cdk-local 0.163.5 → 0.164.0

package/dist/{workload-identity-BOEZuEDO.js → workload-identity-CCXbr0KK.js}

@@ -568,21 +568,319 @@ const AWS_ENDPOINT_SERVICE_IDS = /* @__PURE__ */ new Set([
 	"XRAY"
 ]);
 
+//#endregion
+//#region src/local/aws-real-endpoints.ts
+const AWS_ENDPOINT_PREFIX_OVERRIDES = {
+	ACCESSANALYZER: "access-analyzer",
+	ACCOUNT_ACCESS: "account-access",
+	ACM_PCA: "acm-pca",
+	AGENT_REGISTRY: "agent-registry",
+	AGENT_REGISTRY_CONTROL: "agent-registry-control",
+	AMP: "aps",
+	APIGATEWAYMANAGEMENTAPI: "execute-api",
+	APIGATEWAYV2: "apigateway",
+	APPINTEGRATIONS: "app-integrations",
+	APPLICATIONCOSTPROFILER: "application-cost-profiler",
+	APPLICATION_AUTO_SCALING: "application-autoscaling",
+	APPLICATION_DISCOVERY_SERVICE: "discovery",
+	APPLICATION_SIGNALS: "application-signals",
+	APPSTREAM: "appstream2",
+	ARC_REGION_SWITCH: "arc-region-switch",
+	ARC_ZONAL_SHIFT: "arc-zonal-shift",
+	AUTO_SCALING_PLANS: "autoscaling-plans",
+	BACKUPSEARCH: "backup-search",
+	BACKUP_GATEWAY: "backup-gateway",
+	BCM_DASHBOARDS: "bcm-dashboards",
+	BCM_DATA_EXPORTS: "bcm-data-exports",
+	BCM_PRICING_CALCULATOR: "bcm-pricing-calculator",
+	BCM_RECOMMENDED_ACTIONS: "bcm-recommended-actions",
+	BEDROCK_AGENT: "bedrock-agent",
+	BEDROCK_AGENTCORE: "bedrock-agentcore",
+	BEDROCK_AGENTCORE_CONTROL: "bedrock-agentcore-control",
+	BEDROCK_AGENT_RUNTIME: "bedrock-agent-runtime",
+	BEDROCK_DATA_AUTOMATION: "bedrock-data-automation",
+	BEDROCK_DATA_AUTOMATION_RUNTIME: "bedrock-data-automation-runtime",
+	BEDROCK_RUNTIME: "bedrock-runtime",
+	CHIME_SDK_IDENTITY: "identity-chime",
+	CHIME_SDK_MEDIA_PIPELINES: "media-pipelines-chime",
+	CHIME_SDK_MEETINGS: "meetings-chime",
+	CHIME_SDK_MESSAGING: "messaging-chime",
+	CHIME_SDK_VOICE: "voice-chime",
+	CLEANROOMSML: "cleanrooms-ml",
+	CLOUDCONTROL: "cloudcontrolapi",
+	CLOUDFRONT_KEYVALUESTORE: "cloudfront-keyvaluestore",
+	CLOUDTRAIL_DATA: "cloudtrail-data",
+	CLOUDWATCH: "monitoring",
+	CLOUDWATCHOMNI: "cloudwatch-omni",
+	CLOUDWATCH_LOGS: "logs",
+	CODEGURUPROFILER: "codeguru-profiler",
+	CODEGURU_REVIEWER: "codeguru-reviewer",
+	CODEGURU_SECURITY: "codeguru-security",
+	CODESTAR_CONNECTIONS: "codestar-connections",
+	CODESTAR_NOTIFICATIONS: "codestar-notifications",
+	COGNITO_IDENTITY: "cognito-identity",
+	COGNITO_IDENTITY_PROVIDER: "cognito-idp",
+	COGNITO_SYNC: "cognito-sync",
+	COMPUTE_OPTIMIZER: "compute-optimizer",
+	COMPUTE_OPTIMIZER_AUTOMATION: "aco-automation",
+	CONFIG_SERVICE: "config",
+	CONNECTCAMPAIGNS: "connect-campaigns",
+	CONNECTCAMPAIGNSV2: "connect-campaigns",
+	CONNECTCASES: "cases",
+	CONNECTHEALTH: "health-agent",
+	CONNECTPARTICIPANT: "participant.connect",
+	CONNECT_CONTACT_LENS: "contact-lens",
+	COST_AND_USAGE_REPORT_SERVICE: "cur",
+	COST_EXPLORER: "ce",
+	COST_OPTIMIZATION_HUB: "cost-optimization-hub",
+	CUSTOMER_PROFILES: "profile",
+	DATABASE_MIGRATION_SERVICE: "dms",
+	DETECTIVE: "api.detective",
+	DEVOPS_AGENT: "aidevops",
+	DEVOPS_GURU: "devops-guru",
+	DIRECTORY_SERVICE: "ds",
+	DIRECTORY_SERVICE_DATA: "ds-data",
+	DOCDB: "rds",
+	DOCDB_ELASTIC: "docdb-elastic",
+	DYNAMODB_STREAMS: "streams.dynamodb",
+	EC2_INSTANCE_CONNECT: "ec2-instance-connect",
+	ECR: "api.ecr",
+	ECR_PUBLIC: "api.ecr-public",
+	EFS: "elasticfilesystem",
+	EKS_AUTH: "eks-auth",
+	ELASTICSEARCH_SERVICE: "es",
+	ELASTIC_LOAD_BALANCING_V2: "elasticloadbalancing",
+	ELEMENTALINFERENCE: "elemental-inference",
+	EMR: "elasticmapreduce",
+	EMR_CONTAINERS: "emr-containers",
+	EMR_SERVERLESS: "emr-serverless",
+	ENDUSERMESSAGING: "end-user-messaging",
+	EVENTBRIDGE: "events",
+	EVENTBRIDGEV2: "eventsv2",
+	GEO_MAPS: "geo-maps",
+	GEO_PLACES: "geo-places",
+	GEO_ROUTES: "geo-routes",
+	GREENGRASSV2: "greengrass",
+	IAM_TOOLBOX: "iam-toolbox",
+	INSPECTOR_SCAN: "inspector-scan",
+	IOTDEVICEADVISOR: "api.iotdeviceadvisor",
+	IOTSECURETUNNELING: "api.tunneling.iot",
+	IOT_DATA_PLANE: "data-ats.iot",
+	IOT_JOBS_DATA_PLANE: "data.jobs.iot",
+	IOT_MANAGED_INTEGRATIONS: "api.iotmanagedintegrations",
+	IOT_WIRELESS: "api.iotwireless",
+	KENDRA_RANKING: "kendra-ranking",
+	KEYSPACES: "cassandra",
+	KEYSPACESSTREAMS: "cassandra-streams",
+	KINESIS_ANALYTICS_V2: "kinesisanalytics",
+	KINESIS_VIDEO_ARCHIVED_MEDIA: "kinesisvideo",
+	KINESIS_VIDEO_MEDIA: "kinesisvideo",
+	KINESIS_VIDEO_SIGNALING: "kinesisvideo",
+	KINESIS_VIDEO_WEBRTC_STORAGE: "kinesisvideo",
+	LAMBDA_CORE: "lambda",
+	LAMBDA_MICROVMS: "lambda",
+	LAMBDA_WEB: "lambda",
+	LEX_MODELS_V2: "models-v2-lex",
+	LEX_MODEL_BUILDING_SERVICE: "models.lex",
+	LEX_RUNTIME_SERVICE: "runtime.lex",
+	LEX_RUNTIME_V2: "runtime-v2-lex",
+	LICENSE_MANAGER: "license-manager",
+	LICENSE_MANAGER_LINUX_SUBSCRIPTIONS: "license-manager-linux-subscriptions",
+	LICENSE_MANAGER_USER_SUBSCRIPTIONS: "license-manager-user-subscriptions",
+	LOCATION: "geo",
+	MAILMANAGER: "mail-manager",
+	MANAGEDBLOCKCHAIN_QUERY: "managedblockchain-query",
+	MARKETPLACE_AGREEMENT: "agreement-marketplace",
+	MARKETPLACE_CATALOG: "catalog.marketplace",
+	MARKETPLACE_DEPLOYMENT: "deployment-marketplace",
+	MARKETPLACE_DISCOVERY: "discovery-marketplace",
+	MARKETPLACE_ENTITLEMENT_SERVICE: "entitlement.marketplace",
+	MARKETPLACE_METERING: "metering.marketplace",
+	MARKETPLACE_REPORTING: "reporting-marketplace",
+	MEDIAPACKAGE_VOD: "mediapackage-vod",
+	MEDIASTORE_DATA: "data.mediastore",
+	MEDIATAILOR: "api.mediatailor",
+	MEDICAL_IMAGING: "medical-imaging",
+	MEMORYDB: "memory-db",
+	MIGRATIONHUBORCHESTRATOR: "migrationhub-orchestrator",
+	MIGRATIONHUBSTRATEGY: "migrationhub-strategy",
+	MIGRATIONHUB_CONFIG: "migrationhub-config",
+	MIGRATION_HUB: "mgh",
+	MIGRATION_HUB_REFACTOR_SPACES: "refactor-spaces",
+	MTURK: "mturk-requester",
+	MWAA: "airflow",
+	MWAA_SERVERLESS: "airflow-serverless",
+	NEPTUNE: "rds",
+	NEPTUNEDATA: "neptune-db",
+	NEPTUNE_GRAPH: "neptune-graph",
+	NETWORK_FIREWALL: "network-firewall",
+	NETWORK_SECURITY_MANAGER: "network-security-manager",
+	NOTIFICATIONSCONTACTS: "notifications-contacts",
+	NOVA_ACT: "nova-act",
+	OPENSEARCH: "es",
+	OPENSEARCHSERVERLESS: "aoss",
+	PARTNERCENTRAL_ACCOUNT: "partnercentral-account",
+	PARTNERCENTRAL_BENEFITS: "partnercentral-benefits",
+	PARTNERCENTRAL_CHANNEL: "partnercentral-channel",
+	PARTNERCENTRAL_REVENUE_MEASUREMENT: "partnercentral-prm",
+	PARTNERCENTRAL_SELLING: "partnercentral-selling",
+	PAYMENT_CRYPTOGRAPHY: "controlplane.payment-cryptography",
+	PAYMENT_CRYPTOGRAPHY_DATA: "dataplane.payment-cryptography",
+	PCA_CONNECTOR_AD: "pca-connector-ad",
+	PCA_CONNECTOR_SCEP: "pca-connector-scep",
+	PERSONALIZE_EVENTS: "personalize-events",
+	PERSONALIZE_RUNTIME: "personalize-runtime",
+	PINPOINT_EMAIL: "email",
+	PINPOINT_SMS_VOICE: "sms-voice.pinpoint",
+	PINPOINT_SMS_VOICE_V2: "sms-voice",
+	PRICING: "api.pricing",
+	QAPPS: "data.qapps",
+	QCONNECT: "wisdom",
+	RDS_DATA: "rds-data",
+	REDSHIFT_DATA: "redshift-data",
+	REDSHIFT_SERVERLESS: "redshift-serverless",
+	RESILIENCEHUBV2: "resiliencehub",
+	RESOURCE_EXPLORER_2: "resource-explorer-2",
+	RESOURCE_GROUPS: "resource-groups",
+	RESOURCE_GROUPS_TAGGING_API: "tagging",
+	ROUTE53_RECOVERY_CLUSTER: "route53-recovery-cluster",
+	ROUTE53_RECOVERY_CONTROL_CONFIG: "route53-recovery-control-config",
+	ROUTE53_RECOVERY_READINESS: "route53-recovery-readiness",
+	S3OUTPOSTS: "s3-outposts",
+	S3_CONTROL: "s3-control",
+	SAGEMAKER: "api.sagemaker",
+	SAGEMAKERJOBRUNTIME: "job-runtime.sagemaker",
+	SAGEMAKERTRAININGSESSIONRUNTIME: "training-session-runtime.sagemaker",
+	SAGEMAKER_A2I_RUNTIME: "a2i-runtime.sagemaker",
+	SAGEMAKER_EDGE: "edge.sagemaker",
+	SAGEMAKER_FEATURESTORE_RUNTIME: "featurestore-runtime.sagemaker",
+	SAGEMAKER_GEOSPATIAL: "sagemaker-geospatial",
+	SAGEMAKER_METRICS: "metrics.sagemaker",
+	SAGEMAKER_RUNTIME: "runtime.sagemaker",
+	SECURITY_IR: "security-ir",
+	SERVERLESSAPPLICATIONREPOSITORY: "serverlessrepo",
+	SERVICE_CATALOG_APPREGISTRY: "servicecatalog-appregistry",
+	SES: "email",
+	SESV2: "email",
+	SFN: "states",
+	SIGNER_DATA: "data-signer",
+	SIMPLEDB: "sdb",
+	SIMPLEDBV2: "sdb",
+	SNOW_DEVICE_MANAGEMENT: "snow-device-management",
+	SOCIALMESSAGING: "social-messaging",
+	SSM_CONTACTS: "ssm-contacts",
+	SSM_GUICONNECT: "ssm-guiconnect",
+	SSM_INCIDENTS: "ssm-incidents",
+	SSM_QUICKSETUP: "ssm-quicksetup",
+	SSM_SAP: "ssm-sap",
+	SSO: "portal.sso",
+	SSO_ADMIN: "sso",
+	SSO_OIDC: "oidc",
+	SUPPLYCHAIN: "scn",
+	TAXSETTINGS: "tax",
+	TIMESTREAM_INFLUXDB: "timestream-influxdb",
+	TIMESTREAM_QUERY: "query.timestream",
+	TIMESTREAM_WRITE: "ingest.timestream",
+	VPC_LATTICE: "vpc-lattice",
+	WAF_REGIONAL: "waf-regional",
+	WICKR: "admin.wickr",
+	WORKSPACES_INSTANCES: "workspaces-instances",
+	WORKSPACES_THIN_CLIENT: "thinclient",
+	WORKSPACES_WEB: "workspaces-web"
+};
+const AWS_GLOBAL_ENDPOINTS = {
+	account: {
+		hostname: "account.us-east-1.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	billingconductor: {
+		hostname: "billingconductor.us-east-1.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	budgets: {
+		hostname: "budgets.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	ce: {
+		hostname: "ce.us-east-1.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	chime: {
+		hostname: "chime.us-east-1.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	cloudfront: {
+		hostname: "cloudfront.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	health: {
+		hostname: "global.health.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	iam: {
+		hostname: "iam.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	importexport: {
+		hostname: "importexport.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	networkmanager: {
+		hostname: "networkmanager.us-west-2.amazonaws.com",
+		signingRegion: "us-west-2"
+	},
+	"notifications-contacts": {
+		hostname: "notifications-contacts.us-east-1.api.aws",
+		signingRegion: "us-east-1"
+	},
+	organizations: {
+		hostname: "organizations.us-east-1.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	route53: {
+		hostname: "route53.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	savingsplans: {
+		hostname: "savingsplans.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	shield: {
+		hostname: "shield.us-east-1.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	tax: {
+		hostname: "tax.us-east-1.amazonaws.com",
+		signingRegion: "us-east-1"
+	},
+	waf: {
+		hostname: "waf.amazonaws.com",
+		signingRegion: "us-east-1"
+	}
+};
+
 //#endregion
 //#region src/local/aws-emulator-mixed-mode.ts
-const AWS_EMULATOR_SENTINEL = "aws-emulator";
+const REAL_AWS_SENTINEL = "real-aws";
+const LEGACY_AWS_EMULATOR_SENTINEL = "aws-emulator";
 const MIXED_MODE_RESIGN_PORT = 47297;
 const ENDPOINT_KEY = /^AWS_ENDPOINT_URL(?:_([A-Z0-9_]+))?$/;
-function isAwsEmulatorSentinel(key, value) {
-	return typeof value === "string" && value.trim() === "aws-emulator" && ENDPOINT_KEY.test(key);
+function isSentinel(key, value, sentinel) {
+	return typeof value === "string" && value.trim() === sentinel && ENDPOINT_KEY.test(key);
 }
-function findAwsEmulatorSentinels(overrides) {
+function isRealAwsSentinel(key, value) {
+	return isSentinel(key, value, REAL_AWS_SENTINEL);
+}
+function isLegacyAwsEmulatorSentinel(key, value) {
+	return isSentinel(key, value, LEGACY_AWS_EMULATOR_SENTINEL);
+}
+function findSentinels(overrides, match) {
 	const found = [];
 	if (!overrides || typeof overrides !== "object") return found;
 	for (const [section, map] of Object.entries(overrides)) {
 		if (!map || typeof map !== "object" || Array.isArray(map)) continue;
 		for (const [key, value] of Object.entries(map)) {
-			if (!isAwsEmulatorSentinel(key, value)) continue;
+			if (!match(key, value)) continue;
 			found.push({
 				section,
 				key,
@@ -592,33 +890,33 @@ function findAwsEmulatorSentinels(overrides) {
 	}
 	return found;
 }
+function findRealAwsExceptions(overrides) {
+	return findSentinels(overrides, isRealAwsSentinel);
+}
+function findLegacyAwsEmulatorSentinels(overrides) {
+	return findSentinels(overrides, isLegacyAwsEmulatorSentinel);
+}
 function readAwsEmulatorEnvVarsFile(filePath) {
-	if (!filePath) return {
+	const none = {
 		overrides: void 0,
-		sentinels: []
+		exceptions: [],
+		legacySentinels: []
 	};
+	if (!filePath) return none;
 	let parsed;
 	try {
 		parsed = JSON.parse(readEnvVarsFileText(filePath));
 	} catch {
-		return {
-			overrides: void 0,
-			sentinels: []
-		};
+		return none;
 	}
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {
-		overrides: void 0,
-		sentinels: []
-	};
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return none;
 	const overrides = parsed;
 	return {
 		overrides,
-		sentinels: findAwsEmulatorSentinels(overrides)
+		exceptions: findRealAwsExceptions(overrides),
+		legacySentinels: findLegacyAwsEmulatorSentinels(overrides)
 	};
 }
-function readAwsEmulatorSentinelsFromFile(filePath) {
-	return readAwsEmulatorEnvVarsFile(filePath).sentinels;
-}
 function sectionAppliesTo(section, workload) {
 	if (section === "Parameters") return false;
 	if (workload.logicalId !== void 0 && section === workload.logicalId) return true;
@@ -626,14 +924,14 @@ function sectionAppliesTo(section, workload) {
 	const path = workload.cdkPath;
 	return path !== void 0 && (path === section || path.startsWith(`${section}/`));
 }
-function emulatedServicesForWorkload(overrides, workload) {
+function realAwsServicesForWorkload(overrides, workload) {
 	const out = /* @__PURE__ */ new Set();
 	const apply = (map) => {
 		if (!map || typeof map !== "object" || Array.isArray(map)) return;
 		for (const [key, value] of Object.entries(map)) {
 			const service = ENDPOINT_KEY.exec(key)?.[1];
 			if (service === void 0) continue;
-			if (isAwsEmulatorSentinel(key, value)) out.add(service);
+			if (isRealAwsSentinel(key, value)) out.add(service);
 			else if (value === null || [
 				"string",
 				"number",
@@ -650,21 +948,39 @@ function correctServiceIdSpelling(service) {
 	const bare = service.replace(/_/g, "");
 	for (const id of AWS_ENDPOINT_SERVICE_IDS) if (id.replace(/_/g, "") === bare) return id;
 }
-function validateAwsEmulatorSentinels(sentinels, awsEmulatorOn, envVarName = "CDK_LOCAL_AWS_EMULATOR") {
-	const first = sentinels[0];
-	if (!first) return;
-	const where = (s) => `${s.key} under ${displayUntrustedValue(s.section)}`;
-	const bare = sentinels.find((s) => s.service === "");
-	if (bare) throw new Error(`--env-vars sets ${where(bare)} to "${AWS_EMULATOR_SENTINEL}", but the sentinel routes ONE service (AWS_ENDPOINT_URL_<SERVICE>). To send every service to AWS Emulator, use --aws-emulator without a sentinel.`);
-	const unknown = sentinels.find((s) => !AWS_ENDPOINT_SERVICE_IDS.has(s.service));
+function legacyAwsEmulatorSentinelMessage(s) {
+	return `--env-vars sets ${s.key} under ${displayUntrustedValue(s.section)} to "${LEGACY_AWS_EMULATOR_SENTINEL}", which is no longer supported: --aws-emulator now sends EVERY service to AWS Emulator, and the --env-vars file marks only the exceptions that must reach real AWS, with "${REAL_AWS_SENTINEL}". Remove the "${LEGACY_AWS_EMULATOR_SENTINEL}" entries, and mark each service that must stay on real AWS instead, e.g. "AWS_ENDPOINT_URL_SECRETS_MANAGER": "${REAL_AWS_SENTINEL}".`;
+}
+function validateAwsEmulatorEnvVars(scan, awsEmulatorOn) {
+	const legacy = scan.legacySentinels[0];
+	if (legacy) throw new Error(legacyAwsEmulatorSentinelMessage(legacy));
+	if (!awsEmulatorOn) return;
+	if (scan.exceptions.some((s) => s.service === "")) throw new Error(`--env-vars: "AWS_ENDPOINT_URL": "${REAL_AWS_SENTINEL}" would send every AWS call to real AWS, which is what running without --aws-emulator does. Remove --aws-emulator to run against real AWS, or keep it and mark only the services that must reach real AWS, e.g. "AWS_ENDPOINT_URL_SECRETS_MANAGER": "${REAL_AWS_SENTINEL}".`);
+	const unknown = scan.exceptions.find((s) => !AWS_ENDPOINT_SERVICE_IDS.has(s.service));
 	if (unknown) {
 		const fix = correctServiceIdSpelling(unknown.service);
-		throw new Error(`--env-vars sets ${where(unknown)} to "${AWS_EMULATOR_SENTINEL}", but the AWS SDKs do not read ${unknown.key}, so the workload's calls would still go to real AWS. ` + (fix ? `Use AWS_ENDPOINT_URL_${fix}.` : "The suffix must be the service's SDK endpoint id (its serviceId, uppercased, spaces as underscores)."));
+		throw new Error(`--env-vars sets ${unknown.key} under ${displayUntrustedValue(unknown.section)} to "${REAL_AWS_SENTINEL}", but the AWS SDKs do not read ${unknown.key}, so the workload's calls would still go to AWS Emulator. ` + (fix ? `Use AWS_ENDPOINT_URL_${fix}.` : "The suffix must be the service's SDK endpoint id (its serviceId, uppercased, spaces as underscores)."));
 	}
-	if (!awsEmulatorOn) throw new Error(`--env-vars sets ${where(first)} to "${AWS_EMULATOR_SENTINEL}", which needs --aws-emulator [url] (or ${envVarName}) to name the AWS Emulator to route it to.`);
 }
-function emulatedServicesOf(sentinels) {
-	return [...new Set(sentinels.map((s) => s.service).filter((s) => s !== ""))].sort();
+function realAwsServicesOf(exceptions) {
+	return [...new Set(exceptions.map((s) => s.service).filter((s) => s !== ""))].sort();
+}
+const NO_REGIONAL_ENDPOINT = /* @__PURE__ */ new Set(["APIGATEWAYMANAGEMENTAPI", "CLOUDFRONT_KEYVALUESTORE"]);
+const REGION_SHAPE = /^[a-z]{2}(-[a-z]+)+-\d+$/;
+function realAwsEndpointFor(service, region) {
+	if (!REGION_SHAPE.test(region)) throw new Error(`--env-vars marks AWS_ENDPOINT_URL_${service} "${REAL_AWS_SENTINEL}", but the workload's region ${displayUntrustedValue(region)} is not an AWS region name.`);
+	if (NO_REGIONAL_ENDPOINT.has(service)) throw new Error(`--env-vars marks AWS_ENDPOINT_URL_${service} "${REAL_AWS_SENTINEL}", but ${service} has no regional endpoint to name. Set AWS_ENDPOINT_URL_${service} to the real endpoint URL instead (a literal URL is passed through as-is).`);
+	const prefix = AWS_ENDPOINT_PREFIX_OVERRIDES[service] ?? service.toLowerCase().replace(/_/g, "");
+	const isolated = /^(us|eu)-iso[a-z]*-/.test(region);
+	const china = region.startsWith("cn-");
+	const gov = region.startsWith("us-gov-");
+	const global = AWS_GLOBAL_ENDPOINTS[prefix];
+	if (isolated || global && (china || gov)) throw new Error(`--env-vars marks AWS_ENDPOINT_URL_${service} "${REAL_AWS_SENTINEL}", but ${displayUntrustedValue(region)} has no known real ${service} endpoint. Set AWS_ENDPOINT_URL_${service} to the real endpoint URL instead (a literal URL is passed through as-is).`);
+	if (global) {
+		if (global.signingRegion !== region) throw new Error(`--env-vars marks AWS_ENDPOINT_URL_${service} "${REAL_AWS_SENTINEL}", but ${service} is served by one global endpoint (https://${global.hostname}) that accepts only requests signed for ${global.signingRegion}, and an SDK signs a request to an explicit endpoint for the workload's region (${displayUntrustedValue(region)}), which that endpoint refuses. Leave ${service} on AWS Emulator, or run the workload in ${global.signingRegion}.`);
+		return `https://${global.hostname}`;
+	}
+	return `https://${prefix}.${region}.${china ? "amazonaws.com.cn" : "amazonaws.com"}`;
 }
 const SERVICE_NAMESPACE_ALIASES = {
 	EVENTBRIDGE: ["EVENTS"],
@@ -676,7 +992,7 @@ const SERVICE_NAMESPACE_ALIASES = {
 	OPENSEARCH: ["OPENSEARCHSERVICE"],
 	ELASTICSEARCHSERVICE: ["ELASTICSEARCH"]
 };
-function resourceTypeMatchesEmulatedService(resourceType, services) {
+function resourceTypeMatchesService(resourceType, services) {
 	const ns = /^AWS::([A-Za-z0-9]+)::/.exec(resourceType)?.[1]?.toUpperCase();
 	if (!ns) return false;
 	return services.some((s) => {
@@ -686,71 +1002,71 @@ function resourceTypeMatchesEmulatedService(resourceType, services) {
 }
 const MISSING_LIST_LIMIT = 10;
 function createMixedModeStateProvider(opts) {
-	const { real, emulator, emulatedServices } = opts;
+	const { real, emulator, realServices } = opts;
 	const swaps = /* @__PURE__ */ new Map();
+	const toReal = /* @__PURE__ */ new Map();
 	const warned = /* @__PURE__ */ new Set();
-	const warnedReal = /* @__PURE__ */ new Set();
+	const warnedEmulator = /* @__PURE__ */ new Set();
 	const swap = (v) => swaps.get(v) ?? v;
+	const excepted = (res) => resourceTypeMatchesService(res.resourceType, realServices);
 	const provider = {
-		label: real.label,
+		label: emulator.label,
 		async load(stackName, synthRegion) {
-			const [r, e] = await Promise.all([real.load(stackName, synthRegion), emulator.load(stackName, synthRegion)]);
-			if (!e) {
-				if (r && !warned.has(stackName)) {
-					if (Object.values(r.resources).some((res) => resourceTypeMatchesEmulatedService(res.resourceType, emulatedServices))) {
-						warned.add(stackName);
-						const why = emulator.getLastLoadError?.();
-						getLogger().warn(`${real.label}: stack ${displayUntrustedValue(stackName)} could not be read from AWS Emulator${why ? ` (${why})` : ""}; resources of the emulated services (${emulatedServices.join(", ")}) keep their real AWS names. Override them with --env-vars, or deploy the stack into the emulator.`);
-					}
+			const [e, r] = await Promise.all([emulator.load(stackName, synthRegion), real.load(stackName, synthRegion)]);
+			if (!r) {
+				if (e && !warned.has(stackName) && Object.values(e.resources).some(excepted)) {
+					warned.add(stackName);
+					const why = real.getLastLoadError?.();
+					getLogger().warn(`${emulator.label}: stack ${displayUntrustedValue(stackName)} could not be read from real AWS${why ? ` (${why})` : ""}; resources of the services marked "${REAL_AWS_SENTINEL}" (${realServices.join(", ")}) keep their AWS Emulator names. Override them with --env-vars, or deploy the stack to real AWS too.`);
 				}
-				return r;
+				return e;
 			}
-			const emulated = (res) => resourceTypeMatchesEmulatedService(res.resourceType, emulatedServices);
-			if (!r) {
+			if (!e) {
 				const resources = {};
 				const dropped = [];
-				for (const [id, res] of Object.entries(e.resources)) if (emulated(res)) resources[id] = res;
+				for (const [id, res] of Object.entries(r.resources)) if (excepted(res)) resources[id] = res;
 				else dropped.push(`${displayUntrustedValue(id)} (${displayUntrustedValue(res.resourceType)})`);
-				if (dropped.length > 0 && !warnedReal.has(stackName)) {
-					warnedReal.add(stackName);
-					const why = real.getLastLoadError?.();
+				if (dropped.length > 0 && !warnedEmulator.has(stackName)) {
+					warnedEmulator.add(stackName);
+					const why = emulator.getLastLoadError?.();
 					const shown = dropped.slice(0, MISSING_LIST_LIMIT).join(", ");
 					const more = dropped.length > MISSING_LIST_LIMIT ? ` and ${dropped.length - MISSING_LIST_LIMIT} more` : "";
-					getLogger().warn(`${real.label}: stack ${displayUntrustedValue(stackName)} could not be read from real AWS${why ? ` (${why})` : ""}, only from AWS Emulator; resources outside the emulated services (${emulatedServices.join(", ")}) stay unresolved: ${shown}${more}. Deploy the stack to real AWS too, under the same stack name (the same CDK context, e.g. -c stage=dev), or override them with --env-vars.`);
+					getLogger().warn(`${emulator.label}: stack ${displayUntrustedValue(stackName)} could not be read from AWS Emulator${why ? ` (${why})` : ""}, only from real AWS; resources outside the services marked "${REAL_AWS_SENTINEL}" (${realServices.join(", ")}) stay unresolved: ${shown}${more}. Deploy the stack into AWS Emulator under the same stack name (the same CDK context, e.g. -c stage=dev), or override them with --env-vars.`);
 				}
 				return {
 					resources,
-					outputs: { ...e.outputs },
-					region: e.region
+					outputs: {},
+					region: r.region
 				};
 			}
-			const resources = { ...r.resources };
-			for (const [id, res] of Object.entries(e.resources)) {
-				if (!emulated(res)) continue;
-				const realRes = r.resources[id];
-				if (realRes?.physicalId && res.physicalId && realRes.physicalId !== res.physicalId) swaps.set(realRes.physicalId, res.physicalId);
+			const resources = { ...e.resources };
+			for (const [id, res] of Object.entries(r.resources)) {
+				const emuId = e.resources[id]?.physicalId;
+				if (emuId && res.physicalId) toReal.set(emuId, res.physicalId);
+				if (!excepted(res)) continue;
+				const emuRes = e.resources[id];
+				if (emuRes?.physicalId && res.physicalId && emuRes.physicalId !== res.physicalId) swaps.set(emuRes.physicalId, res.physicalId);
 				resources[id] = res;
 			}
 			const outputs = {};
-			for (const [k, v] of Object.entries(e.outputs)) outputs[k] = v;
-			for (const [k, v] of Object.entries(r.outputs)) outputs[k] = swap(v);
+			for (const [k, v] of Object.entries(e.outputs)) outputs[k] = swap(v);
 			return {
 				resources,
 				outputs,
-				region: r.region
+				region: e.region
 			};
 		},
-		buildCrossStackResolver: (region) => real.buildCrossStackResolver(region),
+		buildCrossStackResolver: (region) => emulator.buildCrossStackResolver(region),
 		dispose() {
 			try {
-				real.dispose();
-			} finally {
 				emulator.dispose();
+			} finally {
+				real.dispose();
 			}
 		}
 	};
-	if (real.resolveDeployedFunctionEnv) {
-		const fn = real.resolveDeployedFunctionEnv.bind(real);
+	if (emulator.resolveDeployedFunctionEnv) {
+		const fn = emulator.resolveDeployedFunctionEnv.bind(emulator);
 		provider.resolveDeployedFunctionEnv = async (id) => {
 			const env = await fn(id);
 			if (!env) return env;
@@ -759,10 +1075,16 @@ function createMixedModeStateProvider(opts) {
 			return out;
 		};
 	}
-	if (real.resolveLambdaExecutionRoleArn) provider.resolveLambdaExecutionRoleArn = real.resolveLambdaExecutionRoleArn.bind(real);
-	if (real.resolveAgentCoreRuntimeRoleArn) provider.resolveAgentCoreRuntimeRoleArn = real.resolveAgentCoreRuntimeRoleArn.bind(real);
+	if (real.resolveLambdaExecutionRoleArn) {
+		const fn = real.resolveLambdaExecutionRoleArn.bind(real);
+		provider.resolveLambdaExecutionRoleArn = (id) => fn(toReal.get(id) ?? id);
+	}
+	if (real.resolveAgentCoreRuntimeRoleArn) {
+		const fn = real.resolveAgentCoreRuntimeRoleArn.bind(real);
+		provider.resolveAgentCoreRuntimeRoleArn = (id) => fn(toReal.get(id) ?? id);
+	}
 	if (real.resolveTemplateSsmParameters) provider.resolveTemplateSsmParameters = real.resolveTemplateSsmParameters.bind(real);
-	if (real.getLastLoadError) provider.getLastLoadError = real.getLastLoadError.bind(real);
+	if (emulator.getLastLoadError) provider.getLastLoadError = emulator.getLastLoadError.bind(emulator);
 	return provider;
 }
 
@@ -858,25 +1180,26 @@ function normalizeAwsEndpointServiceId(serviceId) {
 }
 function setAwsEmulatorServiceRouting(r) {
 	serviceRouting = r ? {
-		services: new Set(r.services.map(normalizeAwsEndpointServiceId)),
+		realServices: new Set(r.realServices.map(normalizeAwsEndpointServiceId)),
 		override: r.override,
 		envOverrides: r.envOverrides
 	} : void 0;
 }
 function getAwsEmulatorServiceRouting() {
 	return serviceRouting ? {
-		services: [...serviceRouting.services].sort(),
+		realServices: [...serviceRouting.realServices].sort(),
 		override: serviceRouting.override,
 		...serviceRouting.envOverrides && { envOverrides: serviceRouting.envOverrides }
 	} : void 0;
 }
-function awsEmulatorRoutedServices(workload) {
+function awsEmulatorRealServices(workload) {
 	if (!serviceRouting) return void 0;
-	if (workload === void 0 || serviceRouting.envOverrides === void 0) return [...serviceRouting.services].sort();
-	return emulatedServicesForWorkload(serviceRouting.envOverrides, workload);
+	if (serviceRouting.envOverrides === void 0) return [...serviceRouting.realServices].sort();
+	return realAwsServicesForWorkload(serviceRouting.envOverrides, workload ?? {});
 }
 function mixedModeRoutes(serviceId, workload) {
-	return awsEmulatorRoutedServices(workload)?.includes(normalizeAwsEndpointServiceId(serviceId)) ?? false;
+	const real = awsEmulatorRealServices(workload);
+	return real !== void 0 && !real.includes(normalizeAwsEndpointServiceId(serviceId));
 }
 function isAwsServiceRoutedToEmulator(serviceId, workload) {
 	if (endpointOverride) return true;
@@ -891,6 +1214,13 @@ function awsClientConfigForService(serviceId, opts = {}) {
 function awsEndpointOverrideClientConfig(o) {
 	return endpointOverrideClientConfig(o);
 }
+function deployArtifactsReadEmulator() {
+	return endpointOverride !== void 0 || serviceRouting !== void 0;
+}
+function deployArtifactClientConfig(opts = {}) {
+	if (!endpointOverride && serviceRouting) return endpointOverrideClientConfig(serviceRouting.override);
+	return buildProxyClientConfig(opts);
+}
 function endpointOverrideClientConfig(o) {
 	const httpsAgent = new Agent$1({
 		keepAlive: true,
@@ -1500,6 +1830,7 @@ var workload_aws_wiring_exports = /* @__PURE__ */ __exportAll({
 	collectHostEndpointOverrides: () => collectHostEndpointOverrides,
 	displayEndpointValue: () => displayEndpointValue,
 	effectiveLoopbackPorts: () => effectiveLoopbackPorts,
+	envKeepsRealAwsException: () => envKeepsRealAwsException,
 	getActiveWorkloadAwsWiring: () => getActiveWorkloadAwsWiring,
 	getContainerCaBundlePath: () => getContainerCaBundlePath,
 	getContainerJavaTruststorePath: () => getContainerJavaTruststorePath,
@@ -1516,6 +1847,8 @@ var workload_aws_wiring_exports = /* @__PURE__ */ __exportAll({
 	resolveWorkloadAwsWiring: () => resolveWorkloadAwsWiring,
 	setActiveWorkloadAwsWiring: () => setActiveWorkloadAwsWiring,
 	sweepStaleResignDirs: () => sweepStaleResignDirs,
+	takeAwsEmulatorStateSourceHint: () => takeAwsEmulatorStateSourceHint,
+	workloadGetsEmulatorKeysOnly: () => workloadGetsEmulatorKeysOnly,
 	writeCaBundleFile: () => writeCaBundleFile
 });
 const CA_TRUST_ENV_KEYS = [
@@ -1795,6 +2128,7 @@ function processAlive(pid) {
 }
 function resolveMixedModeWiring(args) {
 	const { ep, services, credentials, caSources, disposers } = args;
+	const resignEndpoint = `https://127.0.0.1:${MIXED_MODE_RESIGN_PORT}`;
 	const caPems = [];
 	for (const source of caSources) try {
 		caPems.push(...pemCertificates(readFileSync(source, "utf8")));
@@ -1834,10 +2168,12 @@ function resolveMixedModeWiring(args) {
 	return {
 		mode: "forward",
 		mixed: {
-			services,
+			realServices: services,
 			emulatorEndpoint: ep,
 			resignPort: MIXED_MODE_RESIGN_PORT,
-			resignEndpoint: `https://127.0.0.1:${MIXED_MODE_RESIGN_PORT}`,
+			resignEndpoint,
+			emulatorCredentials: config.credentials,
+			...args.region ? { region: args.region } : {},
 			resignConfigHostPath,
 			emulatorClientOverride: {
 				endpoint: ep.url,
@@ -1845,7 +2181,12 @@ function resolveMixedModeWiring(args) {
 				credentials: config.credentials
 			}
 		},
-		env: trust,
+		env: {
+			AWS_ENDPOINT_URL: resignEndpoint,
+			AWS_EC2_METADATA_DISABLED: "true",
+			AWS_DISABLE_HOST_PREFIX_INJECTION: "true",
+			...trust
+		},
 		scrubEnvKeys: [],
 		mounts: [{
 			hostPath: bundle.hostPath,
@@ -1891,7 +2232,7 @@ async function resolveWorkloadAwsWiring(opts) {
 			}
 			const run = readEmulatorRunFiles(ep.port, homeDir);
 			const caSource = opts.caBundle || run.caPath || env["AWS_CA_BUNDLE"];
-			const mixedServices = emulatedServicesOf(opts.awsEmulatorSentinels ?? []);
+			const mixedServices = realAwsServicesOf(opts.realAwsExceptions ?? []);
 			const probeCa = mixedServices.length > 0 ? run.caPath || caSource : caSource;
 			const failure = await (opts.probeHealth ?? probeAwsEmulatorHealth)(ep.url, probeCa ? expandHome(probeCa, homeDir) : void 0);
 			if (failure) throw new Error(describeEmulatorUnreachable(ep, failure));
@@ -1943,6 +2284,7 @@ async function resolveWorkloadAwsWiring(opts) {
 					AWS_ENDPOINT_URL: ep.url,
 					AWS_EC2_METADATA_DISABLED: "true",
 					AWS_DISABLE_HOST_PREFIX_INJECTION: "true",
+					AWS_IGNORE_CONFIGURED_ENDPOINT_URLS: "false",
 					...ca?.env ?? {},
 					...java?.env ?? {}
 				},
@@ -2023,10 +2365,24 @@ function applyWorkloadAwsWiringToEnv(env, wiring, defaultCredentials) {
 		configurable: true,
 		writable: true
 	});
+	let keepsException = false;
 	for (const [k, v] of Object.entries(out)) {
-		if (!isAwsEmulatorSentinel(k, v)) continue;
-		if (!wiring.mixed || k === "AWS_ENDPOINT_URL") throw new Error(`${k}="${AWS_EMULATOR_SENTINEL}" reached a workload container outside mixed mode. The sentinel is read from the --env-vars file, on an AWS_ENDPOINT_URL_<SERVICE> variable, and needs --aws-emulator [url].`);
-		out[k] = wiring.mixed.resignEndpoint;
+		if (isLegacyAwsEmulatorSentinel(k, v)) throw new Error(legacyAwsEmulatorSentinelMessage({
+			section: "the container env",
+			key: k,
+			service: ""
+		}));
+		if (!isRealAwsSentinel(k, v)) continue;
+		if (wiring.mode === "forward" && !wiring.mixed) {
+			getLogger().debug(`${k}="${REAL_AWS_SENTINEL}" without --aws-emulator: dropped (a no-op).`);
+			delete out[k];
+			continue;
+		}
+		if (!wiring.mixed || k === "AWS_ENDPOINT_URL") throw new Error(`${k}="${REAL_AWS_SENTINEL}" reached a workload container under --aws-emulator without mixed-mode wiring. Mark exceptions in the --env-vars file, on an AWS_ENDPOINT_URL_<SERVICE> variable.`);
+		const region = out["AWS_REGION"] || out["AWS_DEFAULT_REGION"] || wiring.mixed.region;
+		if (!region) throw new Error(`${k}="${REAL_AWS_SENTINEL}" needs the workload's region to name the real endpoint, and none is set. Pass --region, or set AWS_REGION.`);
+		out[k] = realAwsEndpointFor(k.slice(17), region);
+		keepsException = true;
 	}
 	const setCreds = (c) => {
 		for (const k of CREDENTIAL_KEYS) delete out[k];
@@ -2042,13 +2398,27 @@ function applyWorkloadAwsWiringToEnv(env, wiring, defaultCredentials) {
 		const javaToolOptions = wiring.env["JAVA_TOOL_OPTIONS"];
 		if (javaToolOptions !== void 0) out["JAVA_TOOL_OPTIONS"] = mergeJavaToolOptions(ownJavaToolOptions, javaToolOptions);
 		setCreds(wiring.emulatorCredentials);
+	} else if (wiring.mixed && !keepsException) {
+		for (const k of EMULATOR_SCRUBBED_ENV_KEYS) delete out[k];
+		delete out["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"];
+		out["AWS_IGNORE_CONFIGURED_ENDPOINT_URLS"] = "false";
+		for (const [k, v] of Object.entries(wiring.env)) if (out[k] === void 0) out[k] = v;
+		setCreds(wiring.mixed.emulatorCredentials);
 	} else {
+		if (wiring.mixed) out["AWS_IGNORE_CONFIGURED_ENDPOINT_URLS"] = "false";
 		for (const [k, v] of Object.entries(wiring.env)) if (out[k] === void 0) out[k] = v;
 		if (defaultCredentials && !out["AWS_ACCESS_KEY_ID"]) setCreds(defaultCredentials);
 	}
 	if (out["AWS_REGION"] && !out["AWS_DEFAULT_REGION"]) out["AWS_DEFAULT_REGION"] = out["AWS_REGION"];
 	return out;
 }
+function envKeepsRealAwsException(env) {
+	return Object.entries(env).some(([k, v]) => k !== "AWS_ENDPOINT_URL" && isRealAwsSentinel(k, v));
+}
+function workloadGetsEmulatorKeysOnly(env, wiring) {
+	if (!wiring) return false;
+	return wiring.mode === "emulator" || wiring.mixed !== void 0 && !envKeepsRealAwsException(env);
+}
 async function resolveHostDefaultCredentials(opts = {}) {
 	const name = assumedRoleRecorded() ? profileName(process.env, opts.profile) : opts.profile;
 	const key = `${assumedRoleRecorded() ? "noenv" : "chain"}:${name ?? ""}`;
@@ -2107,24 +2477,25 @@ function resolveAwsEmulatorOption(flag, env = process.env) {
 }
 async function activateWorkloadAwsWiring(options) {
 	const awsEmulator = resolveAwsEmulatorOption(options.awsEmulator);
-	const { overrides, sentinels } = readAwsEmulatorEnvVarsFile(options.envVars);
-	validateAwsEmulatorSentinels(sentinels, awsEmulator !== void 0, awsEmulatorEnvName());
+	const scan = readAwsEmulatorEnvVarsFile(options.envVars);
+	validateAwsEmulatorEnvVars(scan, awsEmulator !== void 0);
+	const { overrides } = scan;
 	const wiring = await resolveWorkloadAwsWiring({
 		awsEmulator,
 		caBundle: options.caBundle,
 		profile: options.profile,
 		skipPull: options.pull === false,
-		awsEmulatorSentinels: sentinels
+		...awsEmulator !== void 0 && { realAwsExceptions: scan.exceptions }
 	});
 	setActiveWorkloadAwsWiring(wiring);
 	if (wiring.mixed) {
 		setAwsEndpointOverride(void 0);
 		setAwsEmulatorServiceRouting({
-			services: wiring.mixed.services,
+			realServices: wiring.mixed.realServices,
 			override: wiring.mixed.emulatorClientOverride,
 			envOverrides: overrides
 		});
-		getLogger().info(`Mixed mode: ${wiring.mixed.services.join(", ")} go to AWS Emulator at ${wiring.mixed.emulatorEndpoint.url} (signed with its keys), for the workload and for ${getEmbedConfig().productName}'s own calls; every other AWS call uses your real credentials.`);
+		getLogger().info(`Mixed mode: every AWS call goes to AWS Emulator at ${wiring.mixed.emulatorEndpoint.url} (signed with its keys) except ${wiring.mixed.realServices.join(", ")}, which go to real AWS with your real credentials, for the workload and for ${getEmbedConfig().productName}'s own calls.`);
 	} else if (wiring.mode === "emulator" && wiring.emulatorEndpoint) {
 		setAwsEmulatorServiceRouting(void 0);
 		setAwsEndpointOverride({
@@ -2139,6 +2510,14 @@ async function activateWorkloadAwsWiring(options) {
 	}
 	return wiring;
 }
+let stateSourceHintShown = false;
+function takeAwsEmulatorStateSourceHint() {
+	const wiring = active;
+	if (stateSourceHintShown || !wiring || wiring.mode !== "emulator" && !wiring.mixed) return;
+	stateSourceHintShown = true;
+	const { cliName } = getEmbedConfig();
+	return `Under --aws-emulator, the environment variables above that reference a resource need deployed names: pass ${cliName === "cdkl" ? "a host CLI's --from-state (the stack deployed into AWS Emulator with that host's own deploy)" : `--from-state (the stack deployed into AWS Emulator with \`${cliName} deploy --aws-emulator\`)`}, or --from-cfn-stack (the stack deployed into AWS Emulator with \`cdk deploy\`), or set the values with --env-vars.`;
+}
 
 //#endregion
 //#region src/utils/workload-identity.ts
@@ -2264,6 +2643,10 @@ function deployAccountStsClientConfig(args) {
 	};
 }
 function accountLookupStsClientConfig(args) {
+	if (getAwsEmulatorServiceRouting() && isAwsServiceRoutedToEmulator("STS")) return {
+		...buildProxyClientConfig({ service: "STS" }),
+		...args.region && { region: args.region }
+	};
 	return args.readFromCfnStack ? workloadStsClientConfig({
 		region: args.region,
 		profile: args.profile
@@ -2296,5 +2679,5 @@ function warnWorkloadCredentialsStripped() {
 }
 
 //#endregion
-export { setAwsEmulatorServiceRouting as $, parseAwsEndpoint as A, MIXED_MODE_RESIGN_BODY_CAP_BYTES as B, effectiveLoopbackPorts as C, javaTruststoreToolOptions as D, getContainerJavaTruststorePath as E, resolveHostDefaultCredentials as F, awsEndpointOverrideClientConfig as G, createMixedModeTlsMaterials as H, resolveWorkloadAwsWiring as I, getAwsEndpointOverride as J, buildProxyClientConfig as K, setActiveWorkloadAwsWiring as L, readEmulatorRunFiles as M, readProfileEndpointSettings as N, loopbackForwarderPlan as O, resolveAwsEmulatorOption as P, proxyAwareFetch as Q, workload_aws_wiring_exports as R, displayEndpointValue as S, getContainerCaBundlePath as T, awsClientConfigForService as U, RESIGN_SIDECAR_SCRIPT as V, awsEmulatorRoutedServices as W, isProxyEnvConfigured as X, isAwsServiceRoutedToEmulator as Y, normalizeAwsEndpointServiceId as Z, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as _, isLoopbackHostname as _t, deployAccountStsClientConfig as a, emulatedServicesOf as at, awsEmulatorEnvName as b, formatHostForAuthority as bt, resetWorkloadIdentity as c, readAwsEmulatorEnvVarsFile as ct, workloadStsClientConfig as d, validateAwsEmulatorSentinels as dt, setAwsEndpointOverride as et, AUTH_OFF_PLACEHOLDER_CREDENTIALS as f, AWS_ENDPOINT_SERVICE_IDS as ft, HOST_CA_TRUST_ENV_KEYS as g, defineOwnKey as gt, EMULATOR_SCRUBBED_ENV_KEYS as h, resolveEnvVars as ht, assumedRoleRecorded as i, emulatedServicesForWorkload as it, probeAwsEmulatorHealth as j, mergeJavaToolOptions as k, warnWorkloadCredentialsStripped as l, readAwsEmulatorSentinelsFromFile as lt, DEFAULT_AWS_EMULATOR_URL as m, readEnvVarsFileText as mt, accountLookupStsClientConfig as n, MIXED_MODE_RESIGN_PORT as nt, readEnvCallerCredentials as o, findAwsEmulatorSentinels as ot, CA_TRUST_ENV_KEYS as p, applyEnvOverrideMap as pt, getAwsEmulatorServiceRouting as q, applyWorkloadEnvCredentials as r, createMixedModeStateProvider as rt, recordAssumedRole as s, isAwsEmulatorSentinel as st, SECOND_ASSUME_MESSAGE as t, AWS_EMULATOR_SENTINEL as tt, workloadClientConfig as u, resourceTypeMatchesEmulatedService as ut, activateWorkloadAwsWiring as v, isWildcardHostname as vt, getActiveWorkloadAwsWiring as w, collectHostEndpointOverrides as x, hostFromAuthority as xt, applyWorkloadAwsWiringToEnv as y, formatAuthority as yt, writeCaBundleFile as z };
-//# sourceMappingURL=workload-identity-BOEZuEDO.js.map
+export { isAwsServiceRoutedToEmulator as $, parseAwsEndpoint as A, workload_aws_wiring_exports as B, effectiveLoopbackPorts as C, resolveEnvVars as Ct, javaTruststoreToolOptions as D, formatAuthority as Dt, getContainerJavaTruststorePath as E, isWildcardHostname as Et, resolveHostDefaultCredentials as F, awsClientConfigForService as G, MIXED_MODE_RESIGN_BODY_CAP_BYTES as H, resolveWorkloadAwsWiring as I, buildProxyClientConfig as J, awsEmulatorRealServices as K, setActiveWorkloadAwsWiring as L, readEmulatorRunFiles as M, readProfileEndpointSettings as N, loopbackForwarderPlan as O, formatHostForAuthority as Ot, resolveAwsEmulatorOption as P, getAwsEndpointOverride as Q, takeAwsEmulatorStateSourceHint as R, displayEndpointValue as S, readEnvVarsFileText as St, getContainerCaBundlePath as T, isLoopbackHostname as Tt, RESIGN_SIDECAR_SCRIPT as U, writeCaBundleFile as V, createMixedModeTlsMaterials as W, deployArtifactsReadEmulator as X, deployArtifactClientConfig as Y, getAwsEmulatorServiceRouting as Z, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as _, realAwsServicesOf as _t, deployAccountStsClientConfig as a, LEGACY_AWS_EMULATOR_SENTINEL as at, awsEmulatorEnvName as b, AWS_ENDPOINT_SERVICE_IDS as bt, resetWorkloadIdentity as c, createMixedModeStateProvider as ct, workloadStsClientConfig as d, isLegacyAwsEmulatorSentinel as dt, isProxyEnvConfigured as et, AUTH_OFF_PLACEHOLDER_CREDENTIALS as f, isRealAwsSentinel as ft, HOST_CA_TRUST_ENV_KEYS as g, realAwsServicesForWorkload as gt, EMULATOR_SCRUBBED_ENV_KEYS as h, realAwsEndpointFor as ht, assumedRoleRecorded as i, setAwsEndpointOverride as it, probeAwsEmulatorHealth as j, mergeJavaToolOptions as k, hostFromAuthority as kt, warnWorkloadCredentialsStripped as l, findLegacyAwsEmulatorSentinels as lt, DEFAULT_AWS_EMULATOR_URL as m, readAwsEmulatorEnvVarsFile as mt, accountLookupStsClientConfig as n, proxyAwareFetch as nt, readEnvCallerCredentials as o, MIXED_MODE_RESIGN_PORT as ot, CA_TRUST_ENV_KEYS as p, legacyAwsEmulatorSentinelMessage as pt, awsEndpointOverrideClientConfig as q, applyWorkloadEnvCredentials as r, setAwsEmulatorServiceRouting as rt, recordAssumedRole as s, REAL_AWS_SENTINEL as st, SECOND_ASSUME_MESSAGE as t, normalizeAwsEndpointServiceId as tt, workloadClientConfig as u, findRealAwsExceptions as ut, activateWorkloadAwsWiring as v, resourceTypeMatchesService as vt, getActiveWorkloadAwsWiring as w, defineOwnKey as wt, collectHostEndpointOverrides as x, applyEnvOverrideMap as xt, applyWorkloadAwsWiringToEnv as y, validateAwsEmulatorEnvVars as yt, workloadGetsEmulatorKeysOnly as z };
+//# sourceMappingURL=workload-identity-CCXbr0KK.js.map