cdk-local 0.166.1 → 0.166.3

package/dist/workload-identity-Blv2g1Jp.js

@@ -1,1468 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-w6R9maHv.js";
-import { c as getEmbedConfig, t as getLogger } from "./logger-uzapot2X.js";
-import { A as validateAwsEmulatorEnvVars, B as describeCredentialLoadFailure, C as isRealAwsSentinel, E as realAwsEndpointFor, N as displayUntrustedValue, O as realAwsServicesOf, S as isLegacyAwsEmulatorSentinel, T as readAwsEmulatorEnvVarsFile, X as isLoopbackHostname, _ as MIXED_MODE_RESIGN_PORT, a as buildProxyRequestHandler, c as getAwsEmulatorServiceRouting, h as setAwsEndpointOverride, i as buildProxyClientConfig, m as setAwsEmulatorServiceRouting, u as isAwsServiceRoutedToEmulator, v as REAL_AWS_SENTINEL, w as legacyAwsEmulatorSentinelMessage } from "./aws-proxy-Ba_BOPyi.js";
-import { existsSync, lstatSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
-import { createHash, generateKeyPairSync, randomBytes, sign } from "node:crypto";
-import { get } from "node:http";
-import { get as get$1 } from "node:https";
-import { rootCertificates } from "node:tls";
-import * as path$1 from "node:path";
-import { homedir, tmpdir } from "node:os";
-
-//#region src/local/mixed-mode-tls.ts
-function der(tag, content) {
-	const n = content.length;
-	let len;
-	if (n < 128) len = Buffer.from([n]);
-	else {
-		const bytes = [];
-		for (let v = n; v > 0; v = Math.floor(v / 256)) bytes.unshift(v & 255);
-		len = Buffer.from([128 | bytes.length, ...bytes]);
-	}
-	return Buffer.concat([
-		Buffer.from([tag]),
-		len,
-		content
-	]);
-}
-const seq = (...parts) => der(48, Buffer.concat(parts));
-const set = (...parts) => der(49, Buffer.concat(parts));
-const octets = (b) => der(4, b);
-const bits = (b, unused = 0) => der(3, Buffer.concat([Buffer.from([unused]), b]));
-const bool = (v) => der(1, Buffer.from([v ? 255 : 0]));
-const utf8 = (s) => der(12, Buffer.from(s, "utf8"));
-const explicit = (n, inner) => der(160 + n, inner);
-function integer(b) {
-	let v = b;
-	while (v.length > 1 && v[0] === 0 && (v[1] & 128) === 0) v = v.subarray(1);
-	if ((v[0] & 128) !== 0) v = Buffer.concat([Buffer.from([0]), v]);
-	return der(2, v);
-}
-function oid(dotted) {
-	const parts = dotted.split(".").map(Number);
-	const out = [40 * parts[0] + parts[1]];
-	for (const p of parts.slice(2)) {
-		const stack = [p & 127];
-		for (let v = Math.floor(p / 128); v > 0; v = Math.floor(v / 128)) stack.unshift(v & 127 | 128);
-		out.push(...stack);
-	}
-	return der(6, Buffer.from(out));
-}
-function utcTime(d) {
-	const p = (n) => String(n).padStart(2, "0");
-	const s = p(d.getUTCFullYear() % 100) + p(d.getUTCMonth() + 1) + p(d.getUTCDate()) + p(d.getUTCHours()) + p(d.getUTCMinutes()) + p(d.getUTCSeconds()) + "Z";
-	return der(23, Buffer.from(s, "ascii"));
-}
-const OID_ECDSA_SHA256 = "1.2.840.10045.4.3.2";
-const OID_CN = "2.5.4.3";
-const OID_SKI = "2.5.29.14";
-const OID_KEY_USAGE = "2.5.29.15";
-const OID_SAN = "2.5.29.17";
-const OID_BASIC_CONSTRAINTS = "2.5.29.19";
-const OID_AKI = "2.5.29.35";
-const OID_EKU = "2.5.29.37";
-const OID_NAME_CONSTRAINTS = "2.5.29.30";
-const OID_SERVER_AUTH = "1.3.6.1.5.5.7.3.1";
-const name = (cn) => seq(set(seq(oid(OID_CN), utf8(cn))));
-function extension(id, critical, value) {
-	return seq(oid(id), ...critical ? [bool(true)] : [], octets(value));
-}
-function keyIdentifier(spkiDer) {
-	const point = spkiDer.subarray(spkiDer.length - 65);
-	return createHash("sha1").update(point).digest();
-}
-function serialNumber() {
-	const b = randomBytes(16);
-	b[0] = b[0] & 127 | 1;
-	return b;
-}
-function issue(spec) {
-	const sigAlg = seq(oid(OID_ECDSA_SHA256));
-	const spki = spec.publicKey.export({
-		type: "spki",
-		format: "der"
-	});
-	const tbs = seq(explicit(0, integer(Buffer.from([2]))), integer(serialNumber()), sigAlg, name(spec.issuer), seq(utcTime(spec.notBefore), utcTime(spec.notAfter)), name(spec.subject), spki, explicit(3, seq(...spec.extensions)));
-	const signature = sign("sha256", tbs, spec.signingKey);
-	return `-----BEGIN CERTIFICATE-----\n${seq(tbs, sigAlg, bits(signature)).toString("base64").replace(/(.{64})/g, "$1\n").replace(/\n$/, "")}\n-----END CERTIFICATE-----\n`;
-}
-function createMixedModeTlsMaterials(now = /* @__PURE__ */ new Date(), leafDnsNames = ["localhost"]) {
-	const notBefore = /* @__PURE__ */ new Date(now.getTime() - 3600 * 1e3);
-	const notAfter = new Date(now.getTime() + 720 * 60 * 60 * 1e3);
-	const ca = generateKeyPairSync("ec", { namedCurve: "prime256v1" });
-	const leaf = generateKeyPairSync("ec", { namedCurve: "prime256v1" });
-	const caKeyId = keyIdentifier(ca.publicKey.export({
-		type: "spki",
-		format: "der"
-	}));
-	const leafKeyId = keyIdentifier(leaf.publicKey.export({
-		type: "spki",
-		format: "der"
-	}));
-	const aki = (id) => seq(der(128, id));
-	const caCn = `cdk-local mixed-mode CA ${randomBytes(4).toString("hex")}`;
-	const caCertPem = issue({
-		subject: caCn,
-		issuer: caCn,
-		publicKey: ca.publicKey,
-		signingKey: ca.privateKey,
-		notBefore,
-		notAfter,
-		extensions: [
-			extension(OID_BASIC_CONSTRAINTS, true, seq(bool(true), integer(Buffer.from([0])))),
-			extension(OID_KEY_USAGE, true, bits(Buffer.from([6]), 1)),
-			extension(OID_SKI, false, octets(caKeyId)),
-			extension(OID_AKI, false, aki(caKeyId)),
-			extension(OID_NAME_CONSTRAINTS, true, seq(der(160, Buffer.concat([
-				seq(der(135, Buffer.from([
-					127,
-					0,
-					0,
-					1,
-					255,
-					255,
-					255,
-					255
-				]))),
-				seq(der(135, Buffer.from([
-					...new Array(15).fill(0),
-					1,
-					...new Array(16).fill(255)
-				]))),
-				seq(der(130, Buffer.from("localhost", "ascii")))
-			]))))
-		]
-	});
-	const san = seq(der(135, Buffer.from([
-		127,
-		0,
-		0,
-		1
-	])), der(135, Buffer.from([
-		0,
-		0,
-		0,
-		0,
-		0,
-		0,
-		0,
-		0,
-		0,
-		0,
-		0,
-		0,
-		0,
-		0,
-		0,
-		1
-	])), ...leafDnsNames.map((n) => der(130, Buffer.from(n, "ascii"))));
-	return {
-		caCertPem,
-		certPem: issue({
-			subject: "127.0.0.1",
-			issuer: caCn,
-			publicKey: leaf.publicKey,
-			signingKey: ca.privateKey,
-			notBefore,
-			notAfter,
-			extensions: [
-				extension(OID_BASIC_CONSTRAINTS, true, seq()),
-				extension(OID_KEY_USAGE, true, bits(Buffer.from([128]), 7)),
-				extension(OID_EKU, false, seq(oid(OID_SERVER_AUTH))),
-				extension(OID_SAN, false, san),
-				extension(OID_SKI, false, octets(leafKeyId)),
-				extension(OID_AKI, false, aki(caKeyId))
-			]
-		}),
-		keyPem: leaf.privateKey.export({
-			type: "pkcs8",
-			format: "pem"
-		}).toString()
-	};
-}
-const OID_PKCS7_DATA = "1.2.840.113549.1.7.1";
-const OID_CERT_BAG = "1.2.840.113549.1.12.10.1.3";
-const OID_X509_CERTIFICATE = "1.2.840.113549.1.9.22.1";
-const OID_FRIENDLY_NAME = "1.2.840.113549.1.9.20";
-const OID_JDK_TRUSTED_KEY_USAGE = "2.16.840.1.113894.746875.1.1";
-const OID_ANY_EXTENDED_KEY_USAGE = "2.5.29.37.0";
-function buildJavaTrustStore(pems, aliasPrefix = "cdk-local") {
-	const bags = [];
-	for (const pem of pems) for (const block of pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) ?? []) {
-		const body = block.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/g, "");
-		const certDer = Buffer.from(body, "base64");
-		const alias = `${aliasPrefix}-${bags.length}`;
-		const bmp = Buffer.from(alias, "utf16le").swap16();
-		bags.push(seq(oid(OID_CERT_BAG), explicit(0, seq(oid(OID_X509_CERTIFICATE), explicit(0, octets(certDer)))), set(seq(oid(OID_JDK_TRUSTED_KEY_USAGE), set(oid(OID_ANY_EXTENDED_KEY_USAGE))), seq(oid(OID_FRIENDLY_NAME), set(der(30, bmp))))));
-	}
-	const safeContents = seq(...bags);
-	const authSafe = seq(seq(oid(OID_PKCS7_DATA), explicit(0, octets(safeContents))));
-	return seq(integer(Buffer.from([3])), seq(oid(OID_PKCS7_DATA), explicit(0, octets(authSafe))));
-}
-
-//#endregion
-//#region src/local/emulator-resign-sidecar.ts
-const MIXED_MODE_RESIGN_BODY_CAP_BYTES = 100 * 1024 * 1024;
-const RESIGN_SIDECAR_CORE = String.raw`
-var crypto=require('crypto');
-function sha256hex(b){return crypto.createHash('sha256').update(b).digest('hex');}
-function hmac(k,s){return crypto.createHmac('sha256',k).update(s,'utf8').digest();}
-function uriEncode(s){return encodeURIComponent(s).replace(/[!'()*]/g,function(c){return '%'+c.charCodeAt(0).toString(16).toUpperCase();});}
-function safeDecode(s){try{return decodeURIComponent(s);}catch(e){return s;}}
-function canonicalPath(rawPath,service){
-  var p=rawPath||'/';
-  if(service==='s3')return p;
-  var segs=[];
-  p.split('/').forEach(function(s){if(s===''||s==='.')return;if(s==='..')segs.pop();else segs.push(s);});
-  var n=(p.charAt(0)==='/'?'/':'')+segs.join('/')+(segs.length>0&&p.charAt(p.length-1)==='/'?'/':'');
-  return uriEncode(n).replace(/%2F/g,'/');
-}
-function splitQuery(q){
-  if(!q)return [];
-  return q.split('&').filter(function(x){return x!=='';}).map(function(part){
-    var i=part.indexOf('=');
-    return {raw:part,k:safeDecode(i<0?part:part.slice(0,i)),v:i<0?'':safeDecode(part.slice(i+1))};
-  });
-}
-function canonicalQuery(pairs){
-  return pairs.map(function(p){return [uriEncode(p.k),uriEncode(p.v)];})
-    .sort(function(a,b){return a[0]<b[0]?-1:a[0]>b[0]?1:a[1]<b[1]?-1:a[1]>b[1]?1:0;})
-    .map(function(e){return e[0]+'='+e[1];}).join('&');
-}
-var PRESIGN_PARAMS=new Set(['x-amz-algorithm','x-amz-credential','x-amz-date','x-amz-expires','x-amz-signedheaders','x-amz-signature','x-amz-security-token']);
-function parseCredentialScope(algo,credential){
-  var parts=String(credential).split('/');
-  if(algo==='AWS4-HMAC-SHA256'&&parts.length>=5)return {region:parts[parts.length-3],service:parts[parts.length-2]};
-  if(algo==='AWS4-ECDSA-P256-SHA256'&&parts.length>=4)return {service:parts[parts.length-2]};
-  return undefined;
-}
-function parseAuthScope(authorization){
-  var m=/^\s*(AWS4-HMAC-SHA256|AWS4-ECDSA-P256-SHA256)\s+(.*)$/.exec(String(authorization));
-  if(!m)return undefined;
-  var c=/Credential=([^,\s]+)/.exec(m[2]);
-  return c?parseCredentialScope(m[1],c[1]):undefined;
-}
-var DROP_HEADERS=new Set(['authorization','host','connection','keep-alive','proxy-authorization','proxy-connection','te','trailer','transfer-encoding','upgrade','expect','content-length','x-amz-date','x-amz-security-token','x-amz-content-sha256','x-amz-decoded-content-length','x-amz-trailer']);
-function upstreamHeaders(incoming){
-  var out=Object.create(null);
-  Object.keys(incoming).forEach(function(k){var lk=k.toLowerCase();if(DROP_HEADERS.has(lk))return;var v=incoming[k];if(v===undefined)return;out[lk]=Array.isArray(v)?v.join(', '):String(v);});
-  return out;
-}
-function isAwsChunked(headers){
-  var sha=String(headers['x-amz-content-sha256']||'');
-  return sha.indexOf('STREAMING-')===0||/(^|,)\s*aws-chunked\s*(,|$)/i.test(String(headers['content-encoding']||''));
-}
-function stripAwsChunked(ce){
-  if(!ce)return undefined;
-  var rest=String(ce).split(',').map(function(s){return s.trim();}).filter(function(s){return s!==''&&s.toLowerCase()!=='aws-chunked';});
-  return rest.length?rest.join(', '):undefined;
-}
-function decodeAwsChunked(buf){
-  var pos=0,parts=[],trailers=Object.create(null);
-  for(;;){
-    var eol=buf.indexOf('\r\n',pos);
-    if(eol<0)throw new Error('aws-chunked body: missing chunk header');
-    var size=parseInt(buf.toString('latin1',pos,eol).split(';')[0].trim(),16);
-    if(!(size>=0))throw new Error('aws-chunked body: bad chunk size');
-    pos=eol+2;
-    if(size===0)break;
-    if(pos+size+2>buf.length)throw new Error('aws-chunked body: truncated chunk');
-    parts.push(buf.subarray(pos,pos+size));
-    pos+=size;
-    if(buf[pos]!==13||buf[pos+1]!==10)throw new Error('aws-chunked body: missing chunk terminator');
-    pos+=2;
-  }
-  while(pos<buf.length){
-    var e=buf.indexOf('\r\n',pos),end=e<0?buf.length:e;
-    var line=buf.toString('latin1',pos,end);
-    pos=end+2;
-    if(line==='')break;
-    var c=line.indexOf(':');
-    if(c<=0)continue;
-    var k=line.slice(0,c).trim().toLowerCase();
-    if(k==='x-amz-trailer-signature')continue;
-    var v=line.slice(c+1).trim();
-    if(!/^[!#$%&'*+.^_|~0-9a-z-]+$/.test(k)||/[^	 -~]/.test(v))throw new Error('aws-chunked body: invalid trailer');
-    trailers[k]=v;
-  }
-  return {body:Buffer.concat(parts),trailers:trailers};
-}
-function tooLargeByHeaders(headers,cap){
-  var decoded=Number(headers['x-amz-decoded-content-length']);
-  if(decoded>cap)return decoded;
-  var raw=Number(headers['content-length']);
-  if(raw>rawCap(cap))return raw;
-  return 0;
-}
-function rawCap(cap){return cap+Math.max(1048576,Math.floor(cap/100));}
-function signRequest(o){
-  var amzDate=o.now.toISOString().replace(/[:-]|\.\d{3}/g,''),date=amzDate.slice(0,8),h=o.headers;
-  h['x-amz-date']=amzDate;
-  h['x-amz-content-sha256']=sha256hex(o.body);
-  if(o.creds.sessionToken)h['x-amz-security-token']=o.creds.sessionToken;
-  var names=Object.keys(h).filter(function(n){return n==='host'||n==='content-type'||n==='content-md5'||n.indexOf('x-amz-')===0;}).sort();
-  var canonHeaders=names.map(function(n){return n+':'+String(h[n]).trim().replace(/\s+/g,' ')+'\n';}).join('');
-  var signed=names.join(';');
-  var creq=[o.method,canonicalPath(o.path,o.service),canonicalQuery(splitQuery(o.query)),canonHeaders,signed,h['x-amz-content-sha256']].join('\n');
-  var scope=date+'/'+o.region+'/'+o.service+'/aws4_request';
-  var sts=['AWS4-HMAC-SHA256',amzDate,scope,sha256hex(creq)].join('\n');
-  var k=hmac(hmac(hmac(hmac('AWS4'+o.creds.secretAccessKey,date),o.region),o.service),'aws4_request');
-  var sig=crypto.createHmac('sha256',k).update(sts,'utf8').digest('hex');
-  h['authorization']='AWS4-HMAC-SHA256 Credential='+o.creds.accessKeyId+'/'+scope+', SignedHeaders='+signed+', Signature='+sig;
-  return h;
-}
-function prepareResign(req,body,cfg,now){
-  var url=String(req.url||'/'),qi=url.indexOf('?');
-  var path=qi<0?url:url.slice(0,qi),query=qi<0?'':url.slice(qi+1);
-  var incoming=req.headers,scope,signedRequest=false;
-  var pairs=splitQuery(query),cred,algo;
-  pairs.forEach(function(p){var lk=p.k.toLowerCase();if(lk==='x-amz-credential')cred=p.v;if(lk==='x-amz-algorithm')algo=p.v;});
-  // Presign parameters (a real token or signature among them) never go upstream,
-  // whether or not the request ALSO carries a header signature.
-  query=pairs.filter(function(p){return !PRESIGN_PARAMS.has(p.k.toLowerCase());}).map(function(p){return p.raw;}).join('&');
-  if(incoming['authorization']!==undefined){
-    signedRequest=true;
-    scope=parseAuthScope(incoming['authorization']);
-  }else if(cred!==undefined){
-    signedRequest=true;
-    scope=parseCredentialScope(algo||'AWS4-HMAC-SHA256',cred);
-  }
-  if(signedRequest&&!scope)return {error:{status:400,code:'IncompleteSignature',message:'cdk-local mixed mode: the request signature has no credential scope the AWS Emulator re-signing sidecar can read.'}};
-  var service=scope?scope.service:undefined;
-  var headers=upstreamHeaders(incoming);
-  if(isAwsChunked(incoming)){
-    var decoded;
-    try{decoded=decodeAwsChunked(body);}catch(e){return {error:{status:400,code:'IncompleteBody',message:'cdk-local mixed mode: '+e.message+'.'}};}
-    body=decoded.body;
-    Object.keys(decoded.trailers).forEach(function(k){if(!DROP_HEADERS.has(k))headers[k]=decoded.trailers[k];});
-    var ce=stripAwsChunked(headers['content-encoding']);
-    if(ce===undefined)delete headers['content-encoding'];else headers['content-encoding']=ce;
-  }
-  if(body.length>cfg.capBytes)return {error:tooLargeError(body.length,cfg.capBytes,service)};
-  headers['host']=cfg.upstreamHost;
-  headers['content-length']=String(body.length);
-  if(signedRequest){
-    var regionSet=incoming['x-amz-region-set'];
-    pairs.forEach(function(p){if(p.k.toLowerCase()==='x-amz-region-set'&&regionSet===undefined)regionSet=p.v;});
-    var region=scope.region||String(regionSet||'').split(',')[0].trim()||cfg.region||'us-east-1';
-    if(region==='*')region=cfg.region||'us-east-1';
-    signRequest({method:String(req.method||'GET'),path:path,query:query,headers:headers,body:body,region:region,service:service,creds:cfg.credentials,now:now});
-  }
-  return {path:query?path+'?'+query:path,headers:headers,body:body,service:service};
-}
-function tooLargeError(size,cap,service){
-  return {status:413,code:service==='s3'?'EntityTooLarge':'RequestEntityTooLargeException',message:'cdk-local mixed mode: the request body ('+size+' bytes) is over the '+cap+'-byte cap of the AWS Emulator re-signing sidecar, which holds a body in memory to sign it. Upload a large S3 object with multipart upload (each part under the cap), e.g. boto3 upload_file or @aws-sdk/lib-storage.'};
-}
-function errorBody(err,service){
-  if(service==='s3'||service===undefined)return {type:'application/xml',text:'<?xml version="1.0" encoding="UTF-8"?><Error><Code>'+err.code+'</Code><Message>'+err.message.replace(/&/g,'&amp;').replace(/</g,'&lt;')+'</Message></Error>'};
-  return {type:'application/x-amz-json-1.0',text:JSON.stringify({__type:err.code,message:err.message})};
-}
-var PASS_DROP_HEADERS=new Set(['connection','keep-alive','proxy-authorization','proxy-connection','te','trailer','transfer-encoding','upgrade','expect']);
-function passthroughHeaders(incoming){
-  var out=Object.create(null);
-  Object.keys(incoming).forEach(function(k){var lk=k.toLowerCase();if(PASS_DROP_HEADERS.has(lk))return;var v=incoming[k];if(v===undefined)return;out[lk]=v;});
-  return out;
-}
-// Only a real SQS queue URL is rewritten: an AWS SQS host (either form, any
-// partition suffix), no port, user info, query or fragment, and a path of a
-// 12-digit account and a queue name.
-var SQS_QUEUE_URL=/^https?:\/\/(?:sqs\.[a-z0-9-]+|[a-z0-9-]+\.queue)\.amazonaws\.com(?:\.cn)?\/([0-9]{12}\/[A-Za-z0-9_-]{1,80}(?:\.fifo)?)$/;
-function localQueueUrl(u,origin){var m=SQS_QUEUE_URL.exec(String(u));return m?origin+'/'+m[1]:u;}
-var SQS_QUEUE_URL_OPERATIONS=new Set(['CreateQueue','GetQueueUrl','ListQueues','ListDeadLetterSourceQueues']);
-// An unsigned request (an emulator run with --auth off and an SDK that signs
-// nothing) has no scope: only the JSON protocol's target names SQS then.
-function isSqsRequest(headers,service){return service==='sqs'||String(headers['x-amz-target']||'').indexOf('AmazonSQS.')===0;}
-// JSON protocol: the target names the operation. Query protocol: unknown here,
-// so every response is a candidate.
-function sqsResponseMayCarryQueueUrl(headers){
-  var t=String(headers['x-amz-target']||'');
-  if(t==='')return true;
-  return t.indexOf('AmazonSQS.')===0&&SQS_QUEUE_URL_OPERATIONS.has(t.slice('AmazonSQS.'.length));
-}
-function rewriteSqsQueueUrls(text,contentType,origin){
-  var ct=String(contentType||'').toLowerCase(),changed=false;
-  function one(u){if(typeof u!=='string')return u;var n=localQueueUrl(u,origin);if(n!==u)changed=true;return n;}
-  if(ct.indexOf('json')>=0){
-    var o;
-    try{o=JSON.parse(text);}catch(e){return undefined;}
-    if(!o||typeof o!=='object'||Array.isArray(o))return undefined;
-    if(typeof o.QueueUrl==='string')o.QueueUrl=one(o.QueueUrl);
-    ['QueueUrls','queueUrls'].forEach(function(k){if(Array.isArray(o[k]))o[k]=o[k].map(one);});
-    return changed?JSON.stringify(o):undefined;
-  }
-  if(ct.indexOf('xml')>=0){
-    // A message body inside XML is escaped, so a literal element is never user data.
-    var out=String(text).replace(/<QueueUrl>([^<]*)<\/QueueUrl>/g,function(all,u){var n=one(u.trim());return n===u.trim()?all:'<QueueUrl>'+n+'</QueueUrl>';});
-    return changed?out:undefined;
-  }
-  return undefined;
-}
-`;
-const RESIGN_SIDECAR_SERVER = String.raw`
-function startResigner(cfgPath){return new Promise(function(done){
-  var fs=require('fs'),https=require('https'),http=require('http'),tls=require('tls'),net=require('net'),zlib=require('zlib');
-  var cfg;
-  try{cfg=JSON.parse(fs.readFileSync(cfgPath,'utf8'));}catch(e){done({error:'CONFIG_'+(e.code||'ERROR')});return;}
-  var passthrough=cfg.passthrough===true;
-  if(!passthrough&&!cfg.credentials){done({error:'CONFIG_ERROR'});return;}
-  var label=passthrough?'cdk-local --aws-emulator':'cdk-local mixed mode';
-  var up=new URL(cfg.upstream),secure=up.protocol==='https:',mod=secure?https:http;
-  var upHost=up.hostname.replace(/^\[|\]$/g,'');
-  cfg.upstreamHost=up.host;
-  var agentOpts={keepAlive:true};
-  if(secure&&cfg.upstreamCaPem)agentOpts.ca=tls.rootCertificates.concat([cfg.upstreamCaPem]);
-  var agent=new mod.Agent(agentOpts);
-  // What a rewritten queue URL points at: this sidecar, the endpoint the workload already uses.
-  var origin='https://127.0.0.1:'+cfg.port;
-  var REWRITE_CAP=16*1048576;
-  // Response bytes held at once across concurrent requests; past it a
-  // response streams through unrewritten.
-  var heldResp=0,HELD_RESP_CAP=4*REWRITE_CAP;
-  var DECODERS={identity:null,gzip:zlib.gunzipSync,'x-gzip':zlib.gunzipSync,deflate:zlib.inflateSync,br:zlib.brotliDecompressSync};
-  // Relay an emulator response. An SQS response that may carry a queue URL is
-  // held (up to a cap) and its queue URLs point back here; anything else, and
-  // a response that needs no change, goes through byte for byte.
-  function relay(ur,resp,rewrite){
-    var h={};
-    Object.keys(ur.headers).forEach(function(k){if(k==='connection'||k==='keep-alive'||k==='transfer-encoding')return;h[k]=ur.headers[k];});
-    var status=ur.statusCode||502,enc=String(ur.headers['content-encoding']||'identity').trim().toLowerCase();
-    ur.on('error',function(){resp.destroy();});
-    if(!rewrite||status<200||status>=300||!Object.prototype.hasOwnProperty.call(DECODERS,enc)||Number(ur.headers['content-length'])>REWRITE_CAP){resp.writeHead(status,h);ur.pipe(resp);return;}
-    var chunks=[],n=0,released=false;
-    function release(){if(!released){released=true;heldResp-=n;}}
-    function onData(c){
-      n+=c.length;heldResp+=c.length;chunks.push(c);
-      if(n<=REWRITE_CAP&&heldResp<=HELD_RESP_CAP)return;
-      ur.removeListener('data',onData);ur.removeListener('end',onEnd);release();
-      resp.writeHead(status,h);chunks.forEach(function(x){resp.write(x);});chunks=[];
-      ur.pipe(resp);
-    }
-    function onEnd(){
-      release();
-      var raw=Buffer.concat(chunks),text,out;chunks=[];
-      try{var dec=DECODERS[enc];text=(dec?dec(raw,{maxOutputLength:4*REWRITE_CAP}):raw).toString('utf8');}catch(e){text=undefined;}
-      if(text!==undefined)out=rewriteSqsQueueUrls(text,ur.headers['content-type'],origin);
-      if(out===undefined){h['content-length']=String(raw.length);resp.writeHead(status,h);resp.end(raw);return;}
-      var b=Buffer.from(out,'utf8');
-      delete h['content-encoding'];delete h['content-md5'];delete h['x-amz-crc32'];
-      h['content-length']=String(b.length);
-      resp.writeHead(status,h);resp.end(b);
-    }
-    ur.on('data',onData);ur.on('end',onEnd);ur.on('close',release);
-  }
-  function rewritesResponse(req,service){return isSqsRequest(req.headers,service)&&sqsResponseMayCarryQueueUrl(req.headers);}
-  function send(resp,status,err,service){
-    if(resp.headersSent){resp.destroy();return;}
-    var b=errorBody(err,service);
-    resp.writeHead(status,{'content-type':b.type,'content-length':Buffer.byteLength(b.text),'connection':'close'});
-    resp.end(b.text);
-  }
-  function serviceOf(req){
-    var s=parseAuthScope(req.headers['authorization']||'');
-    if(!s){var m=/[?&]X-Amz-Credential=([^&]*)/i.exec(String(req.url||''));if(m)s=parseCredentialScope('AWS4-HMAC-SHA256',safeDecode(m[1]));}
-    return s?s.service:undefined;
-  }
-  // Bodies held at once, across concurrent requests: twice the per-request cap.
-  // Each held byte is charged twice: building the request body briefly keeps
-  // two copies alive (the received chunks while they are joined, then the
-  // joined body while an aws-chunked body is decoded), so the charged total
-  // bounds the real peak by inflightCap.
-  var inflight=0,inflightCap=2*rawCap(cfg.capBytes);
-  function handle(req,resp){
-    // held counts toward inflight until the response is over; seen is the
-    // body size for the 413 message.
-    var chunks=[],held=0,seen=0,over=false,busy=false,limit=rawCap(cfg.capBytes);
-    var drop=function(){inflight-=2*held;held=0;chunks=[];};
-    req.on('data',function(c){seen+=c.length;if(over||busy)return;if(seen>limit){over=true;drop();return;}if(inflight+2*c.length>inflightCap){busy=true;drop();return;}held+=c.length;inflight+=2*c.length;chunks.push(c);});
-    req.on('error',function(){drop();resp.destroy();});
-    resp.on('close',drop);
-    req.on('end',function(){
-      if(busy){send(resp,503,{code:'SlowDown',message:label+': the AWS Emulator re-signing sidecar is holding too many request bodies at once; retry.'},serviceOf(req));return;}
-      if(over){process.stdout.write('CDKL-RESIGN rejected a streamed request body over the cap without holding it\n');send(resp,413,tooLargeError(seen,cfg.capBytes,serviceOf(req)),serviceOf(req));return;}
-      var p;
-      var joined=Buffer.concat(chunks);chunks=[];
-      try{p=prepareResign(req,joined,cfg,new Date());}catch(e){p={error:{status:400,code:'InvalidRequest',message:label+': the request could not be re-signed.'}};}
-      joined=null;
-      if(p.error){if(p.error.status===413)process.stdout.write('CDKL-RESIGN rejected a request body over the cap\n');send(resp,p.error.status,p.error,serviceOf(req));return;}
-      // Re-signed anyway (accept-encoding is not a signed header): ask for an
-      // identity body, so an encoding the sidecar cannot decode never carries
-      // a real queue URL past it.
-      if(rewritesResponse(req,p.service))delete p.headers['accept-encoding'];
-      var r=upstreamRequest(req,resp,p.path,p.headers,p.service,{});
-      if(r)r.end(p.body);
-    });
-  }
-  // One upstream request; the response is relayed back. Undefined when the
-  // headers cannot be sent (the client got a 400).
-  function upstreamRequest(req,resp,path,headers,service,extra){
-    var r,opts={host:upHost,port:up.port||(secure?443:80),method:req.method,path:path,headers:headers,agent:agent};
-    Object.keys(extra).forEach(function(k){opts[k]=extra[k];});
-    try{r=mod.request(opts,function(ur){relay(ur,resp,rewritesResponse(req,service));});}
-    catch(e){send(resp,400,{code:'InvalidRequest',message:label+': the request has a header the AWS Emulator sidecar cannot forward.'},service);return undefined;}
-    // A client that hangs up (an aborted GetObject) frees the upstream socket too.
-    resp.on('close',function(){if(!resp.writableFinished)r.destroy();});
-    r.setTimeout(300000,function(){r.destroy(Object.assign(new Error('upstream timeout'),{code:'ETIMEDOUT'}));});
-    r.on('error',function(e){process.stdout.write('CDKL-RESIGN upstream error '+(e.code||'ERROR')+'\n');send(resp,502,{code:'BadGateway',message:label+': the AWS Emulator at '+cfg.upstream+' did not answer ('+(e.code||'ERROR')+').'},service);});
-    return r;
-  }
-  // Full emulator mode: the workload already signs with the emulator's keys,
-  // so the request goes upstream unchanged (its Host header too, which the
-  // signature covers) and streams; only hop-by-hop headers are dropped. TLS
-  // to the emulator is verified against the emulator's host name.
-  function handlePassthrough(req,resp){
-    var service=serviceOf(req);
-    // The incoming Host names the sidecar, not the emulator: SNI (and with it
-    // the certificate check) uses the emulator's own host name instead.
-    var extra=secure?{servername:net.isIP(upHost)?'':upHost}:{};
-    var r=upstreamRequest(req,resp,String(req.url||'/'),passthroughHeaders(req.headers),service,extra);
-    if(!r){req.resume();return;}
-    req.on('error',function(){r.destroy();resp.destroy();});
-    req.pipe(r);
-  }
-  var srv=https.createServer({key:cfg.keyPem,cert:cfg.certPem},passthrough?handlePassthrough:handle);
-  srv.on('checkContinue',function(req,resp){
-    if(passthrough){resp.writeContinue();handlePassthrough(req,resp);return;}
-    var n=tooLargeByHeaders(req.headers,cfg.capBytes);
-    if(n>0){process.stdout.write('CDKL-RESIGN rejected a request body over the cap\n');send(resp,413,tooLargeError(n,cfg.capBytes,serviceOf(req)),serviceOf(req));req.resume();return;}
-    resp.writeContinue();
-    handle(req,resp);
-  });
-  srv.once('error',function(e){done({error:e.code||'ERROR',port:cfg.port});});
-  // Loopback only: in mixed mode it signs with the emulator's keys for whoever connects.
-  srv.listen(cfg.port,'127.0.0.1',function(){done({port:cfg.port,address:srv.address().address});});
-});}
-`;
-const RESIGN_SIDECAR_SCRIPT = RESIGN_SIDECAR_CORE + RESIGN_SIDECAR_SERVER;
-
-//#endregion
-//#region src/local/workload-aws-wiring.ts
-var workload_aws_wiring_exports = /* @__PURE__ */ __exportAll({
-	AUTH_OFF_PLACEHOLDER_CREDENTIALS: () => AUTH_OFF_PLACEHOLDER_CREDENTIALS,
-	CA_TRUST_ENV_KEYS: () => CA_TRUST_ENV_KEYS,
-	DEFAULT_AWS_EMULATOR_URL: () => DEFAULT_AWS_EMULATOR_URL,
-	EMULATOR_SCRUBBED_ENV_KEYS: () => EMULATOR_SCRUBBED_ENV_KEYS,
-	HOST_CA_TRUST_ENV_KEYS: () => HOST_CA_TRUST_ENV_KEYS,
-	HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS: () => HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS,
-	STALE_RESIGN_DIR_AGE_MS: () => STALE_RESIGN_DIR_AGE_MS,
-	activateWorkloadAwsWiring: () => activateWorkloadAwsWiring,
-	applyWorkloadAwsWiringToEnv: () => applyWorkloadAwsWiringToEnv,
-	awsEmulatorEnvName: () => awsEmulatorEnvName,
-	collectHostEndpointOverrides: () => collectHostEndpointOverrides,
-	displayEndpointValue: () => displayEndpointValue,
-	effectiveLoopbackPorts: () => effectiveLoopbackPorts,
-	envKeepsRealAwsException: () => envKeepsRealAwsException,
-	getActiveWorkloadAwsWiring: () => getActiveWorkloadAwsWiring,
-	getContainerCaBundlePath: () => getContainerCaBundlePath,
-	getContainerJavaTruststorePath: () => getContainerJavaTruststorePath,
-	javaTruststoreToolOptions: () => javaTruststoreToolOptions,
-	loopbackForwarderPlan: () => loopbackForwarderPlan,
-	mergeJavaToolOptions: () => mergeJavaToolOptions,
-	parseAwsEndpoint: () => parseAwsEndpoint,
-	parseIniSections: () => parseIniSections,
-	probeAwsEmulatorHealth: () => probeAwsEmulatorHealth,
-	readEmulatorRunFiles: () => readEmulatorRunFiles,
-	readProfileEndpointSettings: () => readProfileEndpointSettings,
-	resolveAwsEmulatorOption: () => resolveAwsEmulatorOption,
-	resolveHostDefaultCredentials: () => resolveHostDefaultCredentials,
-	resolveWorkloadAwsWiring: () => resolveWorkloadAwsWiring,
-	setActiveWorkloadAwsWiring: () => setActiveWorkloadAwsWiring,
-	sweepStaleResignDirs: () => sweepStaleResignDirs,
-	takeAwsEmulatorStateSourceHint: () => takeAwsEmulatorStateSourceHint,
-	workloadGetsEmulatorKeysOnly: () => workloadGetsEmulatorKeysOnly,
-	writeCaBundleFile: () => writeCaBundleFile
-});
-const CA_TRUST_ENV_KEYS = [
-	"AWS_CA_BUNDLE",
-	"NODE_EXTRA_CA_CERTS",
-	"REQUESTS_CA_BUNDLE",
-	"SSL_CERT_FILE"
-];
-const HOST_CA_TRUST_ENV_KEYS = ["AWS_CA_BUNDLE", "NODE_EXTRA_CA_CERTS"];
-const EMULATOR_SCRUBBED_ENV_KEYS = [
-	"AWS_PROFILE",
-	"AWS_DEFAULT_PROFILE",
-	"AWS_SHARED_CREDENTIALS_FILE",
-	"AWS_CONFIG_FILE",
-	"AWS_WEB_IDENTITY_TOKEN_FILE",
-	"AWS_ROLE_ARN",
-	"AWS_ROLE_SESSION_NAME",
-	"AWS_CONTAINER_CREDENTIALS_FULL_URI",
-	"AWS_CONTAINER_AUTHORIZATION_TOKEN"
-];
-const CREDENTIAL_KEYS = [
-	"AWS_ACCESS_KEY_ID",
-	"AWS_SECRET_ACCESS_KEY",
-	"AWS_SESSION_TOKEN"
-];
-function displayEndpointValue(value) {
-	const scheme = /^\s*https?:[/\\]*/i.exec(value)?.[0] ?? "";
-	let rest = value.slice(scheme.length);
-	const at = rest.lastIndexOf("@");
-	if (at >= 0) rest = `***${rest.slice(at)}`;
-	const tail = rest.search(/[?#]/);
-	if (tail >= 0) rest = `${rest.slice(0, tail + 1)}***`;
-	return displayUntrustedValue(`${scheme}${rest}`);
-}
-function parseAwsEndpoint(value, label = "--aws-emulator") {
-	let u;
-	try {
-		u = new URL(value);
-	} catch {
-		throw new Error(`${label} ${displayEndpointValue(value)} is not a URL (expected e.g. https://127.0.0.1:9297).`);
-	}
-	if (u.protocol !== "https:" && u.protocol !== "http:") throw new Error(`${label} must be an http(s) URL, got ${displayEndpointValue(value)}.`);
-	if (u.username || u.password || u.search || u.hash || u.pathname !== "/" && u.pathname !== "") throw new Error(`${label} must be a bare scheme://host:port URL (no credentials, path or query), got ${displayEndpointValue(value)}.`);
-	const port = u.port ? Number(u.port) : u.protocol === "https:" ? 443 : 80;
-	const hostname = u.hostname.replace(/^\[|\]$/g, "");
-	return {
-		url: `${u.protocol}//${u.host}`,
-		hostname,
-		port,
-		loopback: isLoopbackHostname(u.hostname)
-	};
-}
-function parseIniSections(text) {
-	const out = {};
-	let current;
-	for (const raw of text.split(/\r?\n/)) {
-		const line = raw.trim();
-		if (line === "" || line.startsWith("#") || line.startsWith(";")) continue;
-		const sec = /^\[\s*(.+?)\s*\]$/.exec(line);
-		if (sec) {
-			current = Object.create(null);
-			Object.defineProperty(out, sec[1], {
-				value: current,
-				enumerable: true,
-				configurable: true,
-				writable: true
-			});
-			continue;
-		}
-		const eq = line.indexOf("=");
-		if (current && eq > 0) {
-			const k = line.slice(0, eq).trim();
-			Object.defineProperty(current, k, {
-				value: line.slice(eq + 1).trim(),
-				enumerable: true,
-				configurable: true,
-				writable: true
-			});
-		}
-	}
-	return out;
-}
-function readEmulatorRunFiles(port, homeDir = homedir()) {
-	const dir = path$1.join(homeDir, ".aws", "emulator", String(port));
-	const present = existsSync(dir);
-	const result = {
-		dir,
-		present
-	};
-	if (!present) return result;
-	try {
-		const sections = parseIniSections(readFileSync(path$1.join(dir, "emulator_credentials"), "utf8"));
-		const def = sections["default"] ?? Object.values(sections)[0];
-		if (def?.["aws_access_key_id"] && def["aws_secret_access_key"]) result.credentials = {
-			accessKeyId: def["aws_access_key_id"],
-			secretAccessKey: def["aws_secret_access_key"],
-			...def["aws_session_token"] ? { sessionToken: def["aws_session_token"] } : {}
-		};
-	} catch {}
-	const ca = path$1.join(dir, "ca.pem");
-	if (existsSync(ca)) result.caPath = ca;
-	const truststore = path$1.join(dir, "truststore.p12");
-	if (existsSync(truststore)) result.truststorePath = truststore;
-	return result;
-}
-const AUTH_OFF_PLACEHOLDER_CREDENTIALS = Object.freeze({
-	accessKeyId: "EMULATORAUTHOFF00000",
-	secretAccessKey: "0000000000000000000000000000000000000000"
-});
-function profileName(env, profile) {
-	return profile || env["AWS_PROFILE"] || env["AWS_DEFAULT_PROFILE"] || "default";
-}
-function readProfileEndpointSettings(env, profile, homeDir = homedir()) {
-	const file = env["AWS_CONFIG_FILE"] || path$1.join(homeDir, ".aws", "config");
-	let sections;
-	try {
-		sections = parseIniSections(readFileSync(file, "utf8"));
-	} catch {
-		return {};
-	}
-	const name = profileName(env, profile);
-	const sec = name === "default" ? sections["default"] ?? sections["profile default"] : sections[`profile ${name}`];
-	if (!sec) return {};
-	return {
-		...sec["endpoint_url"] ? { endpointUrl: sec["endpoint_url"] } : {},
-		...sec["ca_bundle"] ? { caBundle: sec["ca_bundle"] } : {},
-		...sec["ignore_configured_endpoint_urls"] ? { ignoreConfiguredEndpointUrls: sec["ignore_configured_endpoint_urls"].toLowerCase() === "true" } : {}
-	};
-}
-function ignoresConfiguredEndpointUrls(env, profile, homeDir) {
-	const fromEnv = (env["AWS_IGNORE_CONFIGURED_ENDPOINT_URLS"] ?? "").trim();
-	if (fromEnv !== "") return fromEnv.toLowerCase() === "true";
-	return readProfileEndpointSettings(env, profile, homeDir).ignoreConfiguredEndpointUrls === true;
-}
-function collectHostEndpointOverrides(env, opts = {}) {
-	if (ignoresConfiguredEndpointUrls(env, opts.profile, opts.homeDir)) return {};
-	const out = {};
-	for (const [k, v] of Object.entries(env)) {
-		if (v === void 0 || v === "") continue;
-		if (k === "AWS_ENDPOINT_URL" || /^AWS_ENDPOINT_URL_[A-Z0-9_]+$/.test(k)) out[k] = v;
-	}
-	if (out["AWS_ENDPOINT_URL"] === void 0) {
-		const fromProfile = readProfileEndpointSettings(env, opts.profile, opts.homeDir).endpointUrl;
-		if (fromProfile) out["AWS_ENDPOINT_URL"] = fromProfile;
-	}
-	for (const [k, v] of Object.entries(out)) try {
-		parseAwsEndpoint(v, k);
-	} catch {
-		getLogger().warn(`${k} is not an http(s) URL; it is not forwarded to workload containers.`);
-		delete out[k];
-	}
-	return out;
-}
-function getContainerJavaTruststorePath() {
-	return `${getEmbedConfig().awsBindMountPath}/truststore.p12`;
-}
-function javaTruststoreToolOptions(containerPath) {
-	return `-Djavax.net.ssl.trustStore=${containerPath} -Djavax.net.ssl.trustStoreType=PKCS12`;
-}
-function mergeJavaToolOptions(existing, wiring) {
-	const own = (existing ?? "").trim();
-	if (own === "") return wiring;
-	if (/-Djavax\.net\.ssl\.trustStore=/.test(own)) return own;
-	return `${own} ${wiring}`;
-}
-function copyTruststoreFile(source) {
-	const bytes = readFileSync(source);
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().productName}-truststore-`));
-	const hostPath = path$1.join(dir, "truststore.p12");
-	writeFileSync(hostPath, bytes, { mode: 420 });
-	return {
-		hostPath,
-		dispose: () => rmSync(dir, {
-			recursive: true,
-			force: true
-		})
-	};
-}
-function getContainerCaBundlePath() {
-	return `${getEmbedConfig().awsBindMountPath}/ca-bundle.pem`;
-}
-function expandHome(p, homeDir) {
-	return p === "~" ? homeDir : p.startsWith("~/") ? path$1.join(homeDir, p.slice(2)) : p;
-}
-function writeCaBundleFile(source, extraCertsPem = []) {
-	const certs = [];
-	if (source !== void 0) {
-		let pem;
-		try {
-			pem = readFileSync(source, "utf8");
-		} catch (err) {
-			throw new Error(`CA bundle ${displayUntrustedValue(source)} cannot be read (${err.code ?? "error"}).`);
-		}
-		const found = pemCertificates(pem);
-		if (found.length === 0) throw new Error(`CA bundle ${displayUntrustedValue(source)} contains no PEM certificate.`);
-		certs.push(...found);
-	}
-	for (const extra of extraCertsPem) certs.push(...pemCertificates(extra));
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().productName}-ca-`));
-	const hostPath = path$1.join(dir, "ca-bundle.pem");
-	writeFileSync(hostPath, `${certs.join("\n")}\n${rootCertificates.join("\n")}\n`, { mode: 420 });
-	return {
-		hostPath,
-		dispose: () => rmSync(dir, {
-			recursive: true,
-			force: true
-		})
-	};
-}
-function pemCertificates(pem) {
-	return pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) ?? [];
-}
-const DEFAULT_AWS_EMULATOR_URL = "https://127.0.0.1:9297";
-function probeAwsEmulatorHealth(url, caPath) {
-	return new Promise((resolve) => {
-		let ca;
-		try {
-			ca = caPath ? [...rootCertificates, readFileSync(caPath, "utf8")] : void 0;
-		} catch {
-			ca = void 0;
-		}
-		const target = `${url}/__admin/health`;
-		const onResponse = (res) => {
-			res.resume();
-			resolve(res.statusCode === 200 ? void 0 : `HTTP_${res.statusCode ?? 0}`);
-		};
-		const req = target.startsWith("https:") ? get$1(target, {
-			timeout: 3e3,
-			...ca ? { ca } : {}
-		}, onResponse) : get(target, { timeout: 3e3 }, onResponse);
-		req.on("timeout", () => {
-			req.destroy();
-			resolve("ETIMEDOUT");
-		});
-		req.on("error", (e) => resolve(e.code ?? "ERROR"));
-	});
-}
-function describeEmulatorUnreachable(ep, reason) {
-	return `--aws-emulator ${ep.url}: no AWS Emulator answers its health check at ${ep.url}/__admin/health (${reason}). Check that it is running on port ${ep.port} (\`aws-emulator -p ${ep.port}\`, or its Docker image published with \`-p 127.0.0.1:${ep.port}:${ep.port}\`), that the URL's port matches, and that it listens on an address this machine reaches (\`-b\`).`;
-}
-const STALE_RESIGN_DIR_AGE_MS = 10800 * 1e3;
-function sweepStaleResignDirs(now = Date.now(), dir = tmpdir()) {
-	const removed = [];
-	const prefix = `${getEmbedConfig().productName}-resign-`;
-	const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
-	let names;
-	try {
-		names = readdirSync(dir);
-	} catch {
-		return removed;
-	}
-	for (const name of names) {
-		if (!name.startsWith(prefix)) continue;
-		const full = path$1.join(dir, name);
-		try {
-			const st = lstatSync(full);
-			if (!st.isDirectory() || uid !== void 0 && st.uid !== uid) continue;
-			if (now - st.mtimeMs < 108e5) continue;
-			const pid = Number(readFileSync(path$1.join(full, "owner.pid"), "utf8").trim());
-			if (!Number.isInteger(pid) || pid <= 0 || processAlive(pid)) continue;
-			rmSync(full, {
-				recursive: true,
-				force: true
-			});
-			removed.push(full);
-		} catch {}
-	}
-	return removed;
-}
-function processAlive(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (err) {
-		return err.code === "EPERM";
-	}
-}
-function writeSidecarConfig(config, disposers) {
-	sweepStaleResignDirs();
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().productName}-resign-`));
-	disposers.push(() => rmSync(dir, {
-		recursive: true,
-		force: true
-	}));
-	writeFileSync(path$1.join(dir, "owner.pid"), String(process.pid), { mode: 384 });
-	const configPath = path$1.join(dir, "resign.json");
-	writeFileSync(configPath, JSON.stringify(config), { mode: 384 });
-	return configPath;
-}
-function readPemCertificates(sources) {
-	const out = [];
-	for (const source of new Set(sources)) try {
-		out.push(...pemCertificates(readFileSync(source, "utf8")));
-	} catch (err) {
-		throw new Error(`--aws-emulator: the CA bundle ${displayUntrustedValue(source)} cannot be read (${err.code ?? "error"}).`);
-	}
-	return out;
-}
-function writeJavaTrustStoreFile(pems) {
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().productName}-truststore-`));
-	const hostPath = path$1.join(dir, "truststore.p12");
-	writeFileSync(hostPath, buildJavaTrustStore(pems), { mode: 420 });
-	return {
-		hostPath,
-		dispose: () => rmSync(dir, {
-			recursive: true,
-			force: true
-		})
-	};
-}
-function resolveMixedModeWiring(args) {
-	const { ep, services, credentials, caSources, disposers } = args;
-	const resignEndpoint = `https://127.0.0.1:${MIXED_MODE_RESIGN_PORT}`;
-	const caPems = readPemCertificates(caSources);
-	const upstreamCaPem = caPems.length > 0 ? caPems.join("\n") : void 0;
-	const tls = createMixedModeTlsMaterials();
-	const bundle = writeCaBundleFile(void 0, [...caPems, tls.caCertPem]);
-	disposers.push(bundle.dispose);
-	const config = {
-		port: MIXED_MODE_RESIGN_PORT,
-		upstream: ep.url,
-		...upstreamCaPem ? { upstreamCaPem } : {},
-		certPem: tls.certPem,
-		keyPem: tls.keyPem,
-		credentials: {
-			accessKeyId: credentials.accessKeyId,
-			secretAccessKey: credentials.secretAccessKey,
-			...credentials.sessionToken ? { sessionToken: credentials.sessionToken } : {}
-		},
-		capBytes: MIXED_MODE_RESIGN_BODY_CAP_BYTES,
-		...args.region ? { region: args.region } : {}
-	};
-	const resignConfigHostPath = writeSidecarConfig(config, disposers);
-	const containerPath = getContainerCaBundlePath();
-	const trust = {};
-	for (const k of CA_TRUST_ENV_KEYS) trust[k] = containerPath;
-	return {
-		mode: "forward",
-		sidecar: {
-			port: MIXED_MODE_RESIGN_PORT,
-			endpoint: resignEndpoint,
-			upstream: ep,
-			configHostPath: resignConfigHostPath,
-			passthrough: false
-		},
-		mixed: {
-			realServices: services,
-			emulatorEndpoint: ep,
-			resignPort: MIXED_MODE_RESIGN_PORT,
-			resignEndpoint,
-			emulatorCredentials: config.credentials,
-			...args.region ? { region: args.region } : {},
-			resignConfigHostPath,
-			emulatorClientOverride: {
-				endpoint: ep.url,
-				...upstreamCaPem ? { caPem: upstreamCaPem } : {},
-				credentials: config.credentials
-			}
-		},
-		env: {
-			AWS_ENDPOINT_URL: resignEndpoint,
-			AWS_EC2_METADATA_DISABLED: "true",
-			AWS_DISABLE_HOST_PREFIX_INJECTION: "true",
-			...trust
-		},
-		scrubEnvKeys: [],
-		mounts: [{
-			hostPath: bundle.hostPath,
-			containerPath
-		}],
-		loopbackPorts: ep.loopback ? [ep.port, MIXED_MODE_RESIGN_PORT] : [MIXED_MODE_RESIGN_PORT],
-		probeHealth: true,
-		caHostPath: bundle.hostPath,
-		...args.skipPull ? { skipPull: true } : {},
-		dispose: args.dispose
-	};
-}
-async function resolveWorkloadAwsWiring(opts) {
-	const env = opts.env ?? process.env;
-	const homeDir = opts.homeDir ?? homedir();
-	const disposers = [];
-	const dispose = () => {
-		for (const d of disposers.splice(0)) try {
-			d();
-		} catch {}
-	};
-	const caMount = (source, keys = CA_TRUST_ENV_KEYS, extraCertsPem = []) => {
-		const file = writeCaBundleFile(expandHome(source, homeDir), extraCertsPem);
-		disposers.push(file.dispose);
-		const containerPath = getContainerCaBundlePath();
-		const caEnv = {};
-		for (const k of keys) caEnv[k] = containerPath;
-		return {
-			hostPath: file.hostPath,
-			mounts: [{
-				hostPath: file.hostPath,
-				containerPath
-			}],
-			env: caEnv
-		};
-	};
-	try {
-		if (opts.awsEmulator) {
-			const ep = parseAwsEndpoint(opts.awsEmulator === true ? DEFAULT_AWS_EMULATOR_URL : opts.awsEmulator, "--aws-emulator");
-			if (ep.hostname === "localhost") {
-				ep.hostname = "127.0.0.1";
-				ep.url = ep.url.replace("//localhost", "//127.0.0.1");
-			}
-			const run = readEmulatorRunFiles(ep.port, homeDir);
-			const caSource = opts.caBundle || run.caPath || env["AWS_CA_BUNDLE"];
-			const mixedServices = realAwsServicesOf(opts.realAwsExceptions ?? []);
-			const probeCa = mixedServices.length > 0 ? run.caPath || caSource : caSource;
-			const failure = await (opts.probeHealth ?? probeAwsEmulatorHealth)(ep.url, probeCa ? expandHome(probeCa, homeDir) : void 0);
-			if (failure) throw new Error(describeEmulatorUnreachable(ep, failure));
-			let credentials;
-			if (run.credentials) credentials = run.credentials;
-			else {
-				credentials = AUTH_OFF_PLACEHOLDER_CREDENTIALS;
-				getLogger().info(`--aws-emulator: ${path$1.join(run.dir, "emulator_credentials")} not found but the emulator is healthy, ` + (mixedServices.length > 0 ? "so it runs with --auth off; the re-signing sidecar signs with placeholder credentials." : "so it runs with --auth off; workload containers get placeholder credentials."));
-			}
-			if (mixedServices.length > 0) return resolveMixedModeWiring({
-				ep,
-				services: mixedServices,
-				credentials,
-				caSources: [...new Set([
-					ep.url.startsWith("https:") ? run.caPath : void 0,
-					opts.caBundle,
-					env["AWS_CA_BUNDLE"]
-				].filter((c) => typeof c === "string" && c !== "").map((c) => expandHome(c, homeDir)))],
-				disposers,
-				dispose,
-				skipPull: opts.skipPull,
-				region: env["AWS_REGION"] || env["AWS_DEFAULT_REGION"] || void 0
-			});
-			const https = ep.url.startsWith("https:");
-			const sidecarTls = https && run.caPath && getEmbedConfig().awsEmulatorSqsSidecar ? createMixedModeTlsMaterials() : void 0;
-			const ca = caSource && https ? caMount(caSource, CA_TRUST_ENV_KEYS, sidecarTls ? [sidecarTls.caCertPem] : []) : void 0;
-			let sidecar;
-			if (sidecarTls && run.caPath) {
-				const upstreamPems = readPemCertificates([run.caPath, ...caSource ? [caSource] : []].map((c) => expandHome(c, homeDir)));
-				sidecar = {
-					port: MIXED_MODE_RESIGN_PORT,
-					endpoint: `https://127.0.0.1:${MIXED_MODE_RESIGN_PORT}`,
-					upstream: ep,
-					passthrough: true,
-					configHostPath: writeSidecarConfig({
-						port: MIXED_MODE_RESIGN_PORT,
-						upstream: ep.url,
-						...upstreamPems.length > 0 ? { upstreamCaPem: upstreamPems.join("\n") } : {},
-						certPem: sidecarTls.certPem,
-						keyPem: sidecarTls.keyPem,
-						capBytes: MIXED_MODE_RESIGN_BODY_CAP_BYTES,
-						passthrough: true
-					}, disposers)
-				};
-			}
-			let java;
-			if (run.truststorePath && https) {
-				let file;
-				const source = sidecarTls && run.caPath ? run.caPath : run.truststorePath;
-				try {
-					file = sidecarTls && run.caPath ? writeJavaTrustStoreFile([readFileSync(run.caPath, "utf8"), sidecarTls.caCertPem]) : copyTruststoreFile(run.truststorePath);
-				} catch (err) {
-					getLogger().warn(`--aws-emulator: ${source} cannot be read (${err.code ?? "error"}); Java workloads get no JAVA_TOOL_OPTIONS trust store.`);
-				}
-				if (file) {
-					disposers.push(file.dispose);
-					const containerPath = getContainerJavaTruststorePath();
-					java = {
-						mount: {
-							hostPath: file.hostPath,
-							containerPath
-						},
-						env: { JAVA_TOOL_OPTIONS: javaTruststoreToolOptions(containerPath) }
-					};
-				}
-			}
-			return {
-				mode: "emulator",
-				emulatorEndpoint: ep,
-				...sidecar ? { sidecar } : {},
-				env: {
-					AWS_ENDPOINT_URL: ep.url,
-					...sidecar ? { AWS_ENDPOINT_URL_SQS: sidecar.endpoint } : {},
-					AWS_EC2_METADATA_DISABLED: "true",
-					AWS_DISABLE_HOST_PREFIX_INJECTION: "true",
-					AWS_IGNORE_CONFIGURED_ENDPOINT_URLS: "false",
-					...ca?.env ?? {},
-					...java?.env ?? {}
-				},
-				scrubEnvKeys: EMULATOR_SCRUBBED_ENV_KEYS,
-				mounts: [...ca?.mounts ?? [], ...java ? [java.mount] : []],
-				loopbackPorts: [...ep.loopback ? [ep.port] : [], ...sidecar ? [sidecar.port] : []],
-				probeHealth: ca !== void 0,
-				...ca ? { caHostPath: ca.hostPath } : {},
-				emulatorCredentials: credentials,
-				...opts.skipPull ? { skipPull: true } : {},
-				dispose
-			};
-		}
-		const endpoints = collectHostEndpointOverrides(env, {
-			profile: opts.profile,
-			homeDir
-		});
-		let ca;
-		if (opts.caBundle) ca = caMount(opts.caBundle);
-		else {
-			const hostCa = env["AWS_CA_BUNDLE"] || readProfileEndpointSettings(env, opts.profile, homeDir).caBundle;
-			if (hostCa) try {
-				ca = caMount(hostCa, HOST_CA_TRUST_ENV_KEYS);
-			} catch (err) {
-				getLogger().warn(`${err.message} It is not mounted into workload containers.`);
-			}
-		}
-		const ports = /* @__PURE__ */ new Set();
-		for (const v of Object.values(endpoints)) {
-			const ep = parseAwsEndpoint(v);
-			if (ep.loopback) ports.add(ep.port);
-		}
-		return {
-			mode: "forward",
-			env: {
-				...endpoints,
-				...ca?.env ?? {}
-			},
-			scrubEnvKeys: [],
-			mounts: ca?.mounts ?? [],
-			loopbackPorts: [...ports].sort((a, b) => a - b),
-			probeHealth: false,
-			...ca ? { caHostPath: ca.hostPath } : {},
-			...opts.skipPull ? { skipPull: true } : {},
-			dispose
-		};
-	} catch (err) {
-		dispose();
-		throw err;
-	}
-}
-function sidecarOf(wiring) {
-	if (wiring.sidecar) return wiring.sidecar;
-	const mixed = wiring.mixed;
-	if (!mixed) return void 0;
-	return {
-		port: mixed.resignPort,
-		endpoint: mixed.resignEndpoint,
-		upstream: mixed.emulatorEndpoint,
-		configHostPath: mixed.resignConfigHostPath,
-		passthrough: false
-	};
-}
-function effectiveLoopbackPorts(env, wiring) {
-	const used = /* @__PURE__ */ new Set();
-	for (const [k, v] of Object.entries(env)) {
-		if (k !== "AWS_ENDPOINT_URL" && !k.startsWith("AWS_ENDPOINT_URL_")) continue;
-		try {
-			const ep = parseAwsEndpoint(v, k);
-			if (ep.loopback) used.add(ep.port);
-		} catch {}
-	}
-	const sidecar = sidecarOf(wiring);
-	if (sidecar && used.has(sidecar.port) && sidecar.upstream.loopback) used.add(sidecar.upstream.port);
-	return wiring.loopbackPorts.filter((p) => used.has(p));
-}
-function loopbackForwarderPlan(wiring, ports) {
-	const sidecar = sidecarOf(wiring);
-	if (!sidecar || !ports.includes(sidecar.port)) return { ports: [...ports] };
-	return {
-		ports: ports.filter((p) => p !== sidecar.port),
-		resignConfigHostPath: sidecar.configHostPath
-	};
-}
-function applyWorkloadAwsWiringToEnv(env, wiring, defaultCredentials) {
-	const out = {};
-	for (const [k, v] of Object.entries(env)) Object.defineProperty(out, k, {
-		value: v,
-		enumerable: true,
-		configurable: true,
-		writable: true
-	});
-	let keepsException = false;
-	for (const [k, v] of Object.entries(out)) {
-		if (isLegacyAwsEmulatorSentinel(k, v)) throw new Error(legacyAwsEmulatorSentinelMessage({
-			section: "the container env",
-			key: k,
-			service: ""
-		}));
-		if (!isRealAwsSentinel(k, v)) continue;
-		if (wiring.mode === "forward" && !wiring.mixed) {
-			getLogger().debug(`${k}="${REAL_AWS_SENTINEL}" without --aws-emulator: dropped (a no-op).`);
-			delete out[k];
-			continue;
-		}
-		if (!wiring.mixed || k === "AWS_ENDPOINT_URL") throw new Error(`${k}="${REAL_AWS_SENTINEL}" reached a workload container under --aws-emulator without mixed-mode wiring. Mark exceptions in the --env-vars file, on an AWS_ENDPOINT_URL_<SERVICE> variable.`);
-		const region = out["AWS_REGION"] || out["AWS_DEFAULT_REGION"] || wiring.mixed.region;
-		if (!region) throw new Error(`${k}="${REAL_AWS_SENTINEL}" needs the workload's region to name the real endpoint, and none is set. Pass --region, or set AWS_REGION.`);
-		out[k] = realAwsEndpointFor(k.slice(17), region);
-		keepsException = true;
-	}
-	const setCreds = (c) => {
-		for (const k of CREDENTIAL_KEYS) delete out[k];
-		if (!c) return;
-		out["AWS_ACCESS_KEY_ID"] = c.accessKeyId;
-		out["AWS_SECRET_ACCESS_KEY"] = c.secretAccessKey;
-		if (c.sessionToken) out["AWS_SESSION_TOKEN"] = c.sessionToken;
-	};
-	if (wiring.mode === "emulator") {
-		const ownJavaToolOptions = out["JAVA_TOOL_OPTIONS"];
-		const ownSqsEndpoint = out["AWS_ENDPOINT_URL_SQS"];
-		for (const k of wiring.scrubEnvKeys) delete out[k];
-		Object.assign(out, wiring.env);
-		if (ownSqsEndpoint !== void 0) out["AWS_ENDPOINT_URL_SQS"] = ownSqsEndpoint;
-		const javaToolOptions = wiring.env["JAVA_TOOL_OPTIONS"];
-		if (javaToolOptions !== void 0) out["JAVA_TOOL_OPTIONS"] = mergeJavaToolOptions(ownJavaToolOptions, javaToolOptions);
-		setCreds(wiring.emulatorCredentials);
-	} else if (wiring.mixed && !keepsException) {
-		for (const k of EMULATOR_SCRUBBED_ENV_KEYS) delete out[k];
-		delete out["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"];
-		out["AWS_IGNORE_CONFIGURED_ENDPOINT_URLS"] = "false";
-		for (const [k, v] of Object.entries(wiring.env)) if (out[k] === void 0) out[k] = v;
-		setCreds(wiring.mixed.emulatorCredentials);
-	} else {
-		if (wiring.mixed) out["AWS_IGNORE_CONFIGURED_ENDPOINT_URLS"] = "false";
-		for (const [k, v] of Object.entries(wiring.env)) if (out[k] === void 0) out[k] = v;
-		if (defaultCredentials && !out["AWS_ACCESS_KEY_ID"]) setCreds(defaultCredentials);
-	}
-	if (out["AWS_REGION"] && !out["AWS_DEFAULT_REGION"]) out["AWS_DEFAULT_REGION"] = out["AWS_REGION"];
-	return out;
-}
-function envKeepsRealAwsException(env) {
-	return Object.entries(env).some(([k, v]) => k !== "AWS_ENDPOINT_URL" && isRealAwsSentinel(k, v));
-}
-function workloadGetsEmulatorKeysOnly(env, wiring) {
-	if (!wiring) return false;
-	return wiring.mode === "emulator" || wiring.mixed !== void 0 && !envKeepsRealAwsException(env);
-}
-async function resolveHostDefaultCredentials(opts = {}) {
-	const name = assumedRoleRecorded() ? profileName(process.env, opts.profile) : opts.profile;
-	const key = `${assumedRoleRecorded() ? "noenv" : "chain"}:${name ?? ""}`;
-	const miss = chainMisses.get(key);
-	if (miss !== void 0 && Date.now() - miss < CHAIN_MISS_TTL_MS) return void 0;
-	let provider = chainProviders.get(key);
-	if (!provider) {
-		const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
-		provider = defaultProvider({
-			...name ? { profile: name } : {},
-			ignoreCache: true
-		});
-		chainProviders.set(key, provider);
-	}
-	try {
-		const c = await provider();
-		chainMisses.delete(key);
-		return {
-			accessKeyId: c.accessKeyId,
-			secretAccessKey: c.secretAccessKey,
-			...c.sessionToken ? { sessionToken: c.sessionToken } : {}
-		};
-	} catch (err) {
-		chainMisses.set(key, Date.now());
-		getLogger().debug(`No credentials from the host default chain for workload containers: ${describeCredentialLoadFailure(err)}`);
-		return;
-	}
-}
-const HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS = 6e4;
-const CHAIN_MISS_TTL_MS = HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS;
-const chainProviders = /* @__PURE__ */ new Map();
-const chainMisses = /* @__PURE__ */ new Map();
-let active;
-let exitHookInstalled = false;
-function getActiveWorkloadAwsWiring() {
-	return active;
-}
-function setActiveWorkloadAwsWiring(wiring) {
-	if (active && active !== wiring) active.dispose();
-	active = wiring;
-	if (wiring && !exitHookInstalled) {
-		exitHookInstalled = true;
-		process.once("exit", () => active?.dispose());
-	}
-}
-function awsEmulatorEnvName() {
-	const { envPrefix } = getEmbedConfig();
-	return envPrefix === "CDKL" ? "CDK_LOCAL_AWS_EMULATOR" : `${envPrefix}_AWS_EMULATOR`;
-}
-function resolveAwsEmulatorOption(flag, env = process.env) {
-	if (typeof flag === "string" && flag !== "") return flag;
-	if (flag === true) return true;
-	const raw = (env[awsEmulatorEnvName()] ?? "").trim();
-	if (raw === "" || /^(0|false)$/i.test(raw)) return void 0;
-	return /^(1|true)$/i.test(raw) ? true : raw;
-}
-async function activateWorkloadAwsWiring(options) {
-	const awsEmulator = resolveAwsEmulatorOption(options.awsEmulator);
-	const scan = readAwsEmulatorEnvVarsFile(options.envVars);
-	validateAwsEmulatorEnvVars(scan, awsEmulator !== void 0);
-	const { overrides } = scan;
-	const wiring = await resolveWorkloadAwsWiring({
-		awsEmulator,
-		caBundle: options.caBundle,
-		profile: options.profile,
-		skipPull: options.pull === false,
-		...awsEmulator !== void 0 && { realAwsExceptions: scan.exceptions }
-	});
-	setActiveWorkloadAwsWiring(wiring);
-	if (wiring.mixed) {
-		setAwsEndpointOverride(void 0);
-		setAwsEmulatorServiceRouting({
-			realServices: wiring.mixed.realServices,
-			override: wiring.mixed.emulatorClientOverride,
-			envOverrides: overrides
-		});
-		getLogger().info(`Mixed mode: every AWS call goes to AWS Emulator at ${wiring.mixed.emulatorEndpoint.url} (signed with its keys) except ${wiring.mixed.realServices.join(", ")}, which go to real AWS with your real credentials, for the workload and for ${getEmbedConfig().productName}'s own calls.`);
-	} else if (wiring.mode === "emulator" && wiring.emulatorEndpoint) {
-		setAwsEmulatorServiceRouting(void 0);
-		setAwsEndpointOverride({
-			endpoint: wiring.emulatorEndpoint.url,
-			...wiring.caHostPath ? { caPem: readFileSync(wiring.caHostPath, "utf8") } : {},
-			...wiring.emulatorCredentials ? { credentials: wiring.emulatorCredentials } : {}
-		});
-		getLogger().info(`Using AWS Emulator at ${wiring.emulatorEndpoint.url} for ${getEmbedConfig().productName}'s AWS calls and every workload container.`);
-	} else {
-		setAwsEndpointOverride(void 0);
-		setAwsEmulatorServiceRouting(void 0);
-	}
-	return wiring;
-}
-let stateSourceHintShown = false;
-function takeAwsEmulatorStateSourceHint() {
-	const wiring = active;
-	if (stateSourceHintShown || !wiring || wiring.mode !== "emulator" && !wiring.mixed) return;
-	stateSourceHintShown = true;
-	const { cliName, productName, deployCommand } = getEmbedConfig();
-	return `Under --aws-emulator, the environment variables above that reference a resource need deployed names: pass ${deployCommand !== void 0 ? `--from-state (the stack deployed into AWS Emulator with \`${deployCommand} --aws-emulator\`)` : cliName === "cdkl" ? "a host CLI's --from-state (the stack deployed into AWS Emulator with that host's own deploy)" : `--from-state (the stack deployed into AWS Emulator with ${productName}'s own deploy and --aws-emulator)`}, or --from-cfn-stack (the stack deployed into AWS Emulator with \`cdk deploy\`), or set the values with --env-vars.`;
-}
-
-//#endregion
-//#region src/utils/workload-identity.ts
-function copyCredentials(c) {
-	return c ? {
-		accessKeyId: c.accessKeyId,
-		secretAccessKey: c.secretAccessKey,
-		...c.sessionToken ? { sessionToken: c.sessionToken } : {}
-	} : void 0;
-}
-let record;
-let stripWarned = false;
-const SECOND_ASSUME_MESSAGE = "A role was already assumed in this process; refusing to assume a second one. Pass --role-arn once.";
-function recordAssumedRole(caller, role) {
-	if (record !== void 0) throw new Error(SECOND_ASSUME_MESSAGE);
-	record = {
-		caller: copyCredentials(caller),
-		role: copyCredentials(role)
-	};
-}
-function assumedRoleRecorded() {
-	return record !== void 0;
-}
-function readEnvCallerCredentials(env = process.env) {
-	const accessKeyId = env["AWS_ACCESS_KEY_ID"];
-	const secretAccessKey = env["AWS_SECRET_ACCESS_KEY"];
-	if (!accessKeyId || !secretAccessKey) return void 0;
-	const sessionToken = env["AWS_SESSION_TOKEN"];
-	return {
-		accessKeyId,
-		secretAccessKey,
-		...sessionToken ? { sessionToken } : {}
-	};
-}
-function resetWorkloadIdentity() {
-	record = void 0;
-	stripWarned = false;
-}
-function callerRecord() {
-	return getEmbedConfig().workloadIdentity === "caller" ? record : void 0;
-}
-const MULTIPLE_CREDENTIAL_SOURCES_WARNING = "Multiple credential sources detected";
-const chainLogger = {
-	debug: () => {},
-	info: () => {},
-	warn: (...args) => {
-		const text = args.map(String).join(" ");
-		if (text.includes(MULTIPLE_CREDENTIAL_SOURCES_WARNING)) return;
-		getLogger().warn(text);
-	},
-	error: (...args) => {
-		getLogger().error(args.map(String).join(" "));
-	}
-};
-function callerChainWithoutEnv(proxied) {
-	let chain;
-	return async (identityProperties) => {
-		chain ??= (async () => {
-			const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
-			return defaultProvider({
-				profile: "default",
-				logger: chainLogger,
-				...proxied ? { clientConfig: { requestHandler: buildProxyRequestHandler() } } : {}
-			});
-		})().catch((err) => {
-			chain = void 0;
-			throw err;
-		});
-		return (await chain)(identityProperties);
-	};
-}
-function workloadClientConfig(opts = {}) {
-	const base = buildProxyClientConfig({
-		profile: opts.profile,
-		service: opts.service,
-		workload: opts.workload
-	});
-	const rec = callerRecord();
-	if (!rec) return base;
-	if (base.endpoint !== void 0) return base;
-	if (opts.profile || process.env["AWS_PROFILE"]) return base;
-	if (rec.caller) {
-		const caller = rec.caller;
-		const credentials = async () => ({
-			accessKeyId: caller.accessKeyId,
-			secretAccessKey: caller.secretAccessKey,
-			...caller.sessionToken ? { sessionToken: caller.sessionToken } : {}
-		});
-		return {
-			...base,
-			credentials
-		};
-	}
-	return {
-		...base,
-		credentials: callerChainWithoutEnv(base.requestHandler !== void 0)
-	};
-}
-function workloadStsClientConfig(args) {
-	return {
-		...workloadClientConfig({ profile: args.profile }),
-		...args.region && { region: args.region },
-		...args.profile && { profile: args.profile }
-	};
-}
-function deployAccountStsClientConfig(args) {
-	const role = callerRecord()?.role;
-	if (!role) return {
-		...buildProxyClientConfig({ profile: args.profile }),
-		...args.region && { region: args.region },
-		...args.profile && { profile: args.profile }
-	};
-	const credentials = async () => ({
-		accessKeyId: role.accessKeyId,
-		secretAccessKey: role.secretAccessKey,
-		...role.sessionToken ? { sessionToken: role.sessionToken } : {}
-	});
-	return {
-		...buildProxyClientConfig(),
-		...args.region && { region: args.region },
-		...args.profile && { profile: args.profile },
-		credentials
-	};
-}
-function accountLookupStsClientConfig(args) {
-	if (getAwsEmulatorServiceRouting() && isAwsServiceRoutedToEmulator("STS")) return {
-		...buildProxyClientConfig({ service: "STS" }),
-		...args.region && { region: args.region }
-	};
-	return args.readFromCfnStack ? workloadStsClientConfig({
-		region: args.region,
-		profile: args.profile
-	}) : deployAccountStsClientConfig({
-		region: args.region,
-		profile: args.profile
-	});
-}
-function applyWorkloadEnvCredentials(env) {
-	const rec = callerRecord();
-	if (!rec) return "unchanged";
-	if (rec.caller) {
-		env["AWS_ACCESS_KEY_ID"] = rec.caller.accessKeyId;
-		env["AWS_SECRET_ACCESS_KEY"] = rec.caller.secretAccessKey;
-		if (rec.caller.sessionToken) env["AWS_SESSION_TOKEN"] = rec.caller.sessionToken;
-		else delete env["AWS_SESSION_TOKEN"];
-		return "restored";
-	}
-	delete env["AWS_ACCESS_KEY_ID"];
-	delete env["AWS_SECRET_ACCESS_KEY"];
-	delete env["AWS_SESSION_TOKEN"];
-	return "stripped";
-}
-function warnWorkloadCredentialsStripped() {
-	const wiring = getActiveWorkloadAwsWiring();
-	if (stripWarned || wiring?.mode === "emulator") return;
-	stripWarned = true;
-	const gets = wiring ? "the container gets what the host default credential chain resolves without the environment (the AWS_PROFILE or default profile in your shared config / credentials files, SSO included), or none when that resolves nothing" : "the container receives none";
-	getLogger().warn(`The --role-arn role is not handed to the emulated workload, and your shell had no static AWS credentials to hand it instead, so ${gets}. Pass --profile <name>, or export static credentials, to choose its identity.`);
-}
-
-//#endregion
-export { parseAwsEndpoint as A, workload_aws_wiring_exports as B, effectiveLoopbackPorts as C, javaTruststoreToolOptions as D, getContainerJavaTruststorePath as E, resolveHostDefaultCredentials as F, createMixedModeTlsMaterials as G, MIXED_MODE_RESIGN_BODY_CAP_BYTES as H, resolveWorkloadAwsWiring as I, setActiveWorkloadAwsWiring as L, readEmulatorRunFiles as M, readProfileEndpointSettings as N, loopbackForwarderPlan as O, resolveAwsEmulatorOption as P, takeAwsEmulatorStateSourceHint as R, displayEndpointValue as S, getContainerCaBundlePath as T, RESIGN_SIDECAR_SCRIPT as U, writeCaBundleFile as V, buildJavaTrustStore as W, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as _, deployAccountStsClientConfig as a, awsEmulatorEnvName as b, resetWorkloadIdentity as c, workloadStsClientConfig as d, AUTH_OFF_PLACEHOLDER_CREDENTIALS as f, HOST_CA_TRUST_ENV_KEYS as g, EMULATOR_SCRUBBED_ENV_KEYS as h, assumedRoleRecorded as i, probeAwsEmulatorHealth as j, mergeJavaToolOptions as k, warnWorkloadCredentialsStripped as l, DEFAULT_AWS_EMULATOR_URL as m, accountLookupStsClientConfig as n, readEnvCallerCredentials as o, CA_TRUST_ENV_KEYS as p, applyWorkloadEnvCredentials as r, recordAssumedRole as s, SECOND_ASSUME_MESSAGE as t, workloadClientConfig as u, activateWorkloadAwsWiring as v, getActiveWorkloadAwsWiring as w, collectHostEndpointOverrides as x, applyWorkloadAwsWiringToEnv as y, workloadGetsEmulatorKeysOnly as z };
-//# sourceMappingURL=workload-identity-Blv2g1Jp.js.map