cdk-local 0.163.5 → 0.164.0

package/dist/{local-studio-DIxEENzj.js → local-studio-C78UofCN.js}

@@ -1,7 +1,7 @@
 import { a as displayIdent, c as getEmbedConfig, i as STACK_REF_MAX_CODE_POINTS, o as displayStackName, s as displayToolOutput, t as getLogger, u as setEmbedConfig } from "./logger-Co5XVwco.js";
-import { C as effectiveLoopbackPorts, F as resolveHostDefaultCredentials, G as awsEndpointOverrideClientConfig, K as buildProxyClientConfig, Q as proxyAwareFetch, W as awsEmulatorRoutedServices, Y as isAwsServiceRoutedToEmulator, _t as isLoopbackHostname, b as awsEmulatorEnvName, bt as formatHostForAuthority, d as workloadStsClientConfig, gt as defineOwnKey, ht as resolveEnvVars$1, l as warnWorkloadCredentialsStripped, mt as readEnvVarsFileText, n as accountLookupStsClientConfig, pt as applyEnvOverrideMap, r as applyWorkloadEnvCredentials, rt as createMixedModeStateProvider, u as workloadClientConfig, v as activateWorkloadAwsWiring, vt as isWildcardHostname, w as getActiveWorkloadAwsWiring, xt as hostFromAuthority, y as applyWorkloadAwsWiringToEnv, yt as formatAuthority } from "./workload-identity-BOEZuEDO.js";
+import { $ as isAwsServiceRoutedToEmulator, C as effectiveLoopbackPorts, Ct as resolveEnvVars$1, Dt as formatAuthority, Et as isWildcardHostname, F as resolveHostDefaultCredentials, K as awsEmulatorRealServices, Ot as formatHostForAuthority, R as takeAwsEmulatorStateSourceHint, St as readEnvVarsFileText, Tt as isLoopbackHostname, X as deployArtifactsReadEmulator, Y as deployArtifactClientConfig, b as awsEmulatorEnvName, ct as createMixedModeStateProvider, d as workloadStsClientConfig, kt as hostFromAuthority, l as warnWorkloadCredentialsStripped, n as accountLookupStsClientConfig, nt as proxyAwareFetch, q as awsEndpointOverrideClientConfig, r as applyWorkloadEnvCredentials, u as workloadClientConfig, v as activateWorkloadAwsWiring, w as getActiveWorkloadAwsWiring, wt as defineOwnKey, xt as applyEnvOverrideMap, y as applyWorkloadAwsWiringToEnv, z as workloadGetsEmulatorKeysOnly } from "./workload-identity-CCXbr0KK.js";
 import { c as clampErrorName, d as flattenToOneLine, f as isAwsServiceException, l as describeAwsFailureForWarn, m as stringifyThrown, o as renderAssemblyPathEscape, p as sanitizeServiceExceptionMessage, r as displayUntrustedValue, s as resolveAssemblyPath, t as absoluteAssemblyPathEscape, u as describeCredentialLoadFailure } from "./assembly-path-R96uhMm1.js";
-import { $ as refusedRoleArnMessage, A as buildDockerImage, B as tryResolveImageFnJoin, D as isImageInLocalCache, E as warnIfEmulatedPlatform, F as parseEcrRegistryHost, G as RouteDiscoveryError, H as InteractiveTtyRequiredError, I as derivePartitionAndUrlSuffix, J as AssumeRoleFailure, K as TargetSelectionCancelledError, L as derivePseudoParametersFromRegion, M as createShutdownSignalHandler, N as signalExitCode, O as parseEcrUri, P as describeExitWithoutArgv, Q as isIamRoleArn, R as formatStateRemedy, T as buildContainerImage, U as LocalInvokeBuildError, V as CdkLocalError, W as LocalStartServiceError, X as assumeRoleCredentials, Y as applyRoleArnIfSet, Z as describeRejectedRoleArn, a as describeRefusedSensitiveEnvKeys, c as execEnvForSecrets, d as rememberForwardedPorts, et as buildStsClientConfig, f as removeContainer, h as streamLogs, i as attachLoopbackForwarder, j as resolveAssetSourcePath, k as pullEcrImage, l as pickFreePort, m as startNamespaceOwnerForwarder, n as SENSITIVE_ENV_KEYS, p as runDetached, q as withErrorHandling, r as appendEnvFlags, s as ensureDockerAvailable, t as DockerRunnerError, tt as resolveProfileCredentials, u as pullImage, w as architectureToPlatform, z as substituteImagePlaceholders } from "./docker-runner-6cuoe4H9.js";
+import { $ as isIamRoleArn, A as buildDockerImage, B as substituteImagePlaceholders, D as isImageInLocalCache, E as warnIfEmulatedPlatform, F as parseEcrRegistryHost, G as LocalStartServiceError, H as CdkLocalError, I as contextForContainer, J as withErrorHandling, K as RouteDiscoveryError, L as derivePartitionAndUrlSuffix, M as createShutdownSignalHandler, N as signalExitCode, O as parseEcrUri, P as describeExitWithoutArgv, Q as describeRejectedRoleArn, R as derivePseudoParametersFromRegion, T as buildContainerImage, U as InteractiveTtyRequiredError, V as tryResolveImageFnJoin, W as LocalInvokeBuildError, X as applyRoleArnIfSet, Y as AssumeRoleFailure, Z as assumeRoleCredentials, a as describeRefusedSensitiveEnvKeys, c as execEnvForSecrets, d as rememberForwardedPorts, et as refusedRoleArnMessage, f as removeContainer, h as streamLogs, i as attachLoopbackForwarder, j as resolveAssetSourcePath, k as pullEcrImage, l as pickFreePort, m as startNamespaceOwnerForwarder, n as SENSITIVE_ENV_KEYS, nt as resolveProfileCredentials, p as runDetached, q as TargetSelectionCancelledError, r as appendEnvFlags, s as ensureDockerAvailable, t as DockerRunnerError, tt as buildStsClientConfig, u as pullImage, w as architectureToPlatform, z as formatStateRemedy } from "./docker-runner-D6K15jJP.js";
 import { a as isDockerClientEnvKey, c as runDockerStreaming, i as getDockerCmd, n as finchSecretArgvRefusal, o as isMalformedEnvKey, u as warnFinchArgvExposure } from "./docker-cmd-Cjg3jGYF.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, promises, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { Command, InvalidArgumentError, Option } from "commander";
@@ -3377,19 +3377,23 @@ function createLocalStateProvider(options, stackName, synthRegion, extraStatePro
 			...options.profile !== void 0 && { profile: options.profile },
 			...behavior.workload !== void 0 && { workload: behavior.workload }
 		});
-		const mixed = behavior.realAwsOnly ? void 0 : getActiveWorkloadAwsWiring()?.mixed;
+		const mixed = getActiveWorkloadAwsWiring()?.mixed;
 		if (!mixed) return real;
-		const emulatedServices = awsEmulatorRoutedServices(behavior.workload) ?? mixed.services;
-		if (emulatedServices.length === 0) return real;
+		const emulator = new CfnLocalStateProvider({
+			cfnStackName,
+			region,
+			endpointOverride: mixed.emulatorClientOverride,
+			label: "--from-cfn-stack (AWS Emulator)"
+		});
+		const realServices = awsEmulatorRealServices(behavior.workload) ?? [];
+		if (realServices.length === 0) {
+			real.dispose();
+			return emulator;
+		}
 		return createMixedModeStateProvider({
+			emulator,
 			real,
-			emulator: new CfnLocalStateProvider({
-				cfnStackName,
-				region,
-				endpointOverride: mixed.emulatorClientOverride,
-				label: "--from-cfn-stack (AWS Emulator)"
-			}),
-			emulatedServices
+			realServices
 		});
 	}
 	if (activeExtras.length === 1) {
@@ -3397,6 +3401,27 @@ function createLocalStateProvider(options, stackName, synthRegion, extraStatePro
 		return factory(options, behavior);
 	}
 }
+const UNNAMED_WORKLOAD = Object.freeze({});
+function groupWorkloadsRoutedApart(items, workloadOf) {
+	const base = awsEmulatorRealServices(UNNAMED_WORKLOAD);
+	if (base === void 0) return [];
+	const baseKey = base.join(",");
+	const groups = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const workload = workloadOf(item);
+		const realServices = awsEmulatorRealServices(workload) ?? base;
+		const key = realServices.join(",");
+		if (key === baseKey) continue;
+		const group = groups.get(key);
+		if (group) group.items.push(item);
+		else groups.set(key, {
+			realServices,
+			workload,
+			items: [item]
+		});
+	}
+	return [...groups.values()];
+}
 function toFlagName(field) {
 	return "--" + field.replace(/([A-Z])/g, "-$1").toLowerCase();
 }
@@ -4231,6 +4256,10 @@ function extractTaskDefinitionProperties(stack, logicalId, resource, context) {
 	if (!Array.isArray(rawContainers) || rawContainers.length === 0) throw new EcsTaskResolutionError(`Task definition ${displayIdent(logicalId)} has no ContainerDefinitions.`);
 	const containers = rawContainers.map((c, idx) => parseContainerDefinition(c, idx, logicalId, resources, stack, context));
 	for (const ctr of containers) for (const w of ctr.warnings) warnings.push(`Container ${displayIdent(ctr.name)}: ${w}`);
+	if (containers.some((c) => c.droppedEnvWithoutState)) {
+		const hint = takeAwsEmulatorStateSourceHint();
+		if (hint) warnings.push(hint);
+	}
 	const rawVolumes = props["Volumes"];
 	const volumes = Array.isArray(rawVolumes) ? rawVolumes.map((v, idx) => parseVolume(v, idx, logicalId, subContext)) : [];
 	const containerNames = new Set(containers.map((c) => c.name));
@@ -4272,10 +4301,11 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 	const command = pickStringArray$1(c["Command"]);
 	const entryPoint = pickStringArray$1(c["EntryPoint"]);
 	const workingDirectory = pickString(c["WorkingDirectory"]);
-	const subContext = buildSubstitutionContextFromImageContext(context);
+	const subContext = buildSubstitutionContextFromImageContext(contextForContainer(context, name));
 	const environment = {};
 	const sensitiveEnvKeys = [];
 	const droppedEnvKeys = [];
+	let droppedEnvWithoutState = false;
 	if (Array.isArray(c["Environment"])) for (const entry of c["Environment"]) {
 		if (!entry || typeof entry !== "object") continue;
 		const e = entry;
@@ -4297,10 +4327,13 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 				key,
 				reason: sub.reason
 			});
-		} else droppedEnvKeys.push({
-			key,
-			reason: "intrinsic-valued; pass --from-state to substitute against deployed state"
-		});
+		} else {
+			droppedEnvWithoutState = true;
+			droppedEnvKeys.push({
+				key,
+				reason: "intrinsic-valued; pass --from-state to substitute against deployed state"
+			});
+		}
 	}
 	const secrets = [];
 	const droppedSecretKeys = [];
@@ -4425,6 +4458,7 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 		ulimits,
 		warnings
 	};
+	if (droppedEnvWithoutState) out.droppedEnvWithoutState = true;
 	if (droppedSecretKeys.length > 0) out.droppedSecretNames = droppedSecretKeys.map((d) => d.key);
 	if (command !== void 0) out.command = command;
 	if (entryPoint !== void 0) out.entryPoint = entryPoint;
@@ -4687,13 +4721,34 @@ async function applyCrossStackValuesToTask(task, crossStackResolver, opts) {
 		crossStackResolver,
 		resolveDynamicReferences: crossStackDynamicReferenceHook(dynamicRefs, `Task ${task.taskDefinitionLogicalId} cross-stack env value`)
 	};
+	const containerState = (name) => {
+		const own = imageContext?.containerStates;
+		if (!own || !Object.hasOwn(own, name)) return void 0;
+		const state = own[name];
+		return {
+			resources: state.stateResources ?? {},
+			parameters: state.stateParameters,
+			sensitiveParameters: state.stateSensitiveParameters?.length ? new Set(state.stateSensitiveParameters) : void 0
+		};
+	};
 	try {
-		await applyCrossStackResolverToTask(task, subContext);
+		await applyCrossStackResolverToTask(task, subContext, containerState);
 	} finally {
 		dynamicRefs.dispose();
 	}
 }
-async function applyCrossStackResolverToTask(task, context) {
+function withContainerState(context, state) {
+	const out = {
+		...context,
+		resources: state.resources
+	};
+	if (state.parameters) out.parameters = state.parameters;
+	else delete out.parameters;
+	if (state.sensitiveParameters) out.sensitiveParameters = state.sensitiveParameters;
+	else delete out.sensitiveParameters;
+	return out;
+}
+async function applyCrossStackResolverToTask(task, context, containerState) {
 	if (!context.crossStackResolver) return;
 	const { resolveDynamicReferences: _envOnly, ...secretContext } = context;
 	const rawContainers = (task.resource.Properties ?? {})["ContainerDefinitions"];
@@ -4705,10 +4760,12 @@ async function applyCrossStackResolverToTask(task, context) {
 		const c = raw;
 		const containerName = pickString(c["Name"]) ?? container.name;
 		const resolveRefs = context.resolveDynamicReferences;
+		const ownState = containerState?.(container.name);
+		const baseContext = ownState ? withContainerState(context, ownState) : context;
 		const containerContext = resolveRefs ? {
-			...context,
+			...baseContext,
 			resolveDynamicReferences: (v, region) => resolveRefs(v, region, { containerName: container.name })
-		} : context;
+		} : baseContext;
 		const resolvedEnvKeys = /* @__PURE__ */ new Set();
 		const resolvedSecretNames = /* @__PURE__ */ new Set();
 		if (Array.isArray(c["Environment"])) for (const entry of c["Environment"]) {
@@ -4736,7 +4793,7 @@ async function applyCrossStackResolverToTask(task, context) {
 			if (typeof valueFromRaw === "string" && valueFromRaw.length > 0) continue;
 			if (container.secrets.some((s) => s.name === sName)) continue;
 			if (!isCrossStackIntrinsic(valueFromRaw)) continue;
-			const sub = await substituteAgainstStateAsync(valueFromRaw, secretContext);
+			const sub = await substituteAgainstStateAsync(valueFromRaw, ownState ? withContainerState(secretContext, ownState) : secretContext);
 			if (sub.kind === "literal" && typeof sub.value === "string" && sub.value.length > 0) {
 				container.secrets.push({
 					name: sName,
@@ -10280,9 +10337,9 @@ async function assumeRoleForLayer(roleArn, region, options) {
 async function defaultLambdaClientFactory() {
 	const { LambdaClient } = await import("@aws-sdk/client-lambda");
 	return (region, credentials) => new LambdaClient({
-		...workloadClientConfig(),
+		...deployArtifactsReadEmulator() ? deployArtifactClientConfig() : workloadClientConfig(),
 		region,
-		...credentials && { credentials: {
+		...credentials && !deployArtifactsReadEmulator() && { credentials: {
 			accessKeyId: credentials.accessKeyId,
 			secretAccessKey: credentials.secretAccessKey,
 			...credentials.sessionToken !== void 0 && { sessionToken: credentials.sessionToken }
@@ -10823,7 +10880,7 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 			for (const [k, v] of direct) corsConfigByApiId.set(k, v);
 		}
 		assertServedLogicalIdsUnambiguous(servedStacks, servedRoutes, routesWithAuth, webSocketApis);
-		const stateByStack = isCfnFlagPresent(options) || hasExtraStateProviderActive(options, extraStateProviders) ? await loadStateForRoutedStacks(servedStacks, servedRoutes, routesWithAuth, options, extraStateProviders) : /* @__PURE__ */ new Map();
+		const stateByStack = isCfnFlagPresent(options) || hasExtraStateProviderActive(options, extraStateProviders) ? await loadStateForRoutedStacks(servedStacks, servedRoutes, routesWithAuth, options, extraStateProviders, webSocketApis) : /* @__PURE__ */ new Map();
 		const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
 		if (options.profile && profileCredentials && !profileCredsFile) profileCredsFile = await writeProfileCredentialsFile(options.profile, profileCredentials);
 		const lambdaIds = uniqueLambdaIds(servedRoutes, routesWithAuth, webSocketApis);
@@ -11396,7 +11453,8 @@ async function buildContainerSpec(args) {
 		platform = architectureToPlatform(lambda.architecture);
 	}
 	let templateEnv = getTemplateEnv$1(lambda.resource);
-	const stateBundle = stateByStack.get(lambda.stack.stackName);
+	const stackBundle = stateByStack.get(lambda.stack.stackName);
+	const stateBundle = stackBundle?.byLambda?.get(logicalId) ?? (stackBundle?.withoutSharedState ? void 0 : stackBundle);
 	let stateAudit;
 	const plaintextKeys = /* @__PURE__ */ new Set();
 	const deployedSecretKeys = [];
@@ -11436,6 +11494,10 @@ async function buildContainerSpec(args) {
 		const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? logicalId;
 		getLogger().warn(`Lambda ${logicalId}: env var ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}) or pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to recover deployed values.`);
 	}
+	if (envResult.unresolved.length > 0 && !stateBundle) {
+		const hint = takeAwsEmulatorStateSourceHint();
+		if (hint) getLogger().warn(hint);
+	}
 	for (const key of stateAudit?.sensitiveKeys ?? []) plaintextKeys.add(key);
 	for (const key of keysNotFromTemplate(templateEnv, envResult.resolved)) plaintextKeys.add(key);
 	const dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
@@ -11461,7 +11523,7 @@ async function buildContainerSpec(args) {
 		logicalId,
 		assumeRole,
 		lambdaResource: lambda.resource,
-		stateBundle
+		stateBundle: stackBundle?.withoutSharedState ? void 0 : stackBundle
 	});
 	if (roleArn) {
 		const creds = await assumeLambdaExecutionRole(roleArn, stsRegion, profile);
@@ -11893,10 +11955,9 @@ function envHasIntrinsicValue$1(templateEnv) {
 	}
 	return false;
 }
-async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options, extraStateProviders) {
-	const logger = getLogger();
+async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options, extraStateProviders, webSocketApis = []) {
 	const out = /* @__PURE__ */ new Map();
-	const lambdaIds = uniqueLambdaIds(routes, routesWithAuth);
+	const lambdaIds = uniqueLambdaIds(routes, routesWithAuth, webSocketApis);
 	const reachableStackNames = /* @__PURE__ */ new Set();
 	for (const logicalId of lambdaIds) for (const stack of stacks) {
 		const resource = stack.template.Resources?.[logicalId];
@@ -11918,51 +11979,88 @@ async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options,
 	for (const stackName of reachableStackNames) {
 		const stack = stacks.find((s) => s.stackName === stackName);
 		if (!stack) continue;
-		const provider = createLocalStateProvider(options, stack.stackName, await resolveCfnFallbackRegion(options, stack.region), extraStateProviders);
-		if (!provider) continue;
-		try {
-			const loaded = await provider.load(stack.stackName, stack.region);
-			if (!loaded) continue;
-			const bundle = {
-				state: {
-					version: 1,
-					stackName: stack.stackName,
-					resources: loaded.resources,
-					outputs: loaded.outputs,
-					lastModified: 0
-				},
-				region: loaded.region
-			};
-			if (stackHasIntrinsicEnv(stackName)) {
-				const pseudo = await resolvePseudoParametersForStartApi(loaded.region, options);
-				if (pseudo) bundle.pseudoParameters = pseudo;
-			}
-			if (provider.resolveDeployedFunctionEnv) {
-				const deployedEnvByLambda = /* @__PURE__ */ new Map();
-				for (const logicalId of lambdaIds) {
-					const resource = stack.template.Resources?.[logicalId];
-					if (!resource || resource.Type !== "AWS::Lambda::Function") continue;
-					if (!envHasIntrinsicValue$1(getTemplateEnv$1(resource))) continue;
-					const physicalId = loaded.resources[logicalId]?.physicalId;
-					if (!physicalId) continue;
-					const deployedEnv = await provider.resolveDeployedFunctionEnv(physicalId);
-					if (deployedEnv) deployedEnvByLambda.set(logicalId, deployedEnv);
-				}
-				if (deployedEnvByLambda.size > 0) bundle.deployedEnvByLambda = deployedEnvByLambda;
-			}
-			if (stackHasIntrinsicEnv(stackName) && provider.resolveTemplateSsmParameters) {
-				const ssmParameters = await provider.resolveTemplateSsmParameters(stack.template);
-				if (Object.keys(ssmParameters.values).length > 0) bundle.ssmParameters = ssmParameters.values;
-				if (ssmParameters.secureStringLogicalIds.length > 0) bundle.ssmSecureStringLogicalIds = ssmParameters.secureStringLogicalIds;
-			}
-			out.set(stackName, bundle);
-			logger.debug(`${provider.label}: loaded state for ${displayStackName(stackName)} (${loaded.region})`);
-		} finally {
-			provider.dispose();
+		const region = await resolveCfnFallbackRegion(options, stack.region);
+		const providerFor = (workload) => createLocalStateProvider(options, stack.stackName, region, extraStateProviders, { workload });
+		const stackLambdaIds = lambdaIds.filter((id) => stack.template.Resources?.[id]?.Type === "AWS::Lambda::Function");
+		const groups = groupWorkloadsRoutedApart(stackLambdaIds, (logicalId) => ({
+			logicalId,
+			cdkPath: readCdkPathOrUndefined(stack.template.Resources[logicalId])
+		}));
+		const grouped = new Set(groups.flatMap((g) => g.items));
+		const shared = await loadStackStateBundle(stack, providerFor(UNNAMED_WORKLOAD), {
+			lambdaIds: stackLambdaIds.filter((id) => !grouped.has(id)),
+			intrinsicEnv: stackHasIntrinsicEnv(stackName),
+			options
+		});
+		const byLambda = /* @__PURE__ */ new Map();
+		for (const group of groups) {
+			const own = await loadStackStateBundle(stack, providerFor(group.workload), {
+				lambdaIds: group.items,
+				intrinsicEnv: stackHasIntrinsicEnv(stackName),
+				options,
+				...shared?.pseudoParameters && { pseudoParameters: shared.pseudoParameters }
+			});
+			if (own) for (const logicalId of group.items) byLambda.set(logicalId, own);
 		}
+		const bundle = shared ?? (byLambda.size > 0 ? {
+			state: {
+				version: 1,
+				stackName: stack.stackName,
+				resources: {},
+				outputs: {},
+				lastModified: 0
+			},
+			withoutSharedState: true
+		} : void 0);
+		if (!bundle) continue;
+		if (byLambda.size > 0) bundle.byLambda = byLambda;
+		out.set(stackName, bundle);
 	}
 	return out;
 }
+async function loadStackStateBundle(stack, provider, args) {
+	if (!provider) return void 0;
+	try {
+		const loaded = await provider.load(stack.stackName, stack.region);
+		if (!loaded) return void 0;
+		const bundle = {
+			state: {
+				version: 1,
+				stackName: stack.stackName,
+				resources: loaded.resources,
+				outputs: loaded.outputs,
+				lastModified: 0
+			},
+			region: loaded.region
+		};
+		if (args.intrinsicEnv) {
+			const pseudo = args.pseudoParameters ?? await resolvePseudoParametersForStartApi(loaded.region, args.options);
+			if (pseudo) bundle.pseudoParameters = pseudo;
+		}
+		if (provider.resolveDeployedFunctionEnv) {
+			const deployedEnvByLambda = /* @__PURE__ */ new Map();
+			for (const logicalId of args.lambdaIds) {
+				const resource = stack.template.Resources?.[logicalId];
+				if (!resource || resource.Type !== "AWS::Lambda::Function") continue;
+				if (!envHasIntrinsicValue$1(getTemplateEnv$1(resource))) continue;
+				const physicalId = loaded.resources[logicalId]?.physicalId;
+				if (!physicalId) continue;
+				const deployedEnv = await provider.resolveDeployedFunctionEnv(physicalId);
+				if (deployedEnv) deployedEnvByLambda.set(logicalId, deployedEnv);
+			}
+			if (deployedEnvByLambda.size > 0) bundle.deployedEnvByLambda = deployedEnvByLambda;
+		}
+		if (args.intrinsicEnv && provider.resolveTemplateSsmParameters) {
+			const ssmParameters = await provider.resolveTemplateSsmParameters(stack.template);
+			if (Object.keys(ssmParameters.values).length > 0) bundle.ssmParameters = ssmParameters.values;
+			if (ssmParameters.secureStringLogicalIds.length > 0) bundle.ssmSecureStringLogicalIds = ssmParameters.secureStringLogicalIds;
+		}
+		getLogger().debug(`${provider.label}: loaded state for ${displayStackName(stack.stackName)} (${loaded.region})`);
+		return bundle;
+	} finally {
+		provider.dispose();
+	}
+}
 async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	const logger = getLogger();
 	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stateRegion;
@@ -12552,6 +12650,10 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 		const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? lambda.logicalId;
 		logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to recover deployed values.`);
 	}
+	if (envResult.unresolved.length > 0 && !stateProvider) {
+		const hint = takeAwsEmulatorStateSourceHint();
+		if (hint) logger.warn(hint);
+	}
 	for (const key of stateAudit?.sensitiveKeys ?? []) plaintextKeys.add(key);
 	for (const key of keysNotFromTemplate(templateEnv, envResult.resolved)) plaintextKeys.add(key);
 	const dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
@@ -12981,10 +13083,10 @@ function defaultFetchObject$1(options) {
 	return async (location) => {
 		const { S3Client, GetObjectCommand } = await import("@aws-sdk/client-s3");
 		const client = new S3Client({
-			...buildProxyClientConfig({ profile: options.profile }),
+			...deployArtifactClientConfig({ profile: options.profile }),
 			...options.region && { region: options.region },
-			...options.profile && !options.credentials && { profile: options.profile },
-			...options.credentials && { credentials: {
+			...options.profile && !options.credentials && !deployArtifactsReadEmulator() && { profile: options.profile },
+			...options.credentials && !deployArtifactsReadEmulator() && { credentials: {
 				accessKeyId: options.credentials.accessKeyId,
 				secretAccessKey: options.credentials.secretAccessKey,
 				...options.credentials.sessionToken && { sessionToken: options.credentials.sessionToken }
@@ -14022,6 +14124,10 @@ async function buildContainerEnvWith(resolved, options, profileCredentials, prof
 		const overrideKeyExample = cdkPath?.replace(/\/Resource$/, "") ?? resolved.logicalId;
 		logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass a state-source flag (e.g. --from-cfn-stack) to recover deployed values.`);
 	}
+	if (envResult.unresolved.length > 0 && !stateProvider) {
+		const hint = takeAwsEmulatorStateSourceHint();
+		if (hint) logger.warn(hint);
+	}
 	const skipKeys = keysNotFromTemplate(templateEnv, envResult.resolved);
 	for (const key of sensitiveEnvKeys) skipKeys.add(key);
 	const dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
@@ -15327,6 +15433,7 @@ async function runEcsTask(task, options, state) {
 			platformOverride: options.platformOverride,
 			region: options.region,
 			sidecarIp: state.network.sidecarIp,
+			...options.mixedModeRoleCredentials && { mixedModeRoleCredentials: options.mixedModeRoleCredentials },
 			...options.skipHostPortPublish ? { skipHostPortPublish: true } : {},
 			...effectiveHostPortOverrides ? { hostPortOverrides: effectiveHostPortOverrides } : {},
 			...autoRemappedContainerPorts ? { autoRemappedContainerPorts } : {},
@@ -15755,7 +15862,13 @@ function buildDockerRunArgs(opts) {
 		}
 	}
 	const wiring = getActiveWorkloadAwsWiring();
-	const profileCredentialsFile = wiring?.mode === "emulator" ? void 0 : opts.profileCredentialsFile;
+	const previewEnv = {};
+	for (const [k, v] of Object.entries(container.environment)) defineOwnKey(previewEnv, k, v);
+	if (opts.envOverrides) {
+		applyEnvOverrideMap(previewEnv, opts.envOverrides["Parameters"]);
+		applyEnvOverrideMap(previewEnv, opts.envOverrides[container.name]);
+	}
+	const profileCredentialsFile = workloadGetsEmulatorKeysOnly(previewEnv, wiring) ? void 0 : opts.profileCredentialsFile;
 	if (profileCredentialsFile) both("-v", `${profileCredentialsFile.hostPath}:${profileCredentialsFile.containerPath}:ro`);
 	for (const m of wiring?.mounts ?? []) if (!container.mountPoints.some((mp) => mp.containerPath === m.containerPath)) both("-v", `${m.hostPath}:${m.containerPath}:ro`);
 	for (const mp of container.mountPoints) {
@@ -15779,6 +15892,12 @@ function buildDockerRunArgs(opts) {
 		...opts.sidecarIp !== void 0 && { sidecarIp: opts.sidecarIp }
 	});
 	Object.assign(finalEnv, metaEnv);
+	if (opts.mixedModeRoleCredentials && wiring?.mixed && !workloadGetsEmulatorKeysOnly(previewEnv, wiring)) {
+		delete finalEnv["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"];
+		finalEnv["AWS_ACCESS_KEY_ID"] = opts.mixedModeRoleCredentials.accessKeyId;
+		finalEnv["AWS_SECRET_ACCESS_KEY"] = opts.mixedModeRoleCredentials.secretAccessKey;
+		if (opts.mixedModeRoleCredentials.sessionToken) finalEnv["AWS_SESSION_TOKEN"] = opts.mixedModeRoleCredentials.sessionToken;
+	}
 	if (profileCredentialsFile) {
 		finalEnv["AWS_SHARED_CREDENTIALS_FILE"] = profileCredentialsFile.containerPath;
 		finalEnv["AWS_PROFILE"] = profileCredentialsFile.profileName;
@@ -16704,10 +16823,10 @@ const defaultDockerStartImpl = async (containerId, opts = {}) => {
 	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["start", containerId]);
 	if (opts.joinedForwarder) return;
-	const { getActiveWorkloadAwsWiring } = await import("./workload-identity-BOEZuEDO.js").then((n) => n.R);
+	const { getActiveWorkloadAwsWiring } = await import("./workload-identity-CCXbr0KK.js").then((n) => n.B);
 	const wiring = getActiveWorkloadAwsWiring();
 	if (wiring) {
-		const { attachLoopbackForwarder } = await import("./docker-runner-6cuoe4H9.js").then((n) => n.o);
+		const { attachLoopbackForwarder } = await import("./docker-runner-D6K15jJP.js").then((n) => n.o);
 		await attachLoopbackForwarder(containerId, wiring);
 	}
 };
@@ -19588,13 +19707,13 @@ async function loadAssetContextForTarget(args) {
 }
 async function rollOneTarget(args) {
 	const { signal, controller, newBoot, stacks, options, discovery, skipPull, extraStateProviders, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, verdict, imageOverrideTag, logger } = args;
-	const candidate = pickCandidateStack$1(newBoot.target, stacks);
-	const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
+	const { stateProvider, stateProviderFor } = await createTargetStateProviders(newBoot.target, stacks, options, extraStateProviders);
 	try {
 		let resolved;
 		try {
 			resolved = await resolveServiceAndRunnerOpts(newBoot, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, {
 				quiet: true,
+				stateProviderFor,
 				...imageOverrideTag !== void 0 && { imageOverrideTag }
 			});
 		} catch (err) {
@@ -19641,23 +19760,28 @@ async function rollOneTarget(args) {
 	}
 }
 async function bootOneTarget(boot, runState, stacks, options, discovery, skipPull, extraStateProviders, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag) {
-	const candidate = pickCandidateStack$1(boot.target, stacks);
-	const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
+	const { stateProvider, stateProviderFor } = await createTargetStateProviders(boot.target, stacks, options, extraStateProviders);
 	try {
-		return await runOneTarget(boot, runState, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag);
+		return await runOneTarget(boot, runState, stacks, options, discovery, skipPull, stateProvider, stateProviderFor, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag);
 	} finally {
 		if (stateProvider) stateProvider.dispose();
 	}
 }
-async function runOneTarget(boot, runState, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag) {
-	const { service, runnerOpts } = await resolveServiceAndRunnerOpts(boot, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag !== void 0 ? { imageOverrideTag } : {});
+async function runOneTarget(boot, runState, stacks, options, discovery, skipPull, stateProvider, stateProviderFor, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag) {
+	const { service, runnerOpts } = await resolveServiceAndRunnerOpts(boot, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, {
+		stateProviderFor,
+		...imageOverrideTag !== void 0 && { imageOverrideTag }
+	});
 	return startEcsService(service, runnerOpts, runState);
 }
 async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, opts = {}) {
 	const logger = getLogger();
 	const target = boot.target;
 	const quiet = opts.quiet === true;
-	const imageContext = await buildEcsImageResolutionContext$1(target, stacks, options, stateProvider, opts.imageOverrideTag !== void 0 ? { imageOverridden: true } : {});
+	const imageContext = await buildEcsImageResolutionContext$1(target, stacks, options, stateProvider, {
+		...opts.imageOverrideTag !== void 0 && { imageOverridden: true },
+		...opts.stateProviderFor && { stateProviderFor: opts.stateProviderFor }
+	});
 	const service = resolveEcsServiceTarget(target, stacks, imageContext, { suppressLoadBalancerWarning });
 	const representative = service.task.containers.find((c) => c.essential) ?? service.task.containers[0];
 	assertEcsTaskImagesResolvable(service.task, new Set(opts.imageOverrideTag !== void 0 && representative ? [representative.name] : []));
@@ -19685,7 +19809,8 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 		resolvedRoleArn = effectiveAssumeRole;
 		assumedCredentials = await assumeTaskRole$1(resolvedRoleArn, options.region, options.profile);
 	}
-	if (discovery.sharedNetwork && resolvedRoleArn !== void 0 && assumedCredentials) try {
+	const mixedWiring = getActiveWorkloadAwsWiring()?.mixed;
+	if (!mixedWiring && discovery.sharedNetwork && resolvedRoleArn !== void 0 && assumedCredentials) try {
 		await serveTaskRoleFromSharedSidecar(discovery.sharedNetwork, {
 			roleArn: resolvedRoleArn,
 			credentials: assumedCredentials,
@@ -19705,7 +19830,10 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 	};
 	if (envOverrides) taskOpts.envOverrides = envOverrides;
 	if (options.stackRegion) taskOpts.stackRegion = options.stackRegion;
-	if (assumedCredentials) taskOpts.taskCredentials = assumedCredentials;
+	if (assumedCredentials && mixedWiring) {
+		taskOpts.taskCredentials = mixedWiring.emulatorCredentials;
+		taskOpts.mixedModeRoleCredentials = assumedCredentials;
+	} else if (assumedCredentials) taskOpts.taskCredentials = assumedCredentials;
 	if (resolvedRoleArn) taskOpts.taskRoleArn = resolvedRoleArn;
 	if (options.platform) taskOpts.platformOverride = options.platform;
 	if (options.region) taskOpts.region = options.region;
@@ -20044,6 +20172,63 @@ async function assumeTaskRole$1(roleArn, region, profile) {
 		makeError: (message) => new LocalStartServiceError(message)
 	});
 }
+async function createTargetStateProviders(target, stacks, options, extraStateProviders) {
+	const candidate = pickCandidateStack$1(target, stacks);
+	const region = await resolveCfnFallbackRegion(options, candidate?.region);
+	const stateProviderFor = (workload) => createLocalStateProvider(options, candidate?.stackName ?? "", region, extraStateProviders, { workload });
+	return {
+		stateProvider: stateProviderFor(UNNAMED_WORKLOAD),
+		stateProviderFor
+	};
+}
+function ecsContainerNamesOf(stack) {
+	const names = /* @__PURE__ */ new Set();
+	for (const resource of Object.values(stack.template.Resources ?? {})) {
+		if (resource?.Type !== "AWS::ECS::TaskDefinition") continue;
+		const defs = resource.Properties?.["ContainerDefinitions"];
+		if (!Array.isArray(defs)) continue;
+		for (const def of defs) {
+			const name = def?.["Name"];
+			if (typeof name === "string" && name !== "") names.add(name);
+		}
+	}
+	return [...names];
+}
+async function loadMixedModeContainerStates(ctx, stack, stateProviderFor) {
+	const groups = groupWorkloadsRoutedApart(ecsContainerNamesOf(stack), (containerName) => ({ containerName }));
+	if (groups.length === 0) return;
+	const containerStates = {};
+	for (const group of groups) {
+		const provider = stateProviderFor(group.workload);
+		if (!provider) continue;
+		try {
+			const state = {};
+			const loaded = await provider.load(stack.stackName, stack.region);
+			if (loaded) state.stateResources = loaded.resources;
+			else {
+				const loadError = provider.getLastLoadError?.();
+				if (loadError) state.stateLoadFailureMessage = loadError;
+			}
+			if (provider.resolveTemplateSsmParameters) {
+				const ssm = await provider.resolveTemplateSsmParameters(stack.template);
+				if (Object.keys(ssm.values).length > 0) state.stateParameters = ssm.values;
+				if (ssm.secureStringLogicalIds.length > 0) state.stateSensitiveParameters = ssm.secureStringLogicalIds;
+			}
+			for (const name of group.items) defineOwnState(containerStates, name, state);
+		} finally {
+			provider.dispose();
+		}
+	}
+	ctx.containerStates = containerStates;
+}
+function defineOwnState(map, key, value) {
+	Object.defineProperty(map, key, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+}
 async function buildEcsImageResolutionContext$1(target, stacks, options, stateProvider, opts = {}) {
 	const logger = getLogger();
 	const candidate = pickCandidateStack$1(target, stacks);
@@ -20084,6 +20269,7 @@ async function buildEcsImageResolutionContext$1(target, stacks, options, statePr
 			if (Object.keys(ssmParameters.values).length > 0) ctx.stateParameters = ssmParameters.values;
 			if (ssmParameters.secureStringLogicalIds.length > 0) ctx.stateSensitiveParameters = ssmParameters.secureStringLogicalIds;
 		}
+		if (needs.needsEnvOrSecretSubstitution && opts.stateProviderFor) await loadMixedModeContainerStates(ctx, candidate, opts.stateProviderFor);
 	} else if (!stateProvider && needs.needsStateResources) {
 		if (!opts.suppressStateWarning && !opts.imageOverridden) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI, or --image-override to build it from a local Dockerfile.");
 	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) {
@@ -20191,6 +20377,7 @@ async function resolveServiceDefaultCredentials(options, assumedCredentials) {
 async function resolveSharedSidecarCredentials(options) {
 	const wiring = getActiveWorkloadAwsWiring();
 	if (wiring?.mode === "emulator") return wiring.emulatorCredentials;
+	if (wiring?.mixed) return wiring.mixed.emulatorCredentials;
 	if (options.profile) return resolveProfileCredentials(options.profile);
 	return resolveHostDefaultCredentials();
 }
@@ -20199,7 +20386,7 @@ async function resolveAndBuildImageOverrides(args) {
 	const resolvedForPeek = [];
 	for (const target of perTarget) {
 		const candidate = pickCandidateStack$1(target, stacks);
-		const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
+		const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders, { workload: UNNAMED_WORKLOAD });
 		let imageContext;
 		let service;
 		try {
@@ -20352,8 +20539,10 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 			onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} run-task requires a <target> (an ECS task definition display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_RUN_TASK_TARGET_REQUIRED")
 		});
 		const candidate = pickCandidateStack(resolvedTarget, stacks);
-		stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
-		const imageContext = await buildEcsImageResolutionContext(candidate, stateProvider, options);
+		const stateRegion = await resolveCfnFallbackRegion(options, candidate?.region);
+		const stateProviderFor = (workload) => createLocalStateProvider(options, candidate?.stackName ?? "", stateRegion, extraStateProviders, { workload });
+		stateProvider = stateProviderFor(UNNAMED_WORKLOAD);
+		const imageContext = await buildEcsImageResolutionContext(candidate, stateProvider, options, stateProviderFor);
 		const task = resolveEcsTaskTarget(resolvedTarget, stacks, imageContext);
 		logger.info(`Target: ${displayStackName(`${task.stack.stackName}/${task.taskDefinitionLogicalId}`)} (family=${displayIdent(task.family)}, containers=${task.containers.length})`);
 		const taskNeeds = detectEcsImageResolutionNeeds(stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack);
@@ -20400,7 +20589,11 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 			detach: options.detach
 		};
 		if (envOverrides) runOpts.envOverrides = envOverrides;
-		if (sidecarCredentials) runOpts.taskCredentials = sidecarCredentials;
+		const mixed = getActiveWorkloadAwsWiring()?.mixed;
+		if (mixed) {
+			runOpts.taskCredentials = mixed.emulatorCredentials;
+			if (assumedCredentials) runOpts.mixedModeRoleCredentials = assumedCredentials;
+		} else if (sidecarCredentials) runOpts.taskCredentials = sidecarCredentials;
 		if (resolvedRoleArn) runOpts.taskRoleArn = resolvedRoleArn;
 		if (options.platform) runOpts.platformOverride = options.platform;
 		if (options.region) runOpts.region = options.region;
@@ -20495,7 +20688,7 @@ async function assumeTaskRole(roleArn, region, profile) {
 		sessionNameSuffix: "run-task"
 	});
 }
-async function buildEcsImageResolutionContext(candidate, stateProvider, options) {
+async function buildEcsImageResolutionContext(candidate, stateProvider, options, stateProviderFor) {
 	const logger = getLogger();
 	if (!candidate) return void 0;
 	const needs = detectEcsImageResolutionNeeds(candidate);
@@ -20534,6 +20727,7 @@ async function buildEcsImageResolutionContext(candidate, stateProvider, options)
 			if (Object.keys(ssmParameters.values).length > 0) ctx.stateParameters = ssmParameters.values;
 			if (ssmParameters.secureStringLogicalIds.length > 0) ctx.stateSensitiveParameters = ssmParameters.secureStringLogicalIds;
 		}
+		if (needs.needsEnvOrSecretSubstitution && stateProviderFor) await loadMixedModeContainerStates(ctx, candidate, stateProviderFor);
 	} else if (!stateProvider && needs.needsStateResources) {
 		if (!options.imageOverride?.length) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI, or --image-override to build it from a local Dockerfile. Otherwise the resolver will surface its existing error.");
 	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
@@ -23436,9 +23630,9 @@ function defaultFetchObject(bucketName, options) {
 			const { S3Client, GetObjectCommand } = await import("@aws-sdk/client-s3");
 			return {
 				client: new S3Client({
-					...workloadClientConfig(),
+					...workloadClientConfig({ service: "S3" }),
 					...options.region && { region: options.region },
-					...options.credentials && { credentials: {
+					...options.credentials && !isAwsServiceRoutedToEmulator("S3") && { credentials: {
 						accessKeyId: options.credentials.accessKeyId,
 						secretAccessKey: options.credentials.secretAccessKey,
 						...options.credentials.sessionToken && { sessionToken: options.credentials.sessionToken }
@@ -23503,9 +23697,9 @@ async function resolveDeployedOriginBucket(options) {
 async function defaultGetOrigins(options) {
 	const { CloudFrontClient, GetDistributionConfigCommand } = await import("@aws-sdk/client-cloudfront");
 	const client = new CloudFrontClient({
-		...workloadClientConfig(),
+		...workloadClientConfig({ service: "CLOUDFRONT" }),
 		region: "us-east-1",
-		...options.credentials && { credentials: {
+		...options.credentials && !isAwsServiceRoutedToEmulator("CLOUDFRONT") && { credentials: {
 			accessKeyId: options.credentials.accessKeyId,
 			secretAccessKey: options.credentials.secretAccessKey,
 			...options.credentials.sessionToken && { sessionToken: options.credentials.sessionToken }
@@ -23522,9 +23716,9 @@ async function defaultGetOrigins(options) {
 //#region src/local/cloudfront-kvs-client.ts
 function createDeployedKvsDataSource(options) {
 	const client = new CloudFrontKeyValueStoreClient({
-		...workloadClientConfig(),
+		...workloadClientConfig({ service: "CLOUDFRONT_KEYVALUESTORE" }),
 		region: options.region ?? "us-east-1",
-		...options.credentials !== void 0 && { credentials: options.credentials }
+		...options.credentials !== void 0 && !isAwsServiceRoutedToEmulator("CLOUDFRONT_KEYVALUESTORE") && { credentials: options.credentials }
 	});
 	return {
 		label: `deployed:${options.kvsArn}`,
@@ -23544,9 +23738,9 @@ function createDeployedKvsDataSource(options) {
 }
 async function resolveDeployedKvsArnByName(name, options = {}) {
 	const client = new CloudFrontClient({
-		...workloadClientConfig(),
+		...workloadClientConfig({ service: "CLOUDFRONT" }),
 		region: options.region ?? "us-east-1",
-		...options.credentials !== void 0 && { credentials: options.credentials }
+		...options.credentials !== void 0 && !isAwsServiceRoutedToEmulator("CLOUDFRONT") && { credentials: options.credentials }
 	});
 	try {
 		for await (const page of paginateListKeyValueStores({ client }, {})) for (const item of page.KeyValueStoreList?.Items ?? []) if (item.Name === name && item.ARN) return {
@@ -24468,7 +24662,7 @@ async function resolveDeployedS3Origins(distribution, stacks, options, profileCr
 		buckets
 	};
 	const synthRegion = stacks.find((s) => s.stackName === distribution.stackName)?.region;
-	const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders, { realAwsOnly: true });
+	const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
 	let record;
 	try {
 		record = provider ? await provider.load(distribution.stackName, synthRegion) : void 0;
@@ -31621,7 +31815,7 @@ async function prepareEcsImageContexts(args) {
 	}
 	rejectExplicitCfnStackWithMultipleStacks(options, owningStacks.length);
 	for (const stack of owningStacks) {
-		const stateProvider = createLocalStateProvider(options, stack.stackName, await resolveCfnFallbackRegion(options, stack.region));
+		const stateProvider = createLocalStateProvider(options, stack.stackName, await resolveCfnFallbackRegion(options, stack.region), void 0, { workload: UNNAMED_WORKLOAD });
 		try {
 			const ctx = await buildEcsImageResolutionContext(stack, stateProvider, options);
 			contextByStack.set(stack.stackName, ctx);
@@ -31998,5 +32192,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { postHook as $, awsEndpointOptions as $a, buildConnectEvent as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, webSocketApiMatchesIdentifier as Aa, buildCorsConfigByApiId as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, pickAgentCoreCandidateStack as Ba, pickResponseTemplate as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, countTargets as Ca, buildMethodArn as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, discoverWebSocketApisOrThrow as Da, invokeTokenAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, discoverWebSocketApis as Ea, invokeRequestAuthorizer as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, AGENTCORE_AGUI_PROTOCOL as Fa, translateLambdaResponse as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, deployedFillMayBeSecret as Ga, HOST_GATEWAY_MIN_VERSION as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, DynamicReferenceResolutionError as Ha, tryParseStatus as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, AGENTCORE_HTTP_PROTOCOL as Ia, applyAuthorizerOverlay as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, keysOverriddenBy as Ja, bufferToBody as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, firstUsableRegion as Ka, probeHostGatewaySupport as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_MCP_PROTOCOL as La, buildHttpApiV2Event as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, pickRefLogicalId as Ma, isFunctionUrlOacFronted as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, resolveLambdaArnIntrinsic as Na, matchPreflight as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, filterWebSocketApisByIdentifiers as Oa, attachAuthorizers as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, AGENTCORE_A2A_PROTOCOL as Pa, matchRoute as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, addAwsEndpointOptions as Qa, parseConnectionsPath as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_RUNTIME_TYPE as Ra, buildRestV1Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, resolveSingleTarget as Sa, verifyJwtViaDiscovery as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, availableWebSocketApiIdentifiers as Ta, evaluateCachedLambdaPolicy as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, DynamicReferenceResolver as Ua, VtlEvaluationError as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, resolveAgentCoreTarget as Va, selectIntegrationResponse as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, containsDynamicReference as Wa, HOST_DOCKER_INTERNAL_GATEWAY as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, resolveDynamicReferencesInEnv as Xa, buildMgmtEndpointEnvUrl as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, parseDynamicReference as Ya, ConnectionRegistry as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, withoutKeys as Za, handleConnectionsRequest as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveCfnStackName as _a, buildCognitoJwksUrl as _i, pickKvsLogicalIdFromArn as _n, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, EcsTaskResolutionError as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, resolveSsmParameters as ba, verifyCognitoJwt as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, substituteAgainstStateAsync as ca, availableApiIdentifiers as ci, buildEdgeRequestEvent as cn, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, LocalStateSourceError as da, groupRoutesByServer as di, httpHeadersToEdge as dn, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildDisconnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, createLocalStateProvider as fa, readMtlsMaterialsFromDisk as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, resolveCfnRegion as ga, defaultCredentialsLoader as gi, pickFunctionUrlLogicalIdFromOrigin as gn, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, resolveCfnFallbackRegion as ha, resolveServiceIntegrationParameters as hi, isCloudFrontDistribution as hn, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, resolveRuntimeImage as ia, createFileWatcher as ii, serveFromStaticOrigin as in, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, discoverRoutes as ja, buildCorsConfigFromCloudFrontChain as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, parseSelectionExpressionPath as ka, applyCorsResponseHeaders as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, substituteEnvVarsFromState as la, filterRoutesByApiIdentifier as li, buildEdgeResponseEvent as ln, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, rejectExplicitCfnStackWithMultipleStacks as ma, resolveSelectionExpression as mi, extractKvsAssociations as mn, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, resolveRuntimeCodeMountPath as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, assertEcsTaskImagesResolvable as oa, buildStageMap as oi, applyEdgeRequestResult as on, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, isCfnFlagPresent as pa, startApiServer as pi, describeS3OriginDomain as pn, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, keysNotFromTemplate as qa, resolveHostGatewayExtraHosts as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, resolveRuntimeFileExtension as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, substituteAgainstState as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildMessageEvent as ta, createWatchPredicates as ti, matchBehavior as tn, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteEnvVarsFromStateAsync as ua, filterRoutesByApiIdentifiers as ui, edgeHeadersToHttp as un, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, CfnLocalStateProvider as va, buildJwksUrlFromIssuer as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, listTargets as wa, computeRequestIdentityHash as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, resolveWatchConfig as xa, verifyJwtAuthorizer as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, collectSsmParameterRefs as ya, createJwksCache as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AgentCoreResolutionError as za, evaluateResponseParameters as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
-//# sourceMappingURL=local-studio-DIxEENzj.js.map
+export { postHook as $, withoutKeys as $a, buildConnectEvent as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, filterWebSocketApisByIdentifiers as Aa, buildCorsConfigByApiId as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AGENTCORE_RUNTIME_TYPE as Ba, pickResponseTemplate as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveWatchConfig as Ca, buildMethodArn as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, availableWebSocketApiIdentifiers as Da, invokeTokenAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, listTargets as Ea, invokeRequestAuthorizer as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, resolveLambdaArnIntrinsic as Fa, translateLambdaResponse as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, DynamicReferenceResolver as Ga, HOST_GATEWAY_MIN_VERSION as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, pickAgentCoreCandidateStack as Ha, tryParseStatus as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, AGENTCORE_A2A_PROTOCOL as Ia, applyAuthorizerOverlay as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, firstUsableRegion as Ja, bufferToBody as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, containsDynamicReference as Ka, probeHostGatewaySupport as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_AGUI_PROTOCOL as La, buildHttpApiV2Event as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, webSocketApiMatchesIdentifier as Ma, isFunctionUrlOacFronted as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, discoverRoutes as Na, matchPreflight as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, discoverWebSocketApis as Oa, attachAuthorizers as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, pickRefLogicalId as Pa, matchRoute as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, resolveDynamicReferencesInEnv as Qa, parseConnectionsPath as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_HTTP_PROTOCOL as Ra, buildRestV1Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, resolveSsmParameters as Sa, verifyJwtViaDiscovery as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, countTargets as Ta, evaluateCachedLambdaPolicy as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, resolveAgentCoreTarget as Ua, VtlEvaluationError as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, AgentCoreResolutionError as Va, selectIntegrationResponse as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, DynamicReferenceResolutionError as Wa, HOST_DOCKER_INTERNAL_GATEWAY as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, keysOverriddenBy as Xa, buildMgmtEndpointEnvUrl as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, keysNotFromTemplate as Ya, ConnectionRegistry as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, parseDynamicReference as Za, handleConnectionsRequest as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveCfnFallbackRegion as _a, buildCognitoJwksUrl as _i, pickKvsLogicalIdFromArn as _n, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, EcsTaskResolutionError as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, CfnLocalStateProvider as ba, verifyCognitoJwt as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, substituteAgainstStateAsync as ca, availableApiIdentifiers as ci, buildEdgeRequestEvent as cn, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, LocalStateSourceError as da, groupRoutesByServer as di, httpHeadersToEdge as dn, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildDisconnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, addAwsEndpointOptions as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, UNNAMED_WORKLOAD as fa, readMtlsMaterialsFromDisk as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, rejectExplicitCfnStackWithMultipleStacks as ga, defaultCredentialsLoader as gi, pickFunctionUrlLogicalIdFromOrigin as gn, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, isCfnFlagPresent as ha, resolveServiceIntegrationParameters as hi, isCloudFrontDistribution as hn, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, resolveRuntimeImage as ia, createFileWatcher as ii, serveFromStaticOrigin as in, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, parseSelectionExpressionPath as ja, buildCorsConfigFromCloudFrontChain as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, discoverWebSocketApisOrThrow as ka, applyCorsResponseHeaders as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, substituteEnvVarsFromState as la, filterRoutesByApiIdentifier as li, buildEdgeResponseEvent as ln, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, groupWorkloadsRoutedApart as ma, resolveSelectionExpression as mi, extractKvsAssociations as mn, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, resolveRuntimeCodeMountPath as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, assertEcsTaskImagesResolvable as oa, buildStageMap as oi, applyEdgeRequestResult as on, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, createLocalStateProvider as pa, startApiServer as pi, describeS3OriginDomain as pn, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, deployedFillMayBeSecret as qa, resolveHostGatewayExtraHosts as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, resolveRuntimeFileExtension as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, substituteAgainstState as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildMessageEvent as ta, createWatchPredicates as ti, matchBehavior as tn, awsEndpointOptions as to, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteEnvVarsFromStateAsync as ua, filterRoutesByApiIdentifiers as ui, edgeHeadersToHttp as un, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnRegion as va, buildJwksUrlFromIssuer as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, resolveSingleTarget as wa, computeRequestIdentityHash as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, collectSsmParameterRefs as xa, verifyJwtAuthorizer as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, resolveCfnStackName as ya, createJwksCache as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_MCP_PROTOCOL as za, evaluateResponseParameters as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
+//# sourceMappingURL=local-studio-C78UofCN.js.map