cdk-local 0.164.0 → 0.164.1

package/dist/{logger-Co5XVwco.js → logger-25be7ULc.js}

@@ -10,7 +10,8 @@ const DEFAULTS = {
 	envPrefix: "CDKL",
 	sigV4StrictByDefault: false,
 	sigV4OptFlag: "--strict-sigv4",
-	workloadIdentity: "role"
+	workloadIdentity: "role",
+	awsEmulatorSqsSidecar: true
 };
 let current = DEFAULTS;
 function setEmbedConfig(config) {
@@ -24,6 +25,7 @@ function setEmbedConfig(config) {
 		sigV4StrictByDefault: config?.sigV4StrictByDefault ?? DEFAULTS.sigV4StrictByDefault,
 		sigV4OptFlag: config?.sigV4OptFlag ?? DEFAULTS.sigV4OptFlag,
 		workloadIdentity: config?.workloadIdentity === "caller" ? "caller" : "role",
+		awsEmulatorSqsSidecar: config === void 0 ? DEFAULTS.awsEmulatorSqsSidecar : config.awsEmulatorSqsSidecar === true,
 		...config?.logger !== void 0 && { logger: config.logger }
 	};
 }
@@ -259,4 +261,4 @@ function getLogger() {
 
 //#endregion
 export { displayIdent as a, getEmbedConfig as c, STACK_REF_MAX_CODE_POINTS as i, resetEmbedConfig as l, renderLogText as n, displayStackName as o, resolveConfiguredLogLevel as r, displayToolOutput as s, getLogger as t, setEmbedConfig as u };
-//# sourceMappingURL=logger-Co5XVwco.js.map
+//# sourceMappingURL=logger-25be7ULc.js.map

package/dist/logger-25be7ULc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger-25be7ULc.js","names":[],"sources":["../src/local/embed-config.ts","../src/utils/ident-display.ts","../src/utils/logger.ts"],"mappings":";;;AAsKA,MAAM,WAAgC;CACpC,SAAS;CACT,YAAY;CACZ,aAAa;CACb,oBAAoB;CACpB,kBAAkB;CAClB,WAAW;CACX,sBAAsB;CACtB,cAAc;CACd,kBAAkB;CAClB,uBAAuB;AACzB;AAEA,IAAI,UAA+B;AAQnC,SAAgB,eAAe,QAAoC;CACjE,UAAU;EACR,SAAS,QAAQ,WAAW,SAAS;EACrC,YAAY,QAAQ,cAAc,SAAS;EAC3C,aAAa,QAAQ,eAAe,SAAS;EAC7C,oBAAoB,QAAQ,sBAAsB,SAAS;EAC3D,kBAAkB,QAAQ,oBAAoB,SAAS;EACvD,WAAW,QAAQ,aAAa,SAAS;EACzC,sBAAsB,QAAQ,wBAAwB,SAAS;EAC/D,cAAc,QAAQ,gBAAgB,SAAS;EAC/C,kBAAkB,QAAQ,qBAAqB,WAAW,WAAW;EAErE,uBACE,WAAW,SAAY,SAAS,wBAAwB,OAAO,0BAA0B;EAC3F,GAAI,QAAQ,WAAW,UAAa,EAAE,QAAQ,OAAO,OAAO;CAC9D;AACF;AAGA,SAAgB,iBAAsC;CACpD,OAAO;AACT;AAGA,SAAgB,mBAAyB;CACvC,UAAU;AACZ;;;;ACvLA,MAAa,eAAe;AAQ5B,MAAa,wBAAwB;AAUrC,MAAa,4BAA4B;AAOzC,MAAM,uBAAuB;AAU7B,MAAM,cAAc;AAOpB,SAAS,cAAc,OAAwB;CAC7C,IAAI,UAAU,UAAa,UAAU,MAAM,OAAO;CAClD,IAAI;EAEF,OAAO,OAAO,KAAK;CACrB,QAAQ;EACN,IAAI;GACF,OAAO,OAAO,UAAU,SAAS,KAAK,KAAK;EAC7C,QAAQ;GACN,OAAO;EACT;CACF;AACF;AAuBA,SAAgB,aACd,OACA,MACQ;CACR,MAAM,MAAM,cAAc,KAAK;CAC/B,IAAI,QAAQ,IAAI,OAAO;CACvB,MAAM,QAAQ,IAAI,QAAQ,WAAW,GAAG,CAAC,CAAC,KAAK;CAC/C,IAAI,CAAC,OAAO,OAAO;CAGnB,MAAM,YAAY,MAAM;CACxB,MAAM,MAAM,OAAO,SAAS,SAAS,IACjC,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,CAAC;CAGrC,MAAM,YAAY,MAAM,SAAS;CACjC,MAAM,OAAO,YAAY,MAAM,MAAM,GAAG,GAAG,IAAI;CAC/C,MAAM,UAAU,UAAU;CAC1B,MAAM,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,MAAM,eAAe,QAAQ,KAAK,SAAS,GAAG;CACxF,MAAM,QAAQ,CAAC,WAAW,QAAQ,OAAO,KAAK,UAAU,IAAI;CAC5D,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,OAAO,MAAM,MAAM,GAAG;CAC5B,MAAM,SAAS,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,oBAAoB;CAC5F,OAAO,GAAG,MAAM,SAAS,KAAK,OAAO,yCAAyC,OAAO;AACvF;AAOA,SAAgB,iBAAiB,OAAwB;CACvD,OAAO,aAAa,OAAO,EAAE,eAAe,0BAA0B,CAAC;AACzE;AAOA,MAAM,gBAEJ;AAUF,SAAgB,kBAAkB,MAAsB;CACtD,OAAO,KAAK,QAAQ,gBAAgB,MAAM,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;AACjG;;;;AC9IA,MAAa,0BAA0B;AA4BvC,SAAgB,cAAc,MAAsB;CAIlD,OAAO,mBADK,OAAO,SAAS,WAAW,OAAO,OAAO,IAAI,EAC7B,CAAC,QAAQ,SAAS,IAAI,CAAC,CAAC,CAAC,QACnD,mBACA,WACF;AACF;AAGA,SAAS,aAAa,KAAuB;CAC3C,OAAO,OAAO,QAAQ,WAAW,cAAc,GAAG,IAAI;AACxD;AAGA,IAAI,aAAa;AAYjB,SAAS,aAA0C;CACjD,IAAI,YAAY,OAAO;CACvB,IAAI,QAAQ,IAAI,uBAAuB,UAAa,QAAQ,IAAI,sBAAsB,QACpF;CAEF,OAAO,eAAe,CAAC,CAAC;AAC1B;AAOA,SAAS,QAAQ,KAA0B;CACzC,aAAa;CACb,IAAI;EACF,IAAI;EACJ,OAAO;CACT,QAAQ;EACN,OAAO;CACT,UAAU;EACR,aAAa;CACf;AACF;AAkBA,MAAM,SAAS;CACb,OAAO;CACP,QAAQ;CACR,KAAK;CACL,KAAK;CACL,OAAO;CACP,QAAQ;CACR,MAAM;CACN,MAAM;CACN,MAAM;AACR;AAEA,SAAS,kBAA0B;CAEjC,wBAAO,IADS,KACP,EAAC,CAAC,YAAY;AACzB;AAuBA,SAAgB,0BAAmC;CACjD,MAAM,UAAU,QAAQ,IAAI;CAC5B,IAAI,YAAY,UAAa,YAAY,IACvC,OAAO;CAET,MAAM,aAAa,QAAQ,IAAI;CAC/B,IACE,eAAe,UACf,eAAe,MACf,eAAe,OACf,eAAe,SAEf,OAAO;CAET,OAAO,CAAC,CAAC,QAAQ,OAAO;AAC1B;AASA,IAAa,gBAAb,MAA6C;CAC3C,AAAU;CACV,AAAQ;CAER,YAAY,QAAkB,QAAQ,YAAqB,wBAAwB,GAAG;EACpF,KAAK,QAAQ;EACb,KAAK,YAAY;CACnB;CAEA,AAAQ,UAAU,OAA0B;EAC1C,MAAM,SAAqB;GAAC;GAAS;GAAQ;GAAQ;EAAO;EAC5D,MAAM,oBAAoB,OAAO,QAAQ,KAAK,KAAK;EAEnD,OAD0B,OAAO,QAAQ,KAClB,KAAK;CAC9B;CAQA,AAAQ,cAAc,OAAiB,SAAiB,GAAG,MAAyB;EAClF,MAAM,gBACJ,KAAK,SAAS,IAAI,cAAc,MAAM,KAAK,KAAK,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI;EAExF,IAAI,KAAK,UAAU,SAAS;GAC1B,MAAM,YAAY,gBAAgB;GAClC,MAAM,WAAW,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC;GAE7C,IAAI,KAAK,WAAW;IAOlB,MAAM,aAAa;KALjB,OAAO,OAAO;KACd,MAAM,OAAO;KACb,MAAM,OAAO;KACb,OAAO,OAAO;IAEe,EAAE;IAEjC,OAAO,GAAG,OAAO,MAAM,YAAY,OAAO,MAAM,GAAG,aAAa,WAAW,OAAO,MAAM,GAAG,UAAU;GACvG;GAEA,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU;EAC/C;EASA,IAAI,UAAU,SAAS;GACrB,MAAM,OAAO,UAAU,UAAU;GACjC,OAAO,KAAK,YAAY,GAAG,OAAO,MAAM,OAAO,OAAO,UAAU;EAClE;EACA,IAAI,UAAU,QAAQ;GACpB,MAAM,OAAO,SAAS,UAAU;GAChC,OAAO,KAAK,YAAY,GAAG,OAAO,SAAS,OAAO,OAAO,UAAU;EACrE;EAEA,OAAO,GAAG,UAAU;CACtB;CAEA,AAAQ,KAAK,OAAiB,WAAyB;EAUrD,IAAI,QAAQ,IAAI,uBAAuB,UAAU;GAC/C,QAAQ,IAAI,SAAS;GACrB;EACF;EACA,IAAI,UAAU,SAAS,QAAQ,MAAM,SAAS;OACzC,IAAI,UAAU,QAAQ,QAAQ,KAAK,SAAS;OAC5C,IAAI,UAAU,QAAQ,QAAQ,KAAK,SAAS;OAC5C,QAAQ,MAAM,SAAS;CAC9B;CAEA,MAAM,SAAiB,GAAG,MAAuB;EAC/C,MAAM,OAAO,cAAc,OAAO;EAClC,MAAM,OAAO,WAAW;EACxB,IAAI,QAAQ,cAAc,KAAK,MAAM,MAAM,GAAG,KAAK,IAAI,YAAY,CAAC,CAAC,GAAG;EACxE,IAAI,KAAK,UAAU,OAAO,GACxB,KAAK,KAAK,SAAS,KAAK,cAAc,SAAS,MAAM,GAAG,IAAI,CAAC;CAEjE;CAEA,KAAK,SAAiB,GAAG,MAAuB;EAC9C,MAAM,OAAO,cAAc,OAAO;EAClC,MAAM,OAAO,WAAW;EACxB,IAAI,QAAQ,cAAc,KAAK,KAAK,MAAM,GAAG,KAAK,IAAI,YAAY,CAAC,CAAC,GAAG;EACvE,IAAI,KAAK,UAAU,MAAM,GACvB,KAAK,KAAK,QAAQ,KAAK,cAAc,QAAQ,MAAM,GAAG,IAAI,CAAC;CAE/D;CAEA,KAAK,SAAiB,GAAG,MAAuB;EAC9C,MAAM,OAAO,cAAc,OAAO;EAClC,MAAM,OAAO,WAAW;EACxB,IAAI,QAAQ,cAAc,KAAK,KAAK,MAAM,GAAG,KAAK,IAAI,YAAY,CAAC,CAAC,GAAG;EACvE,IAAI,KAAK,UAAU,MAAM,GACvB,KAAK,KAAK,QAAQ,KAAK,cAAc,QAAQ,MAAM,GAAG,IAAI,CAAC;CAE/D;CAEA,MAAM,SAAiB,GAAG,MAAuB;EAC/C,MAAM,OAAO,cAAc,OAAO;EAClC,MAAM,OAAO,WAAW;EACxB,IAAI,QAAQ,cAAc,KAAK,MAAM,MAAM,GAAG,KAAK,IAAI,YAAY,CAAC,CAAC,GAAG;EACxE,IAAI,KAAK,UAAU,OAAO,GACxB,KAAK,KAAK,SAAS,KAAK,cAAc,SAAS,MAAM,GAAG,IAAI,CAAC;CAEjE;CAEA,SAAS,OAAuB;EAC9B,KAAK,QAAQ;EACb,MAAM,OAAO,WAAW;EACxB,IAAI,MAAM,cAAc,KAAK,SAAS,KAAK,CAAC;CAC9C;CAEA,WAAqB;EACnB,MAAM,OAAO,WAAW;EACxB,IAAI;EACJ,IAAI,MAAM,cAAe,QAAQ,KAAK,SAAS,CAAE;EACjD,OAAO,SAAS,KAAK;CACvB;CAEA,MAAM,QAA6B;EACjC,OAAO,IAAI,YAAY,QAAQ,KAAK,SAAS;CAC/C;AACF;AAKA,IAAM,cAAN,cAA0B,cAAc;CACtC,AAAiB;CAEjB,YAAY,QAAgB,WAAoB;EAC9C,MAAM,QAAQ,SAAS;EACvB,KAAK,SAAS;CAChB;CAEA,AAAQ,YAAkB;EAGxB,IAAI,cACF,KAAK,QAAQ,aAAa,SAAS;CAEvC;CAEA,AAAS,MAAM,SAAiB,GAAG,MAAuB;EACxD,KAAK,UAAU;EACf,MAAM,MAAM,IAAI,KAAK,OAAO,IAAI,WAAW,GAAG,IAAI;CACpD;CAEA,AAAS,KAAK,SAAiB,GAAG,MAAuB;EACvD,KAAK,UAAU;EACf,MAAM,MAAM,KAAK,SAAS,MAAM,UAAU,IAAI,KAAK,OAAO,IAAI,YAAY;EAC1E,MAAM,KAAK,KAAK,GAAG,IAAI;CACzB;CAEA,AAAS,KAAK,SAAiB,GAAG,MAAuB;EACvD,KAAK,UAAU;EACf,MAAM,MAAM,KAAK,SAAS,MAAM,UAAU,IAAI,KAAK,OAAO,IAAI,YAAY;EAC1E,MAAM,KAAK,KAAK,GAAG,IAAI;CACzB;CAEA,AAAS,MAAM,SAAiB,GAAG,MAAuB;EACxD,KAAK,UAAU;EACf,MAAM,MAAM,KAAK,SAAS,MAAM,UAAU,IAAI,KAAK,OAAO,IAAI,YAAY;EAC1E,MAAM,MAAM,KAAK,GAAG,IAAI;CAC1B;AACF;AAaA,SAAgB,4BAAsC;CACpD,MAAM,MAAM,QAAQ,IAAI;CACxB,IAAI,QAAQ,WAAW,QAAQ,UAAU,QAAQ,UAAU,QAAQ,SACjE,OAAO;CAET,OAAO;AACT;AAEA,IAAI,eAAqC;AAEzC,SAAgB,YAA2B;CACzC,IAAI,CAAC,cACH,eAAe,IAAI,cAAc,0BAA0B,CAAC;CAE9D,OAAO;AACT"}

package/dist/{workload-identity-CCXbr0KK.js → workload-identity-BQBoBgdT.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-w6R9maHv.js";
-import { c as getEmbedConfig, t as getLogger } from "./logger-Co5XVwco.js";
-import { r as displayUntrustedValue, u as describeCredentialLoadFailure } from "./assembly-path-R96uhMm1.js";
+import { c as getEmbedConfig, t as getLogger } from "./logger-25be7ULc.js";
+import { r as displayUntrustedValue, u as describeCredentialLoadFailure } from "./assembly-path-4qK96UfP.js";
 import { existsSync, lstatSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { createHash, generateKeyPairSync, randomBytes, sign } from "node:crypto";
 import { Agent, get, request } from "node:http";
@@ -1583,6 +1583,25 @@ function createMixedModeTlsMaterials(now = /* @__PURE__ */ new Date(), leafDnsNa
 		}).toString()
 	};
 }
+const OID_PKCS7_DATA = "1.2.840.113549.1.7.1";
+const OID_CERT_BAG = "1.2.840.113549.1.12.10.1.3";
+const OID_X509_CERTIFICATE = "1.2.840.113549.1.9.22.1";
+const OID_FRIENDLY_NAME = "1.2.840.113549.1.9.20";
+const OID_JDK_TRUSTED_KEY_USAGE = "2.16.840.1.113894.746875.1.1";
+const OID_ANY_EXTENDED_KEY_USAGE = "2.5.29.37.0";
+function buildJavaTrustStore(pems, aliasPrefix = "cdk-local") {
+	const bags = [];
+	for (const pem of pems) for (const block of pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) ?? []) {
+		const body = block.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/g, "");
+		const certDer = Buffer.from(body, "base64");
+		const alias = `${aliasPrefix}-${bags.length}`;
+		const bmp = Buffer.from(alias, "utf16le").swap16();
+		bags.push(seq(oid(OID_CERT_BAG), explicit(0, seq(oid(OID_X509_CERTIFICATE), explicit(0, octets(certDer)))), set(seq(oid(OID_JDK_TRUSTED_KEY_USAGE), set(oid(OID_ANY_EXTENDED_KEY_USAGE))), seq(oid(OID_FRIENDLY_NAME), set(der(30, bmp))))));
+	}
+	const safeContents = seq(...bags);
+	const authSafe = seq(seq(oid(OID_PKCS7_DATA), explicit(0, octets(safeContents))));
+	return seq(integer(Buffer.from([3])), seq(oid(OID_PKCS7_DATA), explicit(0, octets(authSafe))));
+}
 
 //#endregion
 //#region src/local/emulator-resign-sidecar.ts
@@ -1741,17 +1760,100 @@ function errorBody(err,service){
   if(service==='s3'||service===undefined)return {type:'application/xml',text:'<?xml version="1.0" encoding="UTF-8"?><Error><Code>'+err.code+'</Code><Message>'+err.message.replace(/&/g,'&amp;').replace(/</g,'&lt;')+'</Message></Error>'};
   return {type:'application/x-amz-json-1.0',text:JSON.stringify({__type:err.code,message:err.message})};
 }
+var PASS_DROP_HEADERS=new Set(['connection','keep-alive','proxy-authorization','proxy-connection','te','trailer','transfer-encoding','upgrade','expect']);
+function passthroughHeaders(incoming){
+  var out=Object.create(null);
+  Object.keys(incoming).forEach(function(k){var lk=k.toLowerCase();if(PASS_DROP_HEADERS.has(lk))return;var v=incoming[k];if(v===undefined)return;out[lk]=v;});
+  return out;
+}
+// Only a real SQS queue URL is rewritten: an AWS SQS host (either form, any
+// partition suffix), no port, user info, query or fragment, and a path of a
+// 12-digit account and a queue name.
+var SQS_QUEUE_URL=/^https?:\/\/(?:sqs\.[a-z0-9-]+|[a-z0-9-]+\.queue)\.amazonaws\.com(?:\.cn)?\/([0-9]{12}\/[A-Za-z0-9_-]{1,80}(?:\.fifo)?)$/;
+function localQueueUrl(u,origin){var m=SQS_QUEUE_URL.exec(String(u));return m?origin+'/'+m[1]:u;}
+var SQS_QUEUE_URL_OPERATIONS=new Set(['CreateQueue','GetQueueUrl','ListQueues','ListDeadLetterSourceQueues']);
+// An unsigned request (an emulator run with --auth off and an SDK that signs
+// nothing) has no scope: only the JSON protocol's target names SQS then.
+function isSqsRequest(headers,service){return service==='sqs'||String(headers['x-amz-target']||'').indexOf('AmazonSQS.')===0;}
+// JSON protocol: the target names the operation. Query protocol: unknown here,
+// so every response is a candidate.
+function sqsResponseMayCarryQueueUrl(headers){
+  var t=String(headers['x-amz-target']||'');
+  if(t==='')return true;
+  return t.indexOf('AmazonSQS.')===0&&SQS_QUEUE_URL_OPERATIONS.has(t.slice('AmazonSQS.'.length));
+}
+function rewriteSqsQueueUrls(text,contentType,origin){
+  var ct=String(contentType||'').toLowerCase(),changed=false;
+  function one(u){if(typeof u!=='string')return u;var n=localQueueUrl(u,origin);if(n!==u)changed=true;return n;}
+  if(ct.indexOf('json')>=0){
+    var o;
+    try{o=JSON.parse(text);}catch(e){return undefined;}
+    if(!o||typeof o!=='object'||Array.isArray(o))return undefined;
+    if(typeof o.QueueUrl==='string')o.QueueUrl=one(o.QueueUrl);
+    ['QueueUrls','queueUrls'].forEach(function(k){if(Array.isArray(o[k]))o[k]=o[k].map(one);});
+    return changed?JSON.stringify(o):undefined;
+  }
+  if(ct.indexOf('xml')>=0){
+    // A message body inside XML is escaped, so a literal element is never user data.
+    var out=String(text).replace(/<QueueUrl>([^<]*)<\/QueueUrl>/g,function(all,u){var n=one(u.trim());return n===u.trim()?all:'<QueueUrl>'+n+'</QueueUrl>';});
+    return changed?out:undefined;
+  }
+  return undefined;
+}
 `;
 const RESIGN_SIDECAR_SERVER = String.raw`
 function startResigner(cfgPath){return new Promise(function(done){
-  var fs=require('fs'),https=require('https'),http=require('http'),tls=require('tls');
+  var fs=require('fs'),https=require('https'),http=require('http'),tls=require('tls'),net=require('net'),zlib=require('zlib');
   var cfg;
   try{cfg=JSON.parse(fs.readFileSync(cfgPath,'utf8'));}catch(e){done({error:'CONFIG_'+(e.code||'ERROR')});return;}
+  var passthrough=cfg.passthrough===true;
+  if(!passthrough&&!cfg.credentials){done({error:'CONFIG_ERROR'});return;}
+  var label=passthrough?'cdk-local --aws-emulator':'cdk-local mixed mode';
   var up=new URL(cfg.upstream),secure=up.protocol==='https:',mod=secure?https:http;
+  var upHost=up.hostname.replace(/^\[|\]$/g,'');
   cfg.upstreamHost=up.host;
   var agentOpts={keepAlive:true};
   if(secure&&cfg.upstreamCaPem)agentOpts.ca=tls.rootCertificates.concat([cfg.upstreamCaPem]);
   var agent=new mod.Agent(agentOpts);
+  // What a rewritten queue URL points at: this sidecar, the endpoint the workload already uses.
+  var origin='https://127.0.0.1:'+cfg.port;
+  var REWRITE_CAP=16*1048576;
+  // Response bytes held at once across concurrent requests; past it a
+  // response streams through unrewritten.
+  var heldResp=0,HELD_RESP_CAP=4*REWRITE_CAP;
+  var DECODERS={identity:null,gzip:zlib.gunzipSync,'x-gzip':zlib.gunzipSync,deflate:zlib.inflateSync,br:zlib.brotliDecompressSync};
+  // Relay an emulator response. An SQS response that may carry a queue URL is
+  // held (up to a cap) and its queue URLs point back here; anything else, and
+  // a response that needs no change, goes through byte for byte.
+  function relay(ur,resp,rewrite){
+    var h={};
+    Object.keys(ur.headers).forEach(function(k){if(k==='connection'||k==='keep-alive'||k==='transfer-encoding')return;h[k]=ur.headers[k];});
+    var status=ur.statusCode||502,enc=String(ur.headers['content-encoding']||'identity').trim().toLowerCase();
+    ur.on('error',function(){resp.destroy();});
+    if(!rewrite||status<200||status>=300||!Object.prototype.hasOwnProperty.call(DECODERS,enc)||Number(ur.headers['content-length'])>REWRITE_CAP){resp.writeHead(status,h);ur.pipe(resp);return;}
+    var chunks=[],n=0,released=false;
+    function release(){if(!released){released=true;heldResp-=n;}}
+    function onData(c){
+      n+=c.length;heldResp+=c.length;chunks.push(c);
+      if(n<=REWRITE_CAP&&heldResp<=HELD_RESP_CAP)return;
+      ur.removeListener('data',onData);ur.removeListener('end',onEnd);release();
+      resp.writeHead(status,h);chunks.forEach(function(x){resp.write(x);});chunks=[];
+      ur.pipe(resp);
+    }
+    function onEnd(){
+      release();
+      var raw=Buffer.concat(chunks),text,out;chunks=[];
+      try{var dec=DECODERS[enc];text=(dec?dec(raw,{maxOutputLength:4*REWRITE_CAP}):raw).toString('utf8');}catch(e){text=undefined;}
+      if(text!==undefined)out=rewriteSqsQueueUrls(text,ur.headers['content-type'],origin);
+      if(out===undefined){h['content-length']=String(raw.length);resp.writeHead(status,h);resp.end(raw);return;}
+      var b=Buffer.from(out,'utf8');
+      delete h['content-encoding'];delete h['content-md5'];delete h['x-amz-crc32'];
+      h['content-length']=String(b.length);
+      resp.writeHead(status,h);resp.end(b);
+    }
+    ur.on('data',onData);ur.on('end',onEnd);ur.on('close',release);
+  }
+  function rewritesResponse(req,service){return isSqsRequest(req.headers,service)&&sqsResponseMayCarryQueueUrl(req.headers);}
   function send(resp,status,err,service){
     if(resp.headersSent){resp.destroy();return;}
     var b=errorBody(err,service);
@@ -1778,37 +1880,58 @@ function startResigner(cfgPath){return new Promise(function(done){
     req.on('error',function(){drop();resp.destroy();});
     resp.on('close',drop);
     req.on('end',function(){
-      if(busy){send(resp,503,{code:'SlowDown',message:'cdk-local mixed mode: the AWS Emulator re-signing sidecar is holding too many request bodies at once; retry.'},serviceOf(req));return;}
+      if(busy){send(resp,503,{code:'SlowDown',message:label+': the AWS Emulator re-signing sidecar is holding too many request bodies at once; retry.'},serviceOf(req));return;}
       if(over){process.stdout.write('CDKL-RESIGN rejected a streamed request body over the cap without holding it\n');send(resp,413,tooLargeError(seen,cfg.capBytes,serviceOf(req)),serviceOf(req));return;}
       var p;
       var joined=Buffer.concat(chunks);chunks=[];
-      try{p=prepareResign(req,joined,cfg,new Date());}catch(e){p={error:{status:400,code:'InvalidRequest',message:'cdk-local mixed mode: the request could not be re-signed.'}};}
+      try{p=prepareResign(req,joined,cfg,new Date());}catch(e){p={error:{status:400,code:'InvalidRequest',message:label+': the request could not be re-signed.'}};}
       joined=null;
       if(p.error){if(p.error.status===413)process.stdout.write('CDKL-RESIGN rejected a request body over the cap\n');send(resp,p.error.status,p.error,serviceOf(req));return;}
-      var r;
-      try{r=mod.request({host:up.hostname.replace(/^\[|\]$/g,''),port:up.port||(secure?443:80),method:req.method,path:p.path,headers:p.headers,agent:agent},function(ur){
-        var h={};
-        Object.keys(ur.headers).forEach(function(k){if(k==='connection'||k==='keep-alive'||k==='transfer-encoding')return;h[k]=ur.headers[k];});
-        resp.writeHead(ur.statusCode||502,h);
-        ur.pipe(resp);
-        ur.on('error',function(){resp.destroy();});
-      });}catch(e){send(resp,400,{code:'InvalidRequest',message:'cdk-local mixed mode: the request has a header the AWS Emulator re-signing sidecar cannot forward.'},p.service);return;}
-      // A client that hangs up (an aborted GetObject) frees the upstream socket too.
-      resp.on('close',function(){if(!resp.writableFinished)r.destroy();});
-      r.setTimeout(300000,function(){r.destroy(Object.assign(new Error('upstream timeout'),{code:'ETIMEDOUT'}));});
-      r.on('error',function(e){process.stdout.write('CDKL-RESIGN upstream error '+(e.code||'ERROR')+'\n');send(resp,502,{code:'BadGateway',message:'cdk-local mixed mode: the AWS Emulator at '+cfg.upstream+' did not answer ('+(e.code||'ERROR')+').'},p.service);});
-      r.end(p.body);
+      // Re-signed anyway (accept-encoding is not a signed header): ask for an
+      // identity body, so an encoding the sidecar cannot decode never carries
+      // a real queue URL past it.
+      if(rewritesResponse(req,p.service))delete p.headers['accept-encoding'];
+      var r=upstreamRequest(req,resp,p.path,p.headers,p.service,{});
+      if(r)r.end(p.body);
     });
   }
-  var srv=https.createServer({key:cfg.keyPem,cert:cfg.certPem},handle);
+  // One upstream request; the response is relayed back. Undefined when the
+  // headers cannot be sent (the client got a 400).
+  function upstreamRequest(req,resp,path,headers,service,extra){
+    var r,opts={host:upHost,port:up.port||(secure?443:80),method:req.method,path:path,headers:headers,agent:agent};
+    Object.keys(extra).forEach(function(k){opts[k]=extra[k];});
+    try{r=mod.request(opts,function(ur){relay(ur,resp,rewritesResponse(req,service));});}
+    catch(e){send(resp,400,{code:'InvalidRequest',message:label+': the request has a header the AWS Emulator sidecar cannot forward.'},service);return undefined;}
+    // A client that hangs up (an aborted GetObject) frees the upstream socket too.
+    resp.on('close',function(){if(!resp.writableFinished)r.destroy();});
+    r.setTimeout(300000,function(){r.destroy(Object.assign(new Error('upstream timeout'),{code:'ETIMEDOUT'}));});
+    r.on('error',function(e){process.stdout.write('CDKL-RESIGN upstream error '+(e.code||'ERROR')+'\n');send(resp,502,{code:'BadGateway',message:label+': the AWS Emulator at '+cfg.upstream+' did not answer ('+(e.code||'ERROR')+').'},service);});
+    return r;
+  }
+  // Full emulator mode: the workload already signs with the emulator's keys,
+  // so the request goes upstream unchanged (its Host header too, which the
+  // signature covers) and streams; only hop-by-hop headers are dropped. TLS
+  // to the emulator is verified against the emulator's host name.
+  function handlePassthrough(req,resp){
+    var service=serviceOf(req);
+    // The incoming Host names the sidecar, not the emulator: SNI (and with it
+    // the certificate check) uses the emulator's own host name instead.
+    var extra=secure?{servername:net.isIP(upHost)?'':upHost}:{};
+    var r=upstreamRequest(req,resp,String(req.url||'/'),passthroughHeaders(req.headers),service,extra);
+    if(!r){req.resume();return;}
+    req.on('error',function(){r.destroy();resp.destroy();});
+    req.pipe(r);
+  }
+  var srv=https.createServer({key:cfg.keyPem,cert:cfg.certPem},passthrough?handlePassthrough:handle);
   srv.on('checkContinue',function(req,resp){
+    if(passthrough){resp.writeContinue();handlePassthrough(req,resp);return;}
     var n=tooLargeByHeaders(req.headers,cfg.capBytes);
     if(n>0){process.stdout.write('CDKL-RESIGN rejected a request body over the cap\n');send(resp,413,tooLargeError(n,cfg.capBytes,serviceOf(req)),serviceOf(req));req.resume();return;}
     resp.writeContinue();
     handle(req,resp);
   });
   srv.once('error',function(e){done({error:e.code||'ERROR',port:cfg.port});});
-  // Loopback only: it signs with the emulator's keys for whoever connects.
+  // Loopback only: in mixed mode it signs with the emulator's keys for whoever connects.
   srv.listen(cfg.port,'127.0.0.1',function(){done({port:cfg.port,address:srv.address().address});});
 });}
 `;
@@ -2126,19 +2249,7 @@ function processAlive(pid) {
 		return err.code === "EPERM";
 	}
 }
-function resolveMixedModeWiring(args) {
-	const { ep, services, credentials, caSources, disposers } = args;
-	const resignEndpoint = `https://127.0.0.1:${MIXED_MODE_RESIGN_PORT}`;
-	const caPems = [];
-	for (const source of caSources) try {
-		caPems.push(...pemCertificates(readFileSync(source, "utf8")));
-	} catch (err) {
-		throw new Error(`--aws-emulator: the CA bundle ${displayUntrustedValue(source)} cannot be read (${err.code ?? "error"}).`);
-	}
-	const upstreamCaPem = caPems.length > 0 ? caPems.join("\n") : void 0;
-	const tls = createMixedModeTlsMaterials();
-	const bundle = writeCaBundleFile(void 0, [...caPems, tls.caCertPem]);
-	disposers.push(bundle.dispose);
+function writeSidecarConfig(config, disposers) {
 	sweepStaleResignDirs();
 	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().productName}-resign-`));
 	disposers.push(() => rmSync(dir, {
@@ -2146,7 +2257,39 @@ function resolveMixedModeWiring(args) {
 		force: true
 	}));
 	writeFileSync(path$1.join(dir, "owner.pid"), String(process.pid), { mode: 384 });
-	const resignConfigHostPath = path$1.join(dir, "resign.json");
+	const configPath = path$1.join(dir, "resign.json");
+	writeFileSync(configPath, JSON.stringify(config), { mode: 384 });
+	return configPath;
+}
+function readPemCertificates(sources) {
+	const out = [];
+	for (const source of new Set(sources)) try {
+		out.push(...pemCertificates(readFileSync(source, "utf8")));
+	} catch (err) {
+		throw new Error(`--aws-emulator: the CA bundle ${displayUntrustedValue(source)} cannot be read (${err.code ?? "error"}).`);
+	}
+	return out;
+}
+function writeJavaTrustStoreFile(pems) {
+	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().productName}-truststore-`));
+	const hostPath = path$1.join(dir, "truststore.p12");
+	writeFileSync(hostPath, buildJavaTrustStore(pems), { mode: 420 });
+	return {
+		hostPath,
+		dispose: () => rmSync(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+function resolveMixedModeWiring(args) {
+	const { ep, services, credentials, caSources, disposers } = args;
+	const resignEndpoint = `https://127.0.0.1:${MIXED_MODE_RESIGN_PORT}`;
+	const caPems = readPemCertificates(caSources);
+	const upstreamCaPem = caPems.length > 0 ? caPems.join("\n") : void 0;
+	const tls = createMixedModeTlsMaterials();
+	const bundle = writeCaBundleFile(void 0, [...caPems, tls.caCertPem]);
+	disposers.push(bundle.dispose);
 	const config = {
 		port: MIXED_MODE_RESIGN_PORT,
 		upstream: ep.url,
@@ -2161,12 +2304,19 @@ function resolveMixedModeWiring(args) {
 		capBytes: MIXED_MODE_RESIGN_BODY_CAP_BYTES,
 		...args.region ? { region: args.region } : {}
 	};
-	writeFileSync(resignConfigHostPath, JSON.stringify(config), { mode: 384 });
+	const resignConfigHostPath = writeSidecarConfig(config, disposers);
 	const containerPath = getContainerCaBundlePath();
 	const trust = {};
 	for (const k of CA_TRUST_ENV_KEYS) trust[k] = containerPath;
 	return {
 		mode: "forward",
+		sidecar: {
+			port: MIXED_MODE_RESIGN_PORT,
+			endpoint: resignEndpoint,
+			upstream: ep,
+			configHostPath: resignConfigHostPath,
+			passthrough: false
+		},
 		mixed: {
 			realServices: services,
 			emulatorEndpoint: ep,
@@ -2208,8 +2358,8 @@ async function resolveWorkloadAwsWiring(opts) {
 			d();
 		} catch {}
 	};
-	const caMount = (source, keys = CA_TRUST_ENV_KEYS) => {
-		const file = writeCaBundleFile(expandHome(source, homeDir));
+	const caMount = (source, keys = CA_TRUST_ENV_KEYS, extraCertsPem = []) => {
+		const file = writeCaBundleFile(expandHome(source, homeDir), extraCertsPem);
 		disposers.push(file.dispose);
 		const containerPath = getContainerCaBundlePath();
 		const caEnv = {};
@@ -2256,14 +2406,36 @@ async function resolveWorkloadAwsWiring(opts) {
 				skipPull: opts.skipPull,
 				region: env["AWS_REGION"] || env["AWS_DEFAULT_REGION"] || void 0
 			});
-			const ca = caSource && ep.url.startsWith("https:") ? caMount(caSource) : void 0;
+			const https = ep.url.startsWith("https:");
+			const sidecarTls = https && run.caPath && getEmbedConfig().awsEmulatorSqsSidecar ? createMixedModeTlsMaterials() : void 0;
+			const ca = caSource && https ? caMount(caSource, CA_TRUST_ENV_KEYS, sidecarTls ? [sidecarTls.caCertPem] : []) : void 0;
+			let sidecar;
+			if (sidecarTls && run.caPath) {
+				const upstreamPems = readPemCertificates([run.caPath, ...caSource ? [caSource] : []].map((c) => expandHome(c, homeDir)));
+				sidecar = {
+					port: MIXED_MODE_RESIGN_PORT,
+					endpoint: `https://127.0.0.1:${MIXED_MODE_RESIGN_PORT}`,
+					upstream: ep,
+					passthrough: true,
+					configHostPath: writeSidecarConfig({
+						port: MIXED_MODE_RESIGN_PORT,
+						upstream: ep.url,
+						...upstreamPems.length > 0 ? { upstreamCaPem: upstreamPems.join("\n") } : {},
+						certPem: sidecarTls.certPem,
+						keyPem: sidecarTls.keyPem,
+						capBytes: MIXED_MODE_RESIGN_BODY_CAP_BYTES,
+						passthrough: true
+					}, disposers)
+				};
+			}
 			let java;
-			if (run.truststorePath && ep.url.startsWith("https:")) {
+			if (run.truststorePath && https) {
 				let file;
+				const source = sidecarTls && run.caPath ? run.caPath : run.truststorePath;
 				try {
-					file = copyTruststoreFile(run.truststorePath);
+					file = sidecarTls && run.caPath ? writeJavaTrustStoreFile([readFileSync(run.caPath, "utf8"), sidecarTls.caCertPem]) : copyTruststoreFile(run.truststorePath);
 				} catch (err) {
-					getLogger().warn(`--aws-emulator: ${run.truststorePath} cannot be read (${err.code ?? "error"}); Java workloads get no JAVA_TOOL_OPTIONS trust store.`);
+					getLogger().warn(`--aws-emulator: ${source} cannot be read (${err.code ?? "error"}); Java workloads get no JAVA_TOOL_OPTIONS trust store.`);
 				}
 				if (file) {
 					disposers.push(file.dispose);
@@ -2280,8 +2452,10 @@ async function resolveWorkloadAwsWiring(opts) {
 			return {
 				mode: "emulator",
 				emulatorEndpoint: ep,
+				...sidecar ? { sidecar } : {},
 				env: {
 					AWS_ENDPOINT_URL: ep.url,
+					...sidecar ? { AWS_ENDPOINT_URL_SQS: sidecar.endpoint } : {},
 					AWS_EC2_METADATA_DISABLED: "true",
 					AWS_DISABLE_HOST_PREFIX_INJECTION: "true",
 					AWS_IGNORE_CONFIGURED_ENDPOINT_URLS: "false",
@@ -2290,7 +2464,7 @@ async function resolveWorkloadAwsWiring(opts) {
 				},
 				scrubEnvKeys: EMULATOR_SCRUBBED_ENV_KEYS,
 				mounts: [...ca?.mounts ?? [], ...java ? [java.mount] : []],
-				loopbackPorts: ep.loopback ? [ep.port] : [],
+				loopbackPorts: [...ep.loopback ? [ep.port] : [], ...sidecar ? [sidecar.port] : []],
 				probeHealth: ca !== void 0,
 				...ca ? { caHostPath: ca.hostPath } : {},
 				emulatorCredentials: credentials,
@@ -2336,6 +2510,18 @@ async function resolveWorkloadAwsWiring(opts) {
 		throw err;
 	}
 }
+function sidecarOf(wiring) {
+	if (wiring.sidecar) return wiring.sidecar;
+	const mixed = wiring.mixed;
+	if (!mixed) return void 0;
+	return {
+		port: mixed.resignPort,
+		endpoint: mixed.resignEndpoint,
+		upstream: mixed.emulatorEndpoint,
+		configHostPath: mixed.resignConfigHostPath,
+		passthrough: false
+	};
+}
 function effectiveLoopbackPorts(env, wiring) {
 	const used = /* @__PURE__ */ new Set();
 	for (const [k, v] of Object.entries(env)) {
@@ -2345,16 +2531,16 @@ function effectiveLoopbackPorts(env, wiring) {
 			if (ep.loopback) used.add(ep.port);
 		} catch {}
 	}
-	const mixed = wiring.mixed;
-	if (mixed && used.has(mixed.resignPort) && mixed.emulatorEndpoint.loopback) used.add(mixed.emulatorEndpoint.port);
+	const sidecar = sidecarOf(wiring);
+	if (sidecar && used.has(sidecar.port) && sidecar.upstream.loopback) used.add(sidecar.upstream.port);
 	return wiring.loopbackPorts.filter((p) => used.has(p));
 }
 function loopbackForwarderPlan(wiring, ports) {
-	const mixed = wiring.mixed;
-	if (!mixed || !ports.includes(mixed.resignPort)) return { ports: [...ports] };
+	const sidecar = sidecarOf(wiring);
+	if (!sidecar || !ports.includes(sidecar.port)) return { ports: [...ports] };
 	return {
-		ports: ports.filter((p) => p !== mixed.resignPort),
-		resignConfigHostPath: mixed.resignConfigHostPath
+		ports: ports.filter((p) => p !== sidecar.port),
+		resignConfigHostPath: sidecar.configHostPath
 	};
 }
 function applyWorkloadAwsWiringToEnv(env, wiring, defaultCredentials) {
@@ -2393,8 +2579,10 @@ function applyWorkloadAwsWiringToEnv(env, wiring, defaultCredentials) {
 	};
 	if (wiring.mode === "emulator") {
 		const ownJavaToolOptions = out["JAVA_TOOL_OPTIONS"];
+		const ownSqsEndpoint = out["AWS_ENDPOINT_URL_SQS"];
 		for (const k of wiring.scrubEnvKeys) delete out[k];
 		Object.assign(out, wiring.env);
+		if (ownSqsEndpoint !== void 0) out["AWS_ENDPOINT_URL_SQS"] = ownSqsEndpoint;
 		const javaToolOptions = wiring.env["JAVA_TOOL_OPTIONS"];
 		if (javaToolOptions !== void 0) out["JAVA_TOOL_OPTIONS"] = mergeJavaToolOptions(ownJavaToolOptions, javaToolOptions);
 		setCreds(wiring.emulatorCredentials);
@@ -2679,5 +2867,5 @@ function warnWorkloadCredentialsStripped() {
 }
 
 //#endregion
-export { isAwsServiceRoutedToEmulator as $, parseAwsEndpoint as A, workload_aws_wiring_exports as B, effectiveLoopbackPorts as C, resolveEnvVars as Ct, javaTruststoreToolOptions as D, formatAuthority as Dt, getContainerJavaTruststorePath as E, isWildcardHostname as Et, resolveHostDefaultCredentials as F, awsClientConfigForService as G, MIXED_MODE_RESIGN_BODY_CAP_BYTES as H, resolveWorkloadAwsWiring as I, buildProxyClientConfig as J, awsEmulatorRealServices as K, setActiveWorkloadAwsWiring as L, readEmulatorRunFiles as M, readProfileEndpointSettings as N, loopbackForwarderPlan as O, formatHostForAuthority as Ot, resolveAwsEmulatorOption as P, getAwsEndpointOverride as Q, takeAwsEmulatorStateSourceHint as R, displayEndpointValue as S, readEnvVarsFileText as St, getContainerCaBundlePath as T, isLoopbackHostname as Tt, RESIGN_SIDECAR_SCRIPT as U, writeCaBundleFile as V, createMixedModeTlsMaterials as W, deployArtifactsReadEmulator as X, deployArtifactClientConfig as Y, getAwsEmulatorServiceRouting as Z, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as _, realAwsServicesOf as _t, deployAccountStsClientConfig as a, LEGACY_AWS_EMULATOR_SENTINEL as at, awsEmulatorEnvName as b, AWS_ENDPOINT_SERVICE_IDS as bt, resetWorkloadIdentity as c, createMixedModeStateProvider as ct, workloadStsClientConfig as d, isLegacyAwsEmulatorSentinel as dt, isProxyEnvConfigured as et, AUTH_OFF_PLACEHOLDER_CREDENTIALS as f, isRealAwsSentinel as ft, HOST_CA_TRUST_ENV_KEYS as g, realAwsServicesForWorkload as gt, EMULATOR_SCRUBBED_ENV_KEYS as h, realAwsEndpointFor as ht, assumedRoleRecorded as i, setAwsEndpointOverride as it, probeAwsEmulatorHealth as j, mergeJavaToolOptions as k, hostFromAuthority as kt, warnWorkloadCredentialsStripped as l, findLegacyAwsEmulatorSentinels as lt, DEFAULT_AWS_EMULATOR_URL as m, readAwsEmulatorEnvVarsFile as mt, accountLookupStsClientConfig as n, proxyAwareFetch as nt, readEnvCallerCredentials as o, MIXED_MODE_RESIGN_PORT as ot, CA_TRUST_ENV_KEYS as p, legacyAwsEmulatorSentinelMessage as pt, awsEndpointOverrideClientConfig as q, applyWorkloadEnvCredentials as r, setAwsEmulatorServiceRouting as rt, recordAssumedRole as s, REAL_AWS_SENTINEL as st, SECOND_ASSUME_MESSAGE as t, normalizeAwsEndpointServiceId as tt, workloadClientConfig as u, findRealAwsExceptions as ut, activateWorkloadAwsWiring as v, resourceTypeMatchesService as vt, getActiveWorkloadAwsWiring as w, defineOwnKey as wt, collectHostEndpointOverrides as x, applyEnvOverrideMap as xt, applyWorkloadAwsWiringToEnv as y, validateAwsEmulatorEnvVars as yt, workloadGetsEmulatorKeysOnly as z };
-//# sourceMappingURL=workload-identity-CCXbr0KK.js.map
+export { getAwsEndpointOverride as $, parseAwsEndpoint as A, hostFromAuthority as At, workload_aws_wiring_exports as B, effectiveLoopbackPorts as C, readEnvVarsFileText as Ct, javaTruststoreToolOptions as D, isWildcardHostname as Dt, getContainerJavaTruststorePath as E, isLoopbackHostname as Et, resolveHostDefaultCredentials as F, createMixedModeTlsMaterials as G, MIXED_MODE_RESIGN_BODY_CAP_BYTES as H, resolveWorkloadAwsWiring as I, awsEndpointOverrideClientConfig as J, awsClientConfigForService as K, setActiveWorkloadAwsWiring as L, readEmulatorRunFiles as M, readProfileEndpointSettings as N, loopbackForwarderPlan as O, formatAuthority as Ot, resolveAwsEmulatorOption as P, getAwsEmulatorServiceRouting as Q, takeAwsEmulatorStateSourceHint as R, displayEndpointValue as S, applyEnvOverrideMap as St, getContainerCaBundlePath as T, defineOwnKey as Tt, RESIGN_SIDECAR_SCRIPT as U, writeCaBundleFile as V, buildJavaTrustStore as W, deployArtifactClientConfig as X, buildProxyClientConfig as Y, deployArtifactsReadEmulator as Z, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as _, realAwsServicesForWorkload as _t, deployAccountStsClientConfig as a, setAwsEndpointOverride as at, awsEmulatorEnvName as b, validateAwsEmulatorEnvVars as bt, resetWorkloadIdentity as c, REAL_AWS_SENTINEL as ct, workloadStsClientConfig as d, findRealAwsExceptions as dt, isAwsServiceRoutedToEmulator as et, AUTH_OFF_PLACEHOLDER_CREDENTIALS as f, isLegacyAwsEmulatorSentinel as ft, HOST_CA_TRUST_ENV_KEYS as g, realAwsEndpointFor as gt, EMULATOR_SCRUBBED_ENV_KEYS as h, readAwsEmulatorEnvVarsFile as ht, assumedRoleRecorded as i, setAwsEmulatorServiceRouting as it, probeAwsEmulatorHealth as j, mergeJavaToolOptions as k, formatHostForAuthority as kt, warnWorkloadCredentialsStripped as l, createMixedModeStateProvider as lt, DEFAULT_AWS_EMULATOR_URL as m, legacyAwsEmulatorSentinelMessage as mt, accountLookupStsClientConfig as n, normalizeAwsEndpointServiceId as nt, readEnvCallerCredentials as o, LEGACY_AWS_EMULATOR_SENTINEL as ot, CA_TRUST_ENV_KEYS as p, isRealAwsSentinel as pt, awsEmulatorRealServices as q, applyWorkloadEnvCredentials as r, proxyAwareFetch as rt, recordAssumedRole as s, MIXED_MODE_RESIGN_PORT as st, SECOND_ASSUME_MESSAGE as t, isProxyEnvConfigured as tt, workloadClientConfig as u, findLegacyAwsEmulatorSentinels as ut, activateWorkloadAwsWiring as v, realAwsServicesOf as vt, getActiveWorkloadAwsWiring as w, resolveEnvVars as wt, collectHostEndpointOverrides as x, AWS_ENDPOINT_SERVICE_IDS as xt, applyWorkloadAwsWiringToEnv as y, resourceTypeMatchesService as yt, workloadGetsEmulatorKeysOnly as z };
+//# sourceMappingURL=workload-identity-BQBoBgdT.js.map