cdk-local 0.167.0 → 0.167.2

package/dist/{local-studio-DRE1RQLn.js → local-studio-B0Wlk_VO.js}

@@ -2457,9 +2457,26 @@ async function resolveDynamicReferencesInEnv(env, options) {
 	}
 }
 
+// src/utils/ambient-default-region.ts
+let recorded;
+function setAmbientDefaultRegion(region) {
+	recorded = region === "" ? void 0 : region;
+}
+function ambientDefaultRegion() {
+	return recorded !== void 0 && process.env["AWS_REGION"] === recorded ? recorded : void 0;
+}
+function namedEnvAwsRegion() {
+	return ambientDefaultRegion() === void 0 ? process.env["AWS_REGION"] : void 0;
+}
+function regionOrAmbientDefault(stackRegion) {
+	const ambient = ambientDefaultRegion();
+	if (ambient === void 0) return stackRegion;
+	return stackRegion === void 0 || stackRegion === "" || stackRegion === "unknown-region" ? ambient : stackRegion;
+}
+
 // src/utils/profile-region.ts
 async function resolveContainerRegion(sources) {
-	const named = firstUsableRegion(sources.region, process.env["AWS_REGION"], process.env["AWS_DEFAULT_REGION"], sources.stackRegion, sources.stateRegion);
+	const named = firstUsableRegion(sources.region, namedEnvAwsRegion(), process.env["AWS_DEFAULT_REGION"], sources.stackRegion, sources.stateRegion, ambientDefaultRegion());
 	if (named) return named.toLowerCase();
 	return firstUsableRegion(await resolveSdkDefaultRegion(sources.profile))?.toLowerCase();
 }
@@ -2485,6 +2502,32 @@ async function resolveProfileRegion(profile) {
 	return resolveSdkDefaultRegion(profile);
 }
 
+// src/utils/shutdown-signal.ts
+function signalExitCode(signal) {
+	return signal === "SIGINT" ? 130 : 143;
+}
+function createShutdownSignalHandler(options) {
+	const exit = options.exit ?? ((code) => process.exit(code));
+	const writeStderr = options.writeStderr ?? ((text) => void process.stderr.write(text));
+	let count = 0;
+	const handler = (signal, exitCode) => {
+		const code = exitCode ?? signalExitCode(signal === "SIGINT" ? "SIGINT" : "SIGTERM");
+		count += 1;
+		if (count === 1) {
+			options.info(options.stoppingMessage(signal));
+			options.cleanup().then(() => exit(code));
+			return;
+		}
+		if (count === 2) {
+			options.warn(`Received ${signal} again; still shutting down — waiting for the cleanup to remove the containers and networks. Send it once more to force-exit (that skips the cleanup).`);
+			return;
+		}
+		writeStderr(`Force-exit on repeated ${signal}; container cleanup skipped. ${options.forceExitHint}\n`);
+		exit(code);
+	};
+	return handler;
+}
+
 // src/utils/error-handler.ts
 var CdkLocalError = class CdkLocalError extends Error {
 	code;
@@ -5678,7 +5721,7 @@ function hostStateSourceFields(options, extraStateProviders) {
 	return { ...options };
 }
 function resolveCfnRegion(options, synthRegion) {
-	const region = options.stackRegion ?? options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion;
+	const region = options.stackRegion ?? options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(synthRegion);
 	if (region === void 0) throw new LocalStateSourceError("--from-cfn-stack requires a region to query CloudFormation. Set one of: --stack-region <region>, --region <region>, AWS_REGION env var, AWS_DEFAULT_REGION env var, or an env.region on the target CDK stack.");
 	return region;
 }
@@ -6297,7 +6340,15 @@ async function substituteAgainstStateAsync(value, contextOrResources) {
 	};
 	const intrinsic = keys[0];
 	const arg = obj[intrinsic];
-	if (intrinsic === "Ref" || intrinsic === "Fn::GetAtt" || intrinsic === "Fn::Sub" || intrinsic === "Fn::Join" || intrinsic === "Fn::Select" || intrinsic === "Fn::Split") return substituteAgainstState(value, context);
+	if (intrinsic === "Ref" || intrinsic === "Fn::GetAtt" || intrinsic === "Fn::Sub" || intrinsic === "Fn::Join" || intrinsic === "Fn::Select" || intrinsic === "Fn::Split") {
+		if (!containsCrossStackIntrinsic(value)) return substituteAgainstState(value, context);
+		const rewritten = await resolveNestedCrossStack(value, context);
+		if ("reason" in rewritten) return {
+			kind: "unresolved",
+			reason: rewritten.reason
+		};
+		return substituteAgainstState(rewritten.value, context);
+	}
 	if (intrinsic === "Fn::ImportValue") return resolveImportValueAsync(arg, context);
 	if (intrinsic === "Fn::GetStackOutput") return resolveGetStackOutputAsync(arg, context);
 	return {
@@ -6305,6 +6356,39 @@ async function substituteAgainstStateAsync(value, contextOrResources) {
 		reason: `unsupported intrinsic ${displayIdent(intrinsic)} (supported: Ref, Fn::GetAtt, Fn::Sub, Fn::Join, Fn::Select, Fn::Split, Fn::ImportValue, Fn::GetStackOutput)`
 	};
 }
+function isCrossStackNode(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.hasOwn(value, "Fn::ImportValue") || Object.hasOwn(value, "Fn::GetStackOutput");
+}
+function containsCrossStackIntrinsic(value) {
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value)) return value.some(containsCrossStackIntrinsic);
+	if (isCrossStackNode(value)) return true;
+	return Object.values(value).some(containsCrossStackIntrinsic);
+}
+async function resolveNestedCrossStack(value, context) {
+	if (!containsCrossStackIntrinsic(value)) return { value };
+	if (isCrossStackNode(value)) {
+		const sub = await substituteAgainstStateAsync(value, context);
+		return sub.kind === "literal" ? { value: sub.value } : { reason: sub.reason };
+	}
+	if (Array.isArray(value)) {
+		const out = [];
+		for (const item of value) {
+			const r = await resolveNestedCrossStack(item, context);
+			if ("reason" in r) return r;
+			out.push(r.value);
+		}
+		return { value: out };
+	}
+	const out = {};
+	for (const [key, item] of Object.entries(value)) {
+		const r = await resolveNestedCrossStack(item, context);
+		if ("reason" in r) return r;
+		defineOwnKey(out, key, r.value);
+	}
+	return { value: out };
+}
 async function resolveImportValueAsync(arg, context) {
 	const inner = substituteAgainstState(arg, context);
 	if (inner.kind !== "literal") return {
@@ -6637,6 +6721,12 @@ function detectEcsImageResolutionNeeds(stack) {
 			if (need.pseudo) needsPseudoParameters = true;
 			if (need.state) needsStateResources = true;
 			if (containerHasIntrinsicEnvOrSecret(co)) needsEnvOrSecretSubstitution = true;
+			const argv = containerArgvElements(co);
+			if (argv.some((v) => v !== null && typeof v === "object")) needsEnvOrSecretSubstitution = true;
+			if (argv.some(isCrossStackIntrinsic)) {
+				needsEnvOrSecretSubstitution = true;
+				needsCrossStackResolver = true;
+			}
 			if (containerHasCrossStackEnvOrSecret(co)) {
 				needsEnvOrSecretSubstitution = true;
 				needsCrossStackResolver = true;
@@ -6675,10 +6765,16 @@ function containerHasCrossStackEnvOrSecret(c) {
 	}
 	return false;
 }
+function containerArgvElements(c) {
+	const health = c["HealthCheck"];
+	return [
+		c["Command"],
+		c["EntryPoint"],
+		health && typeof health === "object" ? health["Command"] : void 0
+	].flatMap((l) => Array.isArray(l) ? l : []);
+}
 function isCrossStackIntrinsic(value) {
-	if (!value || typeof value !== "object") return false;
-	const obj = value;
-	return "Fn::ImportValue" in obj || "Fn::GetStackOutput" in obj;
+	return containsCrossStackIntrinsic(value);
 }
 function volumeHasIntrinsicSourcePath(v) {
 	if (!v || typeof v !== "object") return false;
@@ -6910,10 +7006,13 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 	const name = pickString(c["Name"]);
 	if (!name) throw new EcsTaskResolutionError(`Task ${displayIdent(taskLogicalId)} ContainerDefinitions[${idx}] has no Name.`);
 	const image = parseContainerImage(c["Image"], name, taskLogicalId, resources, stack, context);
-	const command = pickStringArray$1(c["Command"]);
-	const entryPoint = pickStringArray$1(c["EntryPoint"]);
+	const containerContext = contextForContainer(context, name);
+	const subContext = buildSubstitutionContextFromImageContext(containerContext);
+	const unresolvedCommandElements = [];
+	const argv = (raw, field) => resolveArgvArray(raw, field, subContext, containerContext, unresolvedCommandElements);
+	const command = argv(c["Command"], "Command");
+	const entryPoint = argv(c["EntryPoint"], "EntryPoint");
 	const workingDirectory = pickString(c["WorkingDirectory"]);
-	const subContext = buildSubstitutionContextFromImageContext(contextForContainer(context, name));
 	const environment = {};
 	const sensitiveEnvKeys = [];
 	const droppedEnvKeys = [];
@@ -7027,7 +7126,7 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 	let healthCheck;
 	if (c["HealthCheck"] && typeof c["HealthCheck"] === "object") {
 		const h = c["HealthCheck"];
-		const command2 = pickStringArray$1(h["Command"]);
+		const command2 = argv(h["Command"], "HealthCheck.Command");
 		if (command2 && command2.length > 0) {
 			healthCheck = { command: command2 };
 			if (typeof h["Interval"] === "number") healthCheck.interval = h["Interval"];
@@ -7079,8 +7178,150 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 	if (user !== void 0) out.user = user;
 	if (privileged !== void 0) out.privileged = privileged;
 	if (readonlyRootFilesystem !== void 0) out.readonlyRootFilesystem = readonlyRootFilesystem;
+	if (unresolvedCommandElements.length > 0) out.unresolvedCommandElements = unresolvedCommandElements;
 	return out;
 }
+function resolveArgvArray(raw, field, subContext, context, unresolved) {
+	if (!Array.isArray(raw)) return void 0;
+	return raw.map((element, index) => {
+		if (typeof element === "string") return element;
+		if (typeof element === "number" || typeof element === "boolean") return String(element);
+		if (!element || typeof element !== "object" || Array.isArray(element)) {
+			unresolved.push({
+				field,
+				index,
+				reason: "not a string or an intrinsic"
+			});
+			return "";
+		}
+		if (isCrossStackIntrinsic(element)) {
+			unresolved.push({
+				field,
+				index,
+				reason: CROSS_STACK_ARGV_REASON
+			});
+			return "";
+		}
+		if (!subContext) {
+			unresolved.push({
+				field,
+				index,
+				reason: `intrinsic-valued and no deployed state was loaded: ${formatStateRemedy(context)}`
+			});
+			return "";
+		}
+		const secret = secretAttributeRead(element, subContext.resources);
+		if (secret !== void 0) {
+			unresolved.push({
+				field,
+				index,
+				reason: secret
+			});
+			return "";
+		}
+		const { result: sub, consumedSensitive } = resolveWithSensitivity(element, subContext);
+		const arg = argvValue(sub, consumedSensitive);
+		if ("value" in arg) return arg.value;
+		unresolved.push({
+			field,
+			index,
+			reason: arg.reason
+		});
+		return "";
+	});
+}
+const STATE_SECRET_MASK = "***";
+const SECRET_ATTRIBUTE_NAME = /secret|password|credential/i;
+const NON_SECRET_ATTRIBUTE_SUFFIX = /(arn|id|name|url|alias|status)$/i;
+const SECRET_VALUED_ATTRIBUTES = /* @__PURE__ */ new Map([
+	["AWS::AppSync::ApiKey", ["ApiKey"]],
+	["AWS::EC2::IpamExternalResourceVerificationToken", ["TokenValue"]],
+	["AWS::IVS::StreamKey", ["Value"]]
+]);
+function secretAttributeRead(element, stateResources) {
+	for (const [logicalId, attribute] of getAttReads(element)) {
+		const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+		const recorded = record?.attributes;
+		const stored = recorded && Object.hasOwn(recorded, attribute) ? recorded[attribute] : void 0;
+		const type = typeof record?.resourceType === "string" ? record.resourceType : "";
+		const typed = SECRET_VALUED_ATTRIBUTES.get(type);
+		if (SECRET_ATTRIBUTE_NAME.test(attribute) && !NON_SECRET_ATTRIBUTE_SUFFIX.test(attribute) || typed?.includes(attribute) === true || type.startsWith("Custom::") || type === "AWS::CloudFormation::CustomResource" || type === "AWS::CloudFormation::Stack" && attribute.startsWith("Outputs.") || stored === STATE_SECRET_MASK) return `reads ${displayIdent(logicalId)}.${displayIdent(attribute)}, an attribute that is or may be a secret, which ${getEmbedConfig().binaryName} will not put on the docker run command line; pass the value through Environment or Secrets instead`;
+	}
+}
+function getAttReads(node, out = []) {
+	if (node === null || typeof node !== "object") return out;
+	if (Array.isArray(node)) {
+		for (const item of node) getAttReads(item, out);
+		return out;
+	}
+	for (const [key, value] of Object.entries(node)) {
+		if (key === "Fn::GetAtt") {
+			if (Array.isArray(value) && typeof value[0] === "string" && typeof value[1] === "string") out.push([value[0], value[1]]);
+			else if (typeof value === "string" && value.includes(".")) {
+				const dot = value.indexOf(".");
+				out.push([value.slice(0, dot), value.slice(dot + 1)]);
+			}
+		} else if (key === "Fn::Sub") {
+			const template = Array.isArray(value) ? value[0] : value;
+			if (typeof template === "string") for (const m of template.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+				const ref = m[1].trim();
+				const dot = ref.indexOf(".");
+				if (dot > 0 && !ref.startsWith("AWS::")) out.push([ref.slice(0, dot), ref.slice(dot + 1)]);
+			}
+		}
+		getAttReads(value, out);
+	}
+	return out;
+}
+function computedAttributeRead(node) {
+	if (node === null || typeof node !== "object") return void 0;
+	if (Array.isArray(node)) {
+		for (const item of node) {
+			const r = computedAttributeRead(item);
+			if (r !== void 0) return r;
+		}
+		return;
+	}
+	for (const [key, value] of Object.entries(node)) {
+		if (key === "Fn::GetAtt" && isCrossStackIntrinsic(value)) return "a Fn::GetAtt whose logical ID or attribute name is a cross-stack reference, which CloudFormation does not accept";
+		if (key === "Fn::Sub") {
+			if (isCrossStackIntrinsic(Array.isArray(value) ? value[0] : value)) return "a Fn::Sub whose template is a cross-stack reference, which CloudFormation does not accept";
+		}
+		const r = computedAttributeRead(value);
+		if (r !== void 0) return r;
+	}
+}
+function withMaskWatch(context, masked) {
+	const inner = context.crossStackResolver;
+	if (!inner) return context;
+	const watch = (v) => {
+		if (v === STATE_SECRET_MASK) masked.hit = true;
+		return v;
+	};
+	return {
+		...context,
+		crossStackResolver: {
+			resolveImport: async (exportName) => watch(await inner.resolveImport(exportName)),
+			resolveGetStackOutput: async (stack, region, output) => watch(await inner.resolveGetStackOutput(stack, region, output))
+		}
+	};
+}
+const CROSS_STACK_ARGV_REASON = "a cross-stack reference (Fn::ImportValue / Fn::GetStackOutput): it resolves only from a state source with the producer stack deployed";
+function argvValue(sub, consumedSensitive) {
+	if (consumedSensitive) return { reason: "resolved from a SecureString parameter, which would put the secret on the docker run argv; move the value into an Environment variable or a Secrets entry" };
+	if (sub.kind !== "literal") return { reason: sub.reason };
+	const value = sub.value;
+	if (typeof value === "number" || typeof value === "boolean") return { value: String(value) };
+	if (value === STATE_SECRET_MASK) return { reason: "resolved to the secret mask (***), not the deployed value" };
+	if (containsDynamicReference(value)) return { reason: "resolved to a CloudFormation dynamic reference ({{resolve:...}}), which is resolved only in Environment, because resolving one here would put the secret on the docker run argv; move the value into an Environment variable or a Secrets entry" };
+	return { value };
+}
+function assertEcsTaskCommandsResolved(task) {
+	const lines = [];
+	for (const container of task.containers) for (const u of container.unresolvedCommandElements ?? []) lines.push(`  - Container ${displayIdent(container.name)} ${u.field}[${u.index}]: ${u.reason}`);
+	if (lines.length === 0) return;
+	throw new EcsTaskResolutionError(`Task ${displayIdent(task.taskDefinitionLogicalId)} has container command elements ${getEmbedConfig().binaryName} could not resolve:\n${lines.join("\n")}\nRefusing to run the task with these arguments missing, since that runs a different command than the deployed task.`);
+}
 function buildSubstitutionContextFromImageContext(context) {
 	if (!context?.stateResources) return void 0;
 	const subContext = { resources: context.stateResources };
@@ -7391,6 +7632,21 @@ async function applyCrossStackValuesToTask(task, crossStackResolver, opts) {
 		dynamicRefs.dispose();
 	}
 }
+function argvTarget(container, field) {
+	if (field === "Command") return container.command;
+	if (field === "EntryPoint") return container.entryPoint;
+	return container.healthCheck?.command;
+}
+function rawArgv(c, field) {
+	let raw;
+	if (field === "Command") raw = c["Command"];
+	else if (field === "EntryPoint") raw = c["EntryPoint"];
+	else {
+		const h = c["HealthCheck"];
+		raw = h && typeof h === "object" ? h["Command"] : void 0;
+	}
+	return Array.isArray(raw) ? raw : void 0;
+}
 function withContainerState(context, state) {
 	const out = {
 		...context,
@@ -7456,6 +7712,39 @@ async function applyCrossStackResolverToTask(task, context, containerState) {
 				resolvedSecretNames.add(sName);
 			}
 		}
+		if (container.unresolvedCommandElements?.length) {
+			const argvContext = ownState ? withContainerState(secretContext, ownState) : secretContext;
+			const remaining = [];
+			for (const u of container.unresolvedCommandElements) {
+				const target = argvTarget(container, u.field);
+				const rawElement = rawArgv(c, u.field)?.[u.index];
+				if (!target || !isCrossStackIntrinsic(rawElement)) {
+					remaining.push(u);
+					continue;
+				}
+				const refusal = secretAttributeRead(rawElement, argvContext.resources) ?? computedAttributeRead(rawElement);
+				if (refusal !== void 0) {
+					remaining.push({
+						...u,
+						reason: refusal
+					});
+					continue;
+				}
+				const masked = { hit: false };
+				const { result: sub, consumedSensitive } = await resolveWithSensitivityAsync(rawElement, withMaskWatch(argvContext, masked));
+				const arg = masked.hit ? { reason: `resolved a cross-stack value recorded as the secret mask (${STATE_SECRET_MASK}), not the deployed value` } : argvValue(sub, consumedSensitive);
+				if ("value" in arg) {
+					target[u.index] = arg.value;
+					continue;
+				}
+				remaining.push({
+					...u,
+					reason: arg.reason
+				});
+			}
+			if (remaining.length > 0) container.unresolvedCommandElements = remaining;
+			else delete container.unresolvedCommandElements;
+		}
 		if (resolvedEnvKeys.size > 0 || resolvedSecretNames.size > 0) {
 			container.warnings = container.warnings.filter((w) => {
 				for (const k of resolvedEnvKeys) if (w.startsWith(`Environment ${displayIdent(k)} dropped:`)) return false;
@@ -8182,32 +8471,6 @@ function isMalformedEnvKey(key) {
 	return !WELL_FORMED_ENV_KEY.test(key);
 }
 
-// src/utils/shutdown-signal.ts
-function signalExitCode(signal) {
-	return signal === "SIGINT" ? 130 : 143;
-}
-function createShutdownSignalHandler(options) {
-	const exit = options.exit ?? ((code) => process.exit(code));
-	const writeStderr = options.writeStderr ?? ((text) => void process.stderr.write(text));
-	let count = 0;
-	const handler = (signal, exitCode) => {
-		const code = exitCode ?? signalExitCode(signal === "SIGINT" ? "SIGINT" : "SIGTERM");
-		count += 1;
-		if (count === 1) {
-			options.info(options.stoppingMessage(signal));
-			options.cleanup().then(() => exit(code));
-			return;
-		}
-		if (count === 2) {
-			options.warn(`Received ${signal} again; still shutting down — waiting for the cleanup to remove the containers and networks. Send it once more to force-exit (that skips the cleanup).`);
-			return;
-		}
-		writeStderr(`Force-exit on repeated ${signal}; container cleanup skipped. ${options.forceExitHint}\n`);
-		exit(code);
-	};
-	return handler;
-}
-
 // src/assets/asset-source-path.ts
 function resolveAssetSourcePath(opts) {
 	const { manifestDir, value, assetOutdir, field, subject, action, wrapError } = opts;
@@ -9441,6 +9704,46 @@ function execEnvForSecrets(passthrough) {
 	return { env };
 }
 
+// src/local/container-start-guard.ts
+const NAME_CONFLICT = /is already (?:in use|used) by|Conflict\. The container name/;
+function createContainerStartGuard(options) {
+	const remove = options.remove ?? removeContainer;
+	let stopping = false;
+	const inFlight = /* @__PURE__ */ new Set();
+	const cancelled = () => new CdkLocalError("Shutting down: the container is not used.", options.cancelledCode);
+	const stopAll = async () => {
+		stopping = true;
+		return (await Promise.all([...inFlight])).filter((id) => id !== void 0);
+	};
+	return {
+		async run(start, name) {
+			if (stopping) throw cancelled();
+			const started = start();
+			const outcome = started.then((id) => id, async (err) => {
+				const message = err instanceof Error ? err.message : String(err);
+				if (name !== void 0 && !NAME_CONFLICT.test(message)) try {
+					await remove(name);
+				} catch {}
+			});
+			inFlight.add(outcome);
+			try {
+				const id = await started;
+				if (stopping) throw cancelled();
+				return id;
+			} catch (err) {
+				await outcome;
+				throw err;
+			} finally {
+				inFlight.delete(outcome);
+			}
+		},
+		async stop() {
+			return (await stopAll())[0];
+		},
+		stopAll
+	};
+}
+
 // src/local/debug-timeout.ts
 const DEBUG_FUNCTION_TIMEOUT_SEC = 36e3;
 function applyDebuggerEnv(dockerEnv, debugPort) {
@@ -10175,13 +10478,17 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 	let containerId;
 	let stopLogs;
 	let sigintHandler;
+	let sigtermHandler;
 	let profileCredsFile;
+	const startGuard = createContainerStartGuard({ cancelledCode: "LOCAL_INVOKE_CANCELLED" });
 	const cleanup = singleFlight(async () => {
+		const pendingContainer = startGuard.stop();
 		if (stopLogs) try {
 			stopLogs();
 		} catch (err) {
 			getLogger().debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		containerId ??= await pendingContainer;
 		if (containerId) try {
 			await removeContainer(containerId);
 		} catch (err) {
@@ -10227,6 +10534,17 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 	}, (err) => {
 		getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
 	});
+	const onSignal = createShutdownSignalHandler({
+		cleanup,
+		stoppingMessage: (signal) => `Received ${signal}, removing the Lambda container...`,
+		forceExitHint: `Run 'docker ps -a --filter name=${getEmbedConfig().resourceNamePrefix}-' to find what is left.`,
+		info: (m) => logger.info(m),
+		warn: (m) => logger.warn(m)
+	});
+	sigintHandler = () => onSignal("SIGINT");
+	sigtermHandler = () => onSignal("SIGTERM");
+	process.on("SIGINT", sigintHandler);
+	process.on("SIGTERM", sigtermHandler);
 	try {
 		await activateWorkloadAwsWiring({
 			...options,
@@ -10294,29 +10612,26 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 			readOnly: true
 		}] : imagePlan.extraMounts;
 		const hostGatewayExtraHosts = await resolveHostGatewayExtraHosts();
-		containerId = await runDetached({
-			image: imagePlan.image,
-			mounts: imagePlan.mounts,
+		const containerName = `${getEmbedConfig().resourceNamePrefix}-invoke-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+		const runPlan = imagePlan;
+		containerId = await startGuard.run(() => runDetached({
+			name: containerName,
+			image: runPlan.image,
+			mounts: runPlan.mounts,
 			extraMounts: extraMountsWithProfile,
 			env: dockerEnv,
 			...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) },
 			...hostGatewayExtraHosts.length > 0 && { extraHosts: hostGatewayExtraHosts },
-			cmd: imagePlan.cmd,
+			cmd: runPlan.cmd,
 			hostPort,
 			host: containerHost,
 			...debugPort !== void 0 && { debugPort },
-			...imagePlan.platform !== void 0 && { platform: imagePlan.platform },
-			...imagePlan.entryPoint !== void 0 && { entryPoint: imagePlan.entryPoint },
-			...imagePlan.workingDir !== void 0 && { workingDir: imagePlan.workingDir },
-			...imagePlan.tmpfs !== void 0 && { tmpfs: imagePlan.tmpfs }
-		});
+			...runPlan.platform !== void 0 && { platform: runPlan.platform },
+			...runPlan.entryPoint !== void 0 && { entryPoint: runPlan.entryPoint },
+			...runPlan.workingDir !== void 0 && { workingDir: runPlan.workingDir },
+			...runPlan.tmpfs !== void 0 && { tmpfs: runPlan.tmpfs }
+		}), containerName);
 		stopLogs = streamLogs(containerId);
-		sigintHandler = () => {
-			cleanup().then(() => {
-				process.exit(130);
-			});
-		};
-		process.on("SIGINT", sigintHandler);
 		await waitForRieReady(containerHost, hostPort, 5e3);
 		const invokeTimeoutMs = rieInvokeTimeoutMs(lambda.timeoutSec, debugPort !== void 0);
 		const result = await invokeRie(containerHost, hostPort, event, invokeTimeoutMs);
@@ -10324,8 +10639,9 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 		process.stdout.write(`${result.raw}\n`);
 		if (options.responseFile) writeFileSync(options.responseFile, result.raw);
 	} finally {
-		if (sigintHandler) process.off("SIGINT", sigintHandler);
 		await cleanup();
+		if (sigintHandler) process.off("SIGINT", sigintHandler);
+		if (sigtermHandler) process.off("SIGTERM", sigtermHandler);
 	}
 }
 async function resolveImagePlan(lambda, options) {
@@ -10499,16 +10815,11 @@ function envHasIntrinsicValue$1(templateEnv) {
 }
 function envHasCrossStackIntrinsic(templateEnv) {
 	if (!templateEnv) return false;
-	for (const v of Object.values(templateEnv)) {
-		if (!v || typeof v !== "object") continue;
-		const obj = v;
-		if ("Fn::ImportValue" in obj || "Fn::GetStackOutput" in obj) return true;
-	}
-	return false;
+	return Object.values(templateEnv).some(containsCrossStackIntrinsic);
 }
 async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stackRegion;
+	const region = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(stackRegion);
 	if (!region) logger.warn(`Resolver references \${AWS::Region} but ${getEmbedConfig().binaryName} could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.`);
 	let accountId;
 	try {
@@ -12834,6 +13145,8 @@ function createContainerPool(specs, options) {
 	const entries = /* @__PURE__ */ new Map();
 	let disposed = false;
 	const inFlightStarts = /* @__PURE__ */ new Set();
+	const startGuard = createContainerStartGuard({ cancelledCode: "CONTAINER_POOL_DISPOSED" });
+	const startedNotReady = /* @__PURE__ */ new Set();
 	for (const logicalId of specs.keys()) entries.set(logicalId, emptyEntry(logicalId));
 	function emptyEntry(logicalId) {
 		return {
@@ -12864,7 +13177,7 @@ function createContainerPool(specs, options) {
 			}] : optMount;
 			const containerCodePath = resolveRuntimeCodeMountPath(spec.lambda.runtime);
 			const image = resolveRuntimeImage(spec.lambda.runtime);
-			containerId = await runDetached({
+			containerId = await startGuard.run(() => runDetached({
 				image,
 				platform: architectureToPlatform(spec.lambda.architecture),
 				mounts: [{
@@ -12882,8 +13195,8 @@ function createContainerPool(specs, options) {
 				...spec.debugPort !== void 0 && { debugPort: spec.debugPort },
 				...spec.tmpfs !== void 0 && { tmpfs: spec.tmpfs },
 				...spec.extraHosts !== void 0 && { extraHosts: spec.extraHosts }
-			});
-		} else containerId = await runDetached({
+			}), name);
+		} else containerId = await startGuard.run(() => runDetached({
 			image: spec.image,
 			mounts: [],
 			extraMounts: [...spec.rieMount ? [spec.rieMount] : [], ...spec.profileCredentialsFile ? [{
@@ -12903,14 +13216,17 @@ function createContainerPool(specs, options) {
 			...spec.debugPort !== void 0 && { debugPort: spec.debugPort },
 			...spec.tmpfs !== void 0 && { tmpfs: spec.tmpfs },
 			...spec.extraHosts !== void 0 && { extraHosts: spec.extraHosts }
-		});
+		}), name);
 		const stopLogStream = streamingEnabled ? streamLogs(containerId) : () => void 0;
+		startedNotReady.add(containerId);
 		try {
 			await waitForRieReady(spec.containerHost, hostPort, 3e4);
 		} catch (err) {
 			stopLogStream();
 			await removeContainer(containerId).catch(() => void 0);
 			throw err;
+		} finally {
+			startedNotReady.delete(containerId);
 		}
 		return {
 			logicalId: spec.lambda.logicalId,
@@ -12967,6 +13283,7 @@ function createContainerPool(specs, options) {
 	}
 	return {
 		async acquire(logicalId) {
+			if (disposed) throw new Error(`Container pool disposed; not starting ${displayIdent(logicalId)}.`);
 			const entry = entries.get(logicalId);
 			if (!entry) throw new Error(`containerPool.acquire: no spec registered for Lambda ${displayIdent(logicalId)}. This is a bug — every reachable route's Lambda should be registered at server boot.`);
 			if (entry.warm.length > 0) {
@@ -13033,6 +13350,7 @@ function createContainerPool(specs, options) {
 				return;
 			}
 			disposed = true;
+			const pendingRuns = startGuard.stopAll();
 			logger.debug("Disposing container pool");
 			for (const entry of entries.values()) {
 				if (entry.idleTimer) {
@@ -13094,10 +13412,14 @@ function createContainerPool(specs, options) {
 				let timedOut = 0;
 				for (const r of results) if (r.kind === "ok") allHandles.push(r.handle);
 				else if (r.kind === "timeout") timedOut++;
-				if (timedOut > 0) logger.warn(`Container pool disposed with ${timedOut} in-flight start(s) still pending after ${drainTimeoutMs}ms; relying on docker --rm + the verify.sh sweep to clean up.`);
+				if (timedOut > 0) logger.debug(`${timedOut} in-flight start(s) still pending after ${drainTimeoutMs}ms; removing them by id once their docker run returns.`);
 				inFlightStarts.clear();
 			}
-			await Promise.allSettled(allHandles.map((h) => tearDown(h)));
+			const interruptedIds = [...await pendingRuns, ...startedNotReady];
+			startedNotReady.clear();
+			await Promise.allSettled([...allHandles.map((h) => tearDown(h)), ...interruptedIds.map((id) => removeContainer(id).catch((err) => {
+				logger.warn(`Failed to remove container ${id}: ${err instanceof Error ? err.message : String(err)}. Continuing cleanup.`);
+			}))]);
 			entries.clear();
 		}
 	};
@@ -16031,6 +16353,21 @@ function formatServerListeningBanner(scheme, host, port, pathSuffix, label) {
 	return `Server listening on ${scheme}://${formatAuthority(host, port)}${pathSuffix}  (${label})\n`;
 }
 async function localStartApiCommand(targets, options, extraStateProviders) {
+	let boot;
+	try {
+		await serveStartApi(targets, options, extraStateProviders, (b) => {
+			boot = b;
+		});
+	} catch (err) {
+		if (boot) {
+			await boot.teardown().catch(() => void 0);
+			if (boot.signalled()) await new Promise(() => void 0);
+			boot.detachSignals();
+		}
+		throw err;
+	}
+}
+async function serveStartApi(targets, options, extraStateProviders, registerBoot) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	let apiFilters = [...targets];
@@ -16067,6 +16404,106 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 	const inlineTmpDirs = /* @__PURE__ */ new Set();
 	const layerTmpDirs = /* @__PURE__ */ new Set();
 	let profileCredsFile;
+	const servers = [];
+	const wsServers = [];
+	const bootPools = [];
+	let watcher;
+	let reloadQueue;
+	let shuttingDown = false;
+	let signalled = false;
+	const runCleanup = singleFlight(async () => {
+		shuttingDown = true;
+		await stopWatchReloads({
+			watcher,
+			queue: reloadQueue,
+			onWatcherCloseError: (err) => logger.warn(`watcher.close() failed: ${err instanceof Error ? err.message : String(err)}`)
+		});
+		await Promise.allSettled(wsServers.map(async (ws) => {
+			try {
+				await ws.attached.close();
+			} catch (err) {
+				logger.warn(`WebSocket close() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}));
+		await Promise.allSettled(servers.map(async ({ server, group }) => {
+			try {
+				await server.close();
+			} catch (err) {
+				logger.warn(`server.close() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}));
+		await Promise.allSettled(wsServers.map(async (ws) => {
+			try {
+				await ws.server.close();
+			} catch (err) {
+				logger.warn(`WebSocket server.close() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}));
+		await Promise.allSettled(servers.map(async ({ server, group }) => {
+			try {
+				await server.getServerState().pool.dispose();
+			} catch (err) {
+				logger.warn(`pool.dispose() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}));
+		await Promise.allSettled(wsServers.map(async (ws) => {
+			try {
+				await ws.server.getServerState().pool.dispose();
+			} catch (err) {
+				logger.warn(`WebSocket pool.dispose() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}));
+		await Promise.allSettled(bootPools.map(async (pool) => {
+			try {
+				await pool.dispose();
+			} catch (err) {
+				logger.warn(`pool.dispose() failed: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}));
+		for (const dir of inlineTmpDirs) try {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		} catch (err) {
+			logger.warn(`Failed to remove inline-code tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		for (const dir of layerTmpDirs) try {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		} catch (err) {
+			logger.warn(`Failed to remove merged-layers tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		if (profileCredsFile) try {
+			await profileCredsFile.dispose();
+		} catch (err) {
+			logger.warn(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	});
+	const shutdown = createShutdownSignalHandler({
+		cleanup: async () => {
+			signalled = true;
+			await runCleanup();
+		},
+		stoppingMessage: (signal) => `Received ${signal}, shutting down...`,
+		forceExitHint: `Orphan containers may remain — run 'docker ps --filter name=${getEmbedConfig().resourceNamePrefix}-' and 'docker rm -f' to clean up.`,
+		info: (m) => logger.info(m),
+		warn: (m) => logger.warn(m)
+	});
+	const onSigint = () => shutdown("SIGINT");
+	const onSigterm = () => shutdown("SIGTERM");
+	process.on("SIGINT", onSigint);
+	process.on("SIGTERM", onSigterm);
+	registerBoot({
+		teardown: runCleanup,
+		detachSignals: () => {
+			process.off("SIGINT", onSigint);
+			process.off("SIGTERM", onSigterm);
+		},
+		signalled: () => signalled
+	});
 	const authorizerCache = createAuthorizerCache();
 	const jwksCache = createJwksCache();
 	const jwksWarnedAt = /* @__PURE__ */ new Map();
@@ -16188,6 +16625,7 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 		};
 	};
 	const buildPool = (specs) => {
+		if (shuttingDown) throw new CdkLocalError("Shutting down: no container pool is built.", "LOCAL_START_API_CANCELLED");
 		const pool = createContainerPool(specs, {
 			perLambdaConcurrency,
 			skipPull: options.pull === false
@@ -16213,11 +16651,11 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 	const mtlsConfig = resolveMtlsConfig(options);
 	if (mtlsConfig) logger.info("mTLS enabled: client certificates required (chain check against --mtls-truststore at TLS handshake).");
 	const initialGroups = groupRoutesByServer(initialMaterial.routes);
-	const servers = [];
 	let nextPort = basePort;
 	for (const group of initialGroups) {
 		const groupSpecs = filterSpecsForGroup(group, initialMaterial.specs);
 		const groupPool = buildPool(groupSpecs);
+		bootPools.push(groupPool);
 		const groupState = {
 			routes: group.routes,
 			pool: groupPool,
@@ -16226,6 +16664,7 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 		if (options.warm) {
 			logger.info(`Pre-warming ${groupSpecs.size} container(s) for ${group.displayName}...`);
 			const handles = await Promise.allSettled([...groupSpecs.keys()].map((id) => groupPool.acquire(id)));
+			if (shuttingDown) throw new CdkLocalError("Shutting down: the boot is not continued.", "LOCAL_START_API_CANCELLED");
 			for (const result of handles) if (result.status === "fulfilled") groupPool.release(result.value);
 			else logger.warn(`Pre-warm failed for one Lambda in ${group.displayName} (cold start cost will apply on first request): ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`);
 		}
@@ -16250,7 +16689,6 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 		});
 		if (basePort !== 0) nextPort += 1;
 	}
-	const wsServers = [];
 	const initialWsApis = initialMaterial.webSocketApis ?? [];
 	warnUnsupportedWebSocketApis(initialWsApis, logger);
 	if (initialWsApis.filter((api) => !api.unsupported).length > 0) {
@@ -16271,6 +16709,7 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 			continue;
 		}
 		const wsPool = buildPool(wsSpecs);
+		bootPools.push(wsPool);
 		const wsState = {
 			routes: [],
 			pool: wsPool,
@@ -16338,8 +16777,6 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 		process.stdout.write(formatServerListeningBanner(scheme, ws.server.host, ws.server.port, ws.apiPath, `${ws.api.apiLogicalId} (WebSocket API)`));
 	}
 	process.stdout.write("^C to stop and clean up containers.\n");
-	let watcher;
-	let reloadQueue;
 	if (options.watch) {
 		const watchRoot = process.cwd();
 		const { ignored, shouldTrigger, excludePatterns } = createWatchPredicates({
@@ -16369,82 +16806,6 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 		});
 		logger.info(`Watching ${watchRoot} for source changes (excluding ${excludePatterns.join(", ")}).`);
 	}
-	const runCleanup = singleFlight(async () => {
-		await stopWatchReloads({
-			watcher,
-			queue: reloadQueue,
-			onWatcherCloseError: (err) => logger.warn(`watcher.close() failed: ${err instanceof Error ? err.message : String(err)}`)
-		});
-		await Promise.allSettled(wsServers.map(async (ws) => {
-			try {
-				await ws.attached.close();
-			} catch (err) {
-				logger.warn(`WebSocket close() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
-			}
-		}));
-		await Promise.allSettled(servers.map(async ({ server, group }) => {
-			try {
-				await server.close();
-			} catch (err) {
-				logger.warn(`server.close() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
-			}
-		}));
-		await Promise.allSettled(wsServers.map(async (ws) => {
-			try {
-				await ws.server.close();
-			} catch (err) {
-				logger.warn(`WebSocket server.close() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
-			}
-		}));
-		await Promise.allSettled(servers.map(async ({ server, group }) => {
-			try {
-				await server.getServerState().pool.dispose();
-			} catch (err) {
-				logger.warn(`pool.dispose() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
-			}
-		}));
-		await Promise.allSettled(wsServers.map(async (ws) => {
-			try {
-				await ws.server.getServerState().pool.dispose();
-			} catch (err) {
-				logger.warn(`WebSocket pool.dispose() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
-			}
-		}));
-		for (const dir of inlineTmpDirs) try {
-			rmSync(dir, {
-				recursive: true,
-				force: true
-			});
-		} catch (err) {
-			logger.warn(`Failed to remove inline-code tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		for (const dir of layerTmpDirs) try {
-			rmSync(dir, {
-				recursive: true,
-				force: true
-			});
-		} catch (err) {
-			logger.warn(`Failed to remove merged-layers tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		if (profileCredsFile) try {
-			await profileCredsFile.dispose();
-		} catch (err) {
-			logger.warn(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
-		}
-	});
-	const shutdown = createShutdownSignalHandler({
-		cleanup: runCleanup,
-		stoppingMessage: (signal) => `Received ${signal}, shutting down...`,
-		forceExitHint: `Orphan containers may remain — run 'docker ps --filter name=${getEmbedConfig().resourceNamePrefix}-' and 'docker rm -f' to clean up.`,
-		info: (m) => logger.info(m),
-		warn: (m) => logger.warn(m)
-	});
-	process.on("SIGINT", () => {
-		shutdown("SIGINT");
-	});
-	process.on("SIGTERM", () => {
-		shutdown("SIGTERM");
-	});
 	process.on("uncaughtException", (err) => {
 		logger.error(`Uncaught exception: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
 		shutdown("uncaughtException", 1);
@@ -17345,7 +17706,7 @@ async function loadStackStateBundle(stack, provider, args) {
 }
 async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? stateRegion;
+	const region = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(stateRegion);
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
@@ -18157,7 +18518,9 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 	let profileCredsFile;
 	let stateProvider;
 	let stopWatch;
+	const startGuard = createContainerStartGuard({ cancelledCode: "LOCAL_INVOKE_AGENTCORE_CANCELLED" });
 	const cleanup = singleFlight(async () => {
+		const pendingContainer = startGuard.stop();
 		if (stopWatch) await stopWatch();
 		if (stateProvider) try {
 			stateProvider.dispose();
@@ -18169,6 +18532,7 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 		} catch (err) {
 			getLogger().debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		containerId ??= await pendingContainer;
 		if (containerId) try {
 			await removeContainer(containerId);
 		} catch (err) {
@@ -18182,6 +18546,17 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 	}, (err) => {
 		getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
 	});
+	const onSignal = createShutdownSignalHandler({
+		cleanup,
+		stoppingMessage: (signal) => `Received ${signal}, removing the agent container...`,
+		forceExitHint: `Run 'docker ps -a --filter name=${getEmbedConfig().resourceNamePrefix}-' to find what is left.`,
+		info: (m) => logger.info(m),
+		warn: (m) => logger.warn(m)
+	});
+	sigintHandler = () => onSignal("SIGINT");
+	sigtermHandler = () => onSignal("SIGTERM");
+	process.on("SIGINT", sigintHandler);
+	process.on("SIGTERM", sigtermHandler);
 	try {
 		await activateWorkloadAwsWiring({
 			...options,
@@ -18261,7 +18636,7 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 		const containerPort = isMcp ? MCP_CONTAINER_PORT : isA2a ? A2A_CONTAINER_PORT : void 0;
 		const containerPortLabel = isMcp ? `${MCP_CONTAINER_PORT}${MCP_PATH}` : isA2a ? `${A2A_CONTAINER_PORT}${"/"}` : "8080";
 		logger.info(`Starting agent container (image=${image}, port=${hostPort} -> ${containerPortLabel})...`);
-		containerId = await runDetached({
+		containerId = await startGuard.run(() => runDetached({
 			image,
 			mounts: [],
 			env: dockerEnv,
@@ -18272,19 +18647,8 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 			name: containerName,
 			...containerPort !== void 0 && { containerPort },
 			...sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys }
-		});
+		}), containerName);
 		stopLogs = streamLogs(containerId);
-		const onSignal = createShutdownSignalHandler({
-			cleanup,
-			stoppingMessage: (signal) => `Received ${signal}, removing the agent container...`,
-			forceExitHint: `Run 'docker ps -a --filter name=${getEmbedConfig().resourceNamePrefix}-' to find what is left.`,
-			info: (m) => logger.info(m),
-			warn: (m) => logger.warn(m)
-		});
-		sigintHandler = () => onSignal("SIGINT");
-		sigtermHandler = () => onSignal("SIGTERM");
-		process.on("SIGINT", sigintHandler);
-		process.on("SIGTERM", sigtermHandler);
 		if (isMcp && mcpRequest) {
 			logger.info(`MCP request: ${mcpRequest.method}`);
 			const mcp = await mcpInvokeOnce(containerHost, hostPort, mcpRequest, { requestTimeoutMs: options.timeout });
@@ -18424,7 +18788,7 @@ async function resolveAgentCoreSigV4Context(options, resolved, loaded, stateProv
 		getLogger().warn(`Runtime ${displayIdent(resolved.logicalId)} declares a customJwtAuthorizer; --sigv4 ignored (JWT path takes precedence).`);
 		return;
 	}
-	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
+	const region = options.region ?? options.stackRegion ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(resolved.stack.region);
 	if (!region) throw new CdkLocalError("--sigv4: no region resolved for the AgentCore signing scope. Pass --region <region>, set AWS_REGION, or use --from-cfn-stack with a region-bound stack.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_REGION");
 	return {
 		credentials: await resolveHostCredentialsForSigV4(options, resolved, loaded, region, stateProvider),
@@ -18558,7 +18922,7 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 		key: s3Source.key,
 		...s3Source.versionId !== void 0 && { versionId: s3Source.versionId }
 	};
-	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
+	const region = options.region ?? options.stackRegion ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(resolved.stack.region);
 	const assumeRoleArn = await resolveAssumeRoleArn(options, resolved, loaded, stateProvider);
 	let credentials;
 	if (assumeRoleArn) try {
@@ -18702,7 +19066,7 @@ function describeIntrinsic(value) {
 }
 async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 	const logger = getLogger();
-	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region;
+	const region = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(candidate.region);
 	let accountId;
 	try {
 		accountId = await resolveCallerAccountId$2(region, options.profile, isCfnFlagPresent(options));
@@ -19854,6 +20218,7 @@ function mergeHostGatewayAddHostFlags(addHostFlags, hostGatewayExtraHosts) {
 async function runEcsTask(task, options, state) {
 	const logger = getLogger();
 	if (task.containers.length === 0) throw new EcsTaskRunnerError(`Task ${displayIdent(task.taskDefinitionLogicalId)} has no containers — nothing to run.`);
+	assertEcsTaskCommandsResolved(task);
 	for (const w of task.warnings) logger.warn(w);
 	const startOrder = topoSort(buildDependencyGraph(task.containers), task.containers);
 	const finchRefusals = [];
@@ -23205,8 +23570,32 @@ function createFrontDoorLambdaRunner(lambda, opts) {
 	let stopLogStream;
 	let starting;
 	let stopped = false;
+	const startGuard = createContainerStartGuard({ cancelledCode: "FRONT_DOOR_LAMBDA_STOPPED" });
+	function removePlanTmpDirs(p) {
+		if (p?.inlineTmpDir) try {
+			rmSync(p.inlineTmpDir, {
+				recursive: true,
+				force: true
+			});
+		} catch (err) {
+			logger.debug(`Failed to remove inline-code tmpdir ${p.inlineTmpDir}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		if (p?.assetTmpDir) try {
+			rmSync(p.assetTmpDir, {
+				recursive: true,
+				force: true
+			});
+		} catch (err) {
+			logger.debug(`Failed to remove zip-asset tmpdir ${p.assetTmpDir}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	}
 	async function doStart() {
-		plan = lambda.kind === "zip" ? await resolveZipImagePlan(lambda, opts) : await resolveContainerImagePlan(lambda, opts);
+		const resolved = lambda.kind === "zip" ? await resolveZipImagePlan(lambda, opts) : await resolveContainerImagePlan(lambda, opts);
+		if (stopped) {
+			removePlanTmpDirs(resolved);
+			throw new Error("FrontDoorLambdaRunner stopped while starting");
+		}
+		plan = resolved;
 		const port = await pickFreePort();
 		hostPort = port;
 		const name = `${getEmbedConfig().resourceNamePrefix}-alblambda-${lambda.logicalId}-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
@@ -23219,20 +23608,20 @@ function createFrontDoorLambdaRunner(lambda, opts) {
 			AWS_LAMBDA_LOG_STREAM_NAME: "local",
 			...forwardAwsEnv()
 		};
-		logger.info(`Starting Lambda target container for ${lambda.logicalId} (image=${plan.image}, port=${port})...`);
-		const id = await runDetached({
-			image: plan.image,
-			mounts: plan.mounts,
+		logger.info(`Starting Lambda target container for ${lambda.logicalId} (image=${resolved.image}, port=${port})...`);
+		const id = await startGuard.run(() => runDetached({
+			image: resolved.image,
+			mounts: resolved.mounts,
 			env,
 			...opts.sensitiveEnvKeys && opts.sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys: opts.sensitiveEnvKeys },
-			cmd: plan.cmd,
+			cmd: resolved.cmd,
 			hostPort: port,
 			host: opts.containerHost,
 			name,
-			...plan.platform !== void 0 && { platform: plan.platform },
-			...plan.entryPoint !== void 0 && { entryPoint: plan.entryPoint },
-			...plan.workingDir !== void 0 && { workingDir: plan.workingDir }
-		});
+			...resolved.platform !== void 0 && { platform: resolved.platform },
+			...resolved.entryPoint !== void 0 && { entryPoint: resolved.entryPoint },
+			...resolved.workingDir !== void 0 && { workingDir: resolved.workingDir }
+		}), name);
 		containerId = id;
 		stopLogStream = opts.streamLogs === false ? void 0 : streamLogs(id);
 		try {
@@ -23261,11 +23650,14 @@ function createFrontDoorLambdaRunner(lambda, opts) {
 		async stop() {
 			if (stopped) return;
 			stopped = true;
+			const pendingContainer = startGuard.stop();
 			try {
 				stopLogStream?.();
 			} catch (err) {
 				logger.debug(`stopLogStream(${displayIdent(lambda.logicalId)}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			}
+			const pendingId = await pendingContainer;
+			containerId ??= pendingId;
 			if (containerId) {
 				try {
 					await removeContainer(containerId);
@@ -23274,22 +23666,7 @@ function createFrontDoorLambdaRunner(lambda, opts) {
 				}
 				containerId = void 0;
 			}
-			if (plan?.inlineTmpDir) try {
-				rmSync(plan.inlineTmpDir, {
-					recursive: true,
-					force: true
-				});
-			} catch (err) {
-				logger.debug(`Failed to remove inline-code tmpdir ${plan.inlineTmpDir}: ${err instanceof Error ? err.message : String(err)}`);
-			}
-			if (plan?.assetTmpDir) try {
-				rmSync(plan.assetTmpDir, {
-					recursive: true,
-					force: true
-				});
-			} catch (err) {
-				logger.debug(`Failed to remove zip-asset tmpdir ${plan.assetTmpDir}: ${err instanceof Error ? err.message : String(err)}`);
-			}
+			removePlanTmpDirs(plan);
 		}
 	};
 }
@@ -23916,7 +24293,14 @@ async function runEcsServiceEmulator(targets, options, strategy, extraStateProvi
 	let frontDoorLambdaRunners = [];
 	let watcher;
 	let reloadQueue;
+	let sharedNetworkPending;
+	let signalled = false;
+	let stopping = false;
+	const throwIfStopping = () => {
+		if (stopping) throw new LocalStartServiceError("Shutting down: the boot is not continued.");
+	};
 	const cleanup = singleFlight(async () => {
+		stopping = true;
 		await stopWatchReloads({
 			watcher,
 			queue: reloadQueue,
@@ -23934,6 +24318,9 @@ async function runEcsServiceEmulator(targets, options, strategy, extraStateProvi
 		frontDoorServers = [];
 		await Promise.allSettled(frontDoorLambdaRunners.map((r) => r.stop().catch((err) => getLogger().warn(`front-door Lambda target teardown failed: ${err instanceof Error ? err.message : String(err)}`))));
 		frontDoorLambdaRunners = [];
+		const pendingNetwork = await sharedNetworkPending;
+		sharedNetwork ??= pendingNetwork;
+		sharedNetworkPending = void 0;
 		if (profileCredsFile) {
 			try {
 				await profileCredsFile.dispose();
@@ -23952,6 +24339,20 @@ async function runEcsServiceEmulator(targets, options, strategy, extraStateProvi
 		}
 	}, (err) => getLogger().warn(`service cleanup failed: ${err instanceof Error ? err.message : String(err)}`));
 	try {
+		const onSignal = createShutdownSignalHandler({
+			cleanup: async () => {
+				signalled = true;
+				await cleanup();
+			},
+			stoppingMessage: () => "Stopping service(s)...",
+			forceExitHint: `Run 'docker ps -a --filter name=${getEmbedConfig().resourceNamePrefix}-' and 'docker network ls --filter name=${getEmbedConfig().resourceNamePrefix}-' to find what is left.`,
+			info: (m) => logger.info(m),
+			warn: (m) => logger.warn(m)
+		});
+		sigintHandler = () => onSignal("SIGINT");
+		sigtermHandler = () => onSignal("SIGTERM");
+		process.on("SIGINT", sigintHandler);
+		process.on("SIGTERM", sigtermHandler);
 		await activateWorkloadAwsWiring(options);
 		warnIfEmulateRoleViaUnused(options.emulateRoleVia, {
 			roleFlag: "--assume-role",
@@ -24002,16 +24403,20 @@ async function runEcsServiceEmulator(targets, options, strategy, extraStateProvi
 		const taskRoleMode = isTaskRoleInEffect(options);
 		const sidecarCredentials = taskRoleMode ? void 0 : await resolveSharedSidecarCredentials(options);
 		try {
-			sharedNetwork = await createSharedSvcNetwork({
+			const creating = createSharedSvcNetwork({
 				prefix: options.cluster,
 				skipPull,
 				cluster: options.cluster,
 				...taskRoleMode && { taskRole: true },
 				...sidecarCredentials !== void 0 && { credentials: sidecarCredentials }
 			});
+			sharedNetworkPending = creating.catch(() => void 0);
+			sharedNetwork = await creating;
+			sharedNetworkPending = void 0;
 		} catch (err) {
 			throw new LocalStartServiceError(`Failed to create shared service network: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		throwIfStopping();
 		if (options.profile && sidecarCredentials) profileCredsFile = await writeProfileCredentialsFile(options.profile, sidecarCredentials);
 		const discovery = {
 			registry,
@@ -24019,22 +24424,13 @@ async function runEcsServiceEmulator(targets, options, strategy, extraStateProvi
 			sharedNetwork
 		};
 		if (frontDoor && frontDoor.listeners.length > 0) {
-			const built = await buildFrontDoor(frontDoor, options, logger, extraStateProviders);
+			const built = await buildFrontDoor(frontDoor, options, logger, extraStateProviders, (r) => {
+				frontDoorLambdaRunners.push(r);
+				if (stopping) r.stop().catch(() => void 0);
+			});
 			frontDoorServers = built.servers;
 			frontDoorByService = built.frontDoorByService;
-			frontDoorLambdaRunners = built.lambdaRunners;
 		}
-		const onSignal = createShutdownSignalHandler({
-			cleanup,
-			stoppingMessage: () => "Stopping service(s)...",
-			forceExitHint: `Run 'docker ps -a --filter name=${getEmbedConfig().resourceNamePrefix}-' and 'docker network ls --filter name=${getEmbedConfig().resourceNamePrefix}-' to find what is left.`,
-			info: (m) => logger.info(m),
-			warn: (m) => logger.warn(m)
-		});
-		sigintHandler = () => onSignal("SIGINT");
-		sigtermHandler = () => onSignal("SIGTERM");
-		process.on("SIGINT", sigintHandler);
-		process.on("SIGTERM", sigtermHandler);
 		const { tags: imageOverrideTags, overrides: imageOverrideMap } = await resolveAndBuildImageOverrides({
 			perTarget: perTarget.map((pt) => pt.boot.target),
 			stacks,
@@ -24042,7 +24438,10 @@ async function runEcsServiceEmulator(targets, options, strategy, extraStateProvi
 			extraStateProviders,
 			logger
 		});
-		for (const pt of perTarget) pt.controller = await bootOneTarget(pt.boot, pt.runState, stacks, options, discovery, skipPull, extraStateProviders, profileCredsFile, frontDoorByService.get(pt.boot.target), strategy.suppressLoadBalancerWarning === true, imageOverrideTags.get(pt.boot.target));
+		for (const pt of perTarget) {
+			throwIfStopping();
+			pt.controller = await bootOneTarget(pt.boot, pt.runState, stacks, options, discovery, skipPull, extraStateProviders, profileCredsFile, frontDoorByService.get(pt.boot.target), strategy.suppressLoadBalancerWarning === true, imageOverrideTags.get(pt.boot.target));
+		}
 		if (perTarget.length > 0) {
 			const summary = perTarget.map((pt) => `${pt.controller.service.serviceName} (${pt.controller.activeReplicaCount()} replica(s))`).join(", ");
 			logger.info(`Service(s) running: ${summary}.`);
@@ -24106,6 +24505,7 @@ async function runEcsServiceEmulator(targets, options, strategy, extraStateProvi
 		await new Promise(() => {});
 	} finally {
 		await cleanup();
+		if (signalled) await new Promise(() => void 0);
 		if (sigintHandler) process.off("SIGINT", sigintHandler);
 		if (sigtermHandler) process.off("SIGTERM", sigtermHandler);
 	}
@@ -24357,14 +24757,15 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 	const taskStack = stacks.find((s) => s.stackName === service.stack.stackName) ?? service.stack;
 	const taskNeeds = detectEcsImageResolutionNeeds(taskStack);
 	if (stateProvider && taskNeeds.needsCrossStackResolver) {
-		const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? service.stack.region ?? "us-east-1";
+		const consumerRegion = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(service.stack.region) ?? "us-east-1";
 		const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
 		if (resolver) await applyCrossStackValuesToTask(service.task, resolver, {
 			imageContext,
 			consumerRegion,
 			profile: options.profile
 		});
-	} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
+	} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets / Command entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
+	assertEcsTaskCommandsResolved(service.task);
 	const effectiveAssumeRole = resolveEcsAssumeRoleOption(options);
 	let assumedCredentials;
 	let resolvedRoleArn;
@@ -24466,7 +24867,7 @@ async function resolveAlbLambdaTargetEnv(plan, options, extraStateProviders) {
 	for (const [logicalId, lambda] of lambdas) out.set(logicalId, await resolveLambdaContainerEnv(lambda, envOptions, profileCredentials, extraStateProviders));
 	return out;
 }
-async function buildFrontDoor(plan, options, logger, extraStateProviders) {
+async function buildFrontDoor(plan, options, logger, extraStateProviders, onLambdaRunner) {
 	const containerHost = options.containerHost;
 	const servers = [];
 	const poolRegistry = /* @__PURE__ */ new Map();
@@ -24487,6 +24888,7 @@ async function buildFrontDoor(plan, options, logger, extraStateProviders) {
 					...containerEnv !== void 0 && containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
 				});
 				lambdaRegistry.set(t.lambda.logicalId, runner);
+				onLambdaRunner?.(runner);
 			}
 			const boundRunner = runner;
 			return {
@@ -24816,7 +25218,7 @@ async function buildEcsImageResolutionContext$1(target, stacks, options, statePr
 	if (!roleRecordUsable) ctx.ignoreStateForRoles = true;
 	const wantsPseudoForEnvOrSecret = !!stateProvider && needs.needsEnvOrSecretSubstitution;
 	if (needs.needsPseudoParameters || wantsPseudoForEnvOrSecret) {
-		const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region;
+		const region = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(candidate.region);
 		if (!region) logger.warn(`Resolver references \${AWS::Region} but ${getEmbedConfig().binaryName} could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.`);
 		let accountId;
 		try {
@@ -24857,7 +25259,7 @@ async function buildEcsImageResolutionContext$1(target, stacks, options, statePr
 	} else if (!stateProvider && needs.needsStateResources) {
 		if (!opts.suppressStateWarning && !opts.imageOverridden) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI, or --image-override to build it from a local Dockerfile.");
 	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) {
-		if (!opts.suppressStateWarning) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against the deployed state.");
+		if (!opts.suppressStateWarning) logger.warn("Container Environment / Secrets / Command entries contain CloudFormation intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against the deployed state; without one an intrinsic Command / EntryPoint / HealthCheck.Command element refuses the run.");
 	}
 	return ctx;
 }
@@ -25155,14 +25557,15 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 		const taskStack = stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack;
 		const taskNeeds = detectEcsImageResolutionNeeds(taskStack);
 		if (stateProvider && taskNeeds.needsCrossStackResolver) {
-			const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? task.stack.region ?? "us-east-1";
+			const consumerRegion = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(task.stack.region) ?? "us-east-1";
 			const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
 			if (resolver) await applyCrossStackValuesToTask(task, resolver, {
 				imageContext,
 				consumerRegion,
 				profile: options.profile
 			});
-		} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
+		} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets / Command entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state.");
+		assertEcsTaskCommandsResolved(task);
 		const onSignal = createShutdownSignalHandler({
 			cleanup,
 			stoppingMessage: () => "Stopping task...",
@@ -25312,7 +25715,7 @@ async function buildEcsImageResolutionContext(candidate, stateProvider, options,
 	if (!roleRecordUsable) ctx.ignoreStateForRoles = true;
 	const wantsPseudoForEnvOrSecret = !!stateProvider && needs.needsEnvOrSecretSubstitution;
 	if (needs.needsPseudoParameters || wantsPseudoForEnvOrSecret) {
-		const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region;
+		const region = options.region ?? namedEnvAwsRegion() ?? process.env["AWS_DEFAULT_REGION"] ?? regionOrAmbientDefault(candidate.region);
 		if (!region) logger.warn(`Resolver references \${AWS::Region} but ${getEmbedConfig().binaryName} could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.`);
 		let accountId;
 		try {
@@ -25352,7 +25755,7 @@ async function buildEcsImageResolutionContext(candidate, stateProvider, options,
 		if (needs.needsEnvOrSecretSubstitution && stateProviderFor) await loadMixedModeContainerStates(ctx, candidate, stateProviderFor);
 	} else if (!stateProvider && needs.needsStateResources) {
 		if (!options.imageOverride?.length) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute the deployed repository URI, or --image-override to build it from a local Dockerfile. Otherwise the resolver will surface its existing error.");
-	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
+	} else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets / Command entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state. Without a state source the Environment / Secrets entries are dropped (per-key warnings will follow), and an intrinsic Command / EntryPoint / HealthCheck.Command element refuses the run.");
 	return ctx;
 }
 function pickCandidateStack(target, stacks) {
@@ -29117,6 +29520,7 @@ async function bootLambdaUrlOrigins(distribution, stacks, opts) {
 				containerEnv: containerEnv.env,
 				...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
 			});
+			opts.runnerSink?.push(runner);
 			logger.info(`Booting Lambda Function URL origin container for ${functionLogicalId} (the backing Lambda runs locally via RIE)...`);
 			await runner.start();
 		} catch (err) {
@@ -29139,6 +29543,14 @@ async function drainWebFunctionServes(serves) {
 		await Promise.all(batch.map((s) => s.teardown().catch(() => void 0)));
 	}
 }
+async function drainLambdaRunners(runners) {
+	let done = 0;
+	while (done < runners.length) {
+		const batch = runners.slice(done);
+		done = runners.length;
+		await Promise.all(batch.map((r) => r.stop().catch(() => void 0)));
+	}
+}
 const WEB_FUNCTION_ORIGIN_READY_TIMEOUT_MS = 6e4;
 async function bootWebFunctionOrigins(distribution, stacks, opts) {
 	const logger = getLogger();
@@ -29207,6 +29619,7 @@ async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
 			containerEnv: containerEnv.env,
 			...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
 		});
+		opts.runnerSink?.push(runner);
 		logger.info(`Booting Lambda@Edge container for ${functionLogicalId} (the function runs locally via RIE)...`);
 		await runner.start();
 		runners.push(runner);
@@ -29383,12 +29796,13 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 	await attachKvsModules(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
 	const bootOpts = buildLambdaBootOptions(options, profileCredentials, extraStateProviders);
 	const webFunctionServes = [];
+	const bootRunners = [];
 	let bootAborted = false;
 	const onBootSignal = (signal) => {
 		if (bootAborted) return;
 		bootAborted = true;
-		logger.info(`Received ${signal} during start-up; removing the web function containers...`);
-		drainWebFunctionServes(webFunctionServes).then(() => process.exit(signalExitCode(signal)));
+		logger.info(`Received ${signal} during start-up; removing the web function containers and the Lambda containers started so far...`);
+		Promise.all([drainWebFunctionServes(webFunctionServes), drainLambdaRunners(bootRunners)]).then(() => process.exit(signalExitCode(signal)));
 	};
 	const bootSigint = () => onBootSignal("SIGINT");
 	const bootSigterm = () => onBootSignal("SIGTERM");
@@ -29396,14 +29810,18 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 		process.off("SIGINT", bootSigint);
 		process.off("SIGTERM", bootSigterm);
 	};
-	if ([...initial.distribution.origins.values()].some((o) => o.kind === "web-function")) {
-		process.on("SIGINT", bootSigint);
-		process.on("SIGTERM", bootSigterm);
-	}
-	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, bootOpts);
-	const { invokers: edgeInvokers, runners: edgeRunners } = await bootLambdaEdgeFunctions(initial.distribution, initial.stacks, bootOpts);
+	process.on("SIGINT", bootSigint);
+	process.on("SIGTERM", bootSigterm);
 	let server;
 	try {
+		const { invokers: lambdaInvokers } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, {
+			...bootOpts,
+			runnerSink: bootRunners
+		});
+		const { invokers: edgeInvokers } = await bootLambdaEdgeFunctions(initial.distribution, initial.stacks, {
+			...bootOpts,
+			runnerSink: bootRunners
+		});
 		const webFunctions = await bootWebFunctionOrigins(initial.distribution, initial.stacks, {
 			...bootOpts,
 			sink: webFunctionServes
@@ -29424,7 +29842,7 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 			...webFunctions.targets.size > 0 && { webFunctionOrigins: webFunctions.targets }
 		});
 	} catch (err) {
-		await Promise.all([...[...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch(() => void 0)), ...webFunctionServes.map((s) => s.teardown().catch(() => void 0))]);
+		await Promise.all([...bootRunners.map((r) => r.stop().catch(() => void 0)), ...webFunctionServes.map((s) => s.teardown().catch(() => void 0))]);
 		if (bootAborted) return await new Promise(() => void 0);
 		disarmBootSignals();
 		throw err;
@@ -29476,7 +29894,7 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 		try {
 			await server.close();
 		} catch {}
-		await Promise.all([...[...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch((err) => {
+		await Promise.all([...bootRunners.map((r) => r.stop().catch((err) => {
 			logger.debug(`Lambda runner stop failed: ${err instanceof Error ? err.message : String(err)}`);
 		})), ...webFunctionServes.map((s) => s.teardown().catch((err) => {
 			logger.debug(`Web function server teardown failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -29850,6 +30268,21 @@ function resolveAgentCoreServePlan(protocol) {
 	};
 }
 async function localStartAgentCoreCommand(target, options, extraStateProviders, hostSynthesizer) {
+	let boot;
+	try {
+		await serveAgentCore(target, options, extraStateProviders, hostSynthesizer, (b) => {
+			boot = b;
+		});
+	} catch (err) {
+		if (boot) {
+			await boot.teardown().catch(() => void 0);
+			if (boot.signalled()) await new Promise(() => void 0);
+			boot.detachSignals();
+		}
+		throw err;
+	}
+}
+async function serveAgentCore(target, options, extraStateProviders, hostSynthesizer, registerBoot) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	let containerId;
@@ -29861,9 +30294,12 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders,
 	let reloadQueue;
 	let shuttingDown = false;
 	let tornDown = false;
-	const teardown = async () => {
-		if (tornDown) return;
+	const startGuard = createContainerStartGuard({ cancelledCode: "LOCAL_START_AGENTCORE_CANCELLED" });
+	let teardownPromise;
+	const teardown = () => teardownPromise ??= doTeardown();
+	const doTeardown = async () => {
 		tornDown = true;
+		const pendingContainer = startGuard.stop();
 		await stopWatchReloads({
 			watcher,
 			queue: reloadQueue,
@@ -29879,6 +30315,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders,
 		} catch (err) {
 			logger.debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		containerId ??= await pendingContainer;
 		if (containerId) try {
 			await removeContainer(containerId);
 		} catch (err) {
@@ -29891,6 +30328,28 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders,
 			await profileCredsFile.dispose();
 		} catch {}
 	};
+	const shutdown = createShutdownSignalHandler({
+		cleanup: async () => {
+			shuttingDown = true;
+			await teardown().catch(() => void 0);
+		},
+		stoppingMessage: (signal) => `Received ${signal}, shutting down...`,
+		forceExitHint: `Run 'docker ps -a --filter name=${getEmbedConfig().resourceNamePrefix}-' to find what is left.`,
+		info: (m) => logger.info(m),
+		warn: (m) => logger.warn(m)
+	});
+	const onSigint = () => shutdown("SIGINT");
+	const onSigterm = () => shutdown("SIGTERM");
+	process.on("SIGINT", onSigint);
+	process.on("SIGTERM", onSigterm);
+	registerBoot({
+		teardown,
+		detachSignals: () => {
+			process.off("SIGINT", onSigint);
+			process.off("SIGTERM", onSigterm);
+		},
+		signalled: () => shuttingDown
+	});
 	await activateWorkloadAwsWiring(options);
 	warnIfEmulateRoleViaUnused(options.emulateRoleVia, {
 		roleFlag: "--assume-role",
@@ -29944,31 +30403,20 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders,
 	const containerHost = options.containerHost;
 	const containerName = `${getEmbedConfig().resourceNamePrefix}-agentcore-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
 	logger.info(`Starting agent container (image=${image}, port=${containerHostPort} -> ${plan.containerPortLabel})...`);
-	containerId = await runDetached({
+	const bootPort = containerHostPort;
+	containerId = await startGuard.run(() => runDetached({
 		image,
 		mounts: [],
 		env: dockerEnv,
 		cmd: [],
-		hostPort: containerHostPort,
+		hostPort: bootPort,
 		host: containerHost,
 		platform: options.platform,
 		name: containerName,
 		...plan.containerPort !== void 0 && { containerPort: plan.containerPort },
 		...sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys }
-	});
+	}), containerName);
 	stopLogs = streamLogs(containerId);
-	const shutdown = createShutdownSignalHandler({
-		cleanup: async () => {
-			shuttingDown = true;
-			await teardown().catch(() => void 0);
-		},
-		stoppingMessage: (signal) => `Received ${signal}, shutting down...`,
-		forceExitHint: `Run 'docker ps -a --filter name=${getEmbedConfig().resourceNamePrefix}-' to find what is left.`,
-		info: (m) => logger.info(m),
-		warn: (m) => logger.warn(m)
-	});
-	process.on("SIGINT", () => shutdown("SIGINT"));
-	process.on("SIGTERM", () => shutdown("SIGTERM"));
 	try {
 		if (plan.readyPath === void 0) await waitForAgentCorePing(containerHost, containerHostPort, options.timeout);
 		else await waitForAgentCoreHttpReady(containerHost, containerHostPort, plan.readyPath, options.timeout);
@@ -36794,5 +37242,5 @@ function addStudioSpecificOptions(cmd) {
 	return cmd;
 }
 
-export { postHook as $, AGENTCORE_HTTP_PROTOCOL as $a, probeHostGatewaySupport as $i, addImageOverrideOptions as $n, readProfileEndpointSettings as $o, resolveApiTargetSubset as $r, classifyS3Error as $t, microvmFidelityWarnings as A, isCfnFlagPresent as Aa, translateLambdaResponse as Ai, stripCloudFrontImport as An, AUTH_OFF_PLACEHOLDER_CREDENTIALS as Ao, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, countTargets as Ba, ConnectionRegistry as Bi, createLocalStartAlbCommand as Bn, collectHostEndpointOverrides as Bo, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, substituteEnvVarsFromState as Ca, attachAuthorizers as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, assumedRoleRecorded as Co, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, UNNAMED_WORKLOAD as Da, isFunctionUrlOacFronted as Di, compileCloudFrontFunction as Dn, resetWorkloadIdentity as Do, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, LocalStateSourceError as Ea, buildCorsConfigFromCloudFrontChain as Ei, resolveWebFunctionTarget as En, recordAssumedRole as Eo, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, CfnLocalStateProvider as Fa, pickResponseTemplate as Fi, findFileAssetForObjectKey as Fn, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as Fo, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, filterWebSocketApisByIdentifiers as Ga, buildDisconnectEvent as Gi, addStartServiceSpecificOptions as Gn, getContainerJavaTruststorePath as Go, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, availableWebSocketApiIdentifiers as Ha, handleConnectionsRequest as Hi, resolveAlbTarget as Hn, effectiveLoopbackPorts as Ho, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, collectSsmParameterRefs as Ia, selectIntegrationResponse as Ii, isBucketDeploymentResource as In, activateWorkloadAwsWiring as Io, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, discoverRoutes as Ja, createFileWatcher as Ji, addRunTaskSpecificOptions as Jn, loopbackForwarderPlan as Jo, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, parseSelectionExpressionPath as Ka, buildMessageEvent as Ki, createLocalStartServiceCommand as Kn, javaTruststoreToolOptions as Ko, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, resolveSsmParameters as La, tryParseStatus as Li, resolveBucketDeploymentObjectKey as Ln, applyWorkloadAwsWiringToEnv as Lo, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, resolveCfnFallbackRegion as Ma, buildHttpApiV2Event as Mi, createLocalFileKvsDataSource as Mn, DEFAULT_AWS_EMULATOR_URL as Mo, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, resolveCfnRegion as Na, buildRestV1Event as Ni, createUnboundCloudFrontModule as Nn, EMULATOR_SCRUBBED_ENV_KEYS as No, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, createLocalStateProvider as Oa, matchPreflight as Oi, runViewerRequest as On, workloadClientConfig as Oo, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, resolveCfnStackName as Pa, evaluateResponseParameters as Pi, bucketDeploymentSourceObjectKeys as Pn, HOST_CA_TRUST_ENV_KEYS as Po, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, AGENTCORE_AGUI_PROTOCOL as Qa, HOST_GATEWAY_MIN_VERSION as Qi, addEcsAssumeRoleOptions as Qn, readEmulatorRunFiles as Qo, createWatchPredicates as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, resolveWatchConfig as Ra, VtlEvaluationError as Ri, addAlbSpecificOptions as Rn, awsEmulatorEnvName as Ro, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, substituteAgainstStateAsync as Sa, invokeTokenAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SECOND_ASSUME_MESSAGE as So, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, materializeLayerFromArn as Ta, buildCorsConfigByApiId as Ti, WebFunctionResolutionError as Tn, readEnvCallerCredentials as To, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, discoverWebSocketApis as Ua, parseConnectionsPath as Ui, isApplicationLoadBalancer as Un, getActiveWorkloadAwsWiring as Uo, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, listTargets as Va, buildMgmtEndpointEnvUrl as Vi, parseLbPortOverrides as Vn, displayEndpointValue as Vo, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, discoverWebSocketApisOrThrow as Wa, buildConnectEvent as Wi, resolveAlbFrontDoor as Wn, getContainerCaBundlePath as Wo, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, resolveLambdaArnIntrinsic as Xa, createLocalInvokeCommand as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, parseAwsEndpoint as Xo, addStartApiSpecificOptions as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, pickRefLogicalId as Ya, addInvokeSpecificOptions as Yi, createLocalRunTaskCommand as Yn, mergeJavaToolOptions as Yo, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, AGENTCORE_A2A_PROTOCOL as Za, HOST_DOCKER_INTERNAL_GATEWAY as Zi, addCommonEcsServiceOptions as Zn, probeAwsEmulatorHealth as Zo, createLocalStartApiCommand as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveRuntimeFileExtension as _a, verifyJwtViaDiscovery as _i, pickKvsLogicalIdFromArn as _n, parseDynamicReference as _o, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, buildLoopbackForwarderDockerArgs as aa, filterRoutesByApiIdentifiers as ai, serveLambdaUrlOrigin as an, derivePseudoParametersFromRegion as ao, resolveSharedSidecarCredentials as ar, writeCaBundleFile as as, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, assertEcsTaskImagesResolvable as ba, evaluateCachedLambdaPolicy as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, addAwsEndpointOptions as bo, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, ensureForwarderImage as ca, startApiServer as ci, buildEdgeRequestEvent as cn, tryResolveImageFnJoin as co, buildImageOverrideTag as cr, isRealAwsHost as cs, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, buildContainerImage as da, defaultCredentialsLoader as di, httpHeadersToEdge as dn, DynamicReferenceResolver as do, mergeForService as dr, rewriteSqsQueueUrlsInEnv as ds, createLocalStartWebFunctionCommand as dt, resolveHostGatewayExtraHosts as ea, createAuthorizerCache as ei, createS3OriginReader as en, AGENTCORE_MCP_PROTOCOL as eo, buildEcsImageResolutionContext$1 as er, resolveAwsEmulatorOption as es, runHookBody as et, filterStudioCustomResources as f, dockerRegistryEnv as fa, buildCognitoJwksUrl as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, containsDynamicReference as fo, parseImageOverrideFlags as fr, sqsEmulatorOriginOf as fs, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, resolveRuntimeCodeMountPath as ga, verifyJwtAuthorizer as gi, pickFunctionUrlLogicalIdFromOrigin as gn, keysOverriddenBy as go, imageOverrideKeyAliases as gr, resolveProfileCredentials as gs, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, stripEcrCredentials as ha, verifyCognitoJwt as hi, isCloudFrontDistribution as hn, keysNotFromTemplate as ho, describePinnedImageUri as hr, buildStsClientConfig as hs, selectServeInboundAuth as ht, coerceStopRequest as i, awaitLoopbackForwarderStatus as ia, filterRoutesByApiIdentifier as ii, serveFromStaticOrigin as in, resolveAgentCoreTarget as io, resolveEcsAssumeRoleOption as ir, takeAwsEmulatorStateSourceHint as is, MicrovmResolutionError as it, readRunHookPayload as j, rejectExplicitCfnStackWithMultipleStacks as ja, applyAuthorizerOverlay as ji, createCloudFrontModule as jn, CA_TRUST_ENV_KEYS as jo, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, groupWorkloadsRoutedApart as ka, matchRoute as ki, runViewerResponse as kn, workloadStsClientConfig as ko, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, startLoopbackForwarder as la, resolveSelectionExpression as li, buildEdgeResponseEvent as ln, LocalInvokeBuildError as lo, canonicalizeImageOverrideKeys as lr, realSqsHostnames as ls, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, noImplicitEcrPullArgs as ma, createJwksCache as mi, extractKvsAssociations as mn, firstUsableRegion as mo, runImageOverrideBuilds as mr, createMixedModeTlsMaterials as ms, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, withWorkloadAwsWiring as na, buildStageMap as ni, startCloudFrontServer as nn, AgentCoreResolutionError as no, parseMaxTasks as nr, resolveWorkloadAwsWiring as ns, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, buildNamespaceOwnerForwarderDockerArgs as oa, groupRoutesByServer as oi, applyEdgeRequestResult as on, formatStateRemedy as oo, runEcsServiceEmulator as or, MIXED_MODE_RESIGN_BODY_CAP_BYTES as os, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, isEcrRegistryConfigKey as pa, buildJwksUrlFromIssuer as pi, describeS3OriginDomain as pn, deployedFillMayBeSecret as po, resolveImageOverrides as pr, buildJavaTrustStore as ps, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, webSocketApiMatchesIdentifier as qa, classifySourceChange as qi, serviceStrategy as qn, logMixedModeForWorkload as qo, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, LOOPBACK_FORWARDER_IMAGE as ra, availableApiIdentifiers as ri, resolveErrorResponseCandidates as rn, pickAgentCoreCandidateStack as ro, parseRestartPolicy as rr, setActiveWorkloadAwsWiring as rs, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, describeForwarderFailure as sa, readMtlsMaterialsFromDisk as si, applyEdgeResponseResult as sn, substituteImagePlaceholders as so, ImageOverrideError as sr, REAL_SQS_QUEUE_URL as ss, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, attachLoopbackForwarder as ta, attachStageContext as ti, matchBehavior as tn, AGENTCORE_RUNTIME_TYPE as to, ecsClusterOption as tr, resolveHostDefaultCredentials as ts, waitForAppAnswer as tt, reinvoke as u, architectureToPlatform as ua, resolveServiceIntegrationParameters as ui, edgeHeadersToHttp as un, DynamicReferenceResolutionError as uo, enforceImageOverrideOrphans as ur, repointLocalSqsQueueUrlsInEnv as us, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveRuntimeImage as va, buildMethodArn as vi, pickLambdaEdgeFunctionLogicalId as vn, resolveDynamicReferencesInEnv as vo, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, substituteEnvVarsFromStateAsync as wa, applyCorsResponseHeaders as wi, WEB_FUNCTION_TYPE as wn, deployAccountStsClientConfig as wo, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, substituteAgainstState as xa, invokeRequestAuthorizer as xi, resolveCloudFrontDistribution as xn, awsEndpointOptions as xo, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, EcsTaskResolutionError as ya, computeRequestIdentityHash as yi, pickTargetFunctionLogicalId as yn, withoutKeys as yo, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, resolveSingleTarget as za, bufferToBody as zi, albStrategy as zn, awsEmulatorSqsHostBlocks as zo, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
-//# sourceMappingURL=local-studio-DRE1RQLn.js.map
+export { postHook as $, AGENTCORE_A2A_PROTOCOL as $a, probeHostGatewaySupport as $i, addImageOverrideOptions as $n, loopbackForwarderPlan as $o, resolveApiTargetSubset as $r, classifyS3Error as $t, microvmFidelityWarnings as A, createLocalStateProvider as Aa, translateLambdaResponse as Ai, stripCloudFrontImport as An, readEnvCallerCredentials as Ao, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, resolveWatchConfig as Ba, ConnectionRegistry as Bi, createLocalStartAlbCommand as Bn, HOST_DEFAULT_CREDENTIALS_MISS_TTL_MS as Bo, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, substituteAgainstState as Ca, attachAuthorizers as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, resolveDynamicReferencesInEnv as Co, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, materializeLayerFromArn as Da, isFunctionUrlOacFronted as Di, compileCloudFrontFunction as Dn, SECOND_ASSUME_MESSAGE as Do, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, substituteEnvVarsFromStateAsync as Ea, buildCorsConfigFromCloudFrontChain as Ei, resolveWebFunctionTarget as En, awsEndpointOptions as Eo, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, resolveCfnRegion as Fa, pickResponseTemplate as Fi, findFileAssetForObjectKey as Fn, AUTH_OFF_PLACEHOLDER_CREDENTIALS as Fo, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, discoverWebSocketApis as Ga, buildDisconnectEvent as Gi, addStartServiceSpecificOptions as Gn, collectHostEndpointOverrides as Go, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, countTargets as Ha, handleConnectionsRequest as Hi, resolveAlbTarget as Hn, applyWorkloadAwsWiringToEnv as Ho, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, resolveCfnStackName as Ia, selectIntegrationResponse as Ii, isBucketDeploymentResource as In, CA_TRUST_ENV_KEYS as Io, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, parseSelectionExpressionPath as Ja, createFileWatcher as Ji, addRunTaskSpecificOptions as Jn, getActiveWorkloadAwsWiring as Jo, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, discoverWebSocketApisOrThrow as Ka, buildMessageEvent as Ki, createLocalStartServiceCommand as Kn, displayEndpointValue as Ko, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, CfnLocalStateProvider as La, tryParseStatus as Li, resolveBucketDeploymentObjectKey as Ln, DEFAULT_AWS_EMULATOR_URL as Lo, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, isCfnFlagPresent as Ma, buildHttpApiV2Event as Mi, createLocalFileKvsDataSource as Mn, resetWorkloadIdentity as Mo, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, rejectExplicitCfnStackWithMultipleStacks as Na, buildRestV1Event as Ni, createUnboundCloudFrontModule as Nn, workloadClientConfig as No, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, LocalStateSourceError as Oa, matchPreflight as Oi, runViewerRequest as On, assumedRoleRecorded as Oo, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, resolveCfnFallbackRegion as Pa, evaluateResponseParameters as Pi, bucketDeploymentSourceObjectKeys as Pn, workloadStsClientConfig as Po, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, resolveLambdaArnIntrinsic as Qa, HOST_GATEWAY_MIN_VERSION as Qi, addEcsAssumeRoleOptions as Qn, logMixedModeForWorkload as Qo, createWatchPredicates as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, collectSsmParameterRefs as Ra, VtlEvaluationError as Ri, addAlbSpecificOptions as Rn, EMULATOR_SCRUBBED_ENV_KEYS as Ro, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, containsCrossStackIntrinsic as Sa, invokeTokenAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, parseDynamicReference as So, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, substituteEnvVarsFromState as Ta, buildCorsConfigByApiId as Ti, WebFunctionResolutionError as Tn, addAwsEndpointOptions as To, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, listTargets as Ua, parseConnectionsPath as Ui, isApplicationLoadBalancer as Un, awsEmulatorEnvName as Uo, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, resolveSingleTarget as Va, buildMgmtEndpointEnvUrl as Vi, parseLbPortOverrides as Vn, activateWorkloadAwsWiring as Vo, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, availableWebSocketApiIdentifiers as Wa, buildConnectEvent as Wi, resolveAlbFrontDoor as Wn, awsEmulatorSqsHostBlocks as Wo, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, discoverRoutes as Xa, createLocalInvokeCommand as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, getContainerJavaTruststorePath as Xo, addStartApiSpecificOptions as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, webSocketApiMatchesIdentifier as Ya, addInvokeSpecificOptions as Yi, createLocalRunTaskCommand as Yn, getContainerCaBundlePath as Yo, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, pickRefLogicalId as Za, HOST_DOCKER_INTERNAL_GATEWAY as Zi, addCommonEcsServiceOptions as Zn, javaTruststoreToolOptions as Zo, createLocalStartApiCommand as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveRuntimeFileExtension as _a, verifyJwtViaDiscovery as _i, pickKvsLogicalIdFromArn as _n, containsDynamicReference as _o, isLocalCdkAssetImage as _r, sqsEmulatorOriginOf as _s, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, buildLoopbackForwarderDockerArgs as aa, filterRoutesByApiIdentifiers as ai, serveLambdaUrlOrigin as an, pickAgentCoreCandidateStack as ao, resolveSharedSidecarCredentials as ar, resolveAwsEmulatorOption as as, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, assertEcsTaskCommandsResolved as ba, evaluateCachedLambdaPolicy as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, keysNotFromTemplate as bo, CloudMapRegistry as br, buildStsClientConfig as bs, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, ensureForwarderImage as ca, startApiServer as ci, buildEdgeRequestEvent as cn, formatStateRemedy as co, buildImageOverrideTag as cr, setActiveWorkloadAwsWiring as cs, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, buildContainerImage as da, defaultCredentialsLoader as di, httpHeadersToEdge as dn, LocalInvokeBuildError as do, mergeForService as dr, MIXED_MODE_RESIGN_BODY_CAP_BYTES as ds, createLocalStartWebFunctionCommand as dt, resolveHostGatewayExtraHosts as ea, createAuthorizerCache as ei, createS3OriginReader as en, AGENTCORE_AGUI_PROTOCOL as eo, buildEcsImageResolutionContext$1 as er, mergeJavaToolOptions as es, runHookBody as et, filterStudioCustomResources as f, dockerRegistryEnv as fa, buildCognitoJwksUrl as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, ambientDefaultRegion as fo, parseImageOverrideFlags as fr, REAL_SQS_QUEUE_URL as fs, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, resolveRuntimeCodeMountPath as ga, verifyJwtAuthorizer as gi, pickFunctionUrlLogicalIdFromOrigin as gn, DynamicReferenceResolver as go, imageOverrideKeyAliases as gr, rewriteSqsQueueUrlsInEnv as gs, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, stripEcrCredentials as ha, verifyCognitoJwt as hi, isCloudFrontDistribution as hn, DynamicReferenceResolutionError as ho, describePinnedImageUri as hr, repointLocalSqsQueueUrlsInEnv as hs, selectServeInboundAuth as ht, coerceStopRequest as i, awaitLoopbackForwarderStatus as ia, filterRoutesByApiIdentifier as ii, serveFromStaticOrigin as in, AgentCoreResolutionError as io, resolveEcsAssumeRoleOption as ir, readProfileEndpointSettings as is, MicrovmResolutionError as it, readRunHookPayload as j, groupWorkloadsRoutedApart as ja, applyAuthorizerOverlay as ji, createCloudFrontModule as jn, recordAssumedRole as jo, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, UNNAMED_WORKLOAD as ka, matchRoute as ki, runViewerResponse as kn, deployAccountStsClientConfig as ko, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, startLoopbackForwarder as la, resolveSelectionExpression as li, buildEdgeResponseEvent as ln, substituteImagePlaceholders as lo, canonicalizeImageOverrideKeys as lr, takeAwsEmulatorStateSourceHint as ls, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, noImplicitEcrPullArgs as ma, createJwksCache as mi, extractKvsAssociations as mn, setAmbientDefaultRegion as mo, runImageOverrideBuilds as mr, realSqsHostnames as ms, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, withWorkloadAwsWiring as na, buildStageMap as ni, startCloudFrontServer as nn, AGENTCORE_MCP_PROTOCOL as no, parseMaxTasks as nr, probeAwsEmulatorHealth as ns, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, buildNamespaceOwnerForwarderDockerArgs as oa, groupRoutesByServer as oi, applyEdgeRequestResult as on, resolveAgentCoreTarget as oo, runEcsServiceEmulator as or, resolveHostDefaultCredentials as os, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, isEcrRegistryConfigKey as pa, buildJwksUrlFromIssuer as pi, describeS3OriginDomain as pn, namedEnvAwsRegion as po, resolveImageOverrides as pr, isRealAwsHost as ps, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, filterWebSocketApisByIdentifiers as qa, classifySourceChange as qi, serviceStrategy as qn, effectiveLoopbackPorts as qo, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, LOOPBACK_FORWARDER_IMAGE as ra, availableApiIdentifiers as ri, resolveErrorResponseCandidates as rn, AGENTCORE_RUNTIME_TYPE as ro, parseRestartPolicy as rr, readEmulatorRunFiles as rs, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, describeForwarderFailure as sa, readMtlsMaterialsFromDisk as si, applyEdgeResponseResult as sn, derivePseudoParametersFromRegion as so, ImageOverrideError as sr, resolveWorkloadAwsWiring as ss, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, attachLoopbackForwarder as ta, attachStageContext as ti, matchBehavior as tn, AGENTCORE_HTTP_PROTOCOL as to, ecsClusterOption as tr, parseAwsEndpoint as ts, waitForAppAnswer as tt, reinvoke as u, architectureToPlatform as ua, resolveServiceIntegrationParameters as ui, edgeHeadersToHttp as un, tryResolveImageFnJoin as uo, enforceImageOverrideOrphans as ur, writeCaBundleFile as us, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveRuntimeImage as va, buildMethodArn as vi, pickLambdaEdgeFunctionLogicalId as vn, deployedFillMayBeSecret as vo, listPinnedTargets as vr, buildJavaTrustStore as vs, startAgentCoreWsBridge as vt, createLocalListCommand as w, substituteAgainstStateAsync as wa, applyCorsResponseHeaders as wi, WEB_FUNCTION_TYPE as wn, withoutKeys as wo, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, assertEcsTaskImagesResolvable as xa, invokeRequestAuthorizer as xi, resolveCloudFrontDistribution as xn, keysOverriddenBy as xo, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, resolveProfileCredentials as xs, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, EcsTaskResolutionError as ya, computeRequestIdentityHash as yi, pickTargetFunctionLogicalId as yn, firstUsableRegion as yo, buildCloudMapIndex as yr, createMixedModeTlsMaterials as ys, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, resolveSsmParameters as za, bufferToBody as zi, albStrategy as zn, HOST_CA_TRUST_ENV_KEYS as zo, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
+//# sourceMappingURL=local-studio-B0Wlk_VO.js.map