cdk-local 0.166.2 → 0.166.4

package/dist/{local-studio-BK2wPCoQ.js → local-studio-DC3gGXhH.js}

@@ -1,5 +1,5 @@
 import { a as displayIdent, c as getEmbedConfig, i as STACK_REF_MAX_CODE_POINTS, o as displayStackName, s as displayToolOutput, t as getLogger, u as setEmbedConfig } from "./logger-pRhBzMui.js";
-import { $ as formatHostForAuthority, A as validateAwsEmulatorEnvVars, B as describeCredentialLoadFailure, C as isRealAwsSentinel, E as realAwsEndpointFor, F as namesTheSameDirectory, H as isAwsServiceException, I as renderAssemblyPathEscape, J as resolveEnvVars$1, K as applyEnvOverrideMap, L as resolveAssemblyPath, M as assemblyPathEscape, N as displayUntrustedValue, O as realAwsServicesOf, P as isPasteableCommandArg, Q as formatAuthority, R as clampErrorName, S as isLegacyAwsEmulatorSentinel, T as readAwsEmulatorEnvVarsFile, U as sanitizeServiceExceptionMessage, V as flattenToOneLine, W as stringifyThrown, X as isLoopbackHostname, Y as defineOwnKey, Z as isWildcardHostname, _ as MIXED_MODE_RESIGN_PORT, a as buildProxyRequestHandler, c as getAwsEmulatorServiceRouting, et as hostFromAuthority, h as setAwsEndpointOverride, i as buildProxyClientConfig, j as absoluteAssemblyPathEscape, m as setAwsEmulatorServiceRouting, n as awsEmulatorRealServices, o as deployArtifactClientConfig, p as proxyAwareFetch, q as readEnvVarsFileText, r as awsEndpointOverrideClientConfig, s as deployArtifactsReadEmulator, u as isAwsServiceRoutedToEmulator, v as REAL_AWS_SENTINEL, w as legacyAwsEmulatorSentinelMessage, y as createMixedModeStateProvider, z as describeAwsFailureForWarn } from "./aws-proxy-D9ll_XO6.js";
+import { $ as formatAuthority, B as describeAwsFailureForWarn, C as isLegacyAwsEmulatorSentinel, D as realAwsEndpointFor, E as readAwsEmulatorEnvVarsFile, F as isPasteableCommandArg, G as stringifyThrown, H as flattenToOneLine, I as namesTheSameDirectory, J as readEnvVarsFileText, L as renderAssemblyPathEscape, M as absoluteAssemblyPathEscape, N as assemblyPathEscape, P as displayUntrustedValue, Q as isWildcardHostname, R as resolveAssemblyPath, T as legacyAwsEmulatorSentinelMessage, U as isAwsServiceException, V as describeCredentialLoadFailure, W as sanitizeServiceExceptionMessage, X as defineOwnKey, Y as resolveEnvVars$1, Z as isLoopbackHostname, _ as MIXED_MODE_RESIGN_PORT, a as buildProxyRequestHandler, b as describeRealAwsExceptions, c as getAwsEmulatorServiceRouting, et as formatHostForAuthority, h as setAwsEndpointOverride, i as buildProxyClientConfig, j as validateAwsEmulatorEnvVars, k as realAwsServicesOf, l as getAwsEndpointOverride, m as setAwsEmulatorServiceRouting, n as awsEmulatorRealServices, o as deployArtifactClientConfig, p as proxyAwareFetch, q as applyEnvOverrideMap, r as awsEndpointOverrideClientConfig, s as deployArtifactsReadEmulator, tt as hostFromAuthority, u as isAwsServiceRoutedToEmulator, v as REAL_AWS_SENTINEL, w as isRealAwsSentinel, y as createMixedModeStateProvider, z as clampErrorName } from "./aws-proxy-Cml7xM3y.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, promises, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { Command, InvalidArgumentError, Option } from "commander";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
@@ -293,6 +293,116 @@ function buildJavaTrustStore(pems, aliasPrefix = "cdk-local") {
 	return seq(integer(Buffer.from([3])), seq(oid(OID_PKCS7_DATA), explicit(0, octets(authSafe))));
 }
 
+// src/local/aws-emulator-sqs-routing.ts
+const REAL_SQS_QUEUE_URL = /^https?:\/\/(?:sqs\.[a-z0-9-]+|[a-z0-9-]+\.queue|queue)\.amazonaws\.com(?:\.cn)?\/([0-9]{12}\/[A-Za-z0-9_-]{1,80}(?:\.fifo)?)$/;
+const SQS_BLOCKED_REGIONS = [
+	"af-south-1",
+	"ap-east-1",
+	"ap-east-2",
+	"ap-northeast-1",
+	"ap-northeast-2",
+	"ap-northeast-3",
+	"ap-south-1",
+	"ap-south-2",
+	"ap-southeast-1",
+	"ap-southeast-2",
+	"ap-southeast-3",
+	"ap-southeast-4",
+	"ap-southeast-5",
+	"ap-southeast-6",
+	"ap-southeast-7",
+	"ca-central-1",
+	"ca-west-1",
+	"cn-north-1",
+	"cn-northwest-1",
+	"eu-central-1",
+	"eu-central-2",
+	"eu-north-1",
+	"eu-south-1",
+	"eu-south-2",
+	"eu-west-1",
+	"eu-west-2",
+	"eu-west-3",
+	"il-central-1",
+	"me-central-1",
+	"me-south-1",
+	"mx-central-1",
+	"sa-east-1",
+	"us-east-1",
+	"us-east-2",
+	"us-gov-east-1",
+	"us-gov-west-1",
+	"us-west-1",
+	"us-west-2"
+];
+const REGION_SHAPE$1 = /^[a-z]{2}(-[a-z]+)+-\d+$/;
+function isRealAwsHost(hostname) {
+	const h = hostname.toLowerCase().replace(/\.$/, "");
+	return /(^|\.)amazonaws\.com(\.cn)?$/.test(h) || /(^|\.)api\.aws$/.test(h);
+}
+function sqsEmulatorOriginOf(env) {
+	const endpoint = env["AWS_ENDPOINT_URL_SQS"] || env["AWS_ENDPOINT_URL"];
+	if (!endpoint) return void 0;
+	let url;
+	try {
+		url = new URL(endpoint.trim());
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") return void 0;
+	if (isRealAwsHost(url.hostname)) return void 0;
+	return url.origin;
+}
+function rewriteSqsQueueUrlsInEnv(env, origin) {
+	const keys = [];
+	for (const [k, v] of Object.entries(env)) {
+		if (typeof v !== "string") continue;
+		const m = REAL_SQS_QUEUE_URL.exec(v.trim());
+		if (!m) continue;
+		env[k] = `${origin}/${m[1]}`;
+		keys.push(k);
+	}
+	return keys;
+}
+function repointLocalSqsQueueUrlsInEnv(env, fromOrigin, toOrigin) {
+	const from = new URL(fromOrigin).origin;
+	for (const [k, v] of Object.entries(env)) {
+		if (typeof v !== "string" || !v.startsWith(`${from}/`)) continue;
+		const rest = v.slice(from.length + 1);
+		if (/^[0-9]{12}\/[A-Za-z0-9_-]{1,80}(?:\.fifo)?$/.test(rest)) env[k] = `${toOrigin}/${rest}`;
+	}
+}
+function regionOfSqsHost(hostname) {
+	const m = /^(?:sqs\.([a-z0-9-]+)|([a-z0-9-]+)\.queue)\.amazonaws\.com(?:\.cn)?$/.exec(hostname);
+	const region = m?.[1] ?? m?.[2];
+	return region && REGION_SHAPE$1.test(region) ? region : void 0;
+}
+function realSqsHostnames(regions) {
+	const out = /* @__PURE__ */ new Set(["queue.amazonaws.com"]);
+	for (const r of regions) {
+		if (!REGION_SHAPE$1.test(r)) continue;
+		const suffix = r.startsWith("cn-") ? "amazonaws.com.cn" : "amazonaws.com";
+		out.add(`sqs.${r}.${suffix}`);
+		out.add(`${r}.queue.${suffix}`);
+	}
+	return [...out].sort();
+}
+function sqsBlockedRegionsFor(env) {
+	const regions = new Set(SQS_BLOCKED_REGIONS);
+	for (const k of ["AWS_REGION", "AWS_DEFAULT_REGION"]) {
+		const r = env[k]?.trim();
+		if (r && REGION_SHAPE$1.test(r)) regions.add(r);
+	}
+	for (const v of Object.values(env)) {
+		if (typeof v !== "string") continue;
+		for (const m of v.matchAll(/https?:\/\/([a-z0-9.-]+)\//gi)) {
+			const r = regionOfSqsHost(m[1].toLowerCase());
+			if (r) regions.add(r);
+		}
+	}
+	return [...regions];
+}
+
 // src/local/emulator-resign-sidecar.ts
 const MIXED_MODE_RESIGN_BODY_CAP_BYTES = 104857600;
 const RESIGN_SIDECAR_CORE = String.raw`
@@ -458,7 +568,7 @@ function passthroughHeaders(incoming){
 // Only a real SQS queue URL is rewritten: an AWS SQS host (either form, any
 // partition suffix), no port, user info, query or fragment, and a path of a
 // 12-digit account and a queue name.
-var SQS_QUEUE_URL=/^https?:\/\/(?:sqs\.[a-z0-9-]+|[a-z0-9-]+\.queue)\.amazonaws\.com(?:\.cn)?\/([0-9]{12}\/[A-Za-z0-9_-]{1,80}(?:\.fifo)?)$/;
+var SQS_QUEUE_URL=/${REAL_SQS_QUEUE_URL.source}/;
 function localQueueUrl(u,origin){var m=SQS_QUEUE_URL.exec(String(u));return m?origin+'/'+m[1]:u;}
 var SQS_QUEUE_URL_OPERATIONS=new Set(['CreateQueue','GetQueueUrl','ListQueues','ListDeadLetterSourceQueues']);
 // An unsigned request (an emulator run with --auth off and an SDK that signs
@@ -1239,7 +1349,7 @@ function applyWorkloadAwsWiringToEnv(env, wiring, defaultCredentials) {
 		if (ownSqsEndpoint !== void 0) out["AWS_ENDPOINT_URL_SQS"] = ownSqsEndpoint;
 		const javaToolOptions = wiring.env["JAVA_TOOL_OPTIONS"];
 		if (javaToolOptions !== void 0) out["JAVA_TOOL_OPTIONS"] = mergeJavaToolOptions(ownJavaToolOptions, javaToolOptions);
-		setCreds(wiring.emulatorCredentials);
+		setCreds(emulatorIssuedCredentialsIn(env) ?? wiring.emulatorCredentials);
 	} else if (wiring.mixed && !keepsException) {
 		for (const k of EMULATOR_SCRUBBED_ENV_KEYS) delete out[k];
 		delete out["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"];
@@ -1252,8 +1362,24 @@ function applyWorkloadAwsWiringToEnv(env, wiring, defaultCredentials) {
 		if (defaultCredentials && !out["AWS_ACCESS_KEY_ID"]) setCreds(defaultCredentials);
 	}
 	if (out["AWS_REGION"] && !out["AWS_DEFAULT_REGION"]) out["AWS_DEFAULT_REGION"] = out["AWS_REGION"];
+	const sqsOrigin = awsEmulatorSqsOriginFor(out, wiring);
+	if (sqsOrigin !== void 0) {
+		const keys = rewriteSqsQueueUrlsInEnv(out, sqsOrigin);
+		if (keys.length > 0) getLogger().debug(`--aws-emulator: SQS queue URLs in ${keys.join(", ")} now point at ${sqsOrigin} (SQS is on AWS Emulator).`);
+	}
 	return out;
 }
+function awsEmulatorSqsOriginFor(env, wiring) {
+	if (wiring.mode !== "emulator" && !wiring.mixed) return void 0;
+	return sqsEmulatorOriginOf(env);
+}
+function awsEmulatorSqsHostBlocks(finalEnv, wiring) {
+	if (!wiring || awsEmulatorSqsOriginFor(finalEnv, wiring) === void 0) return [];
+	return realSqsHostnames(sqsBlockedRegionsFor(finalEnv)).map((host) => ({
+		host,
+		ip: "127.0.0.1"
+	}));
+}
 function envKeepsRealAwsException(env) {
 	return Object.entries(env).some(([k, v]) => k !== "AWS_ENDPOINT_URL" && isRealAwsSentinel(k, v));
 }
@@ -1306,6 +1432,35 @@ function setActiveWorkloadAwsWiring(wiring) {
 		process.once("exit", () => active?.dispose());
 	}
 }
+const emulatorIssued = /* @__PURE__ */ new Map();
+function roleHopsGoToAwsEmulator() {
+	return active?.mode === "emulator" && getAwsEndpointOverride() !== void 0;
+}
+function keepEmulatorIssuedCredentials(creds) {
+	if (roleHopsGoToAwsEmulator()) emulatorIssued.set(creds.accessKeyId, {
+		accessKeyId: creds.accessKeyId,
+		secretAccessKey: creds.secretAccessKey,
+		sessionToken: creds.sessionToken
+	});
+	return creds;
+}
+function emulatorIssuedCredentials(creds) {
+	const id = creds?.accessKeyId;
+	const recorded = id === void 0 ? void 0 : emulatorIssued.get(id);
+	return recorded && recorded.secretAccessKey === creds?.secretAccessKey && recorded.sessionToken === creds.sessionToken ? recorded : void 0;
+}
+function emulatorIssuedCredentialsIn(env) {
+	const accessKeyId = env["AWS_ACCESS_KEY_ID"];
+	if (accessKeyId === void 0) return void 0;
+	return emulatorIssuedCredentials({
+		accessKeyId,
+		secretAccessKey: env["AWS_SECRET_ACCESS_KEY"] ?? "",
+		sessionToken: env["AWS_SESSION_TOKEN"] ?? ""
+	});
+}
+function stateRoleRecordIsEmulatorSide() {
+	return active?.mixed !== void 0 && isAwsServiceRoutedToEmulator("IAM");
+}
 function awsEmulatorEnvName() {
 	const { envPrefix } = getEmbedConfig();
 	return envPrefix === "CDKL" ? "CDK_LOCAL_AWS_EMULATOR" : `${envPrefix}_AWS_EMULATOR`;
@@ -1337,7 +1492,7 @@ async function activateWorkloadAwsWiring(options) {
 			override: wiring.mixed.emulatorClientOverride,
 			envOverrides: overrides
 		});
-		getLogger().info(`Mixed mode: every AWS call goes to AWS Emulator at ${wiring.mixed.emulatorEndpoint.url} (signed with its keys) except ${wiring.mixed.realServices.join(", ")}, which go to real AWS with your real credentials, for the workload and for ${getEmbedConfig().productName}'s own calls.`);
+		if (!options.singleWorkload) getLogger().info(`Mixed mode: every AWS call goes to AWS Emulator at ${wiring.mixed.emulatorEndpoint.url} (signed with its keys), except the services --env-vars marks "${REAL_AWS_SENTINEL}" for a workload, which go to real AWS with your real credentials, for that workload and for ${getEmbedConfig().productName}'s own calls for it: ${describeRealAwsExceptions(scan.exceptions)}. A workload with no exception gets AWS Emulator's keys only.`);
 	} else if (wiring.mode === "emulator" && wiring.emulatorEndpoint) {
 		setAwsEmulatorServiceRouting(void 0);
 		setAwsEndpointOverride({
@@ -1352,6 +1507,17 @@ async function activateWorkloadAwsWiring(options) {
 	}
 	return wiring;
 }
+function logMixedModeForWorkload(workload, label) {
+	const mixed = active?.mixed;
+	if (!mixed) return;
+	const services = awsEmulatorRealServices(workload) ?? [];
+	const at = `AWS Emulator at ${mixed.emulatorEndpoint.url}`;
+	if (services.length === 0) {
+		getLogger().info(`Mixed mode: ${label} keeps no "${REAL_AWS_SENTINEL}" exception in --env-vars, so every AWS call it makes goes to ${at}, with its keys only.`);
+		return;
+	}
+	getLogger().info(`Mixed mode: every AWS call of ${label} goes to ${at} (signed with its keys) except ${services.join(", ")}, which go to real AWS with your real credentials, for the workload and for ${getEmbedConfig().productName}'s own calls for it.`);
+}
 let stateSourceHintShown = false;
 function takeAwsEmulatorStateSourceHint() {
 	const wiring = active;
@@ -1599,6 +1765,7 @@ async function emulate(args) {
 		failedRoles.add(key);
 		logger.warn(`${args.flag}: AssumeRole(${shownRole}) was refused, and the role's permissions cannot be emulated instead: ${reason}.`);
 	};
+	if (args.emulateRoleVia === void 0 && getAwsEndpointOverride() !== void 0) return cannot("in AWS Emulator a sts:GetFederationToken session is allowed nothing (the emulator's own user has no IAM policies). Let the role's trust policy allow the emulator's identity, for example the account root (arn:aws:iam::000000000000:root), and redeploy, or pass --emulate-role-via <arn> naming an emulator role you can assume");
 	const { STSClient, GetCallerIdentityCommand, GetFederationTokenCommand, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
 	const sts = new STSClient(workloadStsClientConfig({
 		region: args.region,
@@ -1785,7 +1952,7 @@ async function assumeRoleCredentials(opts) {
 			flag: opts.roleFlag ?? "--assume-role",
 			sessionNameSuffix: opts.sessionNameSuffix
 		});
-		if (emulated !== void 0) return emulated;
+		if (emulated !== void 0) return keepEmulatorIssuedCredentials(emulated);
 		const detail = describeAwsFailureForWarn(refused.err, "STS AssumeRole");
 		const message = `AssumeRole(${shownArn}) failed: ${detail}`;
 		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, detail);
@@ -1795,11 +1962,11 @@ async function assumeRoleCredentials(opts) {
 		const message = `AssumeRole(${shownArn}) returned no usable credentials.`;
 		throw opts.makeError ? opts.makeError(message) : new AssumeRoleFailure(message, "the response carried no usable credentials");
 	}
-	return {
+	return keepEmulatorIssuedCredentials({
 		accessKeyId: creds.AccessKeyId,
 		secretAccessKey: creds.SecretAccessKey,
 		sessionToken: creds.SessionToken
-	};
+	});
 }
 async function applyRoleArnIfSet(opts) {
 	const roleArn = opts.roleArn || process.env[`${getEmbedConfig().envPrefix}_ROLE_ARN`];
@@ -8889,7 +9056,13 @@ async function runDetached(opts) {
 async function withWorkloadAwsWiring(opts, wiring) {
 	const defaults = wiring.mode === "forward" && !opts.env["AWS_ACCESS_KEY_ID"] ? await resolveHostDefaultCredentials() : void 0;
 	const env = applyWorkloadAwsWiringToEnv(opts.env, wiring, defaults);
-	if (opts.network === "host" && wiring.sidecar?.passthrough && env["AWS_ENDPOINT_URL_SQS"] === wiring.sidecar.endpoint) delete env["AWS_ENDPOINT_URL_SQS"];
+	if (opts.network === "host" && wiring.sidecar?.passthrough && env["AWS_ENDPOINT_URL_SQS"] === wiring.sidecar.endpoint) {
+		delete env["AWS_ENDPOINT_URL_SQS"];
+		const emulator = sqsEmulatorOriginOf(env);
+		if (emulator) repointLocalSqsQueueUrlsInEnv(env, wiring.sidecar.endpoint, emulator);
+	}
+	const sqsBlocks = awsEmulatorSqsHostBlocks(env, wiring);
+	const extraHosts = sqsBlocks.length > 0 ? [...opts.extraHosts ?? [], ...sqsBlocks] : opts.extraHosts;
 	const credsPath = `${getEmbedConfig().awsBindMountPath}/credentials`;
 	const emulatorOnly = workloadGetsEmulatorKeysOnly(opts.env, wiring);
 	const extra = (opts.extraMounts ?? []).filter((m) => !emulatorOnly || m.containerPath !== credsPath);
@@ -8901,7 +9074,8 @@ async function withWorkloadAwsWiring(opts, wiring) {
 	return {
 		...opts,
 		env,
-		extraMounts: extra
+		extraMounts: extra,
+		...extraHosts ? { extraHosts } : {}
 	};
 }
 async function prepareLoopbackForwarder(wiring) {
@@ -9265,6 +9439,19 @@ function execEnvForSecrets(passthrough) {
 	return { env };
 }
 
+// src/local/debug-timeout.ts
+const DEBUG_FUNCTION_TIMEOUT_SEC = 36e3;
+function applyDebuggerEnv(dockerEnv, debugPort) {
+	dockerEnv["NODE_OPTIONS"] = `--inspect-brk=0.0.0.0:${debugPort}`;
+	dockerEnv["AWS_LAMBDA_FUNCTION_TIMEOUT"] = String(DEBUG_FUNCTION_TIMEOUT_SEC);
+}
+function rieInvokeTimeoutMs(timeoutSec, debugging) {
+	return Math.max(3e4, (debugging ? Math.max(timeoutSec, DEBUG_FUNCTION_TIMEOUT_SEC) : timeoutSec) * 2 * 1e3);
+}
+function debugTimeoutNotice(flag) {
+	return `${flag}: the function Timeout is lifted to ${DEBUG_FUNCTION_TIMEOUT_SEC} seconds while debugging, so the handler waits for a debugger to attach.`;
+}
+
 // src/local/docker-version.ts
 const HOST_GATEWAY_MIN_VERSION = {
 	major: 20,
@@ -9372,7 +9559,7 @@ async function invokeRie(host, port, event, timeoutMs) {
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	let response;
 	try {
-		response = await fetchWithStartupRetry(url, body, controller.signal);
+		response = await fetchWithStartupRetry(url, body, controller.signal, void 0, timeoutMs);
 	} catch (err) {
 		if (err.name === "AbortError") throw new Error(`RIE invoke at ${url} timed out after ${timeoutMs}ms. The handler may be hung; check container logs.`);
 		throw err;
@@ -9390,16 +9577,19 @@ async function invokeRie(host, port, event, timeoutMs) {
 		raw
 	};
 }
-async function fetchWithStartupRetry(url, body, signal, extraHeaders) {
+async function fetchWithStartupRetry(url, body, signal, extraHeaders, timeoutMs) {
 	const maxAttempts = 3;
+	const headers = {
+		"Content-Type": "application/json",
+		...extraHeaders
+	};
+	const longWait = timeoutMs !== void 0 && timeoutMs > UNDICI_DEFAULT_TIMEOUT_MS;
 	let lastError;
 	for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
+		if (longWait) return await postWithoutClientTimeout(url, body, headers, signal);
 		return await fetch(url, {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...extraHeaders
-			},
+			headers,
 			body,
 			signal
 		});
@@ -9411,6 +9601,34 @@ async function fetchWithStartupRetry(url, body, signal, extraHeaders) {
 	}
 	throw lastError;
 }
+const UNDICI_DEFAULT_TIMEOUT_MS = 3e5;
+function postWithoutClientTimeout(url, body, headers, signal) {
+	return new Promise((resolve, reject) => {
+		const req = request(url, {
+			method: "POST",
+			headers: {
+				...headers,
+				"Content-Length": String(Buffer.byteLength(body))
+			},
+			signal
+		}, (res) => {
+			const responseHeaders = new Headers();
+			for (const [k, v] of Object.entries(res.headers)) {
+				if (v === void 0) continue;
+				for (const one of Array.isArray(v) ? v : [v]) responseHeaders.append(k, one);
+			}
+			const status = res.statusCode ?? 502;
+			const nullBody = status === 204 || status === 205 || status === 304;
+			if (nullBody) res.resume();
+			resolve(new Response(nullBody ? null : Readable.toWeb(res), {
+				status,
+				headers: responseHeaders
+			}));
+		});
+		req.on("error", reject);
+		req.end(body);
+	});
+}
 var StreamingPreludeLimitError = class StreamingPreludeLimitError extends Error {
 	constructor(message) {
 		super(message);
@@ -9438,7 +9656,7 @@ async function invokeRieStreaming(host, port, event, timeoutMs, options = {}) {
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	let response;
 	try {
-		response = await fetchWithStartupRetry(url, body, controller.signal, { "Lambda-Runtime-Function-Response-Mode": "streaming" });
+		response = await fetchWithStartupRetry(url, body, controller.signal, { "Lambda-Runtime-Function-Response-Mode": "streaming" }, timeoutMs);
 	} catch (err) {
 		clearTimeout(timer);
 		if (err.name === "AbortError") throw new Error(`RIE streaming invoke at ${url} timed out after ${timeoutMs}ms. The handler may be hung; check container logs.`);
@@ -9844,12 +10062,60 @@ function getDockerImageBySourceHash(manifest, imageUri) {
 	}
 	if (entries.length === 1) {
 		const [singleHash, singleAsset] = entries[0];
-		return {
+		if (imageUriTargetsAssetRepository(imageUri, singleAsset)) return {
 			hash: singleHash,
 			asset: singleAsset
 		};
 	}
 }
+function imageUriTargetsAssetRepository(imageUri, asset) {
+	const repo = extractRepositoryFromImageUri(imageUri);
+	if (repo === void 0) return false;
+	for (const dest of Object.values(asset.destinations ?? {})) {
+		const name = dest?.repositoryName;
+		if (typeof name !== "string" || name.length === 0) continue;
+		if (pseudoParameterPatternsOverlap(name, repo)) return true;
+	}
+	return false;
+}
+function extractRepositoryFromImageUri(imageUri) {
+	const slash = imageUri.indexOf("/");
+	if (slash < 0) return void 0;
+	let path = imageUri.slice(slash + 1);
+	const at = path.indexOf("@");
+	if (at >= 0) path = path.slice(0, at);
+	const lastSlash = path.lastIndexOf("/");
+	const colon = path.lastIndexOf(":");
+	if (colon > lastSlash && !path.slice(colon).includes("}")) path = path.slice(0, colon);
+	return path.length > 0 ? path : void 0;
+}
+const PSEUDO_PARAMETER = Symbol("pseudo-parameter");
+function pseudoParameterPatternsOverlap(a, b) {
+	const ta = tokenizePseudoParameters(a);
+	const tb = tokenizePseudoParameters(b);
+	const memo = /* @__PURE__ */ new Map();
+	const match = (i, j) => {
+		if (i === ta.length || j === tb.length) return i === ta.length && j === tb.length;
+		const key = i * (tb.length + 1) + j;
+		const cached = memo.get(key);
+		if (cached !== void 0) return cached;
+		let result = false;
+		if (ta[i] === PSEUDO_PARAMETER) for (let k = j; k < tb.length && tb[k] !== "/" && !result; k++) result = match(i + 1, k + 1);
+		else if (tb[j] === PSEUDO_PARAMETER) for (let k = i; k < ta.length && ta[k] !== "/" && !result; k++) result = match(k + 1, j + 1);
+		else result = ta[i] === tb[j] && match(i + 1, j + 1);
+		memo.set(key, result);
+		return result;
+	};
+	return match(0, 0);
+}
+function tokenizePseudoParameters(value) {
+	const tokens = [];
+	value.split(/\$\{AWS::[^}]*\}/).forEach((part, index) => {
+		if (index > 0) tokens.push(PSEUDO_PARAMETER);
+		tokens.push(...Array.from(part));
+	});
+	return tokens;
+}
 function extractHashFromImageUri(imageUri) {
 	if (imageUri.includes("@sha256:")) return void 0;
 	return /:([a-f0-9]{8,})$/.exec(imageUri)?.[1];
@@ -9960,7 +10226,10 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 		getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
 	});
 	try {
-		await activateWorkloadAwsWiring(options);
+		await activateWorkloadAwsWiring({
+			...options,
+			singleWorkload: true
+		});
 		warnIfEmulateRoleViaUnused(options.emulateRoleVia, {
 			roleFlag: "--assume-role",
 			roleRequested: options.assumeRole !== void 0 && options.assumeRole !== false
@@ -9995,10 +10264,11 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 		const lambda = resolveLambdaTarget(resolvedTarget, stacks);
 		const targetLabel = lambda.kind === "zip" ? lambda.runtime : "container image";
 		logger.info(`Target: ${displayStackName(`${lambda.stack.stackName}/${lambda.logicalId}`)} (${targetLabel})`);
+		logMixedModeForWorkload(lambdaWorkload(lambda), `Lambda ${displayStackName(`${lambda.stack.stackName}/${lambda.logicalId}`)}`);
 		imagePlan = await resolveImagePlan(lambda, options);
 		const containerEnv = await resolveLambdaContainerEnv(lambda, options, profileCredentials, extraStateProviders);
 		const dockerEnv = containerEnv.env;
-		if (options.assumeRole === void 0 && containerEnv.stateForRoleHint) suggestAssumeRoleFromState(containerEnv.stateForRoleHint, lambda.logicalId);
+		if (options.assumeRole === void 0 && containerEnv.stateForRoleHint && !stateRoleRecordIsEmulatorSide()) suggestAssumeRoleFromState(containerEnv.stateForRoleHint, lambda.logicalId);
 		if (!containerEnv.assumeRoleApplied && profileCredsFile) {
 			dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = profileCredsFile.containerPath;
 			dockerEnv["AWS_PROFILE"] = profileCredsFile.profileName;
@@ -10008,7 +10278,8 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 		if (options.debugPort) {
 			debugPort = Number(options.debugPort);
 			if (!Number.isInteger(debugPort) || debugPort <= 0 || debugPort > 65535) throw new Error(`--debug-port must be an integer in 1..65535, got '${options.debugPort}'`);
-			dockerEnv["NODE_OPTIONS"] = `--inspect-brk=0.0.0.0:${debugPort}`;
+			applyDebuggerEnv(dockerEnv, debugPort);
+			logger.info(debugTimeoutNotice("--debug-port"));
 			if (lambda.kind === "image") logger.warn("--debug-port sets NODE_OPTIONS unconditionally on container Lambdas. If the image's runtime is not Node.js, this flag is a no-op.");
 		}
 		const hostPort = await pickFreePort();
@@ -10045,7 +10316,7 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 		};
 		process.on("SIGINT", sigintHandler);
 		await waitForRieReady(containerHost, hostPort, 5e3);
-		const invokeTimeoutMs = Math.max(3e4, lambda.timeoutSec * 2 * 1e3);
+		const invokeTimeoutMs = rieInvokeTimeoutMs(lambda.timeoutSec, debugPort !== void 0);
 		const result = await invokeRie(containerHost, hostPort, event, invokeTimeoutMs);
 		await new Promise((resolveDelay) => setTimeout(resolveDelay, 250));
 		process.stdout.write(`${result.raw}\n`);
@@ -10441,7 +10712,7 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 	});
 	let resolvedAssumeRoleArn;
 	try {
-		const fromTemplate = options.assumeRole === true && options.deployedFunctionLookups === false && stateForRoleHint ? await resolveTemplateRoleArnFromState(lambda.resource.Properties?.["Role"], stateForRoleHint, lambda.stack.template, () => resolvePseudoParametersForInvoke(lambda.stack.region, options)) : void 0;
+		const fromTemplate = options.assumeRole === true && options.deployedFunctionLookups === false && stateForRoleHint && !stateRoleRecordIsEmulatorSide() ? await resolveTemplateRoleArnFromState(lambda.resource.Properties?.["Role"], stateForRoleHint, lambda.stack.template, () => resolvePseudoParametersForInvoke(lambda.stack.region, options)) : void 0;
 		if (fromTemplate !== void 0) logger.info(`--assume-role: auto-resolved execution role from state: ${flattenToOneLine(fromTemplate)}`);
 		resolvedAssumeRoleArn = fromTemplate ?? await resolveAssumeRoleArnForLambda(options.assumeRole, stateForRoleHint, options.deployedFunctionLookups === false ? void 0 : stateProvider, lambda.logicalId);
 	} finally {
@@ -10479,7 +10750,7 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 			assumeSucceeded = true;
 		} catch (err) {
 			const reason = assumeRoleDetail(err, "STS AssumeRole");
-			logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(resolvedAssumeRoleArn)}) failed: ${reason}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(resolvedAssumeRoleArn)}) failed: ${reason}. ` + (roleHopsGoToAwsEmulator() ? "The function runs with the emulator's own keys." : "Falling back to the developer's shell credentials."));
 		}
 	}
 	if (!assumeSucceeded) {
@@ -10510,6 +10781,9 @@ function suggestAssumeRoleFromState(state, logicalId) {
 	const roleArn = resolveExecutionRoleArnFromState(state, logicalId);
 	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${flattenToOneLine(roleArn)}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
 }
+function mixedModeEmulatorRoleWarning(pin) {
+	return `--assume-role: in AWS Emulator mixed mode the execution role is assumed in real AWS, but the state record's IAM roles are the emulator's, so the role is not read from it. Mark IAM as a "real-aws" exception under Parameters (AWS_ENDPOINT_URL_IAM), or pass the ARN explicitly: ${pin}. Falling back to the developer's shell credentials.`;
+}
 async function resolveAssumeRoleArnForLambda(assumeRole, stateForRoleHint, stateProvider, lambdaLogicalId) {
 	const logger = getLogger();
 	if (typeof assumeRole === "string") return assumeRole;
@@ -10518,7 +10792,8 @@ async function resolveAssumeRoleArnForLambda(assumeRole, stateForRoleHint, state
 		logger.warn("--assume-role passed without an ARN, but no state was loaded. Pair it with a state-source flag, or pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.");
 		return;
 	}
-	const fromState = resolveExecutionRoleArnFromState(stateForRoleHint, lambdaLogicalId);
+	const recordIsEmulatorSide = stateRoleRecordIsEmulatorSide();
+	const fromState = recordIsEmulatorSide ? void 0 : resolveExecutionRoleArnFromState(stateForRoleHint, lambdaLogicalId);
 	if (fromState) {
 		logger.info(`--assume-role: auto-resolved execution role from state: ${flattenToOneLine(fromState)}`);
 		return fromState;
@@ -10532,6 +10807,10 @@ async function resolveAssumeRoleArnForLambda(assumeRole, stateForRoleHint, state
 			return liveArn;
 		}
 	}
+	if (recordIsEmulatorSide) {
+		logger.warn(mixedModeEmulatorRoleWarning("--assume-role <arn>"));
+		return;
+	}
 	logger.warn(`--assume-role: could not resolve the execution role ARN for ${displayIdent(lambdaLogicalId)}. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
 }
 function resolveExecutionRoleArnFromState(state, logicalId, roleProperty = "Role") {
@@ -15925,7 +16204,8 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 	warnIamRoutes(initialMaterial.routes);
 	let maxTimeoutSec = 0;
 	for (const spec of initialMaterial.specs.values()) if (spec.lambda.timeoutSec > maxTimeoutSec) maxTimeoutSec = spec.lambda.timeoutSec;
-	const rieTimeoutMs = Math.max(3e4, maxTimeoutSec * 2 * 1e3);
+	const rieTimeoutMs = rieInvokeTimeoutMs(maxTimeoutSec, debugPortBase !== void 0);
+	if (debugPortBase !== void 0) logger.info(debugTimeoutNotice("--debug-port-base"));
 	const basePort = parseInt(options.port, 10);
 	if (!Number.isFinite(basePort) || basePort < 0 || basePort > 65535) throw new Error(`--port must be 0..65535 (got ${options.port}).`);
 	const mtlsConfig = resolveMtlsConfig(options);
@@ -16407,6 +16687,10 @@ function resolveStartApiAssumeRoleArn(args) {
 		if (isIamRoleArn(roleProp)) return roleProp;
 		getLogger().warn(`--assume-role: the template Role for ${displayIdent(logicalId)} is not a well-formed IAM role ARN: ${describeRejectedRoleArn(roleProp)}. Ignoring it.`);
 	}
+	if (stateBundle && stateRoleRecordIsEmulatorSide()) {
+		getLogger().warn(mixedModeEmulatorRoleWarning(`--assume-role ${logicalId}=<arn>`));
+		return;
+	}
 	if (stateBundle) {
 		const fromState = resolveExecutionRoleArnFromState(stateBundle.state, logicalId);
 		if (fromState) {
@@ -16540,7 +16824,7 @@ async function buildContainerSpec(args) {
 		}
 	}
 	setContainerRegion(dockerEnv, containerRegion);
-	if (debugPort !== void 0) dockerEnv["NODE_OPTIONS"] = `--inspect-brk=0.0.0.0:${debugPort}`;
+	if (debugPort !== void 0) applyDebuggerEnv(dockerEnv, debugPort);
 	const tmpfs = lambda.ephemeralStorageMb !== void 0 ? {
 		target: "/tmp",
 		sizeMb: lambda.ephemeralStorageMb
@@ -17897,7 +18181,10 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 		getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
 	});
 	try {
-		await activateWorkloadAwsWiring(options);
+		await activateWorkloadAwsWiring({
+			...options,
+			singleWorkload: true
+		});
 		warnIfEmulateRoleViaUnused(options.emulateRoleVia, {
 			roleFlag: "--assume-role",
 			roleRequested: options.assumeRole !== void 0 && options.assumeRole !== false
@@ -17937,6 +18224,10 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 		};
 		const resolved = resolveAgentCoreTarget(resolvedTarget, stacks, imageContext);
 		logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.logicalId}`)} (${resolved.protocol})`);
+		logMixedModeForWorkload({
+			logicalId: resolved.logicalId,
+			cdkPath: readCdkPathOrUndefined(resolved.resource)
+		}, `AgentCore runtime ${displayStackName(`${resolved.stack.stackName}/${resolved.logicalId}`)}`);
 		const isMcp = resolved.protocol === "MCP";
 		const isA2a = resolved.protocol === "A2A";
 		if (resolved.protocol === "AGUI") logger.info("AGUI runtime: routing through the HTTP /invocations + /ws path (AG-UI wire is SSE / WebSocket on port 8080).");
@@ -18493,7 +18784,8 @@ async function resolveAssumeRoleArn(options, resolved, loaded, stateProvider) {
 		getLogger().warn(`--assume-role: the template RoleArn for ${displayIdent(resolved.logicalId)} is not a well-formed IAM role ARN: ${describeRejectedRoleArn(resolved.roleArn)}. Ignoring it.`);
 	}
 	if (loaded) {
-		const fromState = resolveExecutionRoleArnFromState(loaded, resolved.logicalId, "RoleArn");
+		const recordIsEmulatorSide = stateRoleRecordIsEmulatorSide();
+		const fromState = recordIsEmulatorSide ? void 0 : resolveExecutionRoleArnFromState(loaded, resolved.logicalId, "RoleArn");
 		if (fromState) {
 			getLogger().debug(`--assume-role: resolved RoleArn from state: ${flattenToOneLine(fromState)}`);
 			return fromState;
@@ -18507,6 +18799,10 @@ async function resolveAssumeRoleArn(options, resolved, loaded, stateProvider) {
 				return liveArn;
 			}
 		}
+		if (recordIsEmulatorSide) {
+			getLogger().warn(mixedModeEmulatorRoleWarning("--assume-role <arn>"));
+			return;
+		}
 	}
 	getLogger().warn("--assume-role passed without an ARN, but the runtime's RoleArn is not a literal ARN in the template " + (loaded ? "and could not be resolved from the deployed stack state. " : "and no --from-cfn-stack state is available to resolve it. ") + "Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.");
 }
@@ -18614,16 +18910,16 @@ async function assumeAgentCoreExecutionRole(roleArn, region, profile, emulateRol
 				flag: "--assume-role",
 				sessionNameSuffix: "invoke-agentcore"
 			});
-			if (emulated !== void 0) return emulated;
+			if (emulated !== void 0) return keepEmulatorIssuedCredentials(emulated);
 			throw err;
 		}
 		const creds = response.Credentials;
 		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new AssumeRoleFailure(`AssumeRole(${flattenToOneLine(roleArn)}) returned no usable credentials.`, "the response carried no usable credentials");
-		return {
+		return keepEmulatorIssuedCredentials({
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
 			sessionToken: creds.SessionToken
-		};
+		});
 	} finally {
 		sts.destroy();
 	}
@@ -19683,6 +19979,7 @@ async function runEcsTask(task, options, state) {
 			region: containerRegion,
 			sidecarIp: state.network.sidecarIp,
 			...options.mixedModeRoleCredentials && { mixedModeRoleCredentials: options.mixedModeRoleCredentials },
+			...options.taskCredentials && { taskCredentials: options.taskCredentials },
 			...options.skipHostPortPublish ? { skipHostPortPublish: true } : {},
 			...effectiveHostPortOverrides ? { hostPortOverrides: effectiveHostPortOverrides } : {},
 			...autoRemappedContainerPorts ? { autoRemappedContainerPorts } : {},
@@ -20167,10 +20464,21 @@ function buildDockerRunArgs(opts) {
 		finalEnv["AWS_SECRET_ACCESS_KEY"] = defaultCredentials.secretAccessKey;
 		if (defaultCredentials.sessionToken) finalEnv["AWS_SESSION_TOKEN"] = defaultCredentials.sessionToken;
 	}
-	if (wiring) finalEnv = applyWorkloadAwsWiringToEnv(finalEnv, wiring.mode === "emulator" ? wiring : {
-		...wiring,
-		env: {}
-	});
+	if (wiring) {
+		const emulatorRole = wiring.mode === "emulator" ? emulatorIssuedCredentials(opts.taskCredentials) : void 0;
+		finalEnv = applyWorkloadAwsWiringToEnv(finalEnv, wiring.mode === "emulator" ? emulatorRole ? {
+			...wiring,
+			emulatorCredentials: emulatorRole
+		} : wiring : {
+			...wiring,
+			env: {}
+		});
+		for (const h of awsEmulatorSqsHostBlocks(finalEnv, wiring)) {
+			const mapping = `${h.host}:${h.ip}`;
+			args.push("--add-host", mapping);
+			ownerAddHosts.push(mapping);
+		}
+	}
 	const sensitiveEnvKeys = new Set(SENSITIVE_ENV_KEYS);
 	for (const s of secrets) sensitiveEnvKeys.add(s.name);
 	for (const s of container.secrets) sensitiveEnvKeys.add(s.name);
@@ -25080,7 +25388,7 @@ function readEnvOverridesFile(filePath) {
 }
 async function resolveSidecarCredentials(options, assumedCredentials) {
 	const wiring = getActiveWorkloadAwsWiring();
-	if (wiring?.mode === "emulator") return wiring.emulatorCredentials;
+	if (wiring?.mode === "emulator") return emulatorIssuedCredentials(assumedCredentials) ?? wiring.emulatorCredentials;
 	if (assumedCredentials) return assumedCredentials;
 	if (options.profile) return resolveProfileCredentials(options.profile);
 	return resolveHostDefaultCredentials();
@@ -36484,5 +36792,5 @@ function addStudioSpecificOptions(cmd) {
 	return cmd;
 }
 
-export { postHook as $, AGENTCORE_HTTP_PROTOCOL as $a, probeHostGatewaySupport as $i, addImageOverrideOptions as $n, resolveHostDefaultCredentials as $o, resolveApiTargetSubset as $r, classifyS3Error as $t, microvmFidelityWarnings as A, isCfnFlagPresent as Aa, translateLambdaResponse as Ai, stripCloudFrontImport as An, AUTH_OFF_PLACEHOLDER_CREDENTIALS as Ao, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, countTargets as Ba, ConnectionRegistry as Bi, createLocalStartAlbCommand as Bn, displayEndpointValue as Bo, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, substituteEnvVarsFromState as Ca, attachAuthorizers as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, assumedRoleRecorded as Co, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, UNNAMED_WORKLOAD as Da, isFunctionUrlOacFronted as Di, compileCloudFrontFunction as Dn, resetWorkloadIdentity as Do, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, LocalStateSourceError as Ea, buildCorsConfigFromCloudFrontChain as Ei, resolveWebFunctionTarget as En, recordAssumedRole as Eo, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, CfnLocalStateProvider as Fa, pickResponseTemplate as Fi, findFileAssetForObjectKey as Fn, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as Fo, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, filterWebSocketApisByIdentifiers as Ga, buildDisconnectEvent as Gi, addStartServiceSpecificOptions as Gn, javaTruststoreToolOptions as Go, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, availableWebSocketApiIdentifiers as Ha, handleConnectionsRequest as Hi, resolveAlbTarget as Hn, getActiveWorkloadAwsWiring as Ho, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, collectSsmParameterRefs as Ia, selectIntegrationResponse as Ii, isBucketDeploymentResource as In, activateWorkloadAwsWiring as Io, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, discoverRoutes as Ja, createFileWatcher as Ji, addRunTaskSpecificOptions as Jn, parseAwsEndpoint as Jo, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, parseSelectionExpressionPath as Ka, buildMessageEvent as Ki, createLocalStartServiceCommand as Kn, loopbackForwarderPlan as Ko, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, resolveSsmParameters as La, tryParseStatus as Li, resolveBucketDeploymentObjectKey as Ln, applyWorkloadAwsWiringToEnv as Lo, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, resolveCfnFallbackRegion as Ma, buildHttpApiV2Event as Mi, createLocalFileKvsDataSource as Mn, DEFAULT_AWS_EMULATOR_URL as Mo, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, resolveCfnRegion as Na, buildRestV1Event as Ni, createUnboundCloudFrontModule as Nn, EMULATOR_SCRUBBED_ENV_KEYS as No, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, createLocalStateProvider as Oa, matchPreflight as Oi, runViewerRequest as On, workloadClientConfig as Oo, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, resolveCfnStackName as Pa, evaluateResponseParameters as Pi, bucketDeploymentSourceObjectKeys as Pn, HOST_CA_TRUST_ENV_KEYS as Po, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, AGENTCORE_AGUI_PROTOCOL as Qa, HOST_GATEWAY_MIN_VERSION as Qi, addEcsAssumeRoleOptions as Qn, resolveAwsEmulatorOption as Qo, createWatchPredicates as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, resolveWatchConfig as Ra, VtlEvaluationError as Ri, addAlbSpecificOptions as Rn, awsEmulatorEnvName as Ro, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, substituteAgainstStateAsync as Sa, invokeTokenAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SECOND_ASSUME_MESSAGE as So, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, materializeLayerFromArn as Ta, buildCorsConfigByApiId as Ti, WebFunctionResolutionError as Tn, readEnvCallerCredentials as To, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, discoverWebSocketApis as Ua, parseConnectionsPath as Ui, isApplicationLoadBalancer as Un, getContainerCaBundlePath as Uo, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, listTargets as Va, buildMgmtEndpointEnvUrl as Vi, parseLbPortOverrides as Vn, effectiveLoopbackPorts as Vo, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, discoverWebSocketApisOrThrow as Wa, buildConnectEvent as Wi, resolveAlbFrontDoor as Wn, getContainerJavaTruststorePath as Wo, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, resolveLambdaArnIntrinsic as Xa, createLocalInvokeCommand as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, readEmulatorRunFiles as Xo, addStartApiSpecificOptions as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, pickRefLogicalId as Ya, addInvokeSpecificOptions as Yi, createLocalRunTaskCommand as Yn, probeAwsEmulatorHealth as Yo, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, AGENTCORE_A2A_PROTOCOL as Za, HOST_DOCKER_INTERNAL_GATEWAY as Zi, addCommonEcsServiceOptions as Zn, readProfileEndpointSettings as Zo, createLocalStartApiCommand as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveRuntimeFileExtension as _a, verifyJwtViaDiscovery as _i, pickKvsLogicalIdFromArn as _n, parseDynamicReference as _o, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, buildLoopbackForwarderDockerArgs as aa, filterRoutesByApiIdentifiers as ai, serveLambdaUrlOrigin as an, derivePseudoParametersFromRegion as ao, resolveSharedSidecarCredentials as ar, buildJavaTrustStore as as, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, assertEcsTaskImagesResolvable as ba, evaluateCachedLambdaPolicy as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, addAwsEndpointOptions as bo, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, ensureForwarderImage as ca, startApiServer as ci, buildEdgeRequestEvent as cn, tryResolveImageFnJoin as co, buildImageOverrideTag as cr, resolveProfileCredentials as cs, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, buildContainerImage as da, defaultCredentialsLoader as di, httpHeadersToEdge as dn, DynamicReferenceResolver as do, mergeForService as dr, createLocalStartWebFunctionCommand as dt, resolveHostGatewayExtraHosts as ea, createAuthorizerCache as ei, createS3OriginReader as en, AGENTCORE_MCP_PROTOCOL as eo, buildEcsImageResolutionContext$1 as er, resolveWorkloadAwsWiring as es, runHookBody as et, filterStudioCustomResources as f, dockerRegistryEnv as fa, buildCognitoJwksUrl as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, containsDynamicReference as fo, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, resolveRuntimeCodeMountPath as ga, verifyJwtAuthorizer as gi, pickFunctionUrlLogicalIdFromOrigin as gn, keysOverriddenBy as go, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, stripEcrCredentials as ha, verifyCognitoJwt as hi, isCloudFrontDistribution as hn, keysNotFromTemplate as ho, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, awaitLoopbackForwarderStatus as ia, filterRoutesByApiIdentifier as ii, serveFromStaticOrigin as in, resolveAgentCoreTarget as io, resolveEcsAssumeRoleOption as ir, MIXED_MODE_RESIGN_BODY_CAP_BYTES as is, MicrovmResolutionError as it, readRunHookPayload as j, rejectExplicitCfnStackWithMultipleStacks as ja, applyAuthorizerOverlay as ji, createCloudFrontModule as jn, CA_TRUST_ENV_KEYS as jo, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, groupWorkloadsRoutedApart as ka, matchRoute as ki, runViewerResponse as kn, workloadStsClientConfig as ko, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, startLoopbackForwarder as la, resolveSelectionExpression as li, buildEdgeResponseEvent as ln, LocalInvokeBuildError as lo, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, noImplicitEcrPullArgs as ma, createJwksCache as mi, extractKvsAssociations as mn, firstUsableRegion as mo, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, withWorkloadAwsWiring as na, buildStageMap as ni, startCloudFrontServer as nn, AgentCoreResolutionError as no, parseMaxTasks as nr, takeAwsEmulatorStateSourceHint as ns, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, buildNamespaceOwnerForwarderDockerArgs as oa, groupRoutesByServer as oi, applyEdgeRequestResult as on, formatStateRemedy as oo, runEcsServiceEmulator as or, createMixedModeTlsMaterials as os, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, isEcrRegistryConfigKey as pa, buildJwksUrlFromIssuer as pi, describeS3OriginDomain as pn, deployedFillMayBeSecret as po, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, webSocketApiMatchesIdentifier as qa, classifySourceChange as qi, serviceStrategy as qn, mergeJavaToolOptions as qo, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, LOOPBACK_FORWARDER_IMAGE as ra, availableApiIdentifiers as ri, resolveErrorResponseCandidates as rn, pickAgentCoreCandidateStack as ro, parseRestartPolicy as rr, writeCaBundleFile as rs, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, describeForwarderFailure as sa, readMtlsMaterialsFromDisk as si, applyEdgeResponseResult as sn, substituteImagePlaceholders as so, ImageOverrideError as sr, buildStsClientConfig as ss, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, attachLoopbackForwarder as ta, attachStageContext as ti, matchBehavior as tn, AGENTCORE_RUNTIME_TYPE as to, ecsClusterOption as tr, setActiveWorkloadAwsWiring as ts, waitForAppAnswer as tt, reinvoke as u, architectureToPlatform as ua, resolveServiceIntegrationParameters as ui, edgeHeadersToHttp as un, DynamicReferenceResolutionError as uo, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveRuntimeImage as va, buildMethodArn as vi, pickLambdaEdgeFunctionLogicalId as vn, resolveDynamicReferencesInEnv as vo, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, substituteEnvVarsFromStateAsync as wa, applyCorsResponseHeaders as wi, WEB_FUNCTION_TYPE as wn, deployAccountStsClientConfig as wo, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, substituteAgainstState as xa, invokeRequestAuthorizer as xi, resolveCloudFrontDistribution as xn, awsEndpointOptions as xo, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, EcsTaskResolutionError as ya, computeRequestIdentityHash as yi, pickTargetFunctionLogicalId as yn, withoutKeys as yo, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, resolveSingleTarget as za, bufferToBody as zi, albStrategy as zn, collectHostEndpointOverrides as zo, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
-//# sourceMappingURL=local-studio-BK2wPCoQ.js.map
+export { postHook as $, AGENTCORE_HTTP_PROTOCOL as $a, probeHostGatewaySupport as $i, addImageOverrideOptions as $n, readProfileEndpointSettings as $o, resolveApiTargetSubset as $r, classifyS3Error as $t, microvmFidelityWarnings as A, isCfnFlagPresent as Aa, translateLambdaResponse as Ai, stripCloudFrontImport as An, AUTH_OFF_PLACEHOLDER_CREDENTIALS as Ao, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, countTargets as Ba, ConnectionRegistry as Bi, createLocalStartAlbCommand as Bn, collectHostEndpointOverrides as Bo, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, substituteEnvVarsFromState as Ca, attachAuthorizers as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, assumedRoleRecorded as Co, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, UNNAMED_WORKLOAD as Da, isFunctionUrlOacFronted as Di, compileCloudFrontFunction as Dn, resetWorkloadIdentity as Do, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, LocalStateSourceError as Ea, buildCorsConfigFromCloudFrontChain as Ei, resolveWebFunctionTarget as En, recordAssumedRole as Eo, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, CfnLocalStateProvider as Fa, pickResponseTemplate as Fi, findFileAssetForObjectKey as Fn, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as Fo, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, filterWebSocketApisByIdentifiers as Ga, buildDisconnectEvent as Gi, addStartServiceSpecificOptions as Gn, getContainerJavaTruststorePath as Go, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, availableWebSocketApiIdentifiers as Ha, handleConnectionsRequest as Hi, resolveAlbTarget as Hn, effectiveLoopbackPorts as Ho, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, collectSsmParameterRefs as Ia, selectIntegrationResponse as Ii, isBucketDeploymentResource as In, activateWorkloadAwsWiring as Io, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, discoverRoutes as Ja, createFileWatcher as Ji, addRunTaskSpecificOptions as Jn, loopbackForwarderPlan as Jo, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, parseSelectionExpressionPath as Ka, buildMessageEvent as Ki, createLocalStartServiceCommand as Kn, javaTruststoreToolOptions as Ko, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, resolveSsmParameters as La, tryParseStatus as Li, resolveBucketDeploymentObjectKey as Ln, applyWorkloadAwsWiringToEnv as Lo, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, resolveCfnFallbackRegion as Ma, buildHttpApiV2Event as Mi, createLocalFileKvsDataSource as Mn, DEFAULT_AWS_EMULATOR_URL as Mo, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, resolveCfnRegion as Na, buildRestV1Event as Ni, createUnboundCloudFrontModule as Nn, EMULATOR_SCRUBBED_ENV_KEYS as No, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, createLocalStateProvider as Oa, matchPreflight as Oi, runViewerRequest as On, workloadClientConfig as Oo, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, resolveCfnStackName as Pa, evaluateResponseParameters as Pi, bucketDeploymentSourceObjectKeys as Pn, HOST_CA_TRUST_ENV_KEYS as Po, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, AGENTCORE_AGUI_PROTOCOL as Qa, HOST_GATEWAY_MIN_VERSION as Qi, addEcsAssumeRoleOptions as Qn, readEmulatorRunFiles as Qo, createWatchPredicates as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, resolveWatchConfig as Ra, VtlEvaluationError as Ri, addAlbSpecificOptions as Rn, awsEmulatorEnvName as Ro, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, substituteAgainstStateAsync as Sa, invokeTokenAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SECOND_ASSUME_MESSAGE as So, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, materializeLayerFromArn as Ta, buildCorsConfigByApiId as Ti, WebFunctionResolutionError as Tn, readEnvCallerCredentials as To, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, discoverWebSocketApis as Ua, parseConnectionsPath as Ui, isApplicationLoadBalancer as Un, getActiveWorkloadAwsWiring as Uo, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, listTargets as Va, buildMgmtEndpointEnvUrl as Vi, parseLbPortOverrides as Vn, displayEndpointValue as Vo, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, discoverWebSocketApisOrThrow as Wa, buildConnectEvent as Wi, resolveAlbFrontDoor as Wn, getContainerCaBundlePath as Wo, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, resolveLambdaArnIntrinsic as Xa, createLocalInvokeCommand as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, parseAwsEndpoint as Xo, addStartApiSpecificOptions as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, pickRefLogicalId as Ya, addInvokeSpecificOptions as Yi, createLocalRunTaskCommand as Yn, mergeJavaToolOptions as Yo, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, AGENTCORE_A2A_PROTOCOL as Za, HOST_DOCKER_INTERNAL_GATEWAY as Zi, addCommonEcsServiceOptions as Zn, probeAwsEmulatorHealth as Zo, createLocalStartApiCommand as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveRuntimeFileExtension as _a, verifyJwtViaDiscovery as _i, pickKvsLogicalIdFromArn as _n, parseDynamicReference as _o, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, buildLoopbackForwarderDockerArgs as aa, filterRoutesByApiIdentifiers as ai, serveLambdaUrlOrigin as an, derivePseudoParametersFromRegion as ao, resolveSharedSidecarCredentials as ar, writeCaBundleFile as as, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, assertEcsTaskImagesResolvable as ba, evaluateCachedLambdaPolicy as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, addAwsEndpointOptions as bo, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, ensureForwarderImage as ca, startApiServer as ci, buildEdgeRequestEvent as cn, tryResolveImageFnJoin as co, buildImageOverrideTag as cr, isRealAwsHost as cs, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, buildContainerImage as da, defaultCredentialsLoader as di, httpHeadersToEdge as dn, DynamicReferenceResolver as do, mergeForService as dr, sqsEmulatorOriginOf as ds, createLocalStartWebFunctionCommand as dt, resolveHostGatewayExtraHosts as ea, createAuthorizerCache as ei, createS3OriginReader as en, AGENTCORE_MCP_PROTOCOL as eo, buildEcsImageResolutionContext$1 as er, resolveAwsEmulatorOption as es, runHookBody as et, filterStudioCustomResources as f, dockerRegistryEnv as fa, buildCognitoJwksUrl as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, containsDynamicReference as fo, parseImageOverrideFlags as fr, buildJavaTrustStore as fs, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, resolveRuntimeCodeMountPath as ga, verifyJwtAuthorizer as gi, pickFunctionUrlLogicalIdFromOrigin as gn, keysOverriddenBy as go, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, stripEcrCredentials as ha, verifyCognitoJwt as hi, isCloudFrontDistribution as hn, keysNotFromTemplate as ho, describePinnedImageUri as hr, resolveProfileCredentials as hs, selectServeInboundAuth as ht, coerceStopRequest as i, awaitLoopbackForwarderStatus as ia, filterRoutesByApiIdentifier as ii, serveFromStaticOrigin as in, resolveAgentCoreTarget as io, resolveEcsAssumeRoleOption as ir, takeAwsEmulatorStateSourceHint as is, MicrovmResolutionError as it, readRunHookPayload as j, rejectExplicitCfnStackWithMultipleStacks as ja, applyAuthorizerOverlay as ji, createCloudFrontModule as jn, CA_TRUST_ENV_KEYS as jo, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, groupWorkloadsRoutedApart as ka, matchRoute as ki, runViewerResponse as kn, workloadStsClientConfig as ko, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, startLoopbackForwarder as la, resolveSelectionExpression as li, buildEdgeResponseEvent as ln, LocalInvokeBuildError as lo, canonicalizeImageOverrideKeys as lr, realSqsHostnames as ls, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, noImplicitEcrPullArgs as ma, createJwksCache as mi, extractKvsAssociations as mn, firstUsableRegion as mo, runImageOverrideBuilds as mr, buildStsClientConfig as ms, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, withWorkloadAwsWiring as na, buildStageMap as ni, startCloudFrontServer as nn, AgentCoreResolutionError as no, parseMaxTasks as nr, resolveWorkloadAwsWiring as ns, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, buildNamespaceOwnerForwarderDockerArgs as oa, groupRoutesByServer as oi, applyEdgeRequestResult as on, formatStateRemedy as oo, runEcsServiceEmulator as or, MIXED_MODE_RESIGN_BODY_CAP_BYTES as os, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, isEcrRegistryConfigKey as pa, buildJwksUrlFromIssuer as pi, describeS3OriginDomain as pn, deployedFillMayBeSecret as po, resolveImageOverrides as pr, createMixedModeTlsMaterials as ps, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, webSocketApiMatchesIdentifier as qa, classifySourceChange as qi, serviceStrategy as qn, logMixedModeForWorkload as qo, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, LOOPBACK_FORWARDER_IMAGE as ra, availableApiIdentifiers as ri, resolveErrorResponseCandidates as rn, pickAgentCoreCandidateStack as ro, parseRestartPolicy as rr, setActiveWorkloadAwsWiring as rs, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, describeForwarderFailure as sa, readMtlsMaterialsFromDisk as si, applyEdgeResponseResult as sn, substituteImagePlaceholders as so, ImageOverrideError as sr, REAL_SQS_QUEUE_URL as ss, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, attachLoopbackForwarder as ta, attachStageContext as ti, matchBehavior as tn, AGENTCORE_RUNTIME_TYPE as to, ecsClusterOption as tr, resolveHostDefaultCredentials as ts, waitForAppAnswer as tt, reinvoke as u, architectureToPlatform as ua, resolveServiceIntegrationParameters as ui, edgeHeadersToHttp as un, DynamicReferenceResolutionError as uo, enforceImageOverrideOrphans as ur, rewriteSqsQueueUrlsInEnv as us, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveRuntimeImage as va, buildMethodArn as vi, pickLambdaEdgeFunctionLogicalId as vn, resolveDynamicReferencesInEnv as vo, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, substituteEnvVarsFromStateAsync as wa, applyCorsResponseHeaders as wi, WEB_FUNCTION_TYPE as wn, deployAccountStsClientConfig as wo, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, substituteAgainstState as xa, invokeRequestAuthorizer as xi, resolveCloudFrontDistribution as xn, awsEndpointOptions as xo, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, EcsTaskResolutionError as ya, computeRequestIdentityHash as yi, pickTargetFunctionLogicalId as yn, withoutKeys as yo, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, resolveSingleTarget as za, bufferToBody as zi, albStrategy as zn, awsEmulatorSqsHostBlocks as zo, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
+//# sourceMappingURL=local-studio-DC3gGXhH.js.map