as tryResolveImageFnJoin, D as isImageInLocalCache, E as warnIfEmulatedPlatform, F as parseEcrRegistryHost, G as RouteDiscoveryError, H as InteractiveTtyRequiredError, I as derivePartitionAndUrlSuffix, J as defineOwnKey, K as TargetSelectionCancelledError, L as derivePseudoParametersFromRegion, M as createShutdownSignalHandler, N as signalExitCode, O as parseEcrUri, P as describeExitWithoutArgv, Q as describeRejectedRoleArn, R as formatStateRemedy, T as buildContainerImage, U as LocalInvokeBuildError, V as CdkLocalError, W as LocalStartServiceError, X as applyRoleArnIfSet, Y as AssumeRoleFailure, Z as assumeRoleCredentials, a as describeRefusedSensitiveEnvKeys, c as execEnvForSecrets, d as rememberForwardedPorts, et as refusedRoleArnMessage, f as removeContainer, h as streamLogs, i as attachLoopbackForwarder, j as resolveAssetSourcePath, k as pullEcrImage, l as pickFreePort, m as startNamespaceOwnerForwarder, n as SENSITIVE_ENV_KEYS, nt as resolveProfileCredentials, p as runDetached, q as withErrorHandling, r as appendEnvFlags, s as ensureDockerAvailable, t as DockerRunnerError, tt as buildStsClientConfig, u as pullImage, w as architectureToPlatform, z as substituteImagePlaceholders } from "./docker-runner-Dq3y5-Me.js";
+import { $ as isIamRoleArn, A as buildDockerImage, B as substituteImagePlaceholders, D as isImageInLocalCache, E as warnIfEmulatedPlatform, F as parseEcrRegistryHost, G as LocalStartServiceError, H as CdkLocalError, I as contextForContainer, J as withErrorHandling, K as RouteDiscoveryError, L as derivePartitionAndUrlSuffix, M as createShutdownSignalHandler, N as signalExitCode, O as parseEcrUri, P as describeExitWithoutArgv, Q as describeRejectedRoleArn, R as derivePseudoParametersFromRegion, T as buildContainerImage, U as InteractiveTtyRequiredError, V as tryResolveImageFnJoin, W as LocalInvokeBuildError, X as applyRoleArnIfSet, Y as AssumeRoleFailure, Z as assumeRoleCredentials, a as describeRefusedSensitiveEnvKeys, c as execEnvForSecrets, d as rememberForwardedPorts, et as refusedRoleArnMessage, f as removeContainer, h as streamLogs, i as attachLoopbackForwarder, j as resolveAssetSourcePath, k as pullEcrImage, l as pickFreePort, m as startNamespaceOwnerForwarder, n as SENSITIVE_ENV_KEYS, nt as resolveProfileCredentials, p as runDetached, q as TargetSelectionCancelledError, r as appendEnvFlags, s as ensureDockerAvailable, t as DockerRunnerError, tt as buildStsClientConfig, u as pullImage, w as architectureToPlatform, z as formatStateRemedy } from "./docker-runner-B3OunVKV.js";
 import { a as isDockerClientEnvKey, c as runDockerStreaming, i as getDockerCmd, n as finchSecretArgvRefusal, o as isMalformedEnvKey, u as warnFinchArgvExposure } from "./docker-cmd-Cjg3jGYF.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, promises, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { Command, InvalidArgumentError, Option } from "commander";
@@ -321,10 +321,17 @@ var DynamicReferenceResolver = class {
 			return Promise.reject(new DynamicReferenceResolutionError(`${err.message.replace(/\.$/, "")} (${opts.consumer}).`));
 		}
 		const region = firstUsableRegion(ref.arnRegion, opts.region);
-		const cacheKey = `${region ?? ""}\u0000${raw}`;
+		const workload = opts.workload ?? this.options.workload;
+		const emulator = isAwsServiceRoutedToEmulator(ref.service === "secretsmanager" ? "SECRETS_MANAGER" : "SSM", workload);
+		const cacheKey = `${emulator ? "emulator" : "aws"}\u0000${region ?? ""}\u0000${raw}`;
 		let pending = this.cache.get(cacheKey);
 		if (!pending) {
-			pending = ref.service === "secretsmanager" ? this.fetchSecret(ref, region) : this.fetchParameter(ref, region);
+			const target = {
+				region,
+				workload,
+				emulator
+			};
+			pending = ref.service === "secretsmanager" ? this.fetchSecret(ref, target) : this.fetchParameter(ref, target);
 			this.cache.set(cacheKey, pending);
 			pending.catch(() => this.cache.delete(cacheKey));
 		}
@@ -336,14 +343,19 @@ var DynamicReferenceResolver = class {
 			throw err instanceof DeferredFailure ? err.render(opts) : err;
 		});
 	}
-	smClient(region) {
-		const key = region ?? "";
+	smClient(target) {
+		const { region, workload } = target;
+		const key = `${target.emulator ? "emulator" : "aws"}\u0000${region ?? ""}`;
 		let c = this.smClients.get(key);
 		if (!c) {
-			c = this.options.secretsManagerClientFactory?.(region) ?? new SecretsManagerClient({
+			c = this.options.secretsManagerClientFactory?.(region, {
+				workload,
+				emulator: target.emulator
+			}) ?? new SecretsManagerClient({
 				...workloadClientConfig({
 					profile: this.options.profile,
-					service: "SECRETS_MANAGER"
+					service: "SECRETS_MANAGER",
+					workload
 				}),
 				...region && { region },
 				...this.options.profile && { profile: this.options.profile }
@@ -352,14 +364,19 @@ var DynamicReferenceResolver = class {
 		}
 		return c;
 	}
-	ssmClient(region) {
-		const key = region ?? "";
+	ssmClient(target) {
+		const { region, workload } = target;
+		const key = `${target.emulator ? "emulator" : "aws"}\u0000${region ?? ""}`;
 		let c = this.ssmClients.get(key);
 		if (!c) {
-			c = this.options.ssmClientFactory?.(region) ?? new SSMClient({
+			c = this.options.ssmClientFactory?.(region, {
+				workload,
+				emulator: target.emulator
+			}) ?? new SSMClient({
 				...workloadClientConfig({
 					profile: this.options.profile,
-					service: "SSM"
+					service: "SSM",
+					workload
 				}),
 				...region && { region },
 				...this.options.profile && { profile: this.options.profile }
@@ -376,11 +393,12 @@ var DynamicReferenceResolver = class {
 		const detail = describeAwsFailureForWarn(err, operation);
 		return deferred((consumer, overridable) => `Could not resolve CloudFormation dynamic reference ${displayUntrustedValue(ref.raw)} for ${consumer} (${operation} in ${region ?? "the default region"}): ${detail}.${hint} Resolving it needs ${requiredPermissionsFor(ref)}. cdk-local does not fall back to the unresolved token` + (overridable ? "; override the variable with --env-vars to skip the lookup." : "."));
 	}
-	async fetchSecret(ref, region) {
-		const operation = "SecretsManager GetSecretValue";
+	async fetchSecret(ref, target) {
+		const { region } = target;
+		const operation = `SecretsManager GetSecretValue${target.emulator ? " on AWS Emulator" : ""}`;
 		let secretString;
 		try {
-			secretString = (await this.smClient(region).send(new GetSecretValueCommand({
+			secretString = (await this.smClient(target).send(new GetSecretValueCommand({
 				SecretId: ref.secretId,
 				...ref.versionStage && { VersionStage: ref.versionStage },
 				...ref.versionId && { VersionId: ref.versionId }
@@ -403,12 +421,13 @@ var DynamicReferenceResolver = class {
 		const value = parsed[jsonKey];
 		return typeof value === "string" ? value : JSON.stringify(value);
 	}
-	async fetchParameter(ref, region) {
-		const operation = "SSM GetParameter";
+	async fetchParameter(ref, target) {
+		const { region } = target;
+		const operation = `SSM GetParameter${target.emulator ? " on AWS Emulator" : ""}`;
 		let value;
 		let type;
 		try {
-			const resp = await this.ssmClient(region).send(new GetParameterCommand({
+			const resp = await this.ssmClient(target).send(new GetParameterCommand({
 				Name: ref.version !== void 0 ? `${ref.name}:${ref.version}` : ref.name,
 				WithDecryption: ref.service === "ssm-secure"
 			}));
@@ -422,6 +441,14 @@ var DynamicReferenceResolver = class {
 		return value;
 	}
 };
+function crossStackDynamicReferenceHook(resolver, consumer) {
+	return (value, producerRegion, workload) => resolver.resolveString(value, {
+		region: producerRegion,
+		workload,
+		consumer,
+		overridable: false
+	});
+}
 function keysNotFromTemplate(templateEnv, finalEnv) {
 	const out = /* @__PURE__ */ new Set();
 	for (const [k, v] of Object.entries(finalEnv)) {
@@ -440,7 +467,8 @@ async function resolveDynamicReferencesInEnv(env, options) {
 	try {
 		const values = await Promise.all(candidates.map((k) => resolver.resolveString(env[k], {
 			region: options.region,
-			consumer: `${options.label} env var ${displayUntrustedValue(k)}`
+			consumer: `${options.label} env var ${displayUntrustedValue(k)}`,
+			...options.workload !== void 0 && { workload: options.workload }
 		})));
 		const out = {};
 		for (const k of Object.keys(env)) defineOwnKey(out, k, env[k]);
@@ -1069,6 +1097,20 @@ function resolveAgentCoreTarget(target, stacks, imageContext) {
 	if (resource.Type !== "AWS::BedrockAgentCore::Runtime") throw new AgentCoreResolutionError(`Resource ${displayIdent(logicalId)} in ${stack.stackName} is ${resource.Type}, not ${AGENTCORE_RUNTIME_TYPE}. ${getEmbedConfig().cliName} invoke-agentcore only runs Bedrock AgentCore Runtime resources.`);
 	return extractRuntimeProperties(stack, logicalId, resource, resources, imageContext);
 }
+function agentCoreTargetWorkload(target, stacks) {
+	try {
+		const parsed = parseTarget(target);
+		const stack = pickStack$5(parsed, stacks, target);
+		const { logicalId, resource } = matchRuntime(parsed, target, stack, stack.template.Resources ?? {});
+		const path = resource.Metadata?.["aws:cdk:path"];
+		return {
+			logicalId,
+			cdkPath: typeof path === "string" ? path : void 0
+		};
+	} catch {
+		return;
+	}
+}
 function pickAgentCoreCandidateStack(target, stacks) {
 	return candidateTargetStack(parseTarget(target), target, stacks);
 }
@@ -2998,6 +3040,7 @@ var CfnLocalStateProvider = class {
 	agentCoreControlClient;
 	clientOptions;
 	endpointOverride;
+	workload;
 	disposed = false;
 	lastLoadError;
 	constructor(opts) {
@@ -3005,6 +3048,7 @@ var CfnLocalStateProvider = class {
 		this.region = opts.region;
 		this.clientOptions = { region: opts.region };
 		this.endpointOverride = opts.endpointOverride;
+		this.workload = opts.workload;
 		this.label = opts.label ?? "--from-cfn-stack";
 		if (opts.profile !== void 0 && !opts.endpointOverride) this.clientOptions.profile = opts.profile;
 	}
@@ -3046,7 +3090,10 @@ var CfnLocalStateProvider = class {
 		if (!this.ssmClient) this.ssmClient = new SSMClient({
 			...workloadClientConfig({
 				profile: this.clientOptions.profile,
-				...this.endpointOverride ? {} : { service: "SSM" }
+				...this.endpointOverride ? {} : {
+					service: "SSM",
+					workload: this.workload
+				}
 			}),
 			...this.overrideClientConfig(),
 			region: this.region,
@@ -3327,10 +3374,13 @@ function createLocalStateProvider(options, stackName, synthRegion, extraStatePro
 		const real = new CfnLocalStateProvider({
 			cfnStackName,
 			region,
-			...options.profile !== void 0 && { profile: options.profile }
+			...options.profile !== void 0 && { profile: options.profile },
+			...behavior.workload !== void 0 && { workload: behavior.workload }
 		});
 		const mixed = behavior.realAwsOnly ? void 0 : getActiveWorkloadAwsWiring()?.mixed;
 		if (!mixed) return real;
+		const emulatedServices = awsEmulatorRoutedServices(behavior.workload) ?? mixed.services;
+		if (emulatedServices.length === 0) return real;
 		return createMixedModeStateProvider({
 			real,
 			emulator: new CfnLocalStateProvider({
@@ -3339,13 +3389,34 @@ function createLocalStateProvider(options, stackName, synthRegion, extraStatePro
 				endpointOverride: mixed.emulatorClientOverride,
 				label: "--from-cfn-stack (AWS Emulator)"
 			}),
-			emulatedServices: mixed.services
+			emulatedServices
 		});
 	}
 	if (activeExtras.length === 1) {
 		const factory = extraStateProviders[activeExtras[0]];
-		return factory(options);
+		return factory(options, behavior);
+	}
+}
+const UNNAMED_WORKLOAD = Object.freeze({});
+function groupWorkloadsRoutedApart(items, workloadOf) {
+	const base = awsEmulatorRoutedServices(UNNAMED_WORKLOAD);
+	if (base === void 0) return [];
+	const baseKey = base.join(",");
+	const groups = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const workload = workloadOf(item);
+		const services = awsEmulatorRoutedServices(workload) ?? base;
+		const key = services.join(",");
+		if (key === baseKey) continue;
+		const group = groups.get(key);
+		if (group) group.items.push(item);
+		else groups.set(key, {
+			services,
+			workload,
+			items: [item]
+		});
 	}
+	return [...groups.values()];
 }
 function toFlagName(field) {
 	return "--" + field.replace(/([A-Z])/g, "-$1").toLowerCase();
@@ -4222,7 +4293,7 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 	const command = pickStringArray$1(c["Command"]);
 	const entryPoint = pickStringArray$1(c["EntryPoint"]);
 	const workingDirectory = pickString(c["WorkingDirectory"]);
-	const subContext = buildSubstitutionContextFromImageContext(context);
+	const subContext = buildSubstitutionContextFromImageContext(contextForContainer(context, name));
 	const environment = {};
 	const sensitiveEnvKeys = [];
 	const droppedEnvKeys = [];
@@ -4625,7 +4696,46 @@ function checkVolumeHostPath(hostPath) {
 		return false;
 	}
 }
-async function applyCrossStackResolverToTask(task, context) {
+async function applyCrossStackValuesToTask(task, crossStackResolver, opts) {
+	const { imageContext } = opts;
+	const dynamicRefs = new DynamicReferenceResolver({ ...opts.profile !== void 0 && { profile: opts.profile } });
+	const subContext = {
+		resources: imageContext?.stateResources ?? {},
+		...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
+		...imageContext?.stateParameters && { parameters: imageContext.stateParameters },
+		...imageContext?.stateSensitiveParameters?.length && { sensitiveParameters: new Set(imageContext.stateSensitiveParameters) },
+		consumerRegion: opts.consumerRegion,
+		crossStackResolver,
+		resolveDynamicReferences: crossStackDynamicReferenceHook(dynamicRefs, `Task ${task.taskDefinitionLogicalId} cross-stack env value`)
+	};
+	const containerState = (name) => {
+		const own = imageContext?.containerStates;
+		if (!own || !Object.hasOwn(own, name)) return void 0;
+		const state = own[name];
+		return {
+			resources: state.stateResources ?? {},
+			parameters: state.stateParameters,
+			sensitiveParameters: state.stateSensitiveParameters?.length ? new Set(state.stateSensitiveParameters) : void 0
+		};
+	};
+	try {
+		await applyCrossStackResolverToTask(task, subContext, containerState);
+	} finally {
+		dynamicRefs.dispose();
+	}
+}
+function withContainerState(context, state) {
+	const out = {
+		...context,
+		resources: state.resources
+	};
+	if (state.parameters) out.parameters = state.parameters;
+	else delete out.parameters;
+	if (state.sensitiveParameters) out.sensitiveParameters = state.sensitiveParameters;
+	else delete out.sensitiveParameters;
+	return out;
+}
+async function applyCrossStackResolverToTask(task, context, containerState) {
 	if (!context.crossStackResolver) return;
 	const { resolveDynamicReferences: _envOnly, ...secretContext } = context;
 	const rawContainers = (task.resource.Properties ?? {})["ContainerDefinitions"];
@@ -4636,6 +4746,13 @@ async function applyCrossStackResolverToTask(task, context) {
 		if (!raw || typeof raw !== "object") continue;
 		const c = raw;
 		const containerName = pickString(c["Name"]) ?? container.name;
+		const resolveRefs = context.resolveDynamicReferences;
+		const ownState = containerState?.(container.name);
+		const baseContext = ownState ? withContainerState(context, ownState) : context;
+		const containerContext = resolveRefs ? {
+			...baseContext,
+			resolveDynamicReferences: (v, region) => resolveRefs(v, region, { containerName: container.name })
+		} : baseContext;
 		const resolvedEnvKeys = /* @__PURE__ */ new Set();
 		const resolvedSecretNames = /* @__PURE__ */ new Set();
 		if (Array.isArray(c["Environment"])) for (const entry of c["Environment"]) {
@@ -4647,7 +4764,7 @@ async function applyCrossStackResolverToTask(task, context) {
 			if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") continue;
 			if (Object.hasOwn(container.environment, key)) continue;
 			if (!isCrossStackIntrinsic(value)) continue;
-			const { result: sub, consumedSensitive } = await resolveWithSensitivityAsync(value, context);
+			const { result: sub, consumedSensitive } = await resolveWithSensitivityAsync(value, containerContext);
 			if (sub.kind === "literal") {
 				defineOwnKey(container.environment, key, String(sub.value));
 				resolvedEnvKeys.add(key);
@@ -4663,7 +4780,7 @@ async function applyCrossStackResolverToTask(task, context) {
 			if (typeof valueFromRaw === "string" && valueFromRaw.length > 0) continue;
 			if (container.secrets.some((s) => s.name === sName)) continue;
 			if (!isCrossStackIntrinsic(valueFromRaw)) continue;
-			const sub = await substituteAgainstStateAsync(valueFromRaw, secretContext);
+			const sub = await substituteAgainstStateAsync(valueFromRaw, ownState ? withContainerState(secretContext, ownState) : secretContext);
 			if (sub.kind === "literal" && typeof sub.value === "string" && sub.value.length > 0) {
 				container.secrets.push({
 					name: sName,
@@ -10117,39 +10234,6 @@ function availableApiIdentifiers(routes) {
 	return out;
 }
 
-//#endregion
-//#region src/local/env-resolver.ts
-function resolveEnvVars$1(logicalId, displayPath, templateEnv, overrides) {
-	const resolved = {};
-	const unresolved = [];
-	if (templateEnv) for (const [key, value] of Object.entries(templateEnv)) if (isLiteralEnvValue(value)) defineOwnKey(resolved, key, String(value));
-	else unresolved.push(key);
-	if (overrides) {
-		applyEnvOverrideMap(resolved, overrides.Parameters);
-		for (const [key, val] of Object.entries(overrides)) {
-			if (key === "Parameters") continue;
-			if (!val || typeof val !== "object") continue;
-			if (key === logicalId) {
-				applyEnvOverrideMap(resolved, val);
-				continue;
-			}
-			if (displayPath && (displayPath === key || displayPath.startsWith(`${key}/`))) applyEnvOverrideMap(resolved, val);
-		}
-	}
-	return {
-		resolved,
-		unresolved
-	};
-}
-function applyEnvOverrideMap(acc, map) {
-	if (!map) return;
-	for (const [key, value] of Object.entries(map)) if (value === null) delete acc[key];
-	else if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") defineOwnKey(acc, key, String(value));
-}
-function isLiteralEnvValue(value) {
-	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
-}
-
 //#endregion
 //#region src/local/layer-arn-materializer.ts
 var LayerMaterializationError = class LayerMaterializationError extends Error {
@@ -10783,7 +10867,7 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 			for (const [k, v] of direct) corsConfigByApiId.set(k, v);
 		}
 		assertServedLogicalIdsUnambiguous(servedStacks, servedRoutes, routesWithAuth, webSocketApis);
-		const stateByStack = isCfnFlagPresent(options) || hasExtraStateProviderActive(options, extraStateProviders) ? await loadStateForRoutedStacks(servedStacks, servedRoutes, routesWithAuth, options, extraStateProviders) : /* @__PURE__ */ new Map();
+		const stateByStack = isCfnFlagPresent(options) || hasExtraStateProviderActive(options, extraStateProviders) ? await loadStateForRoutedStacks(servedStacks, servedRoutes, routesWithAuth, options, extraStateProviders, webSocketApis) : /* @__PURE__ */ new Map();
 		const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
 		if (options.profile && profileCredentials && !profileCredsFile) profileCredsFile = await writeProfileCredentialsFile(options.profile, profileCredentials);
 		const lambdaIds = uniqueLambdaIds(servedRoutes, routesWithAuth, webSocketApis);
@@ -11356,7 +11440,8 @@ async function buildContainerSpec(args) {
 		platform = architectureToPlatform(lambda.architecture);
 	}
 	let templateEnv = getTemplateEnv$1(lambda.resource);
-	const stateBundle = stateByStack.get(lambda.stack.stackName);
+	const stackBundle = stateByStack.get(lambda.stack.stackName);
+	const stateBundle = stackBundle?.byLambda?.get(logicalId) ?? (stackBundle?.withoutSharedState ? void 0 : stackBundle);
 	let stateAudit;
 	const plaintextKeys = /* @__PURE__ */ new Set();
 	const deployedSecretKeys = [];
@@ -11402,7 +11487,11 @@ async function buildContainerSpec(args) {
 		region: firstUsableRegion(stateBundle?.region, stackRegionOverride, lambda.stack.region, stsRegion, profileRegion),
 		label: `Lambda ${logicalId}`,
 		skipKeys: plaintextKeys,
-		...profile !== void 0 && { profile }
+		...profile !== void 0 && { profile },
+		workload: {
+			logicalId,
+			cdkPath: lambdaCdkPath
+		}
 	});
 	const dockerEnv = {
 		AWS_LAMBDA_FUNCTION_NAME: logicalId,
@@ -11417,7 +11506,7 @@ async function buildContainerSpec(args) {
 		logicalId,
 		assumeRole,
 		lambdaResource: lambda.resource,
-		stateBundle
+		stateBundle: stackBundle?.withoutSharedState ? void 0 : stackBundle
 	});
 	if (roleArn) {
 		const creds = await assumeLambdaExecutionRole(roleArn, stsRegion, profile);
@@ -11708,7 +11797,7 @@ function readEnvOverridesFile$4(filePath) {
 	if (!filePath) return void 0;
 	let raw;
 	try {
-		raw = readFileSync(filePath, "utf-8");
+		raw = readEnvVarsFileText(filePath);
 	} catch (err) {
 		throw new Error(`Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`);
 	}
@@ -11849,10 +11938,9 @@ function envHasIntrinsicValue$1(templateEnv) {
 	}
 	return false;
 }
-async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options, extraStateProviders) {
-	const logger = getLogger();
+async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options, extraStateProviders, webSocketApis = []) {
 	const out = /* @__PURE__ */ new Map();
-	const lambdaIds = uniqueLambdaIds(routes, routesWithAuth);
+	const lambdaIds = uniqueLambdaIds(routes, routesWithAuth, webSocketApis);
 	const reachableStackNames = /* @__PURE__ */ new Set();
 	for (const logicalId of lambdaIds) for (const stack of stacks) {
 		const resource = stack.template.Resources?.[logicalId];
@@ -11874,51 +11962,88 @@ async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options,
 	for (const stackName of reachableStackNames) {
 		const stack = stacks.find((s) => s.stackName === stackName);
 		if (!stack) continue;
-		const provider = createLocalStateProvider(options, stack.stackName, await resolveCfnFallbackRegion(options, stack.region), extraStateProviders);
-		if (!provider) continue;
-		try {
-			const loaded = await provider.load(stack.stackName, stack.region);
-			if (!loaded) continue;
-			const bundle = {
-				state: {
-					version: 1,
-					stackName: stack.stackName,
-					resources: loaded.resources,
-					outputs: loaded.outputs,
-					lastModified: 0
-				},
-				region: loaded.region
-			};
-			if (stackHasIntrinsicEnv(stackName)) {
-				const pseudo = await resolvePseudoParametersForStartApi(loaded.region, options);
-				if (pseudo) bundle.pseudoParameters = pseudo;
-			}
-			if (provider.resolveDeployedFunctionEnv) {
-				const deployedEnvByLambda = /* @__PURE__ */ new Map();
-				for (const logicalId of lambdaIds) {
-					const resource = stack.template.Resources?.[logicalId];
-					if (!resource || resource.Type !== "AWS::Lambda::Function") continue;
-					if (!envHasIntrinsicValue$1(getTemplateEnv$1(resource))) continue;
-					const physicalId = loaded.resources[logicalId]?.physicalId;
-					if (!physicalId) continue;
-					const deployedEnv = await provider.resolveDeployedFunctionEnv(physicalId);
-					if (deployedEnv) deployedEnvByLambda.set(logicalId, deployedEnv);
-				}
-				if (deployedEnvByLambda.size > 0) bundle.deployedEnvByLambda = deployedEnvByLambda;
-			}
-			if (stackHasIntrinsicEnv(stackName) && provider.resolveTemplateSsmParameters) {
-				const ssmParameters = await provider.resolveTemplateSsmParameters(stack.template);
-				if (Object.keys(ssmParameters.values).length > 0) bundle.ssmParameters = ssmParameters.values;
-				if (ssmParameters.secureStringLogicalIds.length > 0) bundle.ssmSecureStringLogicalIds = ssmParameters.secureStringLogicalIds;
-			}
-			out.set(stackName, bundle);
-			logger.debug(`${provider.label}: loaded state for ${displayStackName(stackName)} (${loaded.region})`);
-		} finally {
-			provider.dispose();
+		const region = await resolveCfnFallbackRegion(options, stack.region);
+		const providerFor = (workload) => createLocalStateProvider(options, stack.stackName, region, extraStateProviders, { workload });
+		const stackLambdaIds = lambdaIds.filter((id) => stack.template.Resources?.[id]?.Type === "AWS::Lambda::Function");
+		const groups = groupWorkloadsRoutedApart(stackLambdaIds, (logicalId) => ({
+			logicalId,
+			cdkPath: readCdkPathOrUndefined(stack.template.Resources[logicalId])
+		}));
+		const grouped = new Set(groups.flatMap((g) => g.items));
+		const shared = await loadStackStateBundle(stack, providerFor(UNNAMED_WORKLOAD), {
+			lambdaIds: stackLambdaIds.filter((id) => !grouped.has(id)),
+			intrinsicEnv: stackHasIntrinsicEnv(stackName),
+			options
+		});
+		const byLambda = /* @__PURE__ */ new Map();
+		for (const group of groups) {
+			const own = await loadStackStateBundle(stack, providerFor(group.workload), {
+				lambdaIds: group.items,
+				intrinsicEnv: stackHasIntrinsicEnv(stackName),
+				options,
+				...shared?.pseudoParameters && { pseudoParameters: shared.pseudoParameters }
+			});
+			if (own) for (const logicalId of group.items) byLambda.set(logicalId, own);
 		}
+		const bundle = shared ?? (byLambda.size > 0 ? {
+			state: {
+				version: 1,
+				stackName: stack.stackName,
+				resources: {},
+				outputs: {},
+				lastModified: 0
+			},
+			withoutSharedState: true
+		} : void 0);
+		if (!bundle) continue;
+		if (byLambda.size > 0) bundle.byLambda = byLambda;
+		out.set(stackName, bundle);
 	}
 	return out;
 }
+async function loadStackStateBundle(stack, provider, args) {
+	if (!provider) return void 0;
+	try {
+		const loaded = await provider.load(stack.stackName, stack.region);
+		if (!loaded) return void 0;
+		const bundle = {
+			state: {
+				version: 1,
+				stackName: stack.stackName,
+				resources: loaded.resources,
+				outputs: loaded.outputs,
+				lastModified: 0
+			},
+			region: loaded.region
+		};
+		if (args.intrinsicEnv) {
+			const pseudo = args.pseudoParameters ?? await resolvePseudoParametersForStartApi(loaded.region, args.options);
+			if (pseudo) bundle.pseudoParameters = pseudo;
+		}
+		if (provider.resolveDeployedFunctionEnv) {
+			const deployedEnvByLambda = /* @__PURE__ */ new Map();
+			for (const logicalId of args.lambdaIds) {
+				const resource = stack.template.Resources?.[logicalId];
+				if (!resource || resource.Type !== "AWS::Lambda::Function") continue;
+				if (!envHasIntrinsicValue$1(getTemplateEnv$1(resource))) continue;
+				const physicalId = loaded.resources[logicalId]?.physicalId;
+				if (!physicalId) continue;
+				const deployedEnv = await provider.resolveDeployedFunctionEnv(physicalId);
+				if (deployedEnv) deployedEnvByLambda.set(logicalId, deployedEnv);
+			}
+			if (deployedEnvByLambda.size > 0) bundle.deployedEnvByLambda = deployedEnvByLambda;
+		}
+		if (args.intrinsicEnv && provider.resolveTemplateSsmParameters) {
+			const ssmParameters = await provider.resolveTemplateSsmParameters(stack.template);
+			if (Object.keys(ssmParameters.values).length > 0) bundle.ssmParameters = ssmParameters.values;
+			if (ssmParameters.secureStringLogicalIds.length > 0) bundle.ssmSecureStringLogicalIds = ssmParameters.secureStringLogicalIds;
+		}
+		getLogger().debug(`${provider.label}: loaded state for ${displayStackName(stack.stackName)} (${loaded.region})`);
+		return bundle;
+	} finally {
+		provider.dispose();
+	}
+}
 async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	const logger = getLogger();
 	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stateRegion;
@@ -12352,11 +12477,17 @@ function getTemplateEnv(resource) {
 	if (!vars || typeof vars !== "object") return void 0;
 	return vars;
 }
+function lambdaWorkload(lambda) {
+	return {
+		logicalId: lambda.logicalId,
+		cdkPath: readCdkPathOrUndefined(lambda.resource)
+	};
+}
 function readEnvOverridesFile$3(filePath) {
 	if (!filePath) return void 0;
 	let raw;
 	try {
-		raw = readFileSync(filePath, "utf-8");
+		raw = readEnvVarsFileText(filePath);
 	} catch (err) {
 		throw new Error(`Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`);
 	}
@@ -12409,7 +12540,10 @@ function applyProfileCredentialsOverlay(env, profileCreds, assumeRoleActive) {
 	else delete env["AWS_SESSION_TOKEN"];
 }
 async function resolveLambdaContainerEnv(lambda, options, profileCredentials, extraStateProviders) {
-	const dynamicRefs = new DynamicReferenceResolver({ ...options.profile !== void 0 && { profile: options.profile } });
+	const dynamicRefs = new DynamicReferenceResolver({
+		...options.profile !== void 0 && { profile: options.profile },
+		workload: lambdaWorkload(lambda)
+	});
 	try {
 		return await resolveLambdaContainerEnvWith(lambda, options, profileCredentials, extraStateProviders, dynamicRefs);
 	} finally {
@@ -12428,7 +12562,7 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 	const overriddenKeys = keysOverriddenBy(declaredEnv, (env) => resolveEnvVars$1(lambda.logicalId, lambdaCdkPath, env, overrides).resolved);
 	let templateEnv = declaredEnv && withoutKeys(declaredEnv, overriddenKeys);
 	let stateForRoleHint;
-	const stateProvider = createLocalStateProvider(options, lambda.stack.stackName, await resolveCfnFallbackRegion(options, lambda.stack.region), extraStateProviders);
+	const stateProvider = createLocalStateProvider(options, lambda.stack.stackName, await resolveCfnFallbackRegion(options, lambda.stack.region), extraStateProviders, { workload: lambdaWorkload(lambda) });
 	if (stateProvider) try {
 		const loaded = await stateProvider.load(lambda.stack.stackName, lambda.stack.region);
 		if (loaded) {
@@ -13565,7 +13699,7 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 			onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} invoke-agentcore requires a <target> (an AgentCore Runtime display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_INVOKE_AGENTCORE_TARGET_REQUIRED")
 		});
 		const candidate = pickAgentCoreCandidateStack(resolvedTarget, stacks);
-		stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
+		stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders, { workload: agentCoreTargetWorkload(resolvedTarget, stacks) });
 		const { context: imageContext, loaded: loadedState } = stateProvider && candidate ? await buildAgentCoreImageContext(candidate, stateProvider, options) : {
 			context: void 0,
 			loaded: void 0
@@ -13923,7 +14057,13 @@ function findFileAssetByObjectKey(fileAssets, hash) {
 	for (const asset of fileAssets.values()) if (Object.values(asset.destinations).some((d) => d.objectKey === zip || d.objectKey.endsWith(`/${zip}`))) return asset;
 }
 async function buildContainerEnv(resolved, options, profileCredentials, profileCredsFile, stateProvider, loaded, imageContext) {
-	const dynamicRefs = new DynamicReferenceResolver({ ...options.profile !== void 0 && { profile: options.profile } });
+	const dynamicRefs = new DynamicReferenceResolver({
+		...options.profile !== void 0 && { profile: options.profile },
+		workload: {
+			logicalId: resolved.logicalId,
+			cdkPath: readCdkPathOrUndefined(resolved.resource)
+		}
+	});
 	try {
 		return await buildContainerEnvWith(resolved, options, profileCredentials, profileCredsFile, stateProvider, loaded, imageContext, dynamicRefs);
 	} finally {
@@ -14269,7 +14409,7 @@ function readEnvOverridesFile$2(filePath) {
 	if (!filePath) return void 0;
 	let raw;
 	try {
-		raw = readFileSync(filePath, "utf-8");
+		raw = readEnvVarsFileText(filePath);
 	} catch (err) {
 		throw new Error(`Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`);
 	}
@@ -14962,26 +15102,49 @@ var EcsSecretsResolutionError = class EcsSecretsResolutionError extends Error {
 async function resolveEcsSecrets(entries, options = {}) {
 	if (entries.length === 0) return [];
 	const logger = getLogger().child("ecs-secrets");
-	const secretsClient = options.secretsManagerClient ?? new SecretsManagerClient({
-		...workloadClientConfig({
-			profile: options.profile,
-			service: "SECRETS_MANAGER"
-		}),
-		...options.region && { region: options.region },
-		...options.profile && { profile: options.profile }
-	});
-	const ssmClient = options.ssmClient ?? new SSMClient({
-		...workloadClientConfig({
-			profile: options.profile,
-			service: "SSM"
-		}),
-		...options.region && { region: options.region },
-		...options.profile && { profile: options.profile }
-	});
-	const ownsSecretsClient = options.secretsManagerClient === void 0;
-	const ownsSsmClient = options.ssmClient === void 0;
+	const owned = [];
+	const smClients = /* @__PURE__ */ new Map();
+	const ssmClients = /* @__PURE__ */ new Map();
+	const clientsFor = (containerName) => {
+		const workload = { containerName };
+		const smRoute = isAwsServiceRoutedToEmulator("SECRETS_MANAGER", workload);
+		const ssmRoute = isAwsServiceRoutedToEmulator("SSM", workload);
+		let secretsClient = options.secretsManagerClient ?? smClients.get(smRoute);
+		if (!secretsClient) {
+			secretsClient = new SecretsManagerClient({
+				...workloadClientConfig({
+					profile: options.profile,
+					service: "SECRETS_MANAGER",
+					workload
+				}),
+				...options.region && { region: options.region },
+				...options.profile && { profile: options.profile }
+			});
+			smClients.set(smRoute, secretsClient);
+			owned.push(secretsClient);
+		}
+		let ssmClient = options.ssmClient ?? ssmClients.get(ssmRoute);
+		if (!ssmClient) {
+			ssmClient = new SSMClient({
+				...workloadClientConfig({
+					profile: options.profile,
+					service: "SSM",
+					workload
+				}),
+				...options.region && { region: options.region },
+				...options.profile && { profile: options.profile }
+			});
+			ssmClients.set(ssmRoute, ssmClient);
+			owned.push(ssmClient);
+		}
+		return {
+			secretsClient,
+			ssmClient
+		};
+	};
 	try {
 		return await Promise.all(entries.map(async (entry) => {
+			const { secretsClient, ssmClient } = clientsFor(entry.containerName);
 			const value = await resolveOne(entry, secretsClient, ssmClient);
 			logger.debug(`Resolved secret ${displayIdent(entry.containerName)}.${displayIdent(entry.name)} (${displayUntrustedValue(entry.valueFrom)})`);
 			return {
@@ -14990,8 +15153,7 @@ async function resolveEcsSecrets(entries, options = {}) {
 			};
 		}));
 	} finally {
-		if (ownsSecretsClient) secretsClient.destroy();
-		if (ownsSsmClient) ssmClient.destroy();
+		for (const c of owned) c.destroy();
 	}
 }
 async function resolveOne(entry, secretsClient, ssmClient) {
@@ -15183,7 +15345,8 @@ async function runEcsTask(task, options, state) {
 				region: firstUsableRegion(options.stackRegion, task.stack.region, options.region),
 				label: `Container ${c.name}`,
 				skipKeys: new Set(Object.keys(c.environment).filter((k) => !tokenKeys.has(k))),
-				resolver: dynamicRefs
+				resolver: dynamicRefs,
+				workload: { containerName: c.name }
 			}));
 		}
 	} finally {
@@ -16622,10 +16785,10 @@ const defaultDockerStartImpl = async (containerId, opts = {}) => {
 	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["start", containerId]);
 	if (opts.joinedForwarder) return;
-	const { getActiveWorkloadAwsWiring } = await import("./workload-identity-D3XdPJjV.js").then((n) => n.R);
+	const { getActiveWorkloadAwsWiring } = await import("./workload-identity-BOEZuEDO.js").then((n) => n.R);
 	const wiring = getActiveWorkloadAwsWiring();
 	if (wiring) {
-		const { attachLoopbackForwarder } = await import("./docker-runner-Dq3y5-Me.js").then((n) => n.o);
+		const { attachLoopbackForwarder } = await import("./docker-runner-B3OunVKV.js").then((n) => n.o);
 		await attachLoopbackForwarder(containerId, wiring);
 	}
 };
@@ -19506,13 +19669,13 @@ async function loadAssetContextForTarget(args) {
 }
 async function rollOneTarget(args) {
 	const { signal, controller, newBoot, stacks, options, discovery, skipPull, extraStateProviders, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, verdict, imageOverrideTag, logger } = args;
-	const candidate = pickCandidateStack$1(newBoot.target, stacks);
-	const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
+	const { stateProvider, stateProviderFor } = await createTargetStateProviders(newBoot.target, stacks, options, extraStateProviders);
 	try {
 		let resolved;
 		try {
 			resolved = await resolveServiceAndRunnerOpts(newBoot, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, {
 				quiet: true,
+				stateProviderFor,
 				...imageOverrideTag !== void 0 && { imageOverrideTag }
 			});
 		} catch (err) {
@@ -19559,23 +19722,28 @@ async function rollOneTarget(args) {
 	}
 }
 async function bootOneTarget(boot, runState, stacks, options, discovery, skipPull, extraStateProviders, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag) {
-	const candidate = pickCandidateStack$1(boot.target, stacks);
-	const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
+	const { stateProvider, stateProviderFor } = await createTargetStateProviders(boot.target, stacks, options, extraStateProviders);
 	try {
-		return await runOneTarget(boot, runState, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag);
+		return await runOneTarget(boot, runState, stacks, options, discovery, skipPull, stateProvider, stateProviderFor, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag);
 	} finally {
 		if (stateProvider) stateProvider.dispose();
 	}
 }
-async function runOneTarget(boot, runState, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag) {
-	const { service, runnerOpts } = await resolveServiceAndRunnerOpts(boot, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag !== void 0 ? { imageOverrideTag } : {});
+async function runOneTarget(boot, runState, stacks, options, discovery, skipPull, stateProvider, stateProviderFor, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag) {
+	const { service, runnerOpts } = await resolveServiceAndRunnerOpts(boot, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, {
+		stateProviderFor,
+		...imageOverrideTag !== void 0 && { imageOverrideTag }
+	});
 	return startEcsService(service, runnerOpts, runState);
 }
 async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, opts = {}) {
 	const logger = getLogger();
 	const target = boot.target;
 	const quiet = opts.quiet === true;
-	const imageContext = await buildEcsImageResolutionContext$1(target, stacks, options, stateProvider, opts.imageOverrideTag !== void 0 ? { imageOverridden: true } : {});
+	const imageContext = await buildEcsImageResolutionContext$1(target, stacks, options, stateProvider, {
+		...opts.imageOverrideTag !== void 0 && { imageOverridden: true },
+		...opts.stateProviderFor && { stateProviderFor: opts.stateProviderFor }
+	});
 	const service = resolveEcsServiceTarget(target, stacks, imageContext, { suppressLoadBalancerWarning });
 	const representative = service.task.containers.find((c) => c.essential) ?? service.task.containers[0];
 	assertEcsTaskImagesResolvable(service.task, new Set(opts.imageOverrideTag !== void 0 && representative ? [representative.name] : []));
@@ -19586,27 +19754,11 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 	if (stateProvider && taskNeeds.needsCrossStackResolver) {
 		const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? service.stack.region ?? "us-east-1";
 		const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
-		if (resolver) {
-			const dynamicRefs = new DynamicReferenceResolver({ ...options.profile !== void 0 && { profile: options.profile } });
-			const subContext = {
-				resources: imageContext?.stateResources ?? {},
-				...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
-				...imageContext?.stateParameters && { parameters: imageContext.stateParameters },
-				...imageContext?.stateSensitiveParameters?.length && { sensitiveParameters: new Set(imageContext.stateSensitiveParameters) },
-				consumerRegion,
-				crossStackResolver: resolver,
-				resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
-					region: producerRegion,
-					consumer: `Task ${service.task.taskDefinitionLogicalId} cross-stack env value`,
-					overridable: false
-				})
-			};
-			try {
-				await applyCrossStackResolverToTask(service.task, subContext);
-			} finally {
-				dynamicRefs.dispose();
-			}
-		}
+		if (resolver) await applyCrossStackValuesToTask(service.task, resolver, {
+			imageContext,
+			consumerRegion,
+			profile: options.profile
+		});
 	} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
 	const effectiveAssumeRole = resolveEcsAssumeRoleOption(options);
 	let assumedCredentials;
@@ -19978,6 +20130,63 @@ async function assumeTaskRole$1(roleArn, region, profile) {
 		makeError: (message) => new LocalStartServiceError(message)
 	});
 }
+async function createTargetStateProviders(target, stacks, options, extraStateProviders) {
+	const candidate = pickCandidateStack$1(target, stacks);
+	const region = await resolveCfnFallbackRegion(options, candidate?.region);
+	const stateProviderFor = (workload) => createLocalStateProvider(options, candidate?.stackName ?? "", region, extraStateProviders, { workload });
+	return {
+		stateProvider: stateProviderFor(UNNAMED_WORKLOAD),
+		stateProviderFor
+	};
+}
+function ecsContainerNamesOf(stack) {
+	const names = /* @__PURE__ */ new Set();
+	for (const resource of Object.values(stack.template.Resources ?? {})) {
+		if (resource?.Type !== "AWS::ECS::TaskDefinition") continue;
+		const defs = resource.Properties?.["ContainerDefinitions"];
+		if (!Array.isArray(defs)) continue;
+		for (const def of defs) {
+			const name = def?.["Name"];
+			if (typeof name === "string" && name !== "") names.add(name);
+		}
+	}
+	return [...names];
+}
+async function loadMixedModeContainerStates(ctx, stack, stateProviderFor) {
+	const groups = groupWorkloadsRoutedApart(ecsContainerNamesOf(stack), (containerName) => ({ containerName }));
+	if (groups.length === 0) return;
+	const containerStates = {};
+	for (const group of groups) {
+		const provider = stateProviderFor(group.workload);
+		if (!provider) continue;
+		try {
+			const state = {};
+			const loaded = await provider.load(stack.stackName, stack.region);
+			if (loaded) state.stateResources = loaded.resources;
+			else {
+				const loadError = provider.getLastLoadError?.();
+				if (loadError) state.stateLoadFailureMessage = loadError;
+			}
+			if (provider.resolveTemplateSsmParameters) {
+				const ssm = await provider.resolveTemplateSsmParameters(stack.template);
+				if (Object.keys(ssm.values).length > 0) state.stateParameters = ssm.values;
+				if (ssm.secureStringLogicalIds.length > 0) state.stateSensitiveParameters = ssm.secureStringLogicalIds;
+			}
+			for (const name of group.items) defineOwnState(containerStates, name, state);
+		} finally {
+			provider.dispose();
+		}
+	}
+	ctx.containerStates = containerStates;
+}
+function defineOwnState(map, key, value) {
+	Object.defineProperty(map, key, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+}
 async function buildEcsImageResolutionContext$1(target, stacks, options, stateProvider, opts = {}) {
 	const logger = getLogger();
 	const candidate = pickCandidateStack$1(target, stacks);
@@ -20018,6 +20227,7 @@ async function buildEcsImageResolutionContext$1(target, stacks, options, statePr
 			if (Object.keys(ssmParameters.values).length > 0) ctx.stateParameters = ssmParameters.values;
 			if (ssmParameters.secureStringLogicalIds.length > 0) ctx.stateSensitiveParameters = ssmParameters.secureStringLogicalIds;
 		}
+		if (needs.needsEnvOrSecretSubstitution && opts.stateProviderFor) await loadMixedModeContainerStates(ctx, candidate, opts.stateProviderFor);
 	} else if (!stateProvider && needs.needsStateResources) {
 		if (!opts.suppressStateWarning && !opts.imageOverridden) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI, or --image-override to build it from a local Dockerfile.");
 	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) {
@@ -20053,7 +20263,7 @@ function readEnvOverridesFile$1(filePath) {
 	if (!filePath) return void 0;
 	let raw;
 	try {
-		raw = readFileSync(filePath, "utf-8");
+		raw = readEnvVarsFileText(filePath);
 	} catch (err) {
 		throw new LocalStartServiceError(`Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`);
 	}
@@ -20133,7 +20343,7 @@ async function resolveAndBuildImageOverrides(args) {
 	const resolvedForPeek = [];
 	for (const target of perTarget) {
 		const candidate = pickCandidateStack$1(target, stacks);
-		const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
+		const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders, { workload: UNNAMED_WORKLOAD });
 		let imageContext;
 		let service;
 		try {
@@ -20286,35 +20496,21 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 			onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} run-task requires a <target> (an ECS task definition display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_RUN_TASK_TARGET_REQUIRED")
 		});
 		const candidate = pickCandidateStack(resolvedTarget, stacks);
-		stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
-		const imageContext = await buildEcsImageResolutionContext(candidate, stateProvider, options);
+		const stateRegion = await resolveCfnFallbackRegion(options, candidate?.region);
+		const stateProviderFor = (workload) => createLocalStateProvider(options, candidate?.stackName ?? "", stateRegion, extraStateProviders, { workload });
+		stateProvider = stateProviderFor(UNNAMED_WORKLOAD);
+		const imageContext = await buildEcsImageResolutionContext(candidate, stateProvider, options, stateProviderFor);
 		const task = resolveEcsTaskTarget(resolvedTarget, stacks, imageContext);
 		logger.info(`Target: ${displayStackName(`${task.stack.stackName}/${task.taskDefinitionLogicalId}`)} (family=${displayIdent(task.family)}, containers=${task.containers.length})`);
 		const taskNeeds = detectEcsImageResolutionNeeds(stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack);
 		if (stateProvider && taskNeeds.needsCrossStackResolver) {
 			const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? task.stack.region ?? "us-east-1";
 			const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
-			if (resolver) {
-				const dynamicRefs = new DynamicReferenceResolver({ ...options.profile !== void 0 && { profile: options.profile } });
-				const subContext = {
-					resources: imageContext?.stateResources ?? {},
-					...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
-					...imageContext?.stateParameters && { parameters: imageContext.stateParameters },
-					...imageContext?.stateSensitiveParameters?.length && { sensitiveParameters: new Set(imageContext.stateSensitiveParameters) },
-					consumerRegion,
-					crossStackResolver: resolver,
-					resolveDynamicReferences: (value, producerRegion) => dynamicRefs.resolveString(value, {
-						region: producerRegion,
-						consumer: `Task ${task.taskDefinitionLogicalId} cross-stack env value`,
-						overridable: false
-					})
-				};
-				try {
-					await applyCrossStackResolverToTask(task, subContext);
-				} finally {
-					dynamicRefs.dispose();
-				}
-			}
+			if (resolver) await applyCrossStackValuesToTask(task, resolver, {
+				imageContext,
+				consumerRegion,
+				profile: options.profile
+			});
 		} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
 		const onSignal = createShutdownSignalHandler({
 			cleanup,
@@ -20445,7 +20641,7 @@ async function assumeTaskRole(roleArn, region, profile) {
 		sessionNameSuffix: "run-task"
 	});
 }
-async function buildEcsImageResolutionContext(candidate, stateProvider, options) {
+async function buildEcsImageResolutionContext(candidate, stateProvider, options, stateProviderFor) {
 	const logger = getLogger();
 	if (!candidate) return void 0;
 	const needs = detectEcsImageResolutionNeeds(candidate);
@@ -20484,6 +20680,7 @@ async function buildEcsImageResolutionContext(candidate, stateProvider, options)
 			if (Object.keys(ssmParameters.values).length > 0) ctx.stateParameters = ssmParameters.values;
 			if (ssmParameters.secureStringLogicalIds.length > 0) ctx.stateSensitiveParameters = ssmParameters.secureStringLogicalIds;
 		}
+		if (needs.needsEnvOrSecretSubstitution && stateProviderFor) await loadMixedModeContainerStates(ctx, candidate, stateProviderFor);
 	} else if (!stateProvider && needs.needsStateResources) {
 		if (!options.imageOverride?.length) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI, or --image-override to build it from a local Dockerfile. Otherwise the resolver will surface its existing error.");
 	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
@@ -20509,7 +20706,7 @@ function readEnvOverridesFile(filePath) {
 	if (!filePath) return void 0;
 	let raw;
 	try {
-		raw = readFileSync(filePath, "utf-8");
+		raw = readEnvVarsFileText(filePath);
 	} catch (err) {
 		throw new Error(`Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`);
 	}
@@ -25070,7 +25267,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders,
 	});
 	const candidate = pickAgentCoreCandidateStack(resolvedTarget, stacks);
 	if (candidate) checkSelectedStacks?.([candidate.stackName]);
-	stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
+	stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders, { workload: agentCoreTargetWorkload(resolvedTarget, stacks) });
 	const { context: imageContext, loaded: loadedState } = stateProvider && candidate ? await buildAgentCoreImageContext(candidate, stateProvider, options) : {
 		context: void 0,
 		loaded: void 0
@@ -31571,7 +31768,7 @@ async function prepareEcsImageContexts(args) {
 	}
 	rejectExplicitCfnStackWithMultipleStacks(options, owningStacks.length);
 	for (const stack of owningStacks) {
-		const stateProvider = createLocalStateProvider(options, stack.stackName, await resolveCfnFallbackRegion(options, stack.region));
+		const stateProvider = createLocalStateProvider(options, stack.stackName, await resolveCfnFallbackRegion(options, stack.region), void 0, { workload: UNNAMED_WORKLOAD });
 		try {
 			const ctx = await buildEcsImageResolutionContext(stack, stateProvider, options);
 			contextByStack.set(stack.stackName, ctx);
@@ -31948,5 +32145,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { postHook as $, addAwsEndpointOptions as $a, parseConnectionsPath as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, parseSelectionExpressionPath as Aa, applyCorsResponseHeaders as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AgentCoreResolutionError as Ba, evaluateResponseParameters as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveSingleTarget as Ca, verifyJwtViaDiscovery as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, discoverWebSocketApis as Da, invokeRequestAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, availableWebSocketApiIdentifiers as Ea, evaluateCachedLambdaPolicy as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, AGENTCORE_A2A_PROTOCOL as Fa, matchRoute as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, containsDynamicReference as Ga, HOST_DOCKER_INTERNAL_GATEWAY as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, resolveAgentCoreTarget as Ha, selectIntegrationResponse as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, AGENTCORE_AGUI_PROTOCOL as Ia, translateLambdaResponse as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, keysNotFromTemplate as Ja, resolveHostGatewayExtraHosts as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, deployedFillMayBeSecret as Ka, HOST_GATEWAY_MIN_VERSION as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_HTTP_PROTOCOL as La, applyAuthorizerOverlay as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, discoverRoutes as Ma, buildCorsConfigFromCloudFrontChain as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, pickRefLogicalId as Na, isFunctionUrlOacFronted as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, discoverWebSocketApisOrThrow as Oa, invokeTokenAuthorizer as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, resolveLambdaArnIntrinsic as Pa, matchPreflight as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, withoutKeys as Qa, handleConnectionsRequest as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_MCP_PROTOCOL as Ra, buildHttpApiV2Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, resolveWatchConfig as Sa, verifyJwtAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, listTargets as Ta, computeRequestIdentityHash as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, DynamicReferenceResolutionError as Ua, tryParseStatus as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, pickAgentCoreCandidateStack as Va, pickResponseTemplate as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, DynamicReferenceResolver as Wa, VtlEvaluationError as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, parseDynamicReference as Xa, ConnectionRegistry as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, keysOverriddenBy as Ya, bufferToBody as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, resolveDynamicReferencesInEnv as Za, buildMgmtEndpointEnvUrl as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveCfnRegion as _a, defaultCredentialsLoader as _i, pickKvsLogicalIdFromArn as _n, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, resolveRuntimeImage as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, collectSsmParameterRefs as ba, createJwksCache as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, substituteAgainstState as ca, resolveEnvVars$1 as ci, buildEdgeRequestEvent as cn, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, substituteEnvVarsFromStateAsync as da, filterRoutesByApiIdentifiers as di, httpHeadersToEdge as dn, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildConnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, awsEndpointOptions as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, LocalStateSourceError as fa, groupRoutesByServer as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, resolveCfnFallbackRegion as ga, resolveServiceIntegrationParameters as gi, pickFunctionUrlLogicalIdFromOrigin as gn, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, rejectExplicitCfnStackWithMultipleStacks as ha, resolveSelectionExpression as hi, isCloudFrontDistribution as hn, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, resolveRuntimeFileExtension as ia, createFileWatcher as ii, serveFromStaticOrigin as in, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, webSocketApiMatchesIdentifier as ja, buildCorsConfigByApiId as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, filterWebSocketApisByIdentifiers as ka, attachAuthorizers as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, substituteAgainstStateAsync as la, availableApiIdentifiers as li, buildEdgeResponseEvent as ln, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, isCfnFlagPresent as ma, startApiServer as mi, extractKvsAssociations as mn, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, buildMessageEvent as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, EcsTaskResolutionError as oa, buildStageMap as oi, applyEdgeRequestResult as on, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, createLocalStateProvider as pa, readMtlsMaterialsFromDisk as pi, describeS3OriginDomain as pn, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, firstUsableRegion as qa, probeHostGatewaySupport as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, resolveRuntimeCodeMountPath as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, assertEcsTaskImagesResolvable as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildDisconnectEvent as ta, createWatchPredicates as ti, matchBehavior as tn, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteEnvVarsFromState as ua, filterRoutesByApiIdentifier as ui, edgeHeadersToHttp as un, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnStackName as va, buildCognitoJwksUrl as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, countTargets as wa, buildMethodArn as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, resolveSsmParameters as xa, verifyCognitoJwt as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, CfnLocalStateProvider as ya, buildJwksUrlFromIssuer as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_RUNTIME_TYPE as za, buildRestV1Event as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
-//# sourceMappingURL=local-studio-DK5chhyj.js.map
+export { postHook as $, withoutKeys as $a, buildConnectEvent as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, filterWebSocketApisByIdentifiers as Aa, buildCorsConfigByApiId as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AGENTCORE_RUNTIME_TYPE as Ba, pickResponseTemplate as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveWatchConfig as Ca, buildMethodArn as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, availableWebSocketApiIdentifiers as Da, invokeTokenAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, listTargets as Ea, invokeRequestAuthorizer as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, resolveLambdaArnIntrinsic as Fa, translateLambdaResponse as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, DynamicReferenceResolver as Ga, HOST_GATEWAY_MIN_VERSION as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, pickAgentCoreCandidateStack as Ha, tryParseStatus as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, AGENTCORE_A2A_PROTOCOL as Ia, applyAuthorizerOverlay as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, firstUsableRegion as Ja, bufferToBody as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, containsDynamicReference as Ka, probeHostGatewaySupport as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_AGUI_PROTOCOL as La, buildHttpApiV2Event as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, webSocketApiMatchesIdentifier as Ma, isFunctionUrlOacFronted as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, discoverRoutes as Na, matchPreflight as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, discoverWebSocketApis as Oa, attachAuthorizers as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, pickRefLogicalId as Pa, matchRoute as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, resolveDynamicReferencesInEnv as Qa, parseConnectionsPath as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_HTTP_PROTOCOL as Ra, buildRestV1Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, resolveSsmParameters as Sa, verifyJwtViaDiscovery as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, countTargets as Ta, evaluateCachedLambdaPolicy as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, resolveAgentCoreTarget as Ua, VtlEvaluationError as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, AgentCoreResolutionError as Va, selectIntegrationResponse as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, DynamicReferenceResolutionError as Wa, HOST_DOCKER_INTERNAL_GATEWAY as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, keysOverriddenBy as Xa, buildMgmtEndpointEnvUrl as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, keysNotFromTemplate as Ya, ConnectionRegistry as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, parseDynamicReference as Za, handleConnectionsRequest as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveCfnFallbackRegion as _a, buildCognitoJwksUrl as _i, pickKvsLogicalIdFromArn as _n, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, EcsTaskResolutionError as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, CfnLocalStateProvider as ba, verifyCognitoJwt as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, substituteAgainstStateAsync as ca, availableApiIdentifiers as ci, buildEdgeRequestEvent as cn, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, LocalStateSourceError as da, groupRoutesByServer as di, httpHeadersToEdge as dn, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildDisconnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, addAwsEndpointOptions as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, UNNAMED_WORKLOAD as fa, readMtlsMaterialsFromDisk as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, rejectExplicitCfnStackWithMultipleStacks as ga, defaultCredentialsLoader as gi, pickFunctionUrlLogicalIdFromOrigin as gn, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, isCfnFlagPresent as ha, resolveServiceIntegrationParameters as hi, isCloudFrontDistribution as hn, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, resolveRuntimeImage as ia, createFileWatcher as ii, serveFromStaticOrigin as in, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, parseSelectionExpressionPath as ja, buildCorsConfigFromCloudFrontChain as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, discoverWebSocketApisOrThrow as ka, applyCorsResponseHeaders as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, substituteEnvVarsFromState as la, filterRoutesByApiIdentifier as li, buildEdgeResponseEvent as ln, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, groupWorkloadsRoutedApart as ma, resolveSelectionExpression as mi, extractKvsAssociations as mn, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, resolveRuntimeCodeMountPath as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, assertEcsTaskImagesResolvable as oa, buildStageMap as oi, applyEdgeRequestResult as on, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, createLocalStateProvider as pa, startApiServer as pi, describeS3OriginDomain as pn, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, deployedFillMayBeSecret as qa, resolveHostGatewayExtraHosts as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, resolveRuntimeFileExtension as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, substituteAgainstState as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildMessageEvent as ta, createWatchPredicates as ti, matchBehavior as tn, awsEndpointOptions as to, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteEnvVarsFromStateAsync as ua, filterRoutesByApiIdentifiers as ui, edgeHeadersToHttp as un, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnRegion as va, buildJwksUrlFromIssuer as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, resolveSingleTarget as wa, computeRequestIdentityHash as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, collectSsmParameterRefs as xa, verifyJwtAuthorizer as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, resolveCfnStackName as ya, createJwksCache as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_MCP_PROTOCOL as za, evaluateResponseParameters as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
+//# sourceMappingURL=local-studio-BR8vPfCn.js.map