cdk-local 0.166.1 → 0.166.3

package/dist/docker-runner-DjcP2syq.js

@@ -1,2234 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-w6R9maHv.js";
-import { a as displayIdent, c as getEmbedConfig, s as displayToolOutput, t as getLogger } from "./logger-uzapot2X.js";
-import { F as namesTheSameDirectory, I as renderAssemblyPathEscape, L as resolveAssemblyPath, M as assemblyPathEscape, N as displayUntrustedValue, P as isPasteableCommandArg, V as flattenToOneLine, Y as defineOwnKey, i as buildProxyClientConfig, j as absoluteAssemblyPathEscape, n as awsEmulatorRealServices, o as deployArtifactClientConfig, s as deployArtifactsReadEmulator, z as describeAwsFailureForWarn } from "./aws-proxy-Ba_BOPyi.js";
-import { C as effectiveLoopbackPorts, F as resolveHostDefaultCredentials, O as loopbackForwarderPlan, U as RESIGN_SIDECAR_SCRIPT, d as workloadStsClientConfig, i as assumedRoleRecorded, o as readEnvCallerCredentials, s as recordAssumedRole, t as SECOND_ASSUME_MESSAGE, u as workloadClientConfig, w as getActiveWorkloadAwsWiring, y as applyWorkloadAwsWiringToEnv, z as workloadGetsEmulatorKeysOnly } from "./workload-identity-Blv2g1Jp.js";
-import { a as isDockerClientEnvKey, c as runDockerStreaming, d as dockerRegistryEnv, i as getDockerCmd, l as spawnStreaming, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as noImplicitEcrPullArgs, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure } from "./docker-cmd-BnW-0c0e.js";
-import { existsSync, readlinkSync, realpathSync } from "node:fs";
-import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { createHash, randomBytes } from "node:crypto";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { homedir } from "node:os";
-import { execFile, execFileSync, spawn } from "node:child_process";
-import { createServer } from "node:net";
-import { StringDecoder } from "node:string_decoder";
-import { promisify } from "node:util";
-import { ECRClient, GetAuthorizationTokenCommand } from "@aws-sdk/client-ecr";
-
-//#region src/utils/profile-resolver.ts
-async function resolveProfileCredentials(profile) {
-	const sts = new STSClient(buildStsClientConfig({ profile }));
-	try {
-		const credsProvider = sts.config.credentials;
-		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
-		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) {
-			const ssoHint = isPasteableCommandArg(profile) ? "Check `aws sso login --profile " + profile + "` for SSO profiles" : "For an SSO profile, run `aws sso login` for that profile (the command is not written out because the name as rendered may not be the one your shell would act on)";
-			throw new Error(`--profile ${displayUntrustedValue(profile)}: credential provider chain resolved without usable credentials. ${ssoHint}, or check \`~/.aws/credentials\` / \`~/.aws/config\` for regular profiles.`);
-		}
-		let region;
-		try {
-			const regionProvider = sts.config.region;
-			const resolved = typeof regionProvider === "function" ? await regionProvider() : regionProvider;
-			if (typeof resolved === "string" && resolved.length > 0) region = resolved;
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			if (!(/region is missing/i.test(msg) || /could not resolve region/i.test(msg) || /no region in config/i.test(msg) || /region.*not.*set/i.test(msg))) throw err;
-			region = void 0;
-		}
-		return {
-			accessKeyId: creds.accessKeyId,
-			secretAccessKey: creds.secretAccessKey,
-			...creds.sessionToken && { sessionToken: creds.sessionToken },
-			...region && { region }
-		};
-	} finally {
-		sts.destroy();
-	}
-}
-function buildStsClientConfig(args) {
-	return {
-		...buildProxyClientConfig({ profile: args.profile }),
-		...args.region && { region: args.region },
-		...args.profile && { profile: args.profile }
-	};
-}
-
-//#endregion
-//#region src/utils/role-permission-emulation.ts
-const SESSION_POLICY_MAX_CHARS = 2048;
-const SESSION_POLICY_MAX_ARNS = 10;
-const DENY_ALL_POLICY = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Action\":\"*\",\"Resource\":\"*\"}]}";
-function buildSessionPolicy(policies) {
-	const { inline, managedArns } = policies;
-	if (managedArns.length > 10) return {
-		ok: false,
-		reason: `the role has ${managedArns.length} managed policies, more than the ${10} STS accepts as session policies`
-	};
-	const versions = /* @__PURE__ */ new Set();
-	const statements = [];
-	for (const doc of inline) {
-		if (doc === null || typeof doc !== "object" || Array.isArray(doc)) return {
-			ok: false,
-			reason: "an inline policy of the role is not a JSON object"
-		};
-		const record = doc;
-		versions.add(typeof record["Version"] === "string" ? record["Version"] : "");
-		const raw = record["Statement"];
-		for (const statement of Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw]) if (statement !== null && typeof statement === "object" && !Array.isArray(statement)) {
-			const { Sid: _sid, ...rest } = statement;
-			statements.push(rest);
-		} else statements.push(statement);
-	}
-	if (versions.size > 1) return {
-		ok: false,
-		reason: "the inline policies of the role use different policy Version values and cannot be combined into one session policy"
-	};
-	const [version] = [...versions];
-	let policy;
-	if (statements.length === 0) policy = managedArns.length === 0 ? DENY_ALL_POLICY : "";
-	else policy = JSON.stringify({
-		...version !== void 0 && version !== "" && { Version: version },
-		Statement: statements
-	});
-	const chars = policy.length + managedArns.reduce((sum, arn) => sum + arn.length, 0);
-	if (chars > 2048) return {
-		ok: false,
-		reason: `the role's policies take ${chars} characters as session policies, more than the ${SESSION_POLICY_MAX_CHARS} STS accepts`
-	};
-	return {
-		ok: true,
-		policy,
-		policyArns: managedArns
-	};
-}
-function isIamUserArn(arn) {
-	return arn !== void 0 && /^arn:[^:]+:iam::\d{12}:user\//.test(arn);
-}
-function isAssumeRoleAccessDenied(err) {
-	return err?.name === "AccessDenied";
-}
-function roleNameOf(roleArn) {
-	const resource = roleArn.split(":").slice(5).join(":");
-	return resource.slice(resource.lastIndexOf("/") + 1);
-}
-const noticedRoles = /* @__PURE__ */ new Set();
-const failedRoles = /* @__PURE__ */ new Set();
-async function emulateRoleAfterDeniedAssume(err, args) {
-	if (!isAssumeRoleAccessDenied(err)) return void 0;
-	try {
-		return await emulate(args);
-	} catch (unexpected) {
-		const key = `${args.roleArn}\0unexpected`;
-		if (failedRoles.has(key)) return void 0;
-		failedRoles.add(key);
-		getLogger().warn(`${args.flag}: emulating the role's permissions failed: ${describeAwsFailureForWarn(unexpected, "role permission emulation")}.`);
-		return;
-	}
-}
-async function emulate(args) {
-	const logger = getLogger();
-	const shownRole = flattenToOneLine(args.roleArn);
-	const cannot = (reason) => {
-		const key = `${args.roleArn}\0${reason}`;
-		if (failedRoles.has(key)) return void 0;
-		failedRoles.add(key);
-		logger.warn(`${args.flag}: AssumeRole(${shownRole}) was refused, and the role's permissions cannot be emulated instead: ${reason}.`);
-	};
-	const { STSClient, GetCallerIdentityCommand, GetFederationTokenCommand, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(workloadStsClientConfig({
-		region: args.region,
-		profile: args.profile
-	}));
-	try {
-		let callerArn;
-		try {
-			callerArn = (await sts.send(new GetCallerIdentityCommand({}))).Arn;
-		} catch (idErr) {
-			return cannot(describeAwsFailureForWarn(idErr, "STS GetCallerIdentity"));
-		}
-		const roleAccount = args.roleArn.split(":")[4];
-		if (roleAccount === void 0 || roleAccount !== callerArn?.split(":")[4]) return cannot("the role is not in your credentials' account, so its policies cannot be read");
-		if (args.emulateRoleVia !== void 0 && !isIamRoleArn(args.emulateRoleVia)) return cannot(`--emulate-role-via is not a well-formed IAM role ARN: ${describeRejectedRoleArn(args.emulateRoleVia)}`);
-		if (args.emulateRoleVia === void 0 && !isIamUserArn(callerArn)) return cannot("your credentials are not an IAM user, and only an IAM user can call sts:GetFederationToken. Pass --emulate-role-via <arn> naming a role you can assume, and that role is assumed with the role's policies as session policies");
-		let policies;
-		try {
-			policies = await readRolePolicies(args);
-		} catch (readErr) {
-			return cannot(`reading the role's policies failed (it needs iam:GetRole, iam:ListRolePolicies, iam:GetRolePolicy and iam:ListAttachedRolePolicies): ${describeAwsFailureForWarn(readErr, "IAM role policy read")}`);
-		}
-		if (policies.permissionsBoundaryArn !== void 0) return cannot(`the role has a permissions boundary (${flattenToOneLine(policies.permissionsBoundaryArn)}), which session policies cannot reproduce, so the emulation could allow what the role cannot`);
-		const plan = buildSessionPolicy(policies);
-		if (!plan.ok) return cannot(plan.reason);
-		const sessionPolicies = {
-			...plan.policy !== "" && { Policy: plan.policy },
-			...plan.policyArns.length > 0 && { PolicyArns: plan.policyArns.map((arn) => ({ arn })) }
-		};
-		const prefix = getEmbedConfig().resourceNamePrefix;
-		let via;
-		let response;
-		try {
-			if (args.emulateRoleVia !== void 0) {
-				via = `AssumeRole of --emulate-role-via ${flattenToOneLine(args.emulateRoleVia)}`;
-				response = await sts.send(new AssumeRoleCommand({
-					RoleArn: args.emulateRoleVia,
-					RoleSessionName: `${prefix}-${args.sessionNameSuffix}-emulate-${Date.now()}`.slice(0, 64),
-					DurationSeconds: 3600,
-					...sessionPolicies
-				}));
-			} else {
-				via = "sts:GetFederationToken";
-				response = await sts.send(new GetFederationTokenCommand({
-					Name: `${prefix.replace(/[^\w+=,.@-]/g, "-")}-${Date.now()}`.slice(-32),
-					DurationSeconds: 3600,
-					...sessionPolicies
-				}));
-			}
-		} catch (stsErr) {
-			const stsName = stsErr?.name;
-			if (stsName === "PackedPolicyTooLargeException" || stsName === "PackedPolicyTooLarge") return cannot("the role's policies are larger than STS accepts as session policies (PackedPolicyTooLarge)");
-			const rendered = describeAwsFailureForWarn(stsErr, "STS session-policy credentials");
-			return cannot(args.emulateRoleVia === void 0 ? `${rendered}. Temporary IAM user credentials (GetSessionToken / MFA) cannot call sts:GetFederationToken; pass --emulate-role-via <arn> naming a role you can assume instead` : rendered);
-		}
-		const creds = response.Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) return cannot("STS returned no usable credentials");
-		if (!noticedRoles.has(args.roleArn)) {
-			noticedRoles.add(args.roleArn);
-			const count = policies.inline.length + policies.managedArns.length;
-			const who = args.emulateRoleVia !== void 0 ? "that role" : "you";
-			const federationNote = args.emulateRoleVia === void 0 ? " A GetFederationToken session cannot call IAM, nor STS except GetCallerIdentity." : "";
-			logger.warn(`${args.flag}: AssumeRole(${shownRole}) was refused (the role's trust policy does not allow you), so its permissions are EMULATED: credentials from ${via} with the role's ${policies.inline.length} inline and ${policies.managedArns.length} managed ${count === 1 ? "policy" : "policies"} as session policies, which allow only what both ${who} and the role allow. This is an APPROXIMATION: resource-based policies, KMS key policies and aws:PrincipalArn conditions that name the role see a different principal, and the role's session tags are not reproduced. Policy variables such as aws:username and aws:userid take this session's values, not the role's (a role session has no aws:username).${federationNote}`);
-		}
-		return {
-			accessKeyId: creds.AccessKeyId,
-			secretAccessKey: creds.SecretAccessKey,
-			sessionToken: creds.SessionToken
-		};
-	} finally {
-		sts.destroy();
-	}
-}
-async function readRolePolicies(args) {
-	const { IAMClient, ListRolePoliciesCommand, GetRolePolicyCommand, ListAttachedRolePoliciesCommand, GetRoleCommand } = await import("@aws-sdk/client-iam");
-	const iam = new IAMClient({
-		...workloadClientConfig({ profile: args.profile }),
-		...args.region && { region: args.region },
-		...args.profile && { profile: args.profile }
-	});
-	const RoleName = roleNameOf(args.roleArn);
-	try {
-		const permissionsBoundaryArn = (await iam.send(new GetRoleCommand({ RoleName }))).Role?.PermissionsBoundary?.PermissionsBoundaryArn;
-		const names = [];
-		let marker;
-		do {
-			const page = await iam.send(new ListRolePoliciesCommand({
-				RoleName,
-				...marker && { Marker: marker }
-			}));
-			names.push(...page.PolicyNames ?? []);
-			marker = page.IsTruncated ? page.Marker : void 0;
-		} while (marker);
-		const inline = [];
-		for (const PolicyName of names) {
-			const got = await iam.send(new GetRolePolicyCommand({
-				RoleName,
-				PolicyName
-			}));
-			let doc;
-			try {
-				doc = JSON.parse(decodeURIComponent(got.PolicyDocument ?? "{}"));
-			} catch {
-				throw new Error("an inline policy document of the role is not valid JSON");
-			}
-			inline.push(doc);
-		}
-		const managedArns = [];
-		let attachedMarker;
-		do {
-			const page = await iam.send(new ListAttachedRolePoliciesCommand({
-				RoleName,
-				...attachedMarker && { Marker: attachedMarker }
-			}));
-			for (const attached of page.AttachedPolicies ?? []) if (attached.PolicyArn) managedArns.push(attached.PolicyArn);
-			attachedMarker = page.IsTruncated ? page.Marker : void 0;
-		} while (attachedMarker);
-		return {
-			inline,
-			managedArns,
-			...permissionsBoundaryArn && { permissionsBoundaryArn }
-		};
-	} finally {
-		iam.destroy();
-	}
-}
-
-//#endregion
-//#region src/utils/role-arn.ts
-const IAM_ROLE_ARN_MAX_LENGTH = 2048;
-const IAM_ROLE_ARN_PATTERN = /^arn:[A-Za-z0-9-]+:iam::[0-9]+:role\/[!-~]+$/;
-function isIamRoleArn(value) {
-	if (typeof value !== "string") return false;
-	if (value.length > 2048) return false;
-	return IAM_ROLE_ARN_PATTERN.test(value);
-}
-const REJECTED_ARN_PREVIEW_MAX = 128;
-function describeRejectedRoleArn(value) {
-	if (typeof value !== "string") return `a non-string ${typeof value} value`;
-	const points = [...flattenToOneLine(value)];
-	return `"${points.length <= REJECTED_ARN_PREVIEW_MAX ? points.join("") : `${points.slice(0, REJECTED_ARN_PREVIEW_MAX).join("")}...`}" (${points.length} characters)`;
-}
-function refusedRoleArnMessage(value) {
-	return `AssumeRole refused: the role ARN is not a well-formed IAM role ARN (expected arn:<partition>:iam::<account>:role/<name>, at most ${IAM_ROLE_ARN_MAX_LENGTH} characters): ${describeRejectedRoleArn(value)}. Nothing was sent to STS.`;
-}
-var AssumeRoleFailure = class AssumeRoleFailure extends Error {
-	detail;
-	constructor(message, detail) {
-		super(message);
-		this.name = "AssumeRoleFailure";
-		this.detail = detail;
-		Object.setPrototypeOf(this, AssumeRoleFailure.prototype);
-	}
-};
-async function assumeRoleCredentials(opts) {
-	if (!isIamRoleArn(opts.roleArn)) {
-		const detail = `the role ARN is not well-formed: ${describeRejectedRoleArn(opts.roleArn)}`;
-		const message = refusedRoleArnMessage(opts.roleArn);
-		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, detail);
-	}
-	const sts = new STSClient(workloadStsClientConfig({
-		region: opts.region,
-		profile: opts.profile
-	}));
-	const shownArn = flattenToOneLine(opts.roleArn);
-	let response;
-	let refused;
-	try {
-		response = await sts.send(new AssumeRoleCommand({
-			RoleArn: opts.roleArn,
-			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-${opts.sessionNameSuffix}-${Date.now()}`,
-			DurationSeconds: 3600
-		}));
-	} catch (err) {
-		refused = { err };
-	} finally {
-		sts.destroy();
-	}
-	if (refused !== void 0) {
-		const emulated = await emulateRoleAfterDeniedAssume(refused.err, {
-			roleArn: opts.roleArn,
-			region: opts.region,
-			profile: opts.profile,
-			emulateRoleVia: opts.emulateRoleVia,
-			flag: opts.roleFlag ?? "--assume-role",
-			sessionNameSuffix: opts.sessionNameSuffix
-		});
-		if (emulated !== void 0) return emulated;
-		const detail = describeAwsFailureForWarn(refused.err, "STS AssumeRole");
-		const message = `AssumeRole(${shownArn}) failed: ${detail}`;
-		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, detail);
-	}
-	const creds = response?.Credentials;
-	if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) {
-		const message = `AssumeRole(${shownArn}) returned no usable credentials.`;
-		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, "the response carried no usable credentials");
-	}
-	return {
-		accessKeyId: creds.AccessKeyId,
-		secretAccessKey: creds.SecretAccessKey,
-		sessionToken: creds.SessionToken
-	};
-}
-async function applyRoleArnIfSet(opts) {
-	const roleArn = opts.roleArn || process.env[`${getEmbedConfig().envPrefix}_ROLE_ARN`];
-	if (!roleArn) return;
-	if (!isIamRoleArn(roleArn)) throw new Error(refusedRoleArnMessage(roleArn));
-	if (assumedRoleRecorded() && getEmbedConfig().workloadIdentity === "caller") throw new Error(SECOND_ASSUME_MESSAGE);
-	const logger = getLogger().child("role-arn");
-	const shownArn = flattenToOneLine(roleArn);
-	logger.debug(`Assuming role ${shownArn}...`);
-	const sts = new STSClient(buildStsClientConfig({
-		region: opts.region,
-		profile: opts.profile
-	}));
-	let response;
-	try {
-		response = await sts.send(new AssumeRoleCommand({
-			RoleArn: roleArn,
-			RoleSessionName: `${getEmbedConfig().binaryName}-${Date.now()}`,
-			DurationSeconds: 3600
-		}));
-	} catch (err) {
-		throw new Error(`AssumeRole(${shownArn}) failed: ${describeAwsFailureForWarn(err, "STS AssumeRole")}`);
-	} finally {
-		sts.destroy();
-	}
-	if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${shownArn}`);
-	const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
-	if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${shownArn}`);
-	if (!assumedRoleRecorded()) recordAssumedRole(readEnvCallerCredentials(), {
-		accessKeyId: AccessKeyId,
-		secretAccessKey: SecretAccessKey,
-		sessionToken: SessionToken
-	});
-	process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
-	process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
-	process.env["AWS_SESSION_TOKEN"] = SessionToken;
-	logger.info(`Assumed role ${shownArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
-}
-
-//#endregion
-//#region src/utils/error-handler.ts
-var CdkLocalError = class CdkLocalError extends Error {
-	code;
-	cause;
-	constructor(message, code, cause) {
-		super(message);
-		this.code = code;
-		this.cause = cause;
-		this.name = "CdkLocalError";
-		Object.setPrototypeOf(this, CdkLocalError.prototype);
-	}
-};
-var LocalInvokeBuildError = class LocalInvokeBuildError extends CdkLocalError {
-	constructor(message, cause) {
-		super(message, "LOCAL_INVOKE_BUILD_ERROR", cause);
-		this.name = "LocalInvokeBuildError";
-		Object.setPrototypeOf(this, LocalInvokeBuildError.prototype);
-	}
-};
-var RouteDiscoveryError = class RouteDiscoveryError extends CdkLocalError {
-	constructor(message, cause) {
-		super(message, "ROUTE_DISCOVERY_ERROR", cause);
-		this.name = "RouteDiscoveryError";
-		Object.setPrototypeOf(this, RouteDiscoveryError.prototype);
-	}
-};
-var LocalStartServiceError = class LocalStartServiceError extends CdkLocalError {
-	constructor(message, cause) {
-		super(message, "LOCAL_START_SERVICE_ERROR", cause);
-		this.name = "LocalStartServiceError";
-		Object.setPrototypeOf(this, LocalStartServiceError.prototype);
-	}
-};
-var TargetSelectionCancelledError = class TargetSelectionCancelledError extends CdkLocalError {
-	silent = true;
-	exitCode = 130;
-	constructor() {
-		super("Target selection cancelled.", "TARGET_SELECTION_CANCELLED");
-		this.name = "TargetSelectionCancelledError";
-		Object.setPrototypeOf(this, TargetSelectionCancelledError.prototype);
-	}
-};
-var InteractiveTtyRequiredError = class InteractiveTtyRequiredError extends CdkLocalError {
-	constructor(message) {
-		super(message, "INTERACTIVE_TTY_REQUIRED");
-		this.name = "InteractiveTtyRequiredError";
-		Object.setPrototypeOf(this, InteractiveTtyRequiredError.prototype);
-	}
-};
-function isCdkLocalError(error) {
-	return error instanceof CdkLocalError;
-}
-function formatError(error) {
-	if (isCdkLocalError(error)) {
-		let message = `${error.name}: ${error.message}`;
-		if (error.cause) message += `\nCaused by: ${error.cause.message}`;
-		return message;
-	}
-	if (error instanceof Error) return `${error.name}: ${error.message}`;
-	return String(error);
-}
-function handleError(error) {
-	const logger = getLogger();
-	if (!(error instanceof CdkLocalError && error.silent)) logger.error(formatError(error));
-	if (error instanceof Error && error.stack) logger.debug("Stack trace:", error.stack);
-	const customExitCode = error instanceof CdkLocalError ? error.exitCode : void 0;
-	const exitCode = typeof customExitCode === "number" ? customExitCode : 1;
-	process.exit(exitCode);
-}
-function withErrorHandling(fn) {
-	return async (...args) => {
-		try {
-			await fn(...args);
-		} catch (error) {
-			handleError(error);
-		}
-	};
-}
-
-//#endregion
-//#region src/local/intrinsic-image.ts
-function contextForContainer(context, containerName) {
-	if (!context?.containerStates || !Object.hasOwn(context.containerStates, containerName)) return context;
-	return {
-		...context.pseudoParameters && { pseudoParameters: context.pseudoParameters },
-		...context.containerStates[containerName]
-	};
-}
-function formatStateRemedy(context) {
-	if (context?.stateLoadFailureMessage) return `the state-source attempt failed: ${context.stateLoadFailureMessage}; verify the stack name (try --from-cfn-stack <deployed-name> if it differs from the synthesized name) and that --region / --profile target the right account`;
-	return "pass --from-cfn-stack to load the deployed stack state";
-}
-const PARTITION_TABLE = [
-	{
-		regionPrefix: "cn-",
-		partition: "aws-cn",
-		urlSuffix: "amazonaws.com.cn"
-	},
-	{
-		regionPrefix: "us-gov-",
-		partition: "aws-us-gov",
-		urlSuffix: "amazonaws.com"
-	},
-	{
-		regionPrefix: "us-isob-",
-		partition: "aws-iso-b",
-		urlSuffix: "sc2s.sgov.gov"
-	},
-	{
-		regionPrefix: "us-isof-",
-		partition: "aws-iso-f",
-		urlSuffix: "csp.hci.ic.gov"
-	},
-	{
-		regionPrefix: "us-iso-",
-		partition: "aws-iso",
-		urlSuffix: "c2s.ic.gov"
-	},
-	{
-		regionPrefix: "eu-isoe-",
-		partition: "aws-iso-e",
-		urlSuffix: "cloud.adc-e.uk"
-	},
-	{
-		regionPrefix: "eusc-",
-		partition: "aws-eusc",
-		urlSuffix: "amazonaws.eu"
-	}
-];
-function derivePartitionAndUrlSuffix(region) {
-	const normalized = region.toLowerCase();
-	for (const row of PARTITION_TABLE) if (normalized.startsWith(row.regionPrefix)) return {
-		partition: row.partition,
-		urlSuffix: row.urlSuffix
-	};
-	return {
-		partition: "aws",
-		urlSuffix: "amazonaws.com"
-	};
-}
-function derivePseudoParametersFromRegion(region, accountId) {
-	if (!region || typeof region !== "string" || region.length === 0) return void 0;
-	const { partition, urlSuffix } = derivePartitionAndUrlSuffix(region);
-	return {
-		...accountId !== void 0 && { accountId },
-		region,
-		partition,
-		urlSuffix
-	};
-}
-function tryResolveImageFnJoin(raw, resources, context) {
-	if (!raw || typeof raw !== "object") return { kind: "not-applicable" };
-	const arg = raw["Fn::Join"];
-	if (arg === void 0) return { kind: "not-applicable" };
-	if (!Array.isArray(arg) || arg.length !== 2 || !Array.isArray(arg[1])) return {
-		kind: "unsupported-join",
-		reason: "Fn::Join must be [delimiter, [elements]]"
-	};
-	const [delimiter, elements] = arg;
-	if (typeof delimiter !== "string") return {
-		kind: "unsupported-join",
-		reason: `Fn::Join delimiter must be a string, got ${typeof delimiter}`
-	};
-	const repoLogicalId = findEcrRepositoryRefInTree(elements, resources);
-	const stateResources = context?.stateResources;
-	if (repoLogicalId && !stateResources) return {
-		kind: "needs-state",
-		repoLogicalId
-	};
-	const parts = [];
-	for (const element of elements) {
-		const r = resolveImageIntrinsic(element, resources, context);
-		if (r === void 0) {
-			if (!repoLogicalId) return { kind: "not-applicable" };
-			return {
-				kind: "unsupported-join",
-				reason: "one or more Fn::Join elements could not be resolved"
-			};
-		}
-		parts.push(r);
-	}
-	return {
-		kind: "resolved",
-		uri: parts.join(delimiter)
-	};
-}
-function findEcrRepositoryRefInTree(node, resources) {
-	if (node === null || node === void 0) return void 0;
-	if (typeof node === "string" || typeof node === "number" || typeof node === "boolean") return;
-	if (Array.isArray(node)) {
-		for (const item of node) {
-			const hit = findEcrRepositoryRefInTree(item, resources);
-			if (hit) return hit;
-		}
-		return;
-	}
-	if (typeof node !== "object") return void 0;
-	const obj = node;
-	if (typeof obj["Ref"] === "string") {
-		const target = obj["Ref"];
-		if (resources[target]?.Type === "AWS::ECR::Repository") return target;
-		return;
-	}
-	const getAtt = obj["Fn::GetAtt"];
-	if (getAtt !== void 0) {
-		let lid;
-		if (Array.isArray(getAtt) && typeof getAtt[0] === "string") lid = getAtt[0];
-		else if (typeof getAtt === "string") lid = getAtt.split(".")[0];
-		if (lid && resources[lid]?.Type === "AWS::ECR::Repository") return lid;
-		return;
-	}
-	for (const value of Object.values(obj)) {
-		const hit = findEcrRepositoryRefInTree(value, resources);
-		if (hit) return hit;
-	}
-}
-function resolveImageIntrinsic(node, resources, context) {
-	const v = resolveImageIntrinsicAny(node, resources, context);
-	if (typeof v === "string") return v;
-	if (typeof v === "number" || typeof v === "boolean") return String(v);
-}
-function resolveImageIntrinsicAny(node, resources, context) {
-	if (node === null || node === void 0) return void 0;
-	if (typeof node === "string" || typeof node === "number" || typeof node === "boolean") return node;
-	if (Array.isArray(node)) return;
-	if (typeof node !== "object") return void 0;
-	const obj = node;
-	const keys = Object.keys(obj);
-	if (keys.length !== 1) return void 0;
-	const intrinsic = keys[0];
-	const arg = obj[intrinsic];
-	if (intrinsic === "Ref") {
-		if (typeof arg !== "string") return void 0;
-		if (arg.startsWith("AWS::")) {
-			const p = context?.pseudoParameters;
-			if (!p) return void 0;
-			if (arg === "AWS::URLSuffix") return p.urlSuffix;
-			if (arg === "AWS::Partition") return p.partition;
-			if (arg === "AWS::Region") return p.region;
-			if (arg === "AWS::AccountId") return p.accountId;
-			return;
-		}
-		if (resources[arg]?.Type !== "AWS::ECR::Repository") return void 0;
-		const stateEntry = context?.stateResources?.[arg];
-		if (!stateEntry) return void 0;
-		return stateEntry.physicalId;
-	}
-	if (intrinsic === "Fn::GetAtt") {
-		let logicalId;
-		let attr;
-		if (Array.isArray(arg) && arg.length === 2 && typeof arg[0] === "string" && typeof arg[1] === "string") {
-			logicalId = arg[0];
-			attr = arg[1];
-		} else if (typeof arg === "string") {
-			const dot = arg.indexOf(".");
-			if (dot > 0 && dot < arg.length - 1) {
-				logicalId = arg.slice(0, dot);
-				attr = arg.slice(dot + 1);
-			}
-		}
-		if (!logicalId || !attr) return void 0;
-		if (resources[logicalId]?.Type !== "AWS::ECR::Repository") return void 0;
-		const cached = context?.stateResources?.[logicalId]?.attributes?.[attr];
-		if (typeof cached === "string" && cached.length > 0) return cached;
-		const physicalId = context?.stateResources?.[logicalId]?.physicalId;
-		const p = context?.pseudoParameters;
-		if (physicalId && p?.region && p.accountId) {
-			if (attr === "Arn" && p.partition) return `arn:${p.partition}:ecr:${p.region}:${p.accountId}:repository/${physicalId}`;
-			if (attr === "RepositoryUri" && p.urlSuffix) return `${p.accountId}.dkr.ecr.${p.region}.${p.urlSuffix}/${physicalId}`;
-		}
-		return;
-	}
-	if (intrinsic === "Fn::Split") {
-		if (!Array.isArray(arg) || arg.length !== 2) return void 0;
-		const argArr = arg;
-		const delim = argArr[0];
-		if (typeof delim !== "string") return void 0;
-		const src = resolveImageIntrinsicAny(argArr[1], resources, context);
-		if (typeof src !== "string") return void 0;
-		return src.split(delim);
-	}
-	if (intrinsic === "Fn::Select") {
-		if (!Array.isArray(arg) || arg.length !== 2) return void 0;
-		const argArr = arg;
-		const rawIndex = argArr[0];
-		let index;
-		if (typeof rawIndex === "number") index = rawIndex;
-		else if (typeof rawIndex === "string" && /^-?\d+$/.test(rawIndex)) index = Number.parseInt(rawIndex, 10);
-		if (index === void 0 || !Number.isFinite(index)) return void 0;
-		const list = resolveImageIntrinsicAny(argArr[1], resources, context);
-		if (Array.isArray(list)) {
-			if (index < 0 || index >= list.length) return void 0;
-			const picked = list[index];
-			if (typeof picked === "string") return picked;
-			return;
-		}
-		if (Array.isArray(argArr[1])) {
-			const listLiteral = argArr[1];
-			if (index < 0 || index >= listLiteral.length) return void 0;
-			return resolveImageIntrinsic(listLiteral[index], resources, context);
-		}
-		return;
-	}
-	if (intrinsic === "Fn::Join") {
-		if (!Array.isArray(arg) || arg.length !== 2) return void 0;
-		const [delim, parts] = arg;
-		if (typeof delim !== "string" || !Array.isArray(parts)) return void 0;
-		const resolved = [];
-		for (const part of parts) {
-			const r = resolveImageIntrinsic(part, resources, context);
-			if (r === void 0) return void 0;
-			resolved.push(r);
-		}
-		return resolved.join(delim);
-	}
-	if (intrinsic === "Fn::Sub") {
-		let template;
-		if (typeof arg === "string") template = arg;
-		else if (Array.isArray(arg) && typeof arg[0] === "string") template = arg[0];
-		if (template === void 0) return void 0;
-		const out = substituteImagePlaceholders(template, resources, context);
-		if (out.includes("${")) return void 0;
-		return out;
-	}
-}
-function substituteImagePlaceholders(flat, resources, context) {
-	if (!flat.includes("${")) return flat;
-	return flat.replace(/\$\{([^}]+)\}/g, (full, key) => {
-		if (context?.pseudoParameters) {
-			if (key === "AWS::AccountId" && context.pseudoParameters.accountId) return context.pseudoParameters.accountId;
-			if (key === "AWS::Region" && context.pseudoParameters.region) return context.pseudoParameters.region;
-			if (key === "AWS::Partition" && context.pseudoParameters.partition) return context.pseudoParameters.partition;
-			if (key === "AWS::URLSuffix" && context.pseudoParameters.urlSuffix) return context.pseudoParameters.urlSuffix;
-		}
-		if (context?.stateResources) {
-			const dot = key.indexOf(".");
-			const logicalId = dot === -1 ? key : key.slice(0, dot);
-			const refResource = resources[logicalId];
-			const stateEntry = context.stateResources[logicalId];
-			if (refResource?.Type === "AWS::ECR::Repository" && stateEntry) {
-				if (dot === -1) return stateEntry.physicalId;
-				const attr = key.slice(dot + 1);
-				const cached = stateEntry.attributes?.[attr];
-				if (typeof cached === "string") return cached;
-			}
-		}
-		return full;
-	});
-}
-
-//#endregion
-//#region src/local/ecr-uri.ts
-const FIPS_AND_DUAL_STACK_PARTITIONS = ["aws", "aws-us-gov"];
-const ECR_REGISTRY_HOST_FORMS = [
-	{ labels: "dkr.ecr" },
-	{
-		labels: "dkr.ecr-fips",
-		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
-	},
-	{
-		labels: "dkr-ecr",
-		fixedUrlSuffix: "on.aws",
-		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
-	},
-	{
-		labels: "dkr-ecr-fips",
-		fixedUrlSuffix: "on.aws",
-		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
-	}
-];
-const ECR_HOST_FORM_BY_LABELS = new Map(ECR_REGISTRY_HOST_FORMS.map((f) => [f.labels, f]));
-function escapeRegExp(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-const ECR_URI_HOST_REGEX = new RegExp(`^(\\d{12})\\.(${[...ECR_REGISTRY_HOST_FORMS].sort((a, b) => b.labels.length - a.labels.length).map((f) => escapeRegExp(f.labels)).join("|")})\\.([^./]+)\\.([^/]+)/`, "i");
-const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
-const REGION_SHAPE = /^(?:(?:us|eu|ap|sa|ca|me|af|il|mx)-[a-z0-9]+-[0-9]+|cn-[a-z0-9]+-[0-9]+|us-gov-[a-z0-9]+-[0-9]+|us-iso-[a-z0-9]+-[0-9]+|us-isob-[a-z0-9]+-[0-9]+|eu-isoe-[a-z0-9]+-[0-9]+|us-isof-[a-z0-9]+-[0-9]+|eusc-[a-z]+-[a-z0-9]+-[0-9]+)$/;
-const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
-function foldAsciiUpperCase(value) {
-	return value.replace(/[A-Z]+/g, (run) => run.toLowerCase());
-}
-function isRegistryHostComponent(component) {
-	return component.includes(".") || component.includes(":") || component === "localhost";
-}
-function canonicalizeImageUriHost(imageUri) {
-	const slash = imageUri.indexOf("/");
-	if (slash < 0) return imageUri;
-	const host = imageUri.slice(0, slash);
-	if (!isRegistryHostComponent(host)) return imageUri;
-	return foldAsciiUpperCase(host) + imageUri.slice(slash);
-}
-function parseEcrRegistryHost(imageUri) {
-	const m = ECR_URI_HOST_REGEX.exec(imageUri);
-	if (!m) return void 0;
-	const [, accountId, rawLabels, rawRegion, rawSuffix] = m;
-	if (!CANONICAL_REGION_SEGMENT.test(rawRegion)) return void 0;
-	if (!CANONICAL_URL_SUFFIX.test(rawSuffix)) return void 0;
-	const form = ECR_HOST_FORM_BY_LABELS.get(foldAsciiUpperCase(rawLabels));
-	if (!form) return void 0;
-	const region = foldAsciiUpperCase(rawRegion);
-	if (!REGION_SHAPE.test(region)) return void 0;
-	const suffix = foldAsciiUpperCase(rawSuffix);
-	const partition = derivePartitionAndUrlSuffix(region);
-	if (form.partitions && !form.partitions.includes(partition.partition)) return void 0;
-	if (suffix !== (form.fixedUrlSuffix ?? partition.urlSuffix)) return void 0;
-	return {
-		accountId,
-		region,
-		registryHost: `${accountId}.${form.labels}.${region}.${suffix}`,
-		form
-	};
-}
-
-//#endregion
-//#region src/utils/docker-argv-redaction.ts
-const REDACTED_ARGV_VALUE = "***";
-const ARGV_VALUE_BEARING_FLAGS = /* @__PURE__ */ new Set([
-	"-e",
-	"--env",
-	"--opt",
-	"--label",
-	"--build-arg"
-]);
-const ARGV_PARAM_LIST_FLAGS = /* @__PURE__ */ new Set(["--cache-from", "--cache-to"]);
-const ARGV_PARAM_LIST_LOCATOR_PARAMS = /* @__PURE__ */ new Set([
-	"type",
-	"mode",
-	"compression",
-	"compression-level",
-	"force-compression",
-	"ignore-error",
-	"image-manifest",
-	"oci-mediatypes",
-	"timeout",
-	"ref",
-	"dest",
-	"src",
-	"digest",
-	"tag",
-	"region",
-	"bucket",
-	"name",
-	"prefix",
-	"manifests_prefix",
-	"blobs_prefix",
-	"use_path_style",
-	"upload_parallelism",
-	"touch_refresh",
-	"account_name",
-	"scope"
-]);
-const ARGV_PARAM_LIST_URL_PARAMS = /* @__PURE__ */ new Set([
-	"account_url",
-	"endpoint_url",
-	"url",
-	"url_v2"
-]);
-function redactUrlLocator(value) {
-	if (value === "") return value;
-	const authority = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\//.exec(value);
-	if (authority === null) return REDACTED_ARGV_VALUE;
-	const prefix = authority[0];
-	let rest = value.slice(prefix.length);
-	const lastAt = rest.lastIndexOf("@");
-	if (lastAt >= 0) rest = `${REDACTED_ARGV_VALUE}${rest.slice(lastAt)}`;
-	else {
-		const host = rest.split(/[/?#]/)[0];
-		const ipv6 = /^\[[0-9A-Fa-f:.]+\]/.exec(host);
-		const bare = ipv6 ? host.slice(ipv6[0].length) : host;
-		if (/:(?!\d{1,5}$)/.test(bare)) return REDACTED_ARGV_VALUE;
-	}
-	for (const delimiter of ["?", "#"]) {
-		const at = rest.indexOf(delimiter);
-		if (at >= 0) rest = `${rest.slice(0, at)}${delimiter}${REDACTED_ARGV_VALUE}`;
-	}
-	return `${prefix}${rest}`;
-}
-function maskArgvFlagValue(flag, value) {
-	if (ARGV_VALUE_BEARING_FLAGS.has(flag)) {
-		const eqIdx = value.indexOf("=");
-		return eqIdx >= 0 ? `${value.substring(0, eqIdx)}=${REDACTED_ARGV_VALUE}` : void 0;
-	}
-	if (ARGV_PARAM_LIST_FLAGS.has(flag)) {
-		let masked = false;
-		const rawParts = value.split(",");
-		const parts = rawParts.map((part, index) => {
-			if (part === "") return part;
-			if (masked) return REDACTED_ARGV_VALUE;
-			const eqIdx = part.indexOf("=");
-			if (eqIdx < 0) {
-				if (index === 0) return part;
-				masked = true;
-				return REDACTED_ARGV_VALUE;
-			}
-			const name = part.substring(0, eqIdx);
-			const normalized = name.trim().toLowerCase();
-			if (ARGV_PARAM_LIST_URL_PARAMS.has(normalized)) {
-				if (rawParts.slice(index + 1).some((later) => later.includes("@"))) {
-					masked = true;
-					return `${name}=${REDACTED_ARGV_VALUE}`;
-				}
-				const rawUrl = part.substring(eqIdx + 1);
-				const safeUrl = redactUrlLocator(rawUrl);
-				if (safeUrl === rawUrl) return part;
-				masked = true;
-				return `${name}=${safeUrl}`;
-			}
-			if (ARGV_PARAM_LIST_LOCATOR_PARAMS.has(normalized)) return part;
-			masked = true;
-			return `${name}=${REDACTED_ARGV_VALUE}`;
-		});
-		return masked ? parts.join(",") : void 0;
-	}
-}
-function maskAttachedShortFlag(arg) {
-	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
-	let chosen;
-	for (const flag of ARGV_VALUE_BEARING_FLAGS) {
-		if (flag.length !== 2 || !flag.startsWith("-") || flag[1] === "-") continue;
-		const at = arg.indexOf(flag[1], 1);
-		if (at < 0 || at === arg.length - 1) continue;
-		if (chosen === void 0 || at < chosen.at) chosen = {
-			at,
-			flag
-		};
-	}
-	if (chosen === void 0) return void 0;
-	const masked = maskArgvFlagValue(chosen.flag, arg.slice(chosen.at + 1));
-	return masked === void 0 ? void 0 : `${arg.slice(0, chosen.at + 1)}${masked}`;
-}
-function trailingShortFlagOfCluster(arg) {
-	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
-	const last = arg[arg.length - 1];
-	for (const flag of ARGV_VALUE_BEARING_FLAGS) if (flag.length === 2 && flag.startsWith("-") && flag[1] !== "-" && flag[1] === last) return flag;
-}
-function redactDockerArgvValues(args) {
-	const out = [];
-	for (let i = 0; i < args.length; i++) {
-		const cur = args[i];
-		const joinedEq = cur.indexOf("=");
-		if (joinedEq > 0) {
-			const maskedJoined = maskArgvFlagValue(cur.substring(0, joinedEq), cur.substring(joinedEq + 1));
-			if (maskedJoined !== void 0) {
-				out.push(`${cur.substring(0, joinedEq)}=${maskedJoined}`);
-				continue;
-			}
-		}
-		const maskedAttached = maskAttachedShortFlag(cur);
-		if (maskedAttached !== void 0) {
-			out.push(maskedAttached);
-			continue;
-		}
-		const next = args[i + 1];
-		if (typeof next === "string") {
-			const maskedNext = maskArgvFlagValue(ARGV_VALUE_BEARING_FLAGS.has(cur) ? cur : trailingShortFlagOfCluster(cur) ?? cur, next);
-			if (maskedNext !== void 0) {
-				out.push(cur, maskedNext);
-				i++;
-				continue;
-			}
-		}
-		out.push(cur);
-	}
-	return out;
-}
-function describeExitWithoutArgv(err) {
-	const e = err;
-	if (typeof e?.signal === "string" && e.signal !== "") return `killed by ${e.signal}`;
-	if (typeof e?.code === "number") return `exited with code ${e.code}`;
-	if (typeof e?.code === "string" && e.code !== "") return `failed (${e.code})`;
-	return "failed with no output";
-}
-
-//#endregion
-//#region src/utils/shutdown-signal.ts
-function signalExitCode(signal) {
-	return signal === "SIGINT" ? 130 : 143;
-}
-function createShutdownSignalHandler(options) {
-	const exit = options.exit ?? ((code) => process.exit(code));
-	const writeStderr = options.writeStderr ?? ((text) => void process.stderr.write(text));
-	let count = 0;
-	const handler = (signal, exitCode) => {
-		const code = exitCode ?? signalExitCode(signal === "SIGINT" ? "SIGINT" : "SIGTERM");
-		count += 1;
-		if (count === 1) {
-			options.info(options.stoppingMessage(signal));
-			options.cleanup().then(() => exit(code));
-			return;
-		}
-		if (count === 2) {
-			options.warn(`Received ${signal} again; still shutting down — waiting for the cleanup to remove the containers and networks. Send it once more to force-exit (that skips the cleanup).`);
-			return;
-		}
-		writeStderr(`Force-exit on repeated ${signal}; container cleanup skipped. ${options.forceExitHint}\n`);
-		exit(code);
-	};
-	return handler;
-}
-
-//#endregion
-//#region src/assets/asset-source-path.ts
-function resolveAssetSourcePath(opts) {
-	const { manifestDir, value, assetOutdir, field, subject, action, wrapError } = opts;
-	const shownValue = displayUntrustedValue(value);
-	if (isAbsolute(value) && opts.absolute !== "fold") {
-		const absolute = resolve(value);
-		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
-		if (escape !== void 0 && opts.absolute === "honour") throw wrapError(`${subject} has an absolute ${field}=${shownValue} which ` + renderAssemblyPathEscape(escape, assetOutdir, action));
-		if (escape !== void 0) {
-			const refusal = originScopeRefusal(absolute, assetOutdir);
-			if (refusal !== void 0) throw wrapError(`${subject} has an absolute ${field}=${shownValue} which ${refusal}. An absolute ${field} is accepted only as a cdk synth --no-staging source folder: a directory inside your project (the git work tree holding the output directory, or the current directory when it contains the output directory or is a git work-tree root), not under a credential or version-control directory. Refusing to ${action}.`);
-			warnAbsoluteOutsideAssembly(opts, absolute, escape);
-			return absolute;
-		}
-		if (namesTheSameDirectory(assetOutdir, absolute)) warnWholeAssemblyAsSource(opts, absolute);
-		return absolute;
-	}
-	const resolved = resolveAssemblyPath(manifestDir, value, { containWithin: assetOutdir });
-	if (resolved.contained) return resolved.path;
-	if (namesTheSameDirectory(assetOutdir, resolved.path)) {
-		warnWholeAssemblyAsSource(opts, resolved.path);
-		return resolved.path;
-	}
-	throw wrapError(`${subject} has ${field}=${shownValue} which ` + renderAssemblyPathEscape(resolved, assetOutdir, action));
-}
-function broadRootReason(root, assetOutdir) {
-	if (root === resolve("/")) return "names the filesystem root";
-	if (containsOrIs(root, realPath(homedir()))) return "names your home directory or a directory containing it";
-	if (containsOrIs(root, realPath(assetOutdir))) return "names a directory containing the app's output directory";
-}
-function originScopeRefusal(absolute, assetOutdir) {
-	const root = realPath(absolute);
-	const broad = broadRootReason(root, assetOutdir);
-	if (broad !== void 0) return broad;
-	const projects = projectRoots(assetOutdir);
-	let hidden;
-	let isProjectRoot = false;
-	for (const project of projects) {
-		const rel = relative(project, root);
-		if (rel === "") isProjectRoot = true;
-		if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) continue;
-		const dotted = rel.split(sep).find((c) => CREDENTIAL_DIR_NAMES.has(c.toLowerCase()));
-		if (dotted === void 0) return void 0;
-		hidden = dotted;
-	}
-	if (isProjectRoot) return "is your project root itself; name a folder inside it";
-	if (hidden !== void 0) return `passes through the credential / version-control directory ${displayUntrustedValue(hidden)} inside your project`;
-	const shown = projects.map((p) => displayUntrustedValue(p)).join(" or ");
-	return projects.length === 0 ? "is outside any usable project root (the current directory and the git work tree are too broad to scope it)" : `resolves to ${displayUntrustedValue(root)}, outside your project (${shown})`;
-}
-const CREDENTIAL_DIR_NAMES = /* @__PURE__ */ new Set([
-	".git",
-	".hg",
-	".svn",
-	".ssh",
-	".aws",
-	".gnupg",
-	".docker",
-	".kube",
-	".config",
-	".azure",
-	".gcloud",
-	".terraform",
-	".npm",
-	".pnpm-store",
-	".yarn",
-	".cache",
-	".local"
-]);
-function projectRoots(assetOutdir) {
-	const roots = [];
-	const usable = (p) => p !== resolve("/") && !containsOrIs(p, realPath(homedir()));
-	const cwd = realPath(process.cwd());
-	const outdir = realPath(assetOutdir);
-	if (usable(cwd) && (containsOrIs(cwd, outdir) || existsSync(join(cwd, ".git")))) roots.push(cwd);
-	let dir = outdir;
-	for (;;) {
-		if (existsSync(join(dir, ".git"))) {
-			if (usable(dir) && !roots.includes(dir)) roots.push(dir);
-			break;
-		}
-		const parent = dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return roots;
-}
-function containsOrIs(outer, inner) {
-	const rel = relative(outer, inner);
-	return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
-}
-function realPath(p, hops = 0) {
-	const abs = resolve(p);
-	try {
-		return realpathSync.native(abs);
-	} catch {
-		const parent = dirname(abs);
-		if (parent === abs) return abs;
-		const realParent = realPath(parent, hops);
-		let link;
-		try {
-			link = readlinkSync(abs);
-		} catch {
-			link = void 0;
-		}
-		if (link !== void 0 && hops < 40) return realPath(resolve(realParent, link), hops + 1);
-		return join(realParent, basename(abs));
-	}
-}
-const warnedAbsoluteOutside = /* @__PURE__ */ new Set();
-function warnAbsoluteOutsideAssembly(opts, absolute, escape) {
-	const logger = getLogger().child("assets");
-	const line = `${opts.subject} has an absolute ${opts.field} pointing outside the assembly: ` + displayUntrustedValue(absolute) + (escape.escape === "symlink" ? ` (through a symbolic link to ${displayUntrustedValue(escape.realPath)})` : "") + `. ${getEmbedConfig().productName} will ${opts.sink}. ` + (escape.escape === "lexical" ? "This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted." : "No CDK synth writes this, so treat this assembly as untrusted unless you made that link yourself.");
-	if (warnedAbsoluteOutside.has(line)) {
-		logger.debug(line);
-		return;
-	}
-	warnedAbsoluteOutside.add(line);
-	logger.warn(line);
-}
-const warnedWholeAssembly = /* @__PURE__ */ new Set();
-function warnWholeAssemblyAsSource(opts, outdir) {
-	const logger = getLogger().child("assets");
-	const line = `${opts.subject} has ${opts.field} naming the assembly's output directory ITSELF: ${displayUntrustedValue(outdir)}. ${getEmbedConfig().productName} will ${opts.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`;
-	if (warnedWholeAssembly.has(line)) {
-		logger.debug(line);
-		return;
-	}
-	warnedWholeAssembly.add(line);
-	logger.warn(line);
-}
-
-//#endregion
-//#region src/assets/docker-cache-option.ts
-function cacheOptionToFlag(option) {
-	let flag = `type=${option.type}`;
-	if (option.params) for (const [k, v] of Object.entries(option.params)) flag += `,${k}=${v}`;
-	return flag;
-}
-
-//#endregion
-//#region src/assets/buildkit-passthrough-warnings.ts
-function candidateHostPaths(value, opts) {
-	const out = [];
-	for (const part of value.split(",")) {
-		const eq = part.indexOf("=");
-		if (eq < 0) {
-			const bare = part.trim();
-			if (bare.length > 0) out.push({
-				path: bare,
-				write: opts.bareIsWrite
-			});
-			continue;
-		}
-		const key = part.slice(0, eq).trim().toLowerCase();
-		const v = part.slice(eq + 1).trim();
-		if (v.length === 0) continue;
-		if (key !== "src" && key !== "source" && key !== "dest") continue;
-		out.push({
-			path: v,
-			write: key === "dest"
-		});
-	}
-	return out;
-}
-function hostPathsOf(source) {
-	const refs = [];
-	if (source.dockerFile) refs.push({
-		field: "dockerFile",
-		where: "dockerFile",
-		path: source.dockerFile,
-		write: false
-	});
-	for (const [k, v] of Object.entries(source.dockerBuildContexts ?? {})) {
-		const rendered = `${k}=${v}`;
-		const contextPath = rendered.slice(rendered.indexOf("=") + 1).trim().replace(/^oci-layout:\/\//, "");
-		if (contextPath.length === 0) continue;
-		refs.push({
-			field: "dockerBuildContexts",
-			where: k,
-			path: contextPath,
-			write: false
-		});
-	}
-	const ssh = source.dockerBuildSsh ?? "";
-	const sshEq = ssh.indexOf("=");
-	(sshEq < 0 ? [] : ssh.slice(sshEq + 1).split(",")).forEach((entry, i) => {
-		const p = entry.trim();
-		if (p.length > 0) refs.push({
-			field: "dockerBuildSsh",
-			where: String(i),
-			path: p,
-			write: false
-		});
-	});
-	for (const [k, v] of Object.entries(source.dockerBuildSecrets ?? {})) for (const { path: p, write } of candidateHostPaths(`id=${k},${v}`, { bareIsWrite: false })) refs.push({
-		field: "dockerBuildSecrets",
-		where: k,
-		path: p,
-		write
-	});
-	(source.cacheFrom ?? []).forEach((c, i) => {
-		for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(c), { bareIsWrite: false })) refs.push({
-			field: "cacheFrom",
-			where: String(i),
-			path: p,
-			write
-		});
-	});
-	if (source.cacheTo) for (const { path: p, write } of candidateHostPaths(cacheOptionToFlag(source.cacheTo), { bareIsWrite: false })) refs.push({
-		field: "cacheTo",
-		where: "cacheTo",
-		path: p,
-		write
-	});
-	(source.dockerOutputs ?? []).forEach((o, i) => {
-		for (const { path: p, write } of candidateHostPaths(o, { bareIsWrite: true })) refs.push({
-			field: "dockerOutputs",
-			where: String(i),
-			path: p,
-			write
-		});
-	});
-	return refs;
-}
-const warnedPassthroughs = /* @__PURE__ */ new Set();
-function warnEscapingBuildKitPaths(source, base, bound) {
-	const logger = getLogger().child("assets");
-	for (const ref of hostPathsOf(source)) {
-		const escape = assemblyPathEscape(base, bound, ref.path);
-		if (escape === void 0) continue;
-		const verb = ref.write ? "WRITE to" : "read";
-		const line = `Docker asset ${ref.field}` + (ref.where === ref.field ? "" : `[${displayUntrustedValue(ref.where)}]`) + ` names a host path outside the assembly, which ` + renderAssemblyPathEscape(escape, bound, "load", `${getEmbedConfig().productName} will ${verb} it during the image build, matching the CDK CLI — a pre-synthesized assembly is trusted input. If you did not produce this assembly, that is a host path it chose and the CloudFormation template does not show.`);
-		if (warnedPassthroughs.has(line)) {
-			logger.debug(line);
-			continue;
-		}
-		warnedPassthroughs.add(line);
-		logger.warn(line);
-	}
-}
-
-//#endregion
-//#region src/assets/docker-build.ts
-const warnedExecutables = /* @__PURE__ */ new Set();
-function warnManifestExecutable(cmd, executable, cwd) {
-	const logger = getLogger().child("docker-build");
-	const key = JSON.stringify([cwd, executable]);
-	if (warnedExecutables.has(key)) {
-		logger.debug(`source.executable already announced this process: ${displayUntrustedValue(cmd)} (cwd=${displayUntrustedValue(cwd)})`);
-		return;
-	}
-	warnedExecutables.add(key);
-	const argCount = executable.length - 1;
-	logger.warn(`Docker asset source.executable runs a command this asset manifest chose, on this machine: ${displayUntrustedValue(cmd)}` + (argCount > 0 ? ` (with ${argCount} argument(s); --verbose shows them)` : "") + `. ${getEmbedConfig().productName} runs it, matching the CDK CLI — a pre-synthesized assembly is trusted input. Note that this means running a local command against a pre-synthesized assembly DOES execute code from it, which the CloudFormation template does not show.`);
-}
-async function buildDockerImage(asset, cdkOutDir, options) {
-	const source = asset.source;
-	const logger = getLogger().child("docker-build");
-	const assetOutdir = options.assetOutdir ?? cdkOutDir;
-	const contextDirectory = (directory, sink) => resolveAssetSourcePath({
-		manifestDir: cdkOutDir,
-		value: directory,
-		assetOutdir,
-		absolute: "fold",
-		field: "source.directory",
-		subject: "Docker image asset",
-		action: "build it",
-		sink,
-		wrapError: (message) => new LocalInvokeBuildError(message)
-	});
-	if (source.executable && source.executable.length > 0) {
-		const [cmd, ...args] = source.executable;
-		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
-		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
-		logger.debug(`Building Docker image via executable: ${displayUntrustedValue(redactDockerArgvValues(source.executable).join(" "))} (cwd=${displayUntrustedValue(cwd)})`);
-		warnManifestExecutable(cmd, source.executable, cwd);
-		let result;
-		try {
-			result = await spawnStreaming(cmd, args, {
-				cwd,
-				env: dockerRegistryEnv(options.workload)
-			});
-		} catch (err) {
-			const e = err;
-			throw options.wrapError(displayToolOutput(e.stderr || e.message || String(err)));
-		}
-		const tag = result.stdout.trim();
-		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${displayUntrustedValue(cmd)}`);
-		return tag;
-	}
-	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (fields present: ${displayUntrustedValue(Object.keys(source).join(", ") || "none")})`);
-	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
-	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
-	const contextDir = contextDirectory(source.directory, `send that directory to docker build as the context of an image ${getEmbedConfig().productName} then runs locally`);
-	buildArgs.push(".");
-	warnEscapingBuildKitPaths(source, contextDir, assetOutdir);
-	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).map((a) => displayUntrustedValue(a)).join(" ")} (cwd=${displayUntrustedValue(contextDir)})`);
-	try {
-		await runDockerStreaming(buildArgs, {
-			cwd: contextDir,
-			env: {
-				...dockerRegistryEnv(options.workload),
-				BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
-			},
-			...options.progressLabel !== void 0 && { progressLabel: options.progressLabel }
-		});
-	} catch (err) {
-		const e = err;
-		throw options.wrapError(displayToolOutput(e.stderr || e.message || String(err)));
-	}
-	return options.tag;
-}
-function buildDockerBuildCommand(source, tag, platformOverride) {
-	const args = [
-		"build",
-		"--tag",
-		tag
-	];
-	if (source.dockerBuildArgs) for (const [k, v] of Object.entries(source.dockerBuildArgs)) args.push("--build-arg", `${k}=${v}`);
-	if (source.dockerBuildContexts) for (const [k, v] of Object.entries(source.dockerBuildContexts)) args.push("--build-context", `${k}=${v}`);
-	if (source.dockerBuildSecrets) for (const [k, v] of Object.entries(source.dockerBuildSecrets)) args.push("--secret", `id=${k},${v}`);
-	if (source.dockerBuildSsh) args.push("--ssh", source.dockerBuildSsh);
-	if (source.dockerBuildTarget) args.push("--target", source.dockerBuildTarget);
-	if (source.dockerFile) args.push("--file", source.dockerFile);
-	if (source.networkMode) args.push("--network", source.networkMode);
-	const platform = platformOverride ?? source.platform;
-	if (platform) args.push("--platform", platform);
-	if (source.dockerOutputs) for (const output of source.dockerOutputs) args.push(`--output=${output}`);
-	if (source.cacheFrom) for (const c of source.cacheFrom) args.push("--cache-from", cacheOptionToFlag(c));
-	if (source.cacheTo) args.push("--cache-to", cacheOptionToFlag(source.cacheTo));
-	if (source.cacheDisabled) args.push("--no-cache");
-	return args;
-}
-
-//#endregion
-//#region src/local/ecr-puller.ts
-function parseEcrUri(imageUri) {
-	const host = parseEcrRegistryHost(imageUri);
-	if (!host) return void 0;
-	const canonicalUri = canonicalizeImageUriHost(imageUri);
-	const m = /^([^:]+):(.+)$/.exec(canonicalUri.slice(canonicalUri.indexOf("/") + 1));
-	if (!m) return void 0;
-	return {
-		accountId: host.accountId,
-		region: host.region,
-		repository: m[1],
-		tag: m[2],
-		canonicalUri,
-		registryHost: host.registryHost
-	};
-}
-const ECR_SERVICE_ID = "ECR";
-const ASSUMED_ROLE_CACHE = /* @__PURE__ */ new Map();
-const CALLER_IDENTITY_CACHE = /* @__PURE__ */ new Map();
-const STS_CREDENTIAL_SAFETY_MARGIN_MS = 300 * 1e3;
-function isCredentialFresh(creds) {
-	if (!creds.expiration) return false;
-	return creds.expiration.getTime() - Date.now() > STS_CREDENTIAL_SAFETY_MARGIN_MS;
-}
-async function pullEcrImage(imageUri, options) {
-	const logger = getLogger().child("ecr-puller");
-	const parsed = parseEcrUri(imageUri);
-	if (!parsed) throw new LocalInvokeBuildError(`Image URI ${displayUntrustedValue(imageUri)} is not an ECR URI. ${getEmbedConfig().cliName} invoke v1 only authenticates against ECR for the deployed-image fallback path.`);
-	const canonicalUri = parsed.canonicalUri;
-	const callerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
-	if (options.skipPull) {
-		logger.info(`Skipping ECR pull (--no-pull). Verifying ${canonicalUri} is in local cache...`);
-		await verifyImageInLocalCache(canonicalUri);
-		return canonicalUri;
-	}
-	if (deployArtifactsReadEmulator(ECR_SERVICE_ID, options.workload)) throw new LocalInvokeBuildError(`--aws-emulator: image ${displayUntrustedValue(canonicalUri)} is in a real ECR registry, and ECR is not excepted to real AWS for this workload, so it is not pulled (AWS Emulator serves no registry docker can pull from). To pull it from real ECR with your real identity, except ECR for the workload in the --env-vars file ("AWS_ENDPOINT_URL_ECR": "real-aws", under "Parameters" or the workload's own section); or pull the image yourself and pass --no-pull.`);
-	const callerIdentityKey = `${options.profile ?? "_noprofile"}|${callerRegion ?? "_unset"}`;
-	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
-	if (callerAccount === void 0) {
-		const sts = new STSClient(buildStsClientConfig({
-			region: callerRegion,
-			profile: options.profile
-		}));
-		try {
-			const identity = await sts.send(new GetCallerIdentityCommand({}));
-			if (!identity.Account) throw new LocalInvokeBuildError("STS GetCallerIdentity returned no Account. Verify your AWS credentials.");
-			callerAccount = identity.Account;
-			CALLER_IDENTITY_CACHE.set(callerIdentityKey, callerAccount);
-		} catch (err) {
-			if (err instanceof LocalInvokeBuildError) throw err;
-			throw new LocalInvokeBuildError(`STS GetCallerIdentity failed while preparing the ECR pull: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity (ECR pull)")}. Verify your AWS credentials.`);
-		} finally {
-			sts.destroy();
-		}
-	}
-	const crossAccount = callerAccount !== parsed.accountId;
-	const crossRegion = callerRegion !== void 0 && callerRegion !== parsed.region;
-	let assumed;
-	if (awsEmulatorRealServices(options.workload) !== void 0) logger.info(`ECR is excepted to real AWS ("real-aws" on AWS_ENDPOINT_URL_ECR): pulling ${displayUntrustedValue(canonicalUri)} from real ECR with your real credentials.`);
-	if (options.ecrRoleArn) {
-		const cacheKey = `${options.profile ?? "_noprofile"}|${options.ecrRoleArn}|${callerRegion ?? "_unset"}`;
-		const cached = ASSUMED_ROLE_CACHE.get(cacheKey);
-		if (cached && isCredentialFresh(cached)) {
-			assumed = cached;
-			logger.debug(`Reusing cached AssumeRole credentials for ${options.ecrRoleArn}`);
-		} else {
-			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, options.profile, logger);
-			ASSUMED_ROLE_CACHE.set(cacheKey, assumed);
-			logger.info(`Assumed role ${options.ecrRoleArn} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
-		}
-	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
-	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
-	const ecr = new ECRClient({
-		...deployArtifactClientConfig({
-			service: "ECR",
-			profile: options.profile,
-			workload: options.workload
-		}),
-		region: parsed.region,
-		...assumed ? { credentials: assumed } : options.profile ? { profile: options.profile } : {}
-	});
-	const dockerEnv = dockerRegistryEnv(options.workload);
-	try {
-		await ecrLogin(ecr, dockerEnv, {
-			accountId: parsed.accountId,
-			region: parsed.region,
-			registryHost: parsed.registryHost
-		});
-	} finally {
-		ecr.destroy();
-	}
-	logger.info(`Pulling ${canonicalUri}...`);
-	try {
-		await runDockerForeground(["pull", canonicalUri], { env: dockerEnv });
-	} catch (err) {
-		throw new LocalInvokeBuildError(`docker pull ${canonicalUri} failed: ${err.message}`);
-	}
-	return canonicalUri;
-}
-async function assumeRoleForEcr(roleArn, callerRegion, profile, logger) {
-	if (!isIamRoleArn(roleArn)) throw new LocalInvokeBuildError(refusedRoleArnMessage(roleArn));
-	logger.debug(`Assuming role ${roleArn} for ECR pull...`);
-	const sts = new STSClient(workloadStsClientConfig({
-		region: callerRegion,
-		profile
-	}));
-	try {
-		const creds = (await sts.send(new AssumeRoleCommand({
-			RoleArn: roleArn,
-			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-ecr-${Date.now()}`,
-			DurationSeconds: 3600
-		}))).Credentials;
-		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError(`AssumeRole(${roleArn}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
-		return {
-			accessKeyId: creds.AccessKeyId,
-			secretAccessKey: creds.SecretAccessKey,
-			sessionToken: creds.SessionToken,
-			...creds.Expiration && { expiration: creds.Expiration }
-		};
-	} catch (err) {
-		if (err instanceof LocalInvokeBuildError) throw err;
-		const reason = describeAwsFailureForWarn(err, "STS AssumeRole (ECR pull)");
-		throw new LocalInvokeBuildError(`Failed to assume role ${flattenToOneLine(roleArn)} for ECR pull: ${reason}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
-	} finally {
-		sts.destroy();
-	}
-}
-async function ecrLogin(client, dockerEnv, target) {
-	const { accountId, region, registryHost } = target;
-	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region}, host=${registryHost})`);
-	const authData = (await client.send(new GetAuthorizationTokenCommand({})).catch((err) => {
-		throw new LocalInvokeBuildError(`ECR GetAuthorizationToken failed (account=${accountId}, region=${region}): ${describeAwsFailureForWarn(err, "ECR GetAuthorizationToken")}. Verify the credentials can call ecr:GetAuthorizationToken.`);
-	})).authorizationData?.[0];
-	if (!authData?.authorizationToken) throw new LocalInvokeBuildError("Failed to get ECR authorization token");
-	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
-	if (!username || password === void 0) throw new LocalInvokeBuildError("ECR authorization token has unexpected shape (missing username/password)");
-	const endpoint = `https://${registryHost}`;
-	try {
-		await runDockerStreaming([
-			"login",
-			"--username",
-			username,
-			"--password-stdin",
-			endpoint
-		], {
-			input: password,
-			env: dockerEnv
-		});
-	} catch (err) {
-		const e = err;
-		throw new LocalInvokeBuildError(`ECR login failed: ${formatDockerLoginError(e.stderr || e.message || String(err), endpoint)}`);
-	}
-}
-async function verifyImageInLocalCache(imageUri) {
-	try {
-		await runDockerStreaming([
-			"image",
-			"inspect",
-			imageUri
-		]);
-	} catch {
-		throw new LocalInvokeBuildError(`Image ${displayUntrustedValue(imageUri)} is not in the local docker cache and --no-pull was set. Either remove --no-pull (${getEmbedConfig().productName} will pull from ECR) or pre-pull the image manually with \`docker pull\`.`);
-	}
-}
-async function isImageInLocalCache(imageRef) {
-	try {
-		await runDockerStreaming([
-			"image",
-			"inspect",
-			imageRef
-		]);
-		return true;
-	} catch {
-		return false;
-	}
-}
-
-//#endregion
-//#region src/local/docker-image-builder.ts
-async function buildContainerImage(asset, cdkOutDir, options) {
-	const tag = computeLocalTag(asset.source);
-	const platform = architectureToPlatform(options.architecture);
-	const logger = getLogger().child("local-invoke-build");
-	if (options.noBuild === true) {
-		logger.info(`Skipping docker build (--no-build). Verifying ${tag} is in local registry...`);
-		if (!await isImageInLocalCache(tag)) throw new LocalInvokeBuildError(`image ${displayIdent(tag)} not in local registry and --no-build is set; remove --no-build or run \`docker build\` manually first.`);
-		logger.debug(`Local tag ${tag} is cached; skipping build.`);
-		return tag;
-	}
-	logger.info(`Building container image (platform=${platform})...`);
-	logger.debug(`Local tag: ${tag}`);
-	const actualTag = await buildDockerImage(asset, cdkOutDir, {
-		tag,
-		platform,
-		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for container Lambda asset (${displayUntrustedValue(asset.source.directory ?? asset.source.executable?.[0] ?? "")}): ${stderr}`),
-		progressLabel: `Building container image (platform=${platform})`,
-		...options.assetOutdir !== void 0 && { assetOutdir: options.assetOutdir },
-		...options.workload !== void 0 && { workload: options.workload }
-	});
-	if (actualTag !== tag) {
-		logger.debug(`Re-tagging executable-built image ${displayIdent(actualTag)} → ${displayIdent(tag)}`);
-		try {
-			await runDockerStreaming([
-				"tag",
-				actualTag,
-				tag
-			]);
-		} catch (err) {
-			const e = err;
-			throw new LocalInvokeBuildError(`docker tag failed re-tagging ${displayIdent(actualTag)} → ${displayIdent(tag)}: ${displayToolOutput(e.stderr?.trim() || e.message || String(err))}`);
-		}
-	}
-	return tag;
-}
-function architectureToPlatform(architecture) {
-	return architecture === "arm64" ? "linux/arm64" : "linux/amd64";
-}
-function hostPlatform() {
-	return process.arch === "arm64" ? "linux/arm64" : "linux/amd64";
-}
-const warnedEmulatedPlatforms = /* @__PURE__ */ new Set();
-function warnIfEmulatedPlatform(platform, opts = {}) {
-	if (!platform) return;
-	const host = hostPlatform();
-	if (platform === host) return;
-	if (warnedEmulatedPlatforms.has(platform)) return;
-	warnedEmulatedPlatforms.add(platform);
-	const logger = opts.logger ?? getLogger();
-	const what = opts.label ? `${displayIdent(opts.label)} ` : "";
-	logger.warn(`Running ${what}under ${platform} emulation on a ${host} host (the declared architecture differs from the host). Emulation is slower and some compiled binaries can fail under it. If the container does not run correctly, enable Rosetta for x86/amd64 emulation in your Docker engine settings, or build the function for ${host}.`);
-}
-function computeLocalTag(source) {
-	const hash = createHash("sha256");
-	pushField(hash, "directory", source.directory ?? "");
-	pushField(hash, "executable", (source.executable ?? []).join(" "));
-	pushField(hash, "dockerFile", source.dockerFile ?? "");
-	pushField(hash, "dockerBuildTarget", source.dockerBuildTarget ?? "");
-	pushField(hash, "networkMode", source.networkMode ?? "");
-	pushField(hash, "platform", source.platform ?? "");
-	pushField(hash, "dockerBuildSsh", source.dockerBuildSsh ?? "");
-	pushField(hash, "cacheDisabled", source.cacheDisabled ? "1" : "0");
-	pushMap(hash, "dockerBuildArgs", source.dockerBuildArgs);
-	pushMap(hash, "dockerBuildContexts", source.dockerBuildContexts);
-	pushMap(hash, "dockerBuildSecrets", source.dockerBuildSecrets);
-	pushField(hash, "dockerOutputs", (source.dockerOutputs ?? []).join(""));
-	pushField(hash, "cacheFrom", (source.cacheFrom ?? []).map((o) => JSON.stringify(o)).join(""));
-	pushField(hash, "cacheTo", source.cacheTo ? JSON.stringify(source.cacheTo) : "");
-	return `${getEmbedConfig().resourceNamePrefix}-invoke-${hash.digest("hex").slice(0, 16)}`;
-}
-function pushField(hash, name, value) {
-	hash.update(name);
-	hash.update("=");
-	hash.update(value);
-	hash.update("\0");
-}
-function pushMap(hash, name, value) {
-	hash.update(name);
-	hash.update("={");
-	if (value) for (const [k, v] of Object.entries(value)) {
-		hash.update(k);
-		hash.update("=");
-		hash.update(v);
-		hash.update(";");
-	}
-	hash.update("}\0");
-}
-
-//#endregion
-//#region src/local/loopback-forwarder.ts
-const execFileAsync$1 = promisify(execFile);
-const LOOPBACK_FORWARDER_IMAGE = "public.ecr.aws/docker/library/node:22-alpine@sha256:1314fb30ec37592d5845e5a160d522c0e680972aa534549940b8d73bde88481a";
-const FORWARDER_CA_PATH = "/cdkl-forwarder/ca.pem";
-const FORWARDER_RESIGN_CONFIG_PATH = "/cdkl-forwarder/resign.json";
-const STATUS_PREFIX = "CDKL-FWD";
-const LOOPBACK_FORWARDER_SCRIPT = `
-const net=require('net'),dns=require('dns'),fs=require('fs'),https=require('https');
-const ports=process.argv[1]==='-'?[]:process.argv[1].split(',').map(Number),mode=process.argv[2],ca=process.argv[3]==='-'?undefined:process.argv[3],resign=process.argv[4];
-const out=(s)=>process.stdout.write('${STATUS_PREFIX} '+s+'\\n');
-function gateway(){try{for(const l of fs.readFileSync('/proc/net/route','utf8').split('\\n').slice(1)){const f=l.trim().split(/\\s+/);if(f[1]==='00000000'&&f[2]&&f[2]!=='00000000'){return [3,2,1,0].map(i=>parseInt(f[2].substr(i*2,2),16)).join('.');}}}catch(e){}return undefined;}
-function listen(port,host,up){return new Promise((res)=>{const s=net.createServer((c)=>{const u=net.connect(port,up);c.pipe(u);u.pipe(c);u.on('error',()=>c.destroy());c.on('error',()=>u.destroy());});s.once('error',(e)=>res(e.code||'ERROR'));s.listen(port,host,()=>res(undefined));});}
-function tcpProbe(port,up){return new Promise((res)=>{const c=net.connect(port,up);c.setTimeout(5000,()=>{c.destroy();res('ETIMEDOUT');});c.once('connect',()=>{c.destroy();res(undefined);});c.once('error',(e)=>res(e.code||'ERROR'));});}
-function healthProbe(port){return new Promise((res)=>{const r=https.get({host:'127.0.0.1',port,path:'/__admin/health',ca:fs.readFileSync(ca),timeout:5000},(m)=>{m.resume();res(m.statusCode===200?undefined:'HTTP_'+m.statusCode);});r.on('timeout',()=>{r.destroy();res('ETIMEDOUT');});r.on('error',(e)=>res(e.code||'ERROR'));});}
-dns.lookup('host.docker.internal',{family:4},async(err,addr)=>{
-const up=err?gateway():addr;
-if(!up&&ports.length>0){out('FAIL '+ports[0]+' NO_UPSTREAM none');return;}
-for(const p of ports){const e=await listen(p,'127.0.0.1',up);if(e){out('FAIL '+p+' LISTEN_'+e+' '+up);return;}await listen(p,'::1',up);}
-for(const p of ports){const e=await tcpProbe(p,up);if(e){out('FAIL '+p+' '+e+' '+up);return;}}
-let probePort=ports[0];
-if(resign){const r=await startResigner(resign);if(r.error){out('FAIL '+(r.port||0)+' RESIGN_'+r.error+' '+(up||'none'));return;}probePort=r.port;}
-if(mode==='health'&&ca&&probePort){const e=await healthProbe(probePort);if(e){out('FAIL '+probePort+' '+(resign?'RESIGN_UPSTREAM_'+e:e)+' '+(up||'none'));return;}}
-out('READY '+(up||'none'));
-});
-`;
-function parseForwarderStatus(logs) {
-	for (const raw of logs.split("\n")) {
-		const line = raw.trim();
-		if (!line.startsWith(`${STATUS_PREFIX} `)) continue;
-		const parts = line.slice(9).split(" ");
-		if (parts[0] === "READY") return {
-			ok: true,
-			...parts[1] && parts[1] !== "none" ? { upstream: parts[1] } : {}
-		};
-		if (parts[0] === "FAIL") {
-			const port = Number(parts[1]);
-			return {
-				ok: false,
-				...Number.isInteger(port) ? { failedPort: port } : {},
-				...parts[2] ? { reason: parts[2] } : {},
-				...parts[3] && parts[3] !== "none" ? { upstream: parts[3] } : {}
-			};
-		}
-	}
-}
-function buildLoopbackForwarderDockerArgs(opts) {
-	const ns = `container:${opts.workloadContainer}`;
-	const args = [
-		"run",
-		"-d",
-		"--rm",
-		"--name",
-		opts.name,
-		"--network",
-		ns,
-		"--pid",
-		ns
-	];
-	if (opts.skipPull) args.push("--pull", "never");
-	args.push(...forwarderMounts(opts), ...forwarderCommand(opts));
-	return args;
-}
-function buildNamespaceOwnerForwarderDockerArgs(opts) {
-	const ns = opts.namespace;
-	const args = [
-		"run",
-		"-d",
-		"--rm",
-		"--name",
-		opts.name,
-		"--network",
-		ns.network
-	];
-	for (const a of ns.networkAliases ?? []) args.push("--network-alias", a);
-	for (const p of ns.publish ?? []) args.push("-p", p);
-	for (const h of ns.addHosts ?? []) args.push("--add-host", h);
-	for (const l of ns.links ?? []) args.push("--link", l);
-	if (opts.skipPull) args.push("--pull", "never");
-	args.push(...forwarderMounts(opts), ...forwarderCommand(opts));
-	return args;
-}
-function forwarderMounts(opts) {
-	const args = [];
-	if (opts.caHostPath) args.push("-v", `${opts.caHostPath}:${FORWARDER_CA_PATH}:ro`);
-	if (opts.resignConfigHostPath) args.push("-v", `${opts.resignConfigHostPath}:${FORWARDER_RESIGN_CONFIG_PATH}:ro`);
-	return args;
-}
-function forwarderCommand(opts) {
-	const resign = opts.resignConfigHostPath !== void 0;
-	return [
-		"--entrypoint",
-		"node",
-		LOOPBACK_FORWARDER_IMAGE,
-		"-e",
-		resign ? RESIGN_SIDECAR_SCRIPT + LOOPBACK_FORWARDER_SCRIPT : LOOPBACK_FORWARDER_SCRIPT,
-		opts.ports.length > 0 ? opts.ports.join(",") : "-",
-		opts.probe === "health" && opts.caHostPath ? "health" : "tcp",
-		...opts.caHostPath ? [FORWARDER_CA_PATH] : resign ? ["-"] : [],
-		...resign ? [FORWARDER_RESIGN_CONFIG_PATH] : []
-	];
-}
-let imageReady;
-let pullFailure;
-const PULL_FAILURE_TTL_MS = 6e4;
-async function ensureForwarderImage(skipPull = false) {
-	if (skipPull) return;
-	if (pullFailure && Date.now() - pullFailure.at < PULL_FAILURE_TTL_MS) throw pullFailure.error;
-	imageReady ??= (async () => {
-		try {
-			await execFileAsync$1(getDockerCmd(), [
-				"image",
-				"inspect",
-				LOOPBACK_FORWARDER_IMAGE
-			]);
-		} catch {
-			await pullImage(LOOPBACK_FORWARDER_IMAGE, false);
-		}
-	})().catch((err) => {
-		imageReady = void 0;
-		pullFailure = {
-			at: Date.now(),
-			error: err
-		};
-		throw err;
-	});
-	return imageReady;
-}
-function newLoopbackForwarderName() {
-	return `${getEmbedConfig().resourceNamePrefix}-awsfwd-${process.pid}-${randomBytes(4).toString("hex")}`;
-}
-async function startLoopbackForwarder(opts) {
-	const logger = getLogger().child("forwarder");
-	await ensureForwarderImage(opts.skipPull === true);
-	const name = opts.name ?? newLoopbackForwarderName();
-	const args = buildLoopbackForwarderDockerArgs({
-		...opts,
-		name
-	});
-	logger.debug(`Starting loopback forwarder ${name} for ports ${opts.ports.join(",")}`);
-	try {
-		await execFileAsync$1(getDockerCmd(), args);
-	} catch (error) {
-		throw new Error(`Could not start the loopback forwarder container: ${displayToolOutput(error.stderr?.trim() || describeExitWithoutArgv(error))}`);
-	}
-	return awaitLoopbackForwarderStatus(name, opts.timeoutMs);
-}
-async function awaitLoopbackForwarderStatus(name, timeoutMs = 2e4) {
-	const logger = getLogger().child("forwarder");
-	const deadline = Date.now() + timeoutMs;
-	for (;;) {
-		let logs = "";
-		try {
-			const r = await execFileAsync$1(getDockerCmd(), ["logs", name]);
-			logs = `${r.stdout}\n${r.stderr}`;
-		} catch (error) {
-			throw new Error(`The loopback forwarder container exited before reporting: ${displayToolOutput(error.stderr?.trim() || describeExitWithoutArgv(error))}`);
-		}
-		const status = parseForwarderStatus(logs);
-		if (status) {
-			logger.debug(status.ok ? `Loopback forwarder ${name} ready (upstream ${status.upstream ?? "?"})` : `Loopback forwarder ${name} failed: port ${status.failedPort} ${status.reason}`);
-			return {
-				name,
-				...status
-			};
-		}
-		if (Date.now() > deadline) {
-			await execFileAsync$1(getDockerCmd(), [
-				"rm",
-				"-f",
-				name
-			]).catch(() => void 0);
-			throw new Error("The loopback forwarder container did not report readiness in time.");
-		}
-		await new Promise((r) => setTimeout(r, 100));
-	}
-}
-function describeForwarderFailure(result, endpointLabel) {
-	const port = result.failedPort ?? 0;
-	const via = result.upstream ? ` via ${result.upstream}:${port}` : "";
-	const reason = result.reason ?? "unknown";
-	if (reason.startsWith("RESIGN_UPSTREAM_")) return `${endpointLabel}: the AWS Emulator sidecar started, but a health check through it did not reach the emulator (${reason.slice(16)}). Check that the emulator is still running, and that its certificate comes from the CA cdk-local trusts (a restart issues a new one).`;
-	if (reason.startsWith("RESIGN_")) {
-		const inUse = reason === "RESIGN_EADDRINUSE";
-		return `${endpointLabel}: the AWS Emulator sidecar could not start${port > 0 ? ` on 127.0.0.1:${port}` : ""} inside the workload container (${reason.slice(7)}). ` + (inUse ? `The workload already listens on port ${port}; under --aws-emulator it is reserved for the AWS Emulator sidecar.` : reason.startsWith("RESIGN_CONFIG_") ? "Its config file was not readable in the container; check that the temp directory is shared with Docker." : "It could not listen on that address inside the container.");
-	}
-	if (reason.startsWith("LISTEN_")) return `${endpointLabel}: the workload container already uses port ${port} on its loopback, so cdk-local cannot forward 127.0.0.1:${port} to the host. Run the endpoint on another port.`;
-	if (reason.startsWith("HTTP_") || reason.includes("CERT") || reason === "DEPTH_ZERO_SELF_SIGNED_CERT") return `${endpointLabel}: containers reach port ${port}${via}, but its health check failed (${reason}). Check that the endpoint on port ${port} is the one whose CA cdk-local mounted (a restart issues a new certificate).`;
-	return `${endpointLabel}: containers cannot reach port ${port} on the host${via} (${reason}). cdk-local forwards 127.0.0.1:${port} inside each workload container to the host, so the endpoint must also accept connections from the Docker network. On Docker Desktop, publish it on the host's 127.0.0.1 (\`-p 127.0.0.1:${port}:${port}\`). On Linux, publish it on 127.0.0.1 AND on the Docker bridge gateway: run the emulator's Docker image with \`-p 127.0.0.1:${port}:${port} -p ${result.upstream && /^\d+\.\d+\.\d+\.\d+$/.test(result.upstream) && !result.upstream.startsWith("192.168.65.") ? result.upstream : "<docker bridge gateway, e.g. 172.17.0.1>"}:${port}:${port}\` (a native install listens on one address only, so it cannot serve this machine and containers at once). Do not bind 0.0.0.0 on a host: that opens it to your network.`;
-}
-
-//#endregion
-//#region src/local/docker-runner.ts
-var docker_runner_exports = /* @__PURE__ */ __exportAll({
-	DockerRunnerError: () => DockerRunnerError,
-	MAX_HELD_LINE_CHARS: () => MAX_HELD_LINE_CHARS,
-	PREFIX_CONTAINER_OUTPUT_ENV: () => PREFIX_CONTAINER_OUTPUT_ENV,
-	SENSITIVE_ENV_KEYS: () => SENSITIVE_ENV_KEYS,
-	appendEnvFlags: () => appendEnvFlags,
-	attachLoopbackForwarder: () => attachLoopbackForwarder,
-	createPrefixedLineRelay: () => createPrefixedLineRelay,
-	describeRefusedSensitiveEnvKeys: () => describeRefusedSensitiveEnvKeys,
-	ensureDockerAvailable: () => ensureDockerAvailable,
-	execEnvForSecrets: () => execEnvForSecrets,
-	pickFreePort: () => pickFreePort,
-	prepareLoopbackForwarder: () => prepareLoopbackForwarder,
-	pullImage: () => pullImage,
-	rememberForwardedPorts: () => rememberForwardedPorts,
-	removeContainer: () => removeContainer,
-	runDetached: () => runDetached,
-	startNamespaceOwnerForwarder: () => startNamespaceOwnerForwarder,
-	streamLogs: () => streamLogs,
-	withWorkloadAwsWiring: () => withWorkloadAwsWiring
-});
-const execFileAsync = promisify(execFile);
-var DockerRunnerError = class DockerRunnerError extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "DockerRunnerError";
-		Object.setPrototypeOf(this, DockerRunnerError.prototype);
-	}
-};
-async function pullImage(image, skipPull, platform) {
-	const logger = getLogger().child("docker");
-	if (skipPull) {
-		logger.debug(`Skipping docker pull for ${displayIdent(image)} (--no-pull)`);
-		return;
-	}
-	const platformArgs = platform ? ["--platform", platform] : [];
-	if (getLogger().getLevel() === "debug") {
-		logger.info(`Pulling ${displayIdent(image)}${platform ? ` (${displayIdent(platform)})` : ""}...`);
-		try {
-			await runDockerForeground([
-				"pull",
-				...platformArgs,
-				image
-			]);
-		} catch (err) {
-			const e = err;
-			throw new DockerRunnerError(`docker pull ${displayIdent(image)} failed: ${e.message}`);
-		}
-		return;
-	}
-	logger.debug(`Pulling ${displayIdent(image)} (silent — pass --verbose to stream progress)`);
-	try {
-		await runDockerStreaming([
-			"pull",
-			...platformArgs,
-			image
-		], {
-			streamLive: false,
-			progressLabel: `Pulling ${displayIdent(image)}`
-		});
-	} catch (err) {
-		const e = err;
-		if (e.exitCode === void 0 || e.exitCode === null) throw new DockerRunnerError(`docker pull ${displayIdent(image)} failed: ${displayToolOutput(e.message ?? String(err))}`);
-		const detail = e.stderr?.trim() || e.stdout?.trim() || "(no output)";
-		throw new DockerRunnerError(`docker pull ${displayIdent(image)} exited with code ${e.exitCode}: ${displayToolOutput(detail)}`);
-	}
-}
-async function runDetached(opts) {
-	const wiring = getActiveWorkloadAwsWiring();
-	if (!wiring) return runDetachedContainer(opts);
-	const wired = await withWorkloadAwsWiring(opts, wiring);
-	if (opts.network === "host" && wiring.mixed && effectiveLoopbackPorts(wired.env, wiring).includes(wiring.mixed.resignPort)) throw new DockerRunnerError("AWS Emulator mixed mode (a \"real-aws\" exception in --env-vars) needs the re-signing sidecar, which cannot run on the host network. Drop the host network for this workload, or use --aws-emulator without a \"real-aws\" exception.");
-	const ports = opts.network === "host" ? [] : effectiveLoopbackPorts(wired.env, wiring);
-	if (ports.length > 0) await prepareLoopbackForwarder(wiring);
-	const id = await runDetachedContainer(wired);
-	await attachLoopbackForwarder(id, wiring, ports);
-	return id;
-}
-async function withWorkloadAwsWiring(opts, wiring) {
-	const defaults = wiring.mode === "forward" && !opts.env["AWS_ACCESS_KEY_ID"] ? await resolveHostDefaultCredentials() : void 0;
-	const env = applyWorkloadAwsWiringToEnv(opts.env, wiring, defaults);
-	if (opts.network === "host" && wiring.sidecar?.passthrough && env["AWS_ENDPOINT_URL_SQS"] === wiring.sidecar.endpoint) delete env["AWS_ENDPOINT_URL_SQS"];
-	const credsPath = `${getEmbedConfig().awsBindMountPath}/credentials`;
-	const emulatorOnly = workloadGetsEmulatorKeysOnly(opts.env, wiring);
-	const extra = (opts.extraMounts ?? []).filter((m) => !emulatorOnly || m.containerPath !== credsPath);
-	const taken = new Set([...opts.mounts, ...extra].map((m) => m.containerPath));
-	for (const m of wiring.mounts) if (!taken.has(m.containerPath)) extra.push({
-		...m,
-		readOnly: true
-	});
-	return {
-		...opts,
-		env,
-		extraMounts: extra
-	};
-}
-async function prepareLoopbackForwarder(wiring) {
-	try {
-		await ensureForwarderImage(wiring.skipPull === true);
-	} catch (err) {
-		if (wiring.mode === "emulator" || wiring.mixed) throw new DockerRunnerError(`--aws-emulator: the loopback forwarder image could not be pulled: ${err.message}`);
-	}
-}
-const warnedForwarderPorts = /* @__PURE__ */ new Set();
-function warnForwarderOnce(key, message) {
-	if (warnedForwarderPorts.has(key)) return;
-	warnedForwarderPorts.add(key);
-	getLogger().warn(message);
-}
-async function isContainerRunning(containerId) {
-	try {
-		const { stdout } = await execFileAsync(getDockerCmd(), [
-			"inspect",
-			"-f",
-			"{{.State.Running}}",
-			containerId
-		]);
-		return stdout.trim() === "true";
-	} catch (err) {
-		return !/no such (object|container)/i.test(err.stderr ?? "");
-	}
-}
-const signalGuarded = /* @__PURE__ */ new Map();
-let signalListeners = [];
-async function removeOnSignalWhile(containers, fn) {
-	if (signalListeners.length === 0) signalListeners = ["SIGINT", "SIGTERM"].map((signal) => {
-		const listener = () => {
-			const names = [...signalGuarded.keys()];
-			if (names.length > 0) try {
-				execFileSync(getDockerCmd(), [
-					"rm",
-					"-f",
-					...names
-				], {
-					stdio: "ignore",
-					timeout: 15e3
-				});
-			} catch {}
-			if (process.listenerCount(signal) === 1) process.exit(signalExitCode(signal));
-		};
-		process.on(signal, listener);
-		return {
-			signal,
-			listener
-		};
-	});
-	for (const c of containers) signalGuarded.set(c, (signalGuarded.get(c) ?? 0) + 1);
-	try {
-		return await fn();
-	} finally {
-		for (const c of containers) {
-			const n = (signalGuarded.get(c) ?? 1) - 1;
-			if (n > 0) signalGuarded.set(c, n);
-			else signalGuarded.delete(c);
-		}
-		if (signalGuarded.size === 0) {
-			for (const { signal, listener } of signalListeners) process.off(signal, listener);
-			signalListeners = [];
-		}
-	}
-}
-const forwardedPortsByContainer = /* @__PURE__ */ new Map();
-async function attachLoopbackForwarder(containerId, wiring, ports = forwardedPortsByContainer.get(containerId) ?? wiring.loopbackPorts) {
-	if (samePorts(ports, wiring.loopbackPorts)) forwardedPortsByContainer.delete(containerId);
-	else forwardedPortsByContainer.set(containerId, ports);
-	if (ports.length === 0) return;
-	const plan = loopbackForwarderPlan(wiring, ports);
-	const fatal = forwarderFailureIsFatal(wiring, plan);
-	const label = forwarderEndpointLabel(wiring);
-	const forwarderName = newLoopbackForwarderName();
-	let result;
-	try {
-		result = await removeOnSignalWhile([containerId, forwarderName], () => startLoopbackForwarder({
-			workloadContainer: containerId,
-			ports: plan.ports,
-			probe: wiring.probeHealth ? "health" : "tcp",
-			name: forwarderName,
-			...wiring.skipPull ? { skipPull: true } : {},
-			...wiring.caHostPath ? { caHostPath: wiring.caHostPath } : {},
-			...plan.resignConfigHostPath ? { resignConfigHostPath: plan.resignConfigHostPath } : {}
-		}));
-	} catch (err) {
-		if (!await isContainerRunning(containerId)) return;
-		const message = `${label}: ${err.message}`;
-		if (fatal) {
-			await removeContainer(containerId);
-			throw new DockerRunnerError(message);
-		}
-		warnForwarderOnce("start", message);
-		return;
-	}
-	if (result.ok) return;
-	const message = describeForwarderFailure(result, label);
-	if (fatal) {
-		await removeContainer(containerId);
-		throw new DockerRunnerError(message);
-	}
-	warnForwarderOnce(String(result.failedPort ?? 0), message);
-}
-async function startNamespaceOwnerForwarder(opts) {
-	const { name, wiring } = opts;
-	const label = forwarderEndpointLabel(wiring);
-	const plan = loopbackForwarderPlan(wiring, opts.ports);
-	const fatal = forwarderFailureIsFatal(wiring, plan);
-	await prepareLoopbackForwarder(wiring);
-	const args = buildNamespaceOwnerForwarderDockerArgs({
-		name,
-		namespace: opts.namespace,
-		ports: plan.ports,
-		probe: wiring.probeHealth ? "health" : "tcp",
-		...wiring.skipPull ? { skipPull: true } : {},
-		...wiring.caHostPath ? { caHostPath: wiring.caHostPath } : {},
-		...plan.resignConfigHostPath ? { resignConfigHostPath: plan.resignConfigHostPath } : {}
-	});
-	getLogger().child("docker").debug(`Starting loopback forwarder ${name} for ports ${opts.ports.join(",")}`);
-	const fail = async (key, message, remove = true) => {
-		if (remove) await removeContainer(name);
-		if (fatal) throw new DockerRunnerError(message);
-		warnForwarderOnce(key, message);
-	};
-	return removeOnSignalWhile([name], async () => {
-		let id;
-		try {
-			id = (await execFileAsync(getDockerCmd(), args)).stdout.trim();
-		} catch (error) {
-			const err = error;
-			const conflict = /is already (?:in use|used) by|Conflict\. The container name/.test(err.stderr ?? "");
-			return fail("start", `${label}: could not start the loopback forwarder for ${opts.workloadLabel} (it holds the ${opts.workloadLabel}'s network aliases and published ports): ` + displayToolOutput(err.stderr?.trim() || describeExitWithoutArgv(error)), !conflict);
-		}
-		let result;
-		try {
-			result = await awaitLoopbackForwarderStatus(name);
-		} catch (err) {
-			return fail("start", `${label}: ${err.message}`);
-		}
-		if (result.ok) return id || name;
-		return fail(String(result.failedPort ?? 0), describeForwarderFailure(result, label));
-	});
-}
-function rememberForwardedPorts(containerId, wiring, ports) {
-	if (samePorts(ports, wiring.loopbackPorts)) forwardedPortsByContainer.delete(containerId);
-	else forwardedPortsByContainer.set(containerId, ports);
-}
-function forwarderEndpointLabel(wiring) {
-	if (wiring.mode === "emulator") return `--aws-emulator ${wiring.emulatorEndpoint?.url ?? ""}`;
-	if (wiring.mixed) return `--aws-emulator ${wiring.mixed.emulatorEndpoint.url} (mixed mode)`;
-	return "The AWS endpoint override (AWS_ENDPOINT_URL*)";
-}
-function forwarderFailureIsFatal(wiring, plan) {
-	return wiring.mode === "emulator" || plan.resignConfigHostPath !== void 0;
-}
-function samePorts(a, b) {
-	return a.length === b.length && a.every((p) => b.includes(p));
-}
-async function runDetachedContainer(opts) {
-	const args = opts.autoRemove === false ? ["run", "-d"] : [
-		"run",
-		"-d",
-		"--rm"
-	];
-	if (opts.name) args.push("--name", opts.name);
-	if (opts.network) args.push("--network", opts.network);
-	if (opts.platform) {
-		args.push("--platform", opts.platform);
-		warnIfEmulatedPlatform(opts.platform, opts.name ? { label: opts.name } : {});
-	}
-	if (opts.extraHosts) for (const entry of opts.extraHosts) args.push("--add-host", `${entry.host}:${entry.ip}`);
-	const host = opts.host ?? "127.0.0.1";
-	args.push("-p", `${host}:${opts.hostPort}:${opts.containerPort ?? 8080}`);
-	if (opts.debugPort !== void 0) args.push("-p", `${host}:${opts.debugPort}:${opts.debugPort}`);
-	for (const extra of opts.extraPorts ?? []) args.push("-p", `${host}:${extra.hostPort}:${extra.containerPort}`);
-	for (const mount of opts.mounts) {
-		const ro = mount.readOnly ? ":ro" : "";
-		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
-	}
-	if (opts.extraMounts) for (const mount of opts.extraMounts) {
-		const ro = mount.readOnly ? ":ro" : "";
-		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
-	}
-	const sensitiveKeys = opts.sensitiveEnvKeys && opts.sensitiveEnvKeys.size > 0 ? /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...opts.sensitiveEnvKeys]) : SENSITIVE_ENV_KEYS;
-	const { passthrough: passthroughEnv, collisions } = appendEnvFlags(args, opts.env, sensitiveKeys);
-	if (opts.tmpfs) args.push("--tmpfs", `${opts.tmpfs.target}:rw,size=${opts.tmpfs.sizeMb}m`);
-	if (opts.workingDir) args.push("--workdir", opts.workingDir);
-	let entryPointTail = [];
-	if (opts.entryPoint && opts.entryPoint.length > 0) {
-		args.push("--entrypoint", opts.entryPoint[0]);
-		entryPointTail = opts.entryPoint.slice(1);
-	}
-	args.push(...noImplicitEcrPullArgs(opts.image), opts.image, ...entryPointTail, ...opts.cmd);
-	const logger = getLogger().child("docker");
-	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(args).map((a) => displayUntrustedValue(a)).join(" ")}`);
-	if (collisions.length > 0) logger.warn(describeRefusedSensitiveEnvKeys(`Container for image ${displayUntrustedValue(opts.image)}`, collisions));
-	const forwardedKeys = Object.keys(passthroughEnv);
-	const refusal = finchSecretArgvRefusal(forwardedKeys.filter((k) => opts.sensitiveEnvKeys?.has(k)), {
-		label: "Container for image",
-		name: opts.image
-	});
-	if (refusal !== void 0) throw new DockerRunnerError(refusal);
-	warnFinchArgvExposure(forwardedKeys);
-	try {
-		const { stdout } = await execFileAsync(getDockerCmd(), args, {
-			maxBuffer: 10 * 1024 * 1024,
-			...execEnvForSecrets(passthroughEnv)
-		});
-		return stdout.trim();
-	} catch (error) {
-		throw new DockerRunnerError(`docker run failed: ${displayToolOutput(error.stderr?.trim() || describeExitWithoutArgv(error))}`);
-	}
-}
-const PREFIX_CONTAINER_OUTPUT_ENV = "CDKL_PREFIX_CONTAINER_OUTPUT";
-const MAX_HELD_LINE_CHARS = 64 * 1024;
-function createPrefixedLineRelay(prefix, out) {
-	const decoder = new StringDecoder("utf8");
-	let pending = "";
-	const emit = (text) => {
-		let nl = text.indexOf("\n");
-		if (nl !== -1) nl += pending.length;
-		pending += text;
-		while (nl !== -1) {
-			out.write(`${prefix}${pending.slice(0, nl + 1)}`);
-			pending = pending.slice(nl + 1);
-			nl = pending.indexOf("\n");
-		}
-		while (pending.length >= MAX_HELD_LINE_CHARS) {
-			const high = pending.charCodeAt(MAX_HELD_LINE_CHARS - 1);
-			const cut = high >= 55296 && high <= 56319 ? MAX_HELD_LINE_CHARS - 1 : MAX_HELD_LINE_CHARS;
-			out.write(`${prefix}${pending.slice(0, cut)}\n`);
-			pending = pending.slice(cut);
-		}
-	};
-	return {
-		push: (chunk) => emit(decoder.write(chunk)),
-		flush: () => {
-			emit(decoder.end());
-			if (pending.length > 0) {
-				out.write(`${prefix}${pending}\n`);
-				pending = "";
-			}
-		}
-	};
-}
-function streamLogs(containerId, opts = {}) {
-	const proc = spawn(getDockerCmd(), [
-		"logs",
-		"-f",
-		containerId
-	], { stdio: [
-		"ignore",
-		"pipe",
-		"pipe"
-	] });
-	if (opts.onOutput) {
-		const tap = opts.onOutput;
-		proc.stdout?.on("data", (chunk) => tap(chunk));
-		proc.stderr?.on("data", (chunk) => tap(chunk));
-	}
-	let flush = () => void 0;
-	if (opts.prefix !== void 0 || process.env["CDKL_PREFIX_CONTAINER_OUTPUT"] === "1") {
-		const tag = opts.prefix ?? `[${flattenToOneLine(containerId.slice(0, 12)).replace(/[\]\s]/g, "_")}] `;
-		const stdoutRelay = createPrefixedLineRelay(tag, process.stdout);
-		const stderrRelay = createPrefixedLineRelay(tag, process.stderr);
-		proc.stdout?.on("data", (chunk) => stdoutRelay.push(chunk));
-		proc.stderr?.on("data", (chunk) => stderrRelay.push(chunk));
-		flush = () => {
-			stdoutRelay.flush();
-			stderrRelay.flush();
-		};
-		proc.on("close", () => flush());
-	} else {
-		proc.stdout?.on("data", (chunk) => process.stdout.write(chunk));
-		proc.stderr?.on("data", (chunk) => process.stderr.write(chunk));
-	}
-	proc.on("error", () => {});
-	return () => {
-		flush();
-		if (!proc.killed) proc.kill("SIGTERM");
-	};
-}
-async function removeContainer(containerId) {
-	if (!containerId) return;
-	forwardedPortsByContainer.delete(containerId);
-	const logger = getLogger().child("docker");
-	try {
-		await execFileAsync(getDockerCmd(), [
-			"rm",
-			"-f",
-			containerId
-		]);
-		logger.debug(`Removed container ${containerId}`);
-	} catch (error) {
-		const err = error;
-		logger.debug(`docker rm -f ${containerId} failed: ${err.stderr || err.message || String(error)}`);
-	}
-}
-async function ensureDockerAvailable() {
-	const cmd = getDockerCmd();
-	try {
-		await execFileAsync(cmd, [
-			"version",
-			"--format",
-			"{{.Server.Version}}"
-		]);
-	} catch (error) {
-		const err = error;
-		if (err.code === "ENOENT") throw new DockerRunnerError(`${cmd} is not installed or not on PATH. ${getEmbedConfig().cliName} invoke needs Docker (or a compatible CLI specified via CDK_DOCKER) — install it and retry.`);
-		throw new DockerRunnerError(`${cmd} daemon is not reachable: ${err.stderr?.trim() || err.message || String(error)}. Start Docker Desktop / the docker daemon and retry.`);
-	}
-}
-function pickFreePort() {
-	return new Promise((resolvePort, rejectPort) => {
-		const server = createServer();
-		server.unref();
-		server.on("error", rejectPort);
-		server.listen(0, "127.0.0.1", () => {
-			const address = server.address();
-			if (!address || typeof address === "string") {
-				server.close();
-				rejectPort(/* @__PURE__ */ new Error("Could not allocate a host port"));
-				return;
-			}
-			const port = address.port;
-			server.close(() => resolvePort(port));
-		});
-	});
-}
-const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
-	"AWS_ACCESS_KEY_ID",
-	"AWS_SECRET_ACCESS_KEY",
-	"AWS_SESSION_TOKEN"
-]);
-function appendEnvFlags(args, env, sensitiveKeys) {
-	const passthrough = {};
-	const collisions = [];
-	for (const [k, v] of Object.entries(env)) if (sensitiveKeys.has(k)) {
-		if (isMalformedEnvKey(k) || isDockerClientEnvKey(k)) {
-			collisions.push(k);
-			continue;
-		}
-		args.push("-e", k);
-		defineOwnKey(passthrough, k, v);
-	} else args.push("-e", `${k}=${v}`);
-	return {
-		passthrough,
-		collisions
-	};
-}
-function describeRefusedSensitiveEnvKeys(subject, keys) {
-	return `${subject}: sensitive env var(s) ${keys.map(displayUntrustedValue).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack that client; a malformed name cannot form a valid environment variable). Rename the variable if the container needs it.`;
-}
-function execEnvForSecrets(passthrough) {
-	const keys = Object.keys(passthrough).filter((k) => !isMalformedEnvKey(k) && !isDockerClientEnvKey(k));
-	if (keys.length === 0) return {};
-	const env = { ...process.env };
-	for (const k of keys) defineOwnKey(env, k, passthrough[k]);
-	return { env };
-}
-
-//#endregion
-export { isIamRoleArn as $, buildDockerImage as A, substituteImagePlaceholders as B, startLoopbackForwarder as C, isImageInLocalCache as D, warnIfEmulatedPlatform as E, parseEcrRegistryHost as F, LocalStartServiceError as G, CdkLocalError as H, contextForContainer as I, withErrorHandling as J, RouteDiscoveryError as K, derivePartitionAndUrlSuffix as L, createShutdownSignalHandler as M, signalExitCode as N, parseEcrUri as O, describeExitWithoutArgv as P, describeRejectedRoleArn as Q, derivePseudoParametersFromRegion as R, ensureForwarderImage as S, buildContainerImage as T, InteractiveTtyRequiredError as U, tryResolveImageFnJoin as V, LocalInvokeBuildError as W, applyRoleArnIfSet as X, AssumeRoleFailure as Y, assumeRoleCredentials as Z, LOOPBACK_FORWARDER_IMAGE as _, describeRefusedSensitiveEnvKeys as a, buildNamespaceOwnerForwarderDockerArgs as b, execEnvForSecrets as c, rememberForwardedPorts as d, refusedRoleArnMessage as et, removeContainer as f, withWorkloadAwsWiring as g, streamLogs as h, attachLoopbackForwarder as i, resolveAssetSourcePath as j, pullEcrImage as k, pickFreePort as l, startNamespaceOwnerForwarder as m, SENSITIVE_ENV_KEYS as n, buildStsClientConfig as nt, docker_runner_exports as o, runDetached as p, TargetSelectionCancelledError as q, appendEnvFlags as r, resolveProfileCredentials as rt, ensureDockerAvailable as s, DockerRunnerError as t, emulateRoleAfterDeniedAssume as tt, pullImage as u, awaitLoopbackForwarderStatus as v, architectureToPlatform as w, describeForwarderFailure as x, buildLoopbackForwarderDockerArgs as y, formatStateRemedy as z };
-//# sourceMappingURL=docker-runner-DjcP2syq.js.map