cdk-local 0.167.0 → 0.167.1

package/dist/{local-studio-DRE1RQLn.js → local-studio-CrP4kia1.js}

@@ -2457,9 +2457,26 @@ async function resolveDynamicReferencesInEnv(env, options) {
 	}
 }
 
+// src/utils/ambient-default-region.ts
+let recorded;
+function setAmbientDefaultRegion(region) {
+	recorded = region === "" ? void 0 : region;
+}
+function ambientDefaultRegion() {
+	return recorded !== void 0 && process.env["AWS_REGION"] === recorded ? recorded : void 0;
+}
+function namedEnvAwsRegion() {
+	return ambientDefaultRegion() === void 0 ? process.env["AWS_REGION"] : void 0;
+}
+function regionOrAmbientDefault(stackRegion) {
+	const ambient = ambientDefaultRegion();
+	if (ambient === void 0) return stackRegion;
+	return stackRegion === void 0 || stackRegion === "" || stackRegion === "unknown-region" ? ambient : stackRegion;
+}
+
 // src/utils/profile-region.ts
 async function resolveContainerRegion(sources) {
-	const named = firstUsableRegion(sources.region, process.env["AWS_REGION"], process.env["AWS_DEFAULT_REGION"], sources.stackRegion, sources.stateRegion);
+	const named = firstUsableRegion(sources.region, namedEnvAwsRegion(), process.env["AWS_DEFAULT_REGION"], sources.stackRegion, sources.stateRegion, ambientDefaultRegion());
 	if (named) return named.toLowerCase();
 	return firstUsableRegion(await resolveSdkDefaultRegion(sources.profile))?.toLowerCase();
 }
@@ -5678,7 +5695,7 @@ function hostStateSourceFields(options, extraStateProviders) {
 	return { ...options };
 }
 function resolveCfnRegion(options, synthRegion) {
-	const region = options.stackRegion ?? options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion;
+	const region = options.stackRegion ?? options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(synthRegion);
 	if (region === void 0) throw new LocalStateSourceError("--from-cfn-stack requires a region to query CloudFormation. Set one of: --stack-region <region>, --region <region>, AWS_REGION env var, AWS_DEFAULT_REGION env var, or an env.region on the target CDK stack.");
 	return region;
 }
@@ -6297,7 +6314,15 @@ async function substituteAgainstStateAsync(value, contextOrResources) {
 	};
 	const intrinsic = keys[0];
 	const arg = obj[intrinsic];
-	if (intrinsic === "Ref" || intrinsic === "Fn::GetAtt" || intrinsic === "Fn::Sub" || intrinsic === "Fn::Join" || intrinsic === "Fn::Select" || intrinsic === "Fn::Split") return substituteAgainstState(value, context);
+	if (intrinsic === "Ref" || intrinsic === "Fn::GetAtt" || intrinsic === "Fn::Sub" || intrinsic === "Fn::Join" || intrinsic === "Fn::Select" || intrinsic === "Fn::Split") {
+		if (!containsCrossStackIntrinsic(value)) return substituteAgainstState(value, context);
+		const rewritten = await resolveNestedCrossStack(value, context);
+		if ("reason" in rewritten) return {
+			kind: "unresolved",
+			reason: rewritten.reason
+		};
+		return substituteAgainstState(rewritten.value, context);
+	}
 	if (intrinsic === "Fn::ImportValue") return resolveImportValueAsync(arg, context);
 	if (intrinsic === "Fn::GetStackOutput") return resolveGetStackOutputAsync(arg, context);
 	return {
@@ -6305,6 +6330,39 @@ async function substituteAgainstStateAsync(value, contextOrResources) {
 		reason: `unsupported intrinsic ${displayIdent(intrinsic)} (supported: Ref, Fn::GetAtt, Fn::Sub, Fn::Join, Fn::Select, Fn::Split, Fn::ImportValue, Fn::GetStackOutput)`
 	};
 }
+function isCrossStackNode(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.hasOwn(value, "Fn::ImportValue") || Object.hasOwn(value, "Fn::GetStackOutput");
+}
+function containsCrossStackIntrinsic(value) {
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value)) return value.some(containsCrossStackIntrinsic);
+	if (isCrossStackNode(value)) return true;
+	return Object.values(value).some(containsCrossStackIntrinsic);
+}
+async function resolveNestedCrossStack(value, context) {
+	if (!containsCrossStackIntrinsic(value)) return { value };
+	if (isCrossStackNode(value)) {
+		const sub = await substituteAgainstStateAsync(value, context);
+		return sub.kind === "literal" ? { value: sub.value } : { reason: sub.reason };
+	}
+	if (Array.isArray(value)) {
+		const out = [];
+		for (const item of value) {
+			const r = await resolveNestedCrossStack(item, context);
+			if ("reason" in r) return r;
+			out.push(r.value);
+		}
+		return { value: out };
+	}
+	const out = {};
+	for (const [key, item] of Object.entries(value)) {
+		const r = await resolveNestedCrossStack(item, context);
+		if ("reason" in r) return r;
+		defineOwnKey(out, key, r.value);
+	}
+	return { value: out };
+}
 async function resolveImportValueAsync(arg, context) {
 	const inner = substituteAgainstState(arg, context);
 	if (inner.kind !== "literal") return {
@@ -6637,6 +6695,12 @@ function detectEcsImageResolutionNeeds(stack) {
 			if (need.pseudo) needsPseudoParameters = true;
 			if (need.state) needsStateResources = true;
 			if (containerHasIntrinsicEnvOrSecret(co)) needsEnvOrSecretSubstitution = true;
+			const argv = containerArgvElements(co);
+			if (argv.some((v) => v !== null && typeof v === "object")) needsEnvOrSecretSubstitution = true;
+			if (argv.some(isCrossStackIntrinsic)) {
+				needsEnvOrSecretSubstitution = true;
+				needsCrossStackResolver = true;
+			}
 			if (containerHasCrossStackEnvOrSecret(co)) {
 				needsEnvOrSecretSubstitution = true;
 				needsCrossStackResolver = true;
@@ -6675,10 +6739,16 @@ function containerHasCrossStackEnvOrSecret(c) {
 	}
 	return false;
 }
+function containerArgvElements(c) {
+	const health = c["HealthCheck"];
+	return [
+		c["Command"],
+		c["EntryPoint"],
+		health && typeof health === "object" ? health["Command"] : void 0
+	].flatMap((l) => Array.isArray(l) ? l : []);
+}
 function isCrossStackIntrinsic(value) {
-	if (!value || typeof value !== "object") return false;
-	const obj = value;
-	return "Fn::ImportValue" in obj || "Fn::GetStackOutput" in obj;
+	return containsCrossStackIntrinsic(value);
 }
 function volumeHasIntrinsicSourcePath(v) {
 	if (!v || typeof v !== "object") return false;
@@ -6910,10 +6980,13 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 	const name = pickString(c["Name"]);
 	if (!name) throw new EcsTaskResolutionError(`Task ${displayIdent(taskLogicalId)} ContainerDefinitions[${idx}] has no Name.`);
 	const image = parseContainerImage(c["Image"], name, taskLogicalId, resources, stack, context);
-	const command = pickStringArray$1(c["Command"]);
-	const entryPoint = pickStringArray$1(c["EntryPoint"]);
+	const containerContext = contextForContainer(context, name);
+	const subContext = buildSubstitutionContextFromImageContext(containerContext);
+	const unresolvedCommandElements = [];
+	const argv = (raw, field) => resolveArgvArray(raw, field, subContext, containerContext, unresolvedCommandElements);
+	const command = argv(c["Command"], "Command");
+	const entryPoint = argv(c["EntryPoint"], "EntryPoint");
 	const workingDirectory = pickString(c["WorkingDirectory"]);
-	const subContext = buildSubstitutionContextFromImageContext(contextForContainer(context, name));
 	const environment = {};
 	const sensitiveEnvKeys = [];
 	const droppedEnvKeys = [];
@@ -7027,7 +7100,7 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 	let healthCheck;
 	if (c["HealthCheck"] && typeof c["HealthCheck"] === "object") {
 		const h = c["HealthCheck"];
-		const command2 = pickStringArray$1(h["Command"]);
+		const command2 = argv(h["Command"], "HealthCheck.Command");
 		if (command2 && command2.length > 0) {
 			healthCheck = { command: command2 };
 			if (typeof h["Interval"] === "number") healthCheck.interval = h["Interval"];
@@ -7079,8 +7152,117 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 	if (user !== void 0) out.user = user;
 	if (privileged !== void 0) out.privileged = privileged;
 	if (readonlyRootFilesystem !== void 0) out.readonlyRootFilesystem = readonlyRootFilesystem;
+	if (unresolvedCommandElements.length > 0) out.unresolvedCommandElements = unresolvedCommandElements;
+	return out;
+}
+function resolveArgvArray(raw, field, subContext, context, unresolved) {
+	if (!Array.isArray(raw)) return void 0;
+	return raw.map((element, index) => {
+		if (typeof element === "string") return element;
+		if (typeof element === "number" || typeof element === "boolean") return String(element);
+		if (!element || typeof element !== "object" || Array.isArray(element)) {
+			unresolved.push({
+				field,
+				index,
+				reason: "not a string or an intrinsic"
+			});
+			return "";
+		}
+		if (isCrossStackIntrinsic(element)) {
+			unresolved.push({
+				field,
+				index,
+				reason: CROSS_STACK_ARGV_REASON
+			});
+			return "";
+		}
+		if (!subContext) {
+			unresolved.push({
+				field,
+				index,
+				reason: `intrinsic-valued and no deployed state was loaded: ${formatStateRemedy(context)}`
+			});
+			return "";
+		}
+		const secret = secretAttributeRead(element, subContext.resources);
+		if (secret !== void 0) {
+			unresolved.push({
+				field,
+				index,
+				reason: secret
+			});
+			return "";
+		}
+		const { result: sub, consumedSensitive } = resolveWithSensitivity(element, subContext);
+		const arg = argvValue(sub, consumedSensitive);
+		if ("value" in arg) return arg.value;
+		unresolved.push({
+			field,
+			index,
+			reason: arg.reason
+		});
+		return "";
+	});
+}
+const STATE_SECRET_MASK = "***";
+const SECRET_ATTRIBUTE_NAME = /secret|password|credential/i;
+const NON_SECRET_ATTRIBUTE_SUFFIX = /(arn|id|name|url|alias|status)$/i;
+const SECRET_VALUED_ATTRIBUTES = /* @__PURE__ */ new Map([
+	["AWS::AppSync::ApiKey", ["ApiKey"]],
+	["AWS::EC2::IpamExternalResourceVerificationToken", ["TokenValue"]],
+	["AWS::IVS::StreamKey", ["Value"]]
+]);
+function secretAttributeRead(element, stateResources) {
+	for (const [logicalId, attribute] of getAttReads(element)) {
+		const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+		const recorded = record?.attributes;
+		const stored = recorded && Object.hasOwn(recorded, attribute) ? recorded[attribute] : void 0;
+		const type = typeof record?.resourceType === "string" ? record.resourceType : "";
+		const typed = SECRET_VALUED_ATTRIBUTES.get(type);
+		if (SECRET_ATTRIBUTE_NAME.test(attribute) && !NON_SECRET_ATTRIBUTE_SUFFIX.test(attribute) || typed?.includes(attribute) === true || type.startsWith("Custom::") || type === "AWS::CloudFormation::CustomResource" || type === "AWS::CloudFormation::Stack" && attribute.startsWith("Outputs.") || stored === STATE_SECRET_MASK) return `reads ${displayIdent(logicalId)}.${displayIdent(attribute)}, an attribute that is or may be a secret, which ${getEmbedConfig().binaryName} will not put on the docker run command line; pass the value through Environment or Secrets instead`;
+	}
+}
+function getAttReads(node, out = []) {
+	if (node === null || typeof node !== "object") return out;
+	if (Array.isArray(node)) {
+		for (const item of node) getAttReads(item, out);
+		return out;
+	}
+	for (const [key, value] of Object.entries(node)) {
+		if (key === "Fn::GetAtt") {
+			if (Array.isArray(value) && typeof value[0] === "string" && typeof value[1] === "string") out.push([value[0], value[1]]);
+			else if (typeof value === "string" && value.includes(".")) {
+				const dot = value.indexOf(".");
+				out.push([value.slice(0, dot), value.slice(dot + 1)]);
+			}
+		} else if (key === "Fn::Sub") {
+			const template = Array.isArray(value) ? value[0] : value;
+			if (typeof template === "string") for (const m of template.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+				const ref = m[1].trim();
+				const dot = ref.indexOf(".");
+				if (dot > 0 && !ref.startsWith("AWS::")) out.push([ref.slice(0, dot), ref.slice(dot + 1)]);
+			}
+		}
+		getAttReads(value, out);
+	}
 	return out;
 }
+const CROSS_STACK_ARGV_REASON = "a cross-stack reference (Fn::ImportValue / Fn::GetStackOutput): it resolves only from a state source with the producer stack deployed";
+function argvValue(sub, consumedSensitive) {
+	if (sub.kind !== "literal") return { reason: sub.reason };
+	if (consumedSensitive) return { reason: "resolved from a SecureString parameter, which would put the secret on the docker run argv; move the value into an Environment variable or a Secrets entry" };
+	const value = sub.value;
+	if (typeof value === "number" || typeof value === "boolean") return { value: String(value) };
+	if (value === STATE_SECRET_MASK) return { reason: "resolved to the secret mask (***), not the deployed value" };
+	if (containsDynamicReference(value)) return { reason: "resolved to a CloudFormation dynamic reference ({{resolve:...}}), which is resolved only in Environment, because resolving one here would put the secret on the docker run argv; move the value into an Environment variable or a Secrets entry" };
+	return { value };
+}
+function assertEcsTaskCommandsResolved(task) {
+	const lines = [];
+	for (const container of task.containers) for (const u of container.unresolvedCommandElements ?? []) lines.push(`  - Container ${displayIdent(container.name)} ${u.field}[${u.index}]: ${u.reason}`);
+	if (lines.length === 0) return;
+	throw new EcsTaskResolutionError(`Task ${displayIdent(task.taskDefinitionLogicalId)} has container command elements ${getEmbedConfig().binaryName} could not resolve:\n${lines.join("\n")}\nRefusing to run the task with these arguments missing, since that runs a different command than the deployed task.`);
+}
 function buildSubstitutionContextFromImageContext(context) {
 	if (!context?.stateResources) return void 0;
 	const subContext = { resources: context.stateResources };
@@ -7391,6 +7573,21 @@ async function applyCrossStackValuesToTask(task, crossStackResolver, opts) {
 		dynamicRefs.dispose();
 	}
 }
+function argvTarget(container, field) {
+	if (field === "Command") return container.command;
+	if (field === "EntryPoint") return container.entryPoint;
+	return container.healthCheck?.command;
+}
+function rawArgv(c, field) {
+	let raw;
+	if (field === "Command") raw = c["Command"];
+	else if (field === "EntryPoint") raw = c["EntryPoint"];
+	else {
+		const h = c["HealthCheck"];
+		raw = h && typeof h === "object" ? h["Command"] : void 0;
+	}
+	return Array.isArray(raw) ? raw : void 0;
+}
 function withContainerState(context, state) {
 	const out = {
 		...context,
@@ -7456,6 +7653,38 @@ async function applyCrossStackResolverToTask(task, context, containerState) {
 				resolvedSecretNames.add(sName);
 			}
 		}
+		if (container.unresolvedCommandElements?.length) {
+			const argvContext = ownState ? withContainerState(secretContext, ownState) : secretContext;
+			const remaining = [];
+			for (const u of container.unresolvedCommandElements) {
+				const target = argvTarget(container, u.field);
+				const rawElement = rawArgv(c, u.field)?.[u.index];
+				if (!target || !isCrossStackIntrinsic(rawElement)) {
+					remaining.push(u);
+					continue;
+				}
+				const secret = secretAttributeRead(rawElement, argvContext.resources);
+				if (secret !== void 0) {
+					remaining.push({
+						...u,
+						reason: secret
+					});
+					continue;
+				}
+				const { result: sub, consumedSensitive } = await resolveWithSensitivityAsync(rawElement, argvContext);
+				const arg = argvValue(sub, consumedSensitive);
+				if ("value" in arg) {
+					target[u.index] = arg.value;
+					continue;
+				}
+				remaining.push({
+					...u,
+					reason: arg.reason
+				});
+			}
+			if (remaining.length > 0) container.unresolvedCommandElements = remaining;
+			else delete container.unresolvedCommandElements;
+		}
 		if (resolvedEnvKeys.size > 0 || resolvedSecretNames.size > 0) {
 			container.warnings = container.warnings.filter((w) => {
 				for (const k of resolvedEnvKeys) if (w.startsWith(`Environment ${displayIdent(k)} dropped:`)) return false;
@@ -10499,16 +10728,11 @@ function envHasIntrinsicValue$1(templateEnv) {
 }
 function envHasCrossStackIntrinsic(templateEnv) {
 	if (!templateEnv) return false;
-	for (const v of Object.values(templateEnv)) {
-		if (!v || typeof v !== "object") continue;
-		const obj = v;
-		if ("Fn::ImportValue" in obj || "Fn::GetStackOutput" in obj) return true;
-	}
-	return false;
+	return Object.values(templateEnv).some(containsCrossStackIntrinsic);
 }
 async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stackRegion;
+	const region = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(stackRegion);
 	if (!region) logger.warn(`Resolver references \${AWS::Region} but ${getEmbedConfig().binaryName} could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.`);
 	let accountId;
 	try {
@@ -17345,7 +17569,7 @@ async function loadStackStateBundle(stack, provider, args) {
 }
 async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stateRegion;
+	const region = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(stateRegion);
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
@@ -18424,7 +18648,7 @@ async function resolveAgentCoreSigV4Context(options, resolved, loaded, stateProv
 		getLogger().warn(`Runtime ${displayIdent(resolved.logicalId)} declares a customJwtAuthorizer; --sigv4 ignored (JWT path takes precedence).`);
 		return;
 	}
-	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
+	const region = options.region ?? options.stackRegion ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(resolved.stack.region);
 	if (!region) throw new CdkLocalError("--sigv4: no region resolved for the AgentCore signing scope. Pass --region <region>, set AWS_REGION, or use --from-cfn-stack with a region-bound stack.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_REGION");
 	return {
 		credentials: await resolveHostCredentialsForSigV4(options, resolved, loaded, region, stateProvider),
@@ -18558,7 +18782,7 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 		key: s3Source.key,
 		...s3Source.versionId !== void 0 && { versionId: s3Source.versionId }
 	};
-	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
+	const region = options.region ?? options.stackRegion ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(resolved.stack.region);
 	const assumeRoleArn = await resolveAssumeRoleArn(options, resolved, loaded, stateProvider);
 	let credentials;
 	if (assumeRoleArn) try {
@@ -18702,7 +18926,7 @@ function describeIntrinsic(value) {
 }
 async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region;
+	const region = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(candidate.region);
 	let accountId;
 	try {
 		accountId = await resolveCallerAccountId$2(region, options.profile, isCfnFlagPresent(options));
@@ -19854,6 +20078,7 @@ function mergeHostGatewayAddHostFlags(addHostFlags, hostGatewayExtraHosts) {
 async function runEcsTask(task, options, state) {
 	const logger = getLogger();
 	if (task.containers.length === 0) throw new EcsTaskRunnerError(`Task ${displayIdent(task.taskDefinitionLogicalId)} has no containers — nothing to run.`);
+	assertEcsTaskCommandsResolved(task);
 	for (const w of task.warnings) logger.warn(w);
 	const startOrder = topoSort(buildDependencyGraph(task.containers), task.containers);
 	const finchRefusals = [];
@@ -24357,14 +24582,15 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 	const taskStack = stacks.find((s) => s.stackName === service.stack.stackName) ?? service.stack;
 	const taskNeeds = detectEcsImageResolutionNeeds(taskStack);
 	if (stateProvider && taskNeeds.needsCrossStackResolver) {
-		const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? service.stack.region ?? "us-east-1";
+		const consumerRegion = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(service.stack.region) ?? "us-east-1";
 		const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
 		if (resolver) await applyCrossStackValuesToTask(service.task, resolver, {
 			imageContext,
 			consumerRegion,
 			profile: options.profile
 		});
-	} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
+	} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets / Command entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
+	assertEcsTaskCommandsResolved(service.task);
 	const effectiveAssumeRole = resolveEcsAssumeRoleOption(options);
 	let assumedCredentials;
 	let resolvedRoleArn;
@@ -24816,7 +25042,7 @@ async function buildEcsImageResolutionContext$1(target, stacks, options, statePr
 	if (!roleRecordUsable) ctx.ignoreStateForRoles = true;
 	const wantsPseudoForEnvOrSecret = !!stateProvider && needs.needsEnvOrSecretSubstitution;
 	if (needs.needsPseudoParameters || wantsPseudoForEnvOrSecret) {
-		const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region;
+		const region = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(candidate.region);
 		if (!region) logger.warn(`Resolver references \${AWS::Region} but ${getEmbedConfig().binaryName} could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.`);
 		let accountId;
 		try {
@@ -24857,7 +25083,7 @@ async function buildEcsImageResolutionContext$1(target, stacks, options, statePr
 	} else if (!stateProvider && needs.needsStateResources) {
 		if (!opts.suppressStateWarning && !opts.imageOverridden) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI, or --image-override to build it from a local Dockerfile.");
 	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) {
-		if (!opts.suppressStateWarning) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against the deployed state.");
+		if (!opts.suppressStateWarning) logger.warn("Container Environment / Secrets / Command entries contain CloudFormation intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against the deployed state; without one an intrinsic Command / EntryPoint / HealthCheck.Command element refuses the run.");
 	}
 	return ctx;
 }
@@ -25155,14 +25381,15 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 		const taskStack = stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack;
 		const taskNeeds = detectEcsImageResolutionNeeds(taskStack);
 		if (stateProvider && taskNeeds.needsCrossStackResolver) {
-			const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? task.stack.region ?? "us-east-1";
+			const consumerRegion = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(task.stack.region) ?? "us-east-1";
 			const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
 			if (resolver) await applyCrossStackValuesToTask(task, resolver, {
 				imageContext,
 				consumerRegion,
 				profile: options.profile
 			});
-		} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
+		} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets / Command entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
+		assertEcsTaskCommandsResolved(task);
 		const onSignal = createShutdownSignalHandler({
 			cleanup,
 			stoppingMessage: () => "Stopping task...",
@@ -25312,7 +25539,7 @@ async function buildEcsImageResolutionContext(candidate, stateProvider, options,
 	if (!roleRecordUsable) ctx.ignoreStateForRoles = true;
 	const wantsPseudoForEnvOrSecret = !!stateProvider && needs.needsEnvOrSecretSubstitution;
 	if (needs.needsPseudoParameters || wantsPseudoForEnvOrSecret) {
-		const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region;
+		const region = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(candidate.region);
 		if (!region) logger.warn(`Resolver references \${AWS::Region} but ${getEmbedConfig().binaryName} could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.`);
 		let accountId;
 		try {
@@ -25352,7 +25579,7 @@ async function buildEcsImageResolutionContext(candidate, stateProvider, options,
 		if (needs.needsEnvOrSecretSubstitution && stateProviderFor) await loadMixedModeContainerStates(ctx, candidate, stateProviderFor);
 	} else if (!stateProvider && needs.needsStateResources) {
 		if (!options.imageOverride?.length) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI, or --image-override to build it from a local Dockerfile. Otherwise the resolver will surface its existing error.");
-	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
+	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets / Command entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state. Without a state source the Environment / Secrets entries are dropped (per-key warnings will follow), and an intrinsic Command / EntryPoint / HealthCheck.Command element refuses the run.");
 	return ctx;
 }
 function pickCandidateStack(target, stacks) {
@@ -36794,5 +37021,5 @@ function addStudioSpecificOptions(cmd) {
 	return cmd;
 }
 
-export { postHook as $, AGENTCORE_HTTP_PROTOCOL as $a, probeHostGatewaySupport as $i, addImageOverrideOptions as $n, readProfileEndpointSettings as $o, resolveApiTargetSubset as $r, classifyS3Error as $t, microvmFidelityWarnings as A, isCfnFlagPresent as Aa, translateLambdaResponse as Ai, stripCloudFrontImport as An, AUTH_OFF_PLACEHOLDER_CREDENTIALS as Ao, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, countTargets as Ba, ConnectionRegistry as Bi, createLocalStartAlbCommand as Bn, collectHostEndpointOverrides as Bo, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, substituteEnvVarsFromState as Ca, attachAuthorizers as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, assumedRoleRecorded as Co, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, UNNAMED_WORKLOAD as Da, isFunctionUrlOacFronted as Di, compileCloudFrontFunction as Dn, resetWorkloadIdentity as Do, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, LocalStateSourceError as Ea, buildCorsConfigFromCloudFrontChain as Ei, resolveWebFunctionTarget as En, recordAssumedRole as Eo, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, CfnLocalStateProvider as Fa, pickResponseTemplate as Fi, findFileAssetForObjectKey as Fn, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as Fo, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, filterWebSocketApisByIdentifiers as Ga, buildDisconnectEvent as Gi, addStartServiceSpecificOptions as Gn, getContainerJavaTruststorePath as Go, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, availableWebSocketApiIdentifiers as Ha, handleConnectionsRequest as Hi, resolveAlbTarget as Hn, effectiveLoopbackPorts as Ho, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, collectSsmParameterRefs as Ia, selectIntegrationResponse as Ii, isBucketDeploymentResource as In, activateWorkloadAwsWiring as Io, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, discoverRoutes as Ja, createFileWatcher as Ji, addRunTaskSpecificOptions as Jn, loopbackForwarderPlan as Jo, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, parseSelectionExpressionPath as Ka, buildMessageEvent as Ki, createLocalStartServiceCommand as Kn, javaTruststoreToolOptions as Ko, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, resolveSsmParameters as La, tryParseStatus as Li, resolveBucketDeploymentObjectKey as Ln, applyWorkloadAwsWiringToEnv as Lo, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, resolveCfnFallbackRegion as Ma, buildHttpApiV2Event as Mi, createLocalFileKvsDataSource as Mn, DEFAULT_AWS_EMULATOR_URL as Mo, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, resolveCfnRegion as Na, buildRestV1Event as Ni, createUnboundCloudFrontModule as Nn, EMULATOR_SCRUBBED_ENV_KEYS as No, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, createLocalStateProvider as Oa, matchPreflight as Oi, runViewerRequest as On, workloadClientConfig as Oo, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, resolveCfnStackName as Pa, evaluateResponseParameters as Pi, bucketDeploymentSourceObjectKeys as Pn, HOST_CA_TRUST_ENV_KEYS as Po, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, AGENTCORE_AGUI_PROTOCOL as Qa, HOST_GATEWAY_MIN_VERSION as Qi, addEcsAssumeRoleOptions as Qn, readEmulatorRunFiles as Qo, createWatchPredicates as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, resolveWatchConfig as Ra, VtlEvaluationError as Ri, addAlbSpecificOptions as Rn, awsEmulatorEnvName as Ro, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, substituteAgainstStateAsync as Sa, invokeTokenAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SECOND_ASSUME_MESSAGE as So, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, materializeLayerFromArn as Ta, buildCorsConfigByApiId as Ti, WebFunctionResolutionError as Tn, readEnvCallerCredentials as To, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, discoverWebSocketApis as Ua, parseConnectionsPath as Ui, isApplicationLoadBalancer as Un, getActiveWorkloadAwsWiring as Uo, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, listTargets as Va, buildMgmtEndpointEnvUrl as Vi, parseLbPortOverrides as Vn, displayEndpointValue as Vo, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, discoverWebSocketApisOrThrow as Wa, buildConnectEvent as Wi, resolveAlbFrontDoor as Wn, getContainerCaBundlePath as Wo, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, resolveLambdaArnIntrinsic as Xa, createLocalInvokeCommand as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, parseAwsEndpoint as Xo, addStartApiSpecificOptions as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, pickRefLogicalId as Ya, addInvokeSpecificOptions as Yi, createLocalRunTaskCommand as Yn, mergeJavaToolOptions as Yo, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, AGENTCORE_A2A_PROTOCOL as Za, HOST_DOCKER_INTERNAL_GATEWAY as Zi, addCommonEcsServiceOptions as Zn, probeAwsEmulatorHealth as Zo, createLocalStartApiCommand as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveRuntimeFileExtension as _a, verifyJwtViaDiscovery as _i, pickKvsLogicalIdFromArn as _n, parseDynamicReference as _o, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, buildLoopbackForwarderDockerArgs as aa, filterRoutesByApiIdentifiers as ai, serveLambdaUrlOrigin as an, derivePseudoParametersFromRegion as ao, resolveSharedSidecarCredentials as ar, writeCaBundleFile as as, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, assertEcsTaskImagesResolvable as ba, evaluateCachedLambdaPolicy as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, addAwsEndpointOptions as bo, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, ensureForwarderImage as ca, startApiServer as ci, buildEdgeRequestEvent as cn, tryResolveImageFnJoin as co, buildImageOverrideTag as cr, isRealAwsHost as cs, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, buildContainerImage as da, defaultCredentialsLoader as di, httpHeadersToEdge as dn, DynamicReferenceResolver as do, mergeForService as dr, rewriteSqsQueueUrlsInEnv as ds, createLocalStartWebFunctionCommand as dt, resolveHostGatewayExtraHosts as ea, createAuthorizerCache as ei, createS3OriginReader as en, AGENTCORE_MCP_PROTOCOL as eo, buildEcsImageResolutionContext$1 as er, resolveAwsEmulatorOption as es, runHookBody as et, filterStudioCustomResources as f, dockerRegistryEnv as fa, buildCognitoJwksUrl as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, containsDynamicReference as fo, parseImageOverrideFlags as fr, sqsEmulatorOriginOf as fs, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, resolveRuntimeCodeMountPath as ga, verifyJwtAuthorizer as gi, pickFunctionUrlLogicalIdFromOrigin as gn, keysOverriddenBy as go, imageOverrideKeyAliases as gr, resolveProfileCredentials as gs, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, stripEcrCredentials as ha, verifyCognitoJwt as hi, isCloudFrontDistribution as hn, keysNotFromTemplate as ho, describePinnedImageUri as hr, buildStsClientConfig as hs, selectServeInboundAuth as ht, coerceStopRequest as i, awaitLoopbackForwarderStatus as ia, filterRoutesByApiIdentifier as ii, serveFromStaticOrigin as in, resolveAgentCoreTarget as io, resolveEcsAssumeRoleOption as ir, takeAwsEmulatorStateSourceHint as is, MicrovmResolutionError as it, readRunHookPayload as j, rejectExplicitCfnStackWithMultipleStacks as ja, applyAuthorizerOverlay as ji, createCloudFrontModule as jn, CA_TRUST_ENV_KEYS as jo, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, groupWorkloadsRoutedApart as ka, matchRoute as ki, runViewerResponse as kn, workloadStsClientConfig as ko, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, startLoopbackForwarder as la, resolveSelectionExpression as li, buildEdgeResponseEvent as ln, LocalInvokeBuildError as lo, canonicalizeImageOverrideKeys as lr, realSqsHostnames as ls, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, noImplicitEcrPullArgs as ma, createJwksCache as mi, extractKvsAssociations as mn, firstUsableRegion as mo, runImageOverrideBuilds as mr, createMixedModeTlsMaterials as ms, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, withWorkloadAwsWiring as na, buildStageMap as ni, startCloudFrontServer as nn, AgentCoreResolutionError as no, parseMaxTasks as nr, resolveWorkloadAwsWiring as ns, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, buildNamespaceOwnerForwarderDockerArgs as oa, groupRoutesByServer as oi, applyEdgeRequestResult as on, formatStateRemedy as oo, runEcsServiceEmulator as or, MIXED_MODE_RESIGN_BODY_CAP_BYTES as os, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, isEcrRegistryConfigKey as pa, buildJwksUrlFromIssuer as pi, describeS3OriginDomain as pn, deployedFillMayBeSecret as po, resolveImageOverrides as pr, buildJavaTrustStore as ps, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, webSocketApiMatchesIdentifier as qa, classifySourceChange as qi, serviceStrategy as qn, logMixedModeForWorkload as qo, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, LOOPBACK_FORWARDER_IMAGE as ra, availableApiIdentifiers as ri, resolveErrorResponseCandidates as rn, pickAgentCoreCandidateStack as ro, parseRestartPolicy as rr, setActiveWorkloadAwsWiring as rs, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, describeForwarderFailure as sa, readMtlsMaterialsFromDisk as si, applyEdgeResponseResult as sn, substituteImagePlaceholders as so, ImageOverrideError as sr, REAL_SQS_QUEUE_URL as ss, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, attachLoopbackForwarder as ta, attachStageContext as ti, matchBehavior as tn, AGENTCORE_RUNTIME_TYPE as to, ecsClusterOption as tr, resolveHostDefaultCredentials as ts, waitForAppAnswer as tt, reinvoke as u, architectureToPlatform as ua, resolveServiceIntegrationParameters as ui, edgeHeadersToHttp as un, DynamicReferenceResolutionError as uo, enforceImageOverrideOrphans as ur, repointLocalSqsQueueUrlsInEnv as us, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveRuntimeImage as va, buildMethodArn as vi, pickLambdaEdgeFunctionLogicalId as vn, resolveDynamicReferencesInEnv as vo, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, substituteEnvVarsFromStateAsync as wa, applyCorsResponseHeaders as wi, WEB_FUNCTION_TYPE as wn, deployAccountStsClientConfig as wo, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, substituteAgainstState as xa, invokeRequestAuthorizer as xi, resolveCloudFrontDistribution as xn, awsEndpointOptions as xo, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, EcsTaskResolutionError as ya, computeRequestIdentityHash as yi, pickTargetFunctionLogicalId as yn, withoutKeys as yo, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, resolveSingleTarget as za, bufferToBody as zi, albStrategy as zn, awsEmulatorSqsHostBlocks as zo, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
-//# sourceMappingURL=local-studio-DRE1RQLn.js.map
+export { postHook as $, AGENTCORE_A2A_PROTOCOL as $a, probeHostGatewaySupport as $i, addImageOverrideOptions as $n, loopbackForwarderPlan as $o, resolveApiTargetSubset as $r, classifyS3Error as $t, microvmFidelityWarnings as A, createLocalStateProvider as Aa, translateLambdaResponse as Ai, stripCloudFrontImport as An, readEnvCallerCredentials as Ao, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, resolveWatchConfig as Ba, ConnectionRegistry as Bi, createLocalStartAlbCommand as Bn, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as Bo, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, substituteAgainstState as Ca, attachAuthorizers as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, resolveDynamicReferencesInEnv as Co, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, materializeLayerFromArn as Da, isFunctionUrlOacFronted as Di, compileCloudFrontFunction as Dn, SECOND_ASSUME_MESSAGE as Do, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, substituteEnvVarsFromStateAsync as Ea, buildCorsConfigFromCloudFrontChain as Ei, resolveWebFunctionTarget as En, awsEndpointOptions as Eo, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, resolveCfnRegion as Fa, pickResponseTemplate as Fi, findFileAssetForObjectKey as Fn, AUTH_OFF_PLACEHOLDER_CREDENTIALS as Fo, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, discoverWebSocketApis as Ga, buildDisconnectEvent as Gi, addStartServiceSpecificOptions as Gn, collectHostEndpointOverrides as Go, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, countTargets as Ha, handleConnectionsRequest as Hi, resolveAlbTarget as Hn, applyWorkloadAwsWiringToEnv as Ho, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, resolveCfnStackName as Ia, selectIntegrationResponse as Ii, isBucketDeploymentResource as In, CA_TRUST_ENV_KEYS as Io, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, parseSelectionExpressionPath as Ja, createFileWatcher as Ji, addRunTaskSpecificOptions as Jn, getActiveWorkloadAwsWiring as Jo, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, discoverWebSocketApisOrThrow as Ka, buildMessageEvent as Ki, createLocalStartServiceCommand as Kn, displayEndpointValue as Ko, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, CfnLocalStateProvider as La, tryParseStatus as Li, resolveBucketDeploymentObjectKey as Ln, DEFAULT_AWS_EMULATOR_URL as Lo, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, isCfnFlagPresent as Ma, buildHttpApiV2Event as Mi, createLocalFileKvsDataSource as Mn, resetWorkloadIdentity as Mo, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, rejectExplicitCfnStackWithMultipleStacks as Na, buildRestV1Event as Ni, createUnboundCloudFrontModule as Nn, workloadClientConfig as No, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, LocalStateSourceError as Oa, matchPreflight as Oi, runViewerRequest as On, assumedRoleRecorded as Oo, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, resolveCfnFallbackRegion as Pa, evaluateResponseParameters as Pi, bucketDeploymentSourceObjectKeys as Pn, workloadStsClientConfig as Po, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, resolveLambdaArnIntrinsic as Qa, HOST_GATEWAY_MIN_VERSION as Qi, addEcsAssumeRoleOptions as Qn, logMixedModeForWorkload as Qo, createWatchPredicates as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, collectSsmParameterRefs as Ra, VtlEvaluationError as Ri, addAlbSpecificOptions as Rn, EMULATOR_SCRUBBED_ENV_KEYS as Ro, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, containsCrossStackIntrinsic as Sa, invokeTokenAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, parseDynamicReference as So, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, substituteEnvVarsFromState as Ta, buildCorsConfigByApiId as Ti, WebFunctionResolutionError as Tn, addAwsEndpointOptions as To, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, listTargets as Ua, parseConnectionsPath as Ui, isApplicationLoadBalancer as Un, awsEmulatorEnvName as Uo, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, resolveSingleTarget as Va, buildMgmtEndpointEnvUrl as Vi, parseLbPortOverrides as Vn, activateWorkloadAwsWiring as Vo, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, availableWebSocketApiIdentifiers as Wa, buildConnectEvent as Wi, resolveAlbFrontDoor as Wn, awsEmulatorSqsHostBlocks as Wo, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, discoverRoutes as Xa, createLocalInvokeCommand as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, getContainerJavaTruststorePath as Xo, addStartApiSpecificOptions as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, webSocketApiMatchesIdentifier as Ya, addInvokeSpecificOptions as Yi, createLocalRunTaskCommand as Yn, getContainerCaBundlePath as Yo, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, pickRefLogicalId as Za, HOST_DOCKER_INTERNAL_GATEWAY as Zi, addCommonEcsServiceOptions as Zn, javaTruststoreToolOptions as Zo, createLocalStartApiCommand as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveRuntimeFileExtension as _a, verifyJwtViaDiscovery as _i, pickKvsLogicalIdFromArn as _n, containsDynamicReference as _o, isLocalCdkAssetImage as _r, sqsEmulatorOriginOf as _s, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, buildLoopbackForwarderDockerArgs as aa, filterRoutesByApiIdentifiers as ai, serveLambdaUrlOrigin as an, pickAgentCoreCandidateStack as ao, resolveSharedSidecarCredentials as ar, resolveAwsEmulatorOption as as, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, assertEcsTaskCommandsResolved as ba, evaluateCachedLambdaPolicy as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, keysNotFromTemplate as bo, CloudMapRegistry as br, buildStsClientConfig as bs, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, ensureForwarderImage as ca, startApiServer as ci, buildEdgeRequestEvent as cn, formatStateRemedy as co, buildImageOverrideTag as cr, setActiveWorkloadAwsWiring as cs, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, buildContainerImage as da, defaultCredentialsLoader as di, httpHeadersToEdge as dn, LocalInvokeBuildError as do, mergeForService as dr, MIXED_MODE_RESIGN_BODY_CAP_BYTES as ds, createLocalStartWebFunctionCommand as dt, resolveHostGatewayExtraHosts as ea, createAuthorizerCache as ei, createS3OriginReader as en, AGENTCORE_AGUI_PROTOCOL as eo, buildEcsImageResolutionContext$1 as er, mergeJavaToolOptions as es, runHookBody as et, filterStudioCustomResources as f, dockerRegistryEnv as fa, buildCognitoJwksUrl as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, ambientDefaultRegion as fo, parseImageOverrideFlags as fr, REAL_SQS_QUEUE_URL as fs, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, resolveRuntimeCodeMountPath as ga, verifyJwtAuthorizer as gi, pickFunctionUrlLogicalIdFromOrigin as gn, DynamicReferenceResolver as go, imageOverrideKeyAliases as gr, rewriteSqsQueueUrlsInEnv as gs, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, stripEcrCredentials as ha, verifyCognitoJwt as hi, isCloudFrontDistribution as hn, DynamicReferenceResolutionError as ho, describePinnedImageUri as hr, repointLocalSqsQueueUrlsInEnv as hs, selectServeInboundAuth as ht, coerceStopRequest as i, awaitLoopbackForwarderStatus as ia, filterRoutesByApiIdentifier as ii, serveFromStaticOrigin as in, AgentCoreResolutionError as io, resolveEcsAssumeRoleOption as ir, readProfileEndpointSettings as is, MicrovmResolutionError as it, readRunHookPayload as j, groupWorkloadsRoutedApart as ja, applyAuthorizerOverlay as ji, createCloudFrontModule as jn, recordAssumedRole as jo, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, UNNAMED_WORKLOAD as ka, matchRoute as ki, runViewerResponse as kn, deployAccountStsClientConfig as ko, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, startLoopbackForwarder as la, resolveSelectionExpression as li, buildEdgeResponseEvent as ln, substituteImagePlaceholders as lo, canonicalizeImageOverrideKeys as lr, takeAwsEmulatorStateSourceHint as ls, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, noImplicitEcrPullArgs as ma, createJwksCache as mi, extractKvsAssociations as mn, setAmbientDefaultRegion as mo, runImageOverrideBuilds as mr, realSqsHostnames as ms, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, withWorkloadAwsWiring as na, buildStageMap as ni, startCloudFrontServer as nn, AGENTCORE_MCP_PROTOCOL as no, parseMaxTasks as nr, probeAwsEmulatorHealth as ns, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, buildNamespaceOwnerForwarderDockerArgs as oa, groupRoutesByServer as oi, applyEdgeRequestResult as on, resolveAgentCoreTarget as oo, runEcsServiceEmulator as or, resolveHostDefaultCredentials as os, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, isEcrRegistryConfigKey as pa, buildJwksUrlFromIssuer as pi, describeS3OriginDomain as pn, namedEnvAwsRegion as po, resolveImageOverrides as pr, isRealAwsHost as ps, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, filterWebSocketApisByIdentifiers as qa, classifySourceChange as qi, serviceStrategy as qn, effectiveLoopbackPorts as qo, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, LOOPBACK_FORWARDER_IMAGE as ra, availableApiIdentifiers as ri, resolveErrorResponseCandidates as rn, AGENTCORE_RUNTIME_TYPE as ro, parseRestartPolicy as rr, readEmulatorRunFiles as rs, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, describeForwarderFailure as sa, readMtlsMaterialsFromDisk as si, applyEdgeResponseResult as sn, derivePseudoParametersFromRegion as so, ImageOverrideError as sr, resolveWorkloadAwsWiring as ss, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, attachLoopbackForwarder as ta, attachStageContext as ti, matchBehavior as tn, AGENTCORE_HTTP_PROTOCOL as to, ecsClusterOption as tr, parseAwsEndpoint as ts, waitForAppAnswer as tt, reinvoke as u, architectureToPlatform as ua, resolveServiceIntegrationParameters as ui, edgeHeadersToHttp as un, tryResolveImageFnJoin as uo, enforceImageOverrideOrphans as ur, writeCaBundleFile as us, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveRuntimeImage as va, buildMethodArn as vi, pickLambdaEdgeFunctionLogicalId as vn, deployedFillMayBeSecret as vo, listPinnedTargets as vr, buildJavaTrustStore as vs, startAgentCoreWsBridge as vt, createLocalListCommand as w, substituteAgainstStateAsync as wa, applyCorsResponseHeaders as wi, WEB_FUNCTION_TYPE as wn, withoutKeys as wo, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, assertEcsTaskImagesResolvable as xa, invokeRequestAuthorizer as xi, resolveCloudFrontDistribution as xn, keysOverriddenBy as xo, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, resolveProfileCredentials as xs, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, EcsTaskResolutionError as ya, computeRequestIdentityHash as yi, pickTargetFunctionLogicalId as yn, firstUsableRegion as yo, buildCloudMapIndex as yr, createMixedModeTlsMaterials as ys, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, resolveSsmParameters as za, bufferToBody as zi, albStrategy as zn, HOST_CA_TRUST_ENV_KEYS as zo, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
+//# sourceMappingURL=local-studio-CrP4kia1.js.map