cdk-local 0.104.0 → 0.105.0

package/dist/{local-studio-BQC2kT2L.js → local-studio-ix442f3q.js}

@@ -33,6 +33,7 @@ import { Sha256 } from "@aws-crypto/sha256-js";
 import { SignatureV4 } from "@smithy/signature-v4";
 import graphlib from "graphlib";
 import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import * as vm from "node:vm";
 import { EventEmitter } from "node:events";
 
 //#region src/cli/options.ts
@@ -926,7 +927,7 @@ function parseTarget(target) {
 function resolveLambdaTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalInvokeResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseTarget(target);
-	const stack = pickStack$4(parsed, stacks);
+	const stack = pickStack$5(parsed, stacks);
 	const template = stack.template;
 	const resources = template.Resources ?? {};
 	let match;
@@ -960,7 +961,7 @@ function resolveLambdaTarget(target, stacks) {
 * user may omit the stack prefix. Otherwise an explicit stack pattern is
 * required.
 */
-function pickStack$4(parsed, stacks) {
+function pickStack$5(parsed, stacks) {
 	if (parsed.stackPattern === null) {
 		if (stacks.length === 1) return stacks[0];
 		throw new LocalInvokeResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
@@ -1369,7 +1370,7 @@ var AgentCoreResolutionError = class AgentCoreResolutionError extends Error {
 function resolveAgentCoreTarget(target, stacks, imageContext) {
 	if (stacks.length === 0) throw new AgentCoreResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseTarget(target);
-	const stack = pickStack$3(parsed, stacks);
+	const stack = pickStack$4(parsed, stacks);
 	const resources = stack.template.Resources ?? {};
 	const { logicalId, resource } = matchRuntime(parsed, target, stack, resources);
 	if (resource.Type !== "AWS::BedrockAgentCore::Runtime") throw new AgentCoreResolutionError(`Resource '${logicalId}' in ${stack.stackName} is ${resource.Type}, not ${AGENTCORE_RUNTIME_TYPE}. ${getEmbedConfig().cliName} invoke-agentcore only runs Bedrock AgentCore Runtime resources.`);
@@ -1397,7 +1398,7 @@ function pickAgentCoreCandidateStack(target, stacks) {
 * Mirrors the Lambda / ECS resolvers' behavior via the shared
 * stack-matcher.
 */
-function pickStack$3(parsed, stacks) {
+function pickStack$4(parsed, stacks) {
 	if (parsed.stackPattern === null) {
 		if (stacks.length === 1) return stacks[0];
 		throw new AgentCoreResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
@@ -3397,7 +3398,8 @@ function listTargets(stacks) {
 		ecsServices: sortEntries(scanByType(stacks, "AWS::ECS::Service")),
 		ecsTaskDefinitions: sortEntries(scanByType(stacks, "AWS::ECS::TaskDefinition")),
 		agentCoreRuntimes: sortEntries(scanByType(stacks, AGENTCORE_RUNTIME_TYPE)),
-		loadBalancers: sortEntries(scanApplicationLoadBalancers(stacks))
+		loadBalancers: sortEntries(scanApplicationLoadBalancers(stacks)),
+		cloudFrontDistributions: sortEntries(scanByType(stacks, "AWS::CloudFront::Distribution"))
 	};
 }
 const pathOf$1 = (e) => e.displayPath ?? e.qualifiedId;
@@ -3429,7 +3431,7 @@ function sortApiEntries(entries) {
 }
 /** Total number of targets across every category. */
 function countTargets(listing) {
-	return listing.lambdas.length + listing.apis.length + listing.ecsServices.length + listing.ecsTaskDefinitions.length + listing.agentCoreRuntimes.length + listing.loadBalancers.length;
+	return listing.lambdas.length + listing.apis.length + listing.ecsServices.length + listing.ecsTaskDefinitions.length + listing.agentCoreRuntimes.length + listing.loadBalancers.length + listing.cloudFrontDistributions.length;
 }
 
 //#endregion
@@ -5691,7 +5693,7 @@ function parseEcsTarget(target) {
 function resolveEcsTaskTarget(target, stacks, context) {
 	if (stacks.length === 0) throw new EcsTaskResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack$2(parsed, stacks);
+	const stack = pickStack$3(parsed, stacks);
 	const resources = stack.template.Resources ?? {};
 	let logicalId;
 	let resource;
@@ -5712,7 +5714,7 @@ function resolveEcsTaskTarget(target, stacks, context) {
 	if (resource.Type !== "AWS::ECS::TaskDefinition") throw new EcsTaskResolutionError(`Resource '${logicalId}' in ${stack.stackName} is ${resource.Type}, not an AWS::ECS::TaskDefinition.`);
 	return extractTaskDefinitionProperties(stack, logicalId, resource, context);
 }
-function pickStack$2(parsed, stacks) {
+function pickStack$3(parsed, stacks) {
 	if (parsed.stackPattern === null) {
 		if (stacks.length === 1) return stacks[0];
 		throw new EcsTaskResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
@@ -13553,7 +13555,7 @@ async function startApiServer(opts) {
 	const logger = getLogger().child("start-api");
 	let currentState = opts.state;
 	const requestHandler = (req, res) => {
-		handleRequest$1(req, res, currentState, opts).catch((err) => {
+		handleRequest$2(req, res, currentState, opts).catch((err) => {
 			logger.error(`Unhandled request error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
 			if (!res.headersSent) writeError$1(res, 502);
 		});
@@ -13622,7 +13624,7 @@ async function startApiServer(opts) {
 *      route handler.
 *   4. Build event, acquire container, invoke RIE, translate response.
 */
-async function handleRequest$1(req, res, state, opts) {
+async function handleRequest$2(req, res, state, opts) {
 	const logger = getLogger().child("start-api");
 	if (opts.preDispatch) try {
 		if (await opts.preDispatch(req, res)) return;
@@ -19142,7 +19144,7 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	const loader = new AssetManifestLoader();
 	const manifest = await loader.loadManifest(cdkOutDir, resolved.stack.stackName);
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
-	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey(fileAssets, code.codeAssetHash) : void 0;
+	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey$1(fileAssets, code.codeAssetHash) : void 0;
 	if (!asset) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' code bundle (asset ${code.codeAssetHash}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
 	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset);
 	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' code bundle source '${sourceDir}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
@@ -19202,7 +19204,7 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 * `Code.S3.Prefix`'s hash) when the source-hash-keyed lookup misses — covers a
 * synthesizer whose source hash differs from the destination objectKey.
 */
-function findFileAssetByObjectKey(fileAssets, hash) {
+function findFileAssetByObjectKey$1(fileAssets, hash) {
 	const zip = `${hash}.zip`;
 	for (const asset of fileAssets.values()) if (Object.values(asset.destinations).some((d) => d.objectKey === zip || d.objectKey.endsWith(`/${zip}`))) return asset;
 }
@@ -21189,7 +21191,7 @@ function shellJoin(parts) {
 function resolveEcsServiceTarget(target, stacks, context, options) {
 	if (stacks.length === 0) throw new EcsTaskResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack$1(parsed, stacks);
+	const stack = pickStack$2(parsed, stacks);
 	const resources = stack.template.Resources ?? {};
 	let serviceLogicalId;
 	let serviceResource;
@@ -21440,7 +21442,7 @@ function deriveServiceDisplayName(rawServiceName, serviceLogicalId, metadata) {
 * service-specific extensions (e.g. cross-stack service-to-task refs)
 * can diverge without breaking the run-task code path.
 */
-function pickStack$1(parsed, stacks) {
+function pickStack$2(parsed, stacks) {
 	if (parsed.stackPattern === null) {
 		if (stacks.length === 1) return stacks[0];
 		throw new EcsTaskResolutionError(`Target has no stack prefix, and the assembly contains ${stacks.length} stacks: ${stacks.map((s) => s.stackName).join(", ")}. Pass the target as 'Stack/Path' or 'Stack:LogicalId'.`);
@@ -23945,6 +23947,13 @@ function ruleMatches(rule, requestPath, requestQuery, requestHost, facts) {
 	return true;
 }
 /**
+* Whether a single ALB `path-pattern` value matches a request path. The path
+* must already be query-stripped, or pass a raw URL and it is stripped here.
+*/
+function albPathPatternMatches(pattern, requestPath) {
+	return globToRegExp$1(pattern, false).test(pathOf(requestPath));
+}
+/**
 * Whether an `http-header` condition matches the request's headers. The
 * header name is looked up case-insensitively; each listed value glob is
 * matched case-insensitively against every value of that header (multi-valued
@@ -27740,7 +27749,7 @@ function parseLbPortOverrides(values) {
 function resolveAlbTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalStartServiceError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack(parsed.stackPattern, stacks, target);
+	const stack = pickStack$1(parsed.stackPattern, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
@@ -27748,7 +27757,7 @@ function resolveAlbTarget(target, stacks) {
 			const r = resources[logicalId];
 			return r !== void 0 && isApplicationLoadBalancer(r);
 		});
-		if (albs.length === 0) throw notFound(target, stack, resources);
+		if (albs.length === 0) throw notFound$1(target, stack, resources);
 		if (albs.length > 1) throw new LocalStartServiceError(`Target '${target}' matches ${albs.length} load balancers in ${stack.stackName}: ${albs.map((a) => a.logicalId).join(", ")}. Refine the path or use the stack:LogicalId form.`);
 		return {
 			stack,
@@ -27756,13 +27765,13 @@ function resolveAlbTarget(target, stacks) {
 		};
 	}
 	const res = resources[parsed.pathOrId];
-	if (!res || !isApplicationLoadBalancer(res)) throw notFound(target, stack, resources);
+	if (!res || !isApplicationLoadBalancer(res)) throw notFound$1(target, stack, resources);
 	return {
 		stack,
 		albLogicalId: parsed.pathOrId
 	};
 }
-function pickStack(stackPattern, stacks, target) {
+function pickStack$1(stackPattern, stacks, target) {
 	if (stackPattern === null) {
 		if (stacks.length === 1) return stacks[0];
 		throw new LocalStartServiceError(`Target '${target}' has no stack prefix, and the assembly contains ${stacks.length} stacks: ${stacks.map((s) => s.stackName).join(", ")}. Pass it as 'Stack/Path' or 'Stack:LogicalId'.`);
@@ -27772,7 +27781,7 @@ function pickStack(stackPattern, stacks, target) {
 	if (matched.length > 1) throw new LocalStartServiceError(`Multiple stacks match '${stackPattern}': ${matched.map((s) => s.stackName).join(", ")}. Refine the pattern.`);
 	return matched[0];
 }
-function notFound(target, stack, resources) {
+function notFound$1(target, stack, resources) {
 	const albs = Object.entries(resources).filter(([, r]) => r.Type === "AWS::ElasticLoadBalancingV2::LoadBalancer").map(([logicalId]) => logicalId);
 	const available = albs.length > 0 ? ` Available load balancers in ${stack.stackName}: ${albs.join(", ")}.` : ` ${stack.stackName} declares no AWS::ElasticLoadBalancingV2::LoadBalancer resources.`;
 	return new LocalStartServiceError(`Target '${target}' did not match an application Load Balancer in ${stack.stackName}.${available}`);
@@ -27917,6 +27926,988 @@ function addAlbSpecificOptions(cmd) {
 	return cmd.addOption(new Option("--lb-port <listenerPort=hostPort...>", "Bind the local front-door on a specific host port (e.g. 80=8080); repeatable. Default: host port == ALB listener port. Use this on macOS to remap a privileged listener port (< 1024) to a non-privileged host port.")).addOption(new Option("--tls", "Terminate TLS locally for cloud-HTTPS listeners. Default: a cloud-HTTPS listener is served over plain HTTP locally (X-Forwarded-Proto: https is preserved so the upstream app still sees the deployed listener protocol). Implied by --tls-cert / --tls-key. Use this when local-dev cookies need Secure / SameSite=None, when the upstream app inspects TLS metadata, or for mTLS / SNI testing — otherwise plain HTTP is friendlier (no self-signed cert warnings in curl / browser).")).addOption(new Option("--tls-cert <path>", "PEM-encoded server certificate for HTTPS front-door listeners. Implies --tls. Must be set together with --tls-key. Pass --tls alone (without --tls-cert / --tls-key) to auto-generate a self-signed cert (cached under $XDG_CACHE_HOME/cdk-local/alb-https/, default ~/.cache/cdk-local/alb-https/); requires openssl on PATH. The deployed Listener Certificates[] are NOT fetched (ACM private keys are not retrievable by design). The auto-generated cert lists DNS:localhost,IP:127.0.0.1 as SubjectAltName, so a client validating a non-loopback --container-host will fail the SAN check — pass --tls-cert / --tls-key with a SAN covering that host instead.")).addOption(new Option("--tls-key <path>", "PEM-encoded server private key matching --tls-cert. Implies --tls. Must be set together with --tls-cert.")).addOption(new Option("--no-verify-auth", "Disable local enforcement of authenticate-cognito / authenticate-oidc actions. Every request is served as if the auth check passed. Useful for local dev where you do not want to mint a Bearer token at all.")).addOption(new Option("--bearer-token <jwt>", "Default Bearer JWT this command INJECTS only when an inbound request has none (the default-when-missing role) — `cdkl start-alb` is the local ALB front-door RECEIVING outside-in requests, so this token is the fallback the front-door slots in as Authorization: Bearer <jwt> if the caller did not already supply one. Verified against the same JWKS / OIDC discovery URL the deployed ALB would (signature + iss + aud + exp). Cookie pass-through (AWSELBAuthSessionCookie-*) also bypasses the guard. Contrast with `cdkl invoke-agentcore --bearer-token`, where the role is reversed — that command is the outbound client and ALWAYS presents this token (the supplier).")).addOption(new Option("--watch", "Hot-reload: re-synth + per-replica reload of every ECS service behind the ALB when the CDK source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). A per-firing classifier picks the per-replica primitive: source-only edits on interpreted-language handlers (Node/Python/Ruby/shell) take a bind-mount FAST PATH (`docker cp` the new source into each replica + `docker restart`; no rebuild, front-door pool entry unchanged since the IP/port are preserved). Dockerfile / dependency manifest / compiled-language source / ambiguous edits fall through to the rebuild rolling primitive — boot a shadow under a bumped generation suffix, wait for its container port to accept a TCP connection, atomically register it in the front-door pool, then drop the old entry and retire the old container. Either path rolls one replica at a time, so a continuous external request stream against the listener port sees zero connection refusals across the reload. The host front-door (TLS, JWKS cache, Lambda-target containers, listener sockets) stays up across the reload. Lambda target groups behind the ALB are a no-op on reload (the warm RIE container keeps its boot-time image). Off by default; existing replica(s) keep serving when synth fails mid-reload.").default(false));
 }
 
+//#endregion
+//#region src/local/cloudfront-function-runtime.ts
+/**
+* Hard cap on a single CloudFront Function's synchronous run. The deployed
+* runtime caps CPU at ~1ms; locally we are generous but still bound it so a
+* runaway `while (true) {}` in a function fails that one request with a clear
+* error instead of wedging the single-threaded local server for every
+* subsequent request. `vm`'s timeout only interrupts synchronous code — an
+* `await`-based hang in a 2.0 async handler is not caught (it has no local
+* analogue), which is acceptable for a dev tool.
+*/
+const FUNCTION_TIMEOUT_MS = 5e3;
+const EVENT_GLOBAL = "__cfEvent";
+/**
+* Compile a CloudFront Function's inline code once. Throws a clear error when
+* the code has a syntax error or declares no `handler` (surfaced at boot so a
+* malformed function never silently no-ops at request time).
+*/
+function compileCloudFrontFunction(logicalId, code, runtime) {
+	let script;
+	try {
+		script = new vm.Script(`${code}\n;handler(${EVENT_GLOBAL})`, { filename: `cloudfront-function-${logicalId}.js` });
+	} catch (err) {
+		throw new Error(`CloudFront Function '${logicalId}' failed to compile: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	let hasHandler;
+	try {
+		const probeContext = vm.createContext({ console });
+		hasHandler = new vm.Script(`${code}\n;typeof handler === 'function'`).runInContext(probeContext, { timeout: FUNCTION_TIMEOUT_MS });
+	} catch (err) {
+		throw new Error(`CloudFront Function '${logicalId}' failed to compile: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (hasHandler !== true) throw new Error(`CloudFront Function '${logicalId}' does not declare a 'handler' function. A CloudFront Function must export \`function handler(event) { ... }\`.`);
+	return {
+		logicalId,
+		runtime,
+		script
+	};
+}
+/**
+* Invoke a compiled function's `handler(event)` in a fresh sandbox and return
+* its result. The synchronous portion is bounded by {@link FUNCTION_TIMEOUT_MS}
+* (a runaway `while (true) {}` fails this one request instead of wedging the
+* server); a `cloudfront-js-2.0` async handler's promise is awaited. Any error
+* thrown by the handler is wrapped with the function's logical id.
+*/
+async function invokeCloudFrontFunction(fn, event) {
+	const context = vm.createContext({
+		console,
+		[EVENT_GLOBAL]: event
+	});
+	let result;
+	try {
+		result = fn.script.runInContext(context, { timeout: FUNCTION_TIMEOUT_MS });
+	} catch (err) {
+		throw new Error(`CloudFront Function '${fn.logicalId}' threw at request time: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	try {
+		return result instanceof Promise ? await result : result;
+	} catch (err) {
+		throw new Error(`CloudFront Function '${fn.logicalId}' threw at request time: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+/**
+* Run a `viewer-request` function and classify its return value. A non-object
+* return (or `undefined`) is treated as "continue unchanged" — a defensive
+* default matching CloudFront's tolerance of a function that just inspects the
+* request.
+*/
+async function runViewerRequest(fn, event) {
+	const result = await invokeCloudFrontFunction(fn, event);
+	if (result && typeof result === "object") {
+		const obj = result;
+		if ("statusCode" in obj) return {
+			kind: "response",
+			response: coerceResponse(obj)
+		};
+		return {
+			kind: "continue",
+			request: coerceRequest(obj, event.request)
+		};
+	}
+	return {
+		kind: "continue",
+		request: event.request
+	};
+}
+/**
+* Run a `viewer-response` function and return the (possibly mutated) response.
+* A non-object return falls back to the unmodified origin response.
+*/
+async function runViewerResponse(fn, event) {
+	const result = await invokeCloudFrontFunction(fn, event);
+	if (result && typeof result === "object") return coerceResponse(result, event.response);
+	return event.response;
+}
+/** Normalize a function's returned request object back into a {@link CfRequest}. */
+function coerceRequest(obj, fallback) {
+	return {
+		method: typeof obj["method"] === "string" ? obj["method"] : fallback.method,
+		uri: typeof obj["uri"] === "string" ? obj["uri"] : fallback.uri,
+		querystring: coerceValueMap(obj["querystring"]) ?? fallback.querystring,
+		headers: coerceValueMap(obj["headers"]) ?? fallback.headers,
+		cookies: coerceValueMap(obj["cookies"]) ?? fallback.cookies
+	};
+}
+/** Normalize a function's returned response object into a {@link CfResponse}. */
+function coerceResponse(obj, fallback) {
+	const res = {
+		statusCode: typeof obj["statusCode"] === "number" ? obj["statusCode"] : fallback?.statusCode ?? 200,
+		headers: coerceValueMap(obj["headers"]) ?? fallback?.headers ?? {}
+	};
+	const desc = obj["statusDescription"] ?? fallback?.statusDescription;
+	if (typeof desc === "string") res.statusDescription = desc;
+	const cookies = coerceValueMap(obj["cookies"]);
+	if (cookies) res.cookies = cookies;
+	const body = obj["body"];
+	if (typeof body === "string" || body && typeof body === "object") res.body = body;
+	else if (fallback?.body !== void 0) res.body = fallback.body;
+	return res;
+}
+/**
+* Coerce a header / cookie / querystring map back into the `{ value }` shape,
+* tolerating a function that wrote a bare string value (`headers.location =
+* 'https://...'` instead of `{ value: '...' }`). Returns `undefined` when the
+* field is absent so the caller keeps the prior value.
+*/
+function coerceValueMap(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const out = {};
+	for (const [k, v] of Object.entries(value)) if (v && typeof v === "object" && "value" in v) {
+		const cv = v;
+		const entry = { value: scalarToString(cv.value) };
+		if (Array.isArray(cv.multiValue)) entry.multiValue = cv.multiValue.filter((m) => Boolean(m) && typeof m === "object").map((m) => ({ value: scalarToString(m.value) }));
+		out[k] = entry;
+	} else if (typeof v === "string") out[k] = { value: v };
+	return out;
+}
+/**
+* Coerce a CloudFront function's header / cookie / query value to a string. CF
+* values are strings, but a function may hand back a number / boolean; anything
+* non-scalar (or absent) collapses to the empty string.
+*/
+function scalarToString(value) {
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	return "";
+}
+/**
+* Build a `viewer-request` event from an incoming HTTP request. Header keys
+* are lower-cased (CloudFront's contract); a multi-valued header is carried in
+* `multiValue` with `value` set to the first entry.
+*/
+function buildViewerRequestEvent(input) {
+	return {
+		version: "1.0",
+		context: {
+			distributionDomainName: input.domainName,
+			distributionId: input.distributionId,
+			eventType: "viewer-request",
+			requestId: input.requestId
+		},
+		viewer: { ip: input.ip },
+		request: {
+			method: input.method.toUpperCase(),
+			uri: input.uri,
+			querystring: parseQueryStringToCf(input.querystring),
+			headers: headersToCf(input.headers),
+			cookies: cookiesFromHeaders(input.headers)
+		}
+	};
+}
+/** Extend a request event into a `viewer-response` event with the origin response. */
+function buildViewerResponseEvent(requestEvent, response) {
+	return {
+		...requestEvent,
+		context: {
+			...requestEvent.context,
+			eventType: "viewer-response"
+		},
+		response: {
+			statusCode: response.statusCode,
+			...response.statusDescription !== void 0 && { statusDescription: response.statusDescription },
+			headers: headersToCf(response.headers)
+		}
+	};
+}
+function parseQueryStringToCf(raw) {
+	const out = {};
+	if (!raw) return out;
+	for (const pair of raw.split("&")) {
+		if (!pair) continue;
+		const eq = pair.indexOf("=");
+		addCfValue(out, decodePart(eq === -1 ? pair : pair.slice(0, eq)), eq === -1 ? "" : decodePart(pair.slice(eq + 1)));
+	}
+	return out;
+}
+function headersToCf(headers) {
+	const out = {};
+	for (const [name, raw] of Object.entries(headers)) {
+		if (raw === void 0) continue;
+		const lower = name.toLowerCase();
+		if (Array.isArray(raw)) for (const v of raw) addCfValue(out, lower, v);
+		else addCfValue(out, lower, raw);
+	}
+	return out;
+}
+function cookiesFromHeaders(headers) {
+	const out = {};
+	const raw = headers["cookie"] ?? headers["Cookie"];
+	const list = raw === void 0 ? [] : Array.isArray(raw) ? raw : [raw];
+	for (const header of list) for (const pair of header.split(";")) {
+		const trimmed = pair.trim();
+		if (!trimmed) continue;
+		const eq = trimmed.indexOf("=");
+		if (eq === -1) continue;
+		addCfValue(out, trimmed.slice(0, eq).trim(), trimmed.slice(eq + 1).trim());
+	}
+	return out;
+}
+/** Append a value under `key`, promoting to `multiValue` on the second hit. */
+function addCfValue(map, key, value) {
+	const existing = map[key];
+	if (existing === void 0) {
+		map[key] = { value };
+		return;
+	}
+	if (!existing.multiValue) existing.multiValue = [{ value: existing.value }];
+	existing.multiValue.push({ value });
+}
+function decodePart(s) {
+	try {
+		return decodeURIComponent(s.replace(/\+/g, " "));
+	} catch {
+		return s;
+	}
+}
+
+//#endregion
+//#region src/local/cloudfront-resolver.ts
+const CLOUDFRONT_DISTRIBUTION_TYPE = "AWS::CloudFront::Distribution";
+const CLOUDFRONT_FUNCTION_TYPE = "AWS::CloudFront::Function";
+const S3_BUCKET_TYPE = "AWS::S3::Bucket";
+/**
+* Resolve a distribution logical id within a stack into its routing model.
+* `originOverrides` maps an origin id to a local directory (the `--origin`
+* escape hatch); a covered origin is served from that directory regardless of
+* BucketDeployment resolution.
+*/
+function resolveCloudFrontDistribution(args) {
+	const { stack, logicalId } = args;
+	const template = stack.template;
+	const resource = (template.Resources ?? {})[logicalId];
+	if (!resource || resource.Type !== "AWS::CloudFront::Distribution") throw new Error(`Resource '${logicalId}' in stack ${stack.stackName} is not an ${CLOUDFRONT_DISTRIBUTION_TYPE}.`);
+	const distConfig = (resource.Properties ?? {})["DistributionConfig"];
+	if (!distConfig || typeof distConfig !== "object") throw new Error(`Distribution '${logicalId}' has no DistributionConfig.`);
+	const dc = distConfig;
+	const behaviors = resolveBehaviors(dc, compileDistributionFunctions(template), logicalId);
+	const origins = resolveOrigins(dc, template, stack, args.originOverrides ?? /* @__PURE__ */ new Map());
+	const customErrorResponses = resolveCustomErrorResponses(dc);
+	const result = {
+		logicalId,
+		stackName: stack.stackName,
+		behaviors,
+		origins,
+		customErrorResponses
+	};
+	if (typeof dc["DefaultRootObject"] === "string" && dc["DefaultRootObject"] !== "") result.defaultRootObject = dc["DefaultRootObject"];
+	return result;
+}
+/** Compile every `AWS::CloudFront::Function` in the template, keyed by logical id. */
+function compileDistributionFunctions(template) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+		if (resource.Type !== CLOUDFRONT_FUNCTION_TYPE) continue;
+		const props = resource.Properties ?? {};
+		const code = props["FunctionCode"];
+		if (typeof code !== "string") {
+			getLogger().warn(`CloudFront Function '${logicalId}' has a non-inline FunctionCode; cdk-local can only run inline function code. Skipping.`);
+			continue;
+		}
+		const config = props["FunctionConfig"];
+		const runtime = config && typeof config === "object" && typeof config["Runtime"] === "string" ? config["Runtime"] : "cloudfront-js-1.0";
+		out.set(logicalId, compileCloudFrontFunction(logicalId, code, runtime));
+	}
+	return out;
+}
+function resolveBehaviors(dc, functions, distLogicalId) {
+	const behaviors = [];
+	const def = dc["DefaultCacheBehavior"];
+	if (def && typeof def === "object") behaviors.push(resolveBehavior(def, void 0, functions, distLogicalId));
+	const extra = Array.isArray(dc["CacheBehaviors"]) ? dc["CacheBehaviors"] : [];
+	for (const b of extra) {
+		if (!b || typeof b !== "object") continue;
+		const behavior = b;
+		if (typeof behavior["PathPattern"] !== "string") {
+			getLogger().warn(`Distribution '${distLogicalId}': a cache behavior has no literal PathPattern; cdk-local cannot route it and is skipping it.`);
+			continue;
+		}
+		behaviors.push(resolveBehavior(behavior, behavior["PathPattern"], functions, distLogicalId));
+	}
+	return behaviors;
+}
+function resolveBehavior(behavior, pathPattern, functions, distLogicalId) {
+	const resolved = {
+		targetOriginId: typeof behavior["TargetOriginId"] === "string" ? behavior["TargetOriginId"] : "",
+		hasLambdaEdge: Array.isArray(behavior["LambdaFunctionAssociations"]) ? behavior["LambdaFunctionAssociations"].length > 0 : false
+	};
+	if (pathPattern !== void 0) resolved.pathPattern = pathPattern;
+	if (typeof behavior["ViewerProtocolPolicy"] === "string") resolved.viewerProtocolPolicy = behavior["ViewerProtocolPolicy"];
+	const assocs = Array.isArray(behavior["FunctionAssociations"]) ? behavior["FunctionAssociations"] : [];
+	for (const a of assocs) {
+		if (!a || typeof a !== "object") continue;
+		const assoc = a;
+		const eventType = assoc["EventType"];
+		const fnLogicalId = pickFunctionLogicalIdFromArn(assoc["FunctionARN"] ?? assoc["FunctionArn"]);
+		if (!fnLogicalId) {
+			getLogger().warn(`Distribution '${distLogicalId}': a FunctionAssociation references a function ARN cdk-local could not resolve to a local AWS::CloudFront::Function; it will not run.`);
+			continue;
+		}
+		const fn = functions.get(fnLogicalId);
+		if (!fn) continue;
+		if (eventType === "viewer-request") resolved.viewerRequest = fn;
+		else if (eventType === "viewer-response") resolved.viewerResponse = fn;
+	}
+	return resolved;
+}
+/**
+* Unwrap a `FunctionAssociations[].FunctionARN` intrinsic to the
+* `AWS::CloudFront::Function` logical id. CDK synthesizes it as
+* `{Fn::GetAtt: [<logicalId>, "FunctionARN"]}`.
+*/
+function pickFunctionLogicalIdFromArn(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const getAtt = value["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && getAtt.length === 2 && typeof getAtt[0] === "string") return getAtt[0];
+}
+function resolveOrigins(dc, template, stack, overrides) {
+	const out = /* @__PURE__ */ new Map();
+	const origins = Array.isArray(dc["Origins"]) ? dc["Origins"] : [];
+	const manifest = loadStackManifest(stack);
+	for (const o of origins) {
+		if (!o || typeof o !== "object") continue;
+		const origin = o;
+		const originId = typeof origin["Id"] === "string" ? origin["Id"] : void 0;
+		if (!originId) continue;
+		const overrideDir = overrides.get(originId);
+		if (overrideDir) {
+			out.set(originId, {
+				kind: "s3",
+				originId,
+				localDirs: [resolveDir(overrideDir)]
+			});
+			continue;
+		}
+		const bucketLogicalId = pickBucketLogicalIdFromOrigin(origin, template);
+		if (!(origin["S3OriginConfig"] !== void 0 || bucketLogicalId !== void 0)) {
+			out.set(originId, {
+				kind: "custom",
+				originId,
+				domainName: describeDomainName(origin["DomainName"])
+			});
+			continue;
+		}
+		const localDirs = bucketLogicalId && manifest ? resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId) : [];
+		if (localDirs.length > 0) out.set(originId, {
+			kind: "s3",
+			originId,
+			localDirs
+		});
+		else out.set(originId, {
+			kind: "s3-unresolved",
+			originId,
+			...bucketLogicalId !== void 0 && { bucketLogicalId }
+		});
+	}
+	return out;
+}
+/**
+* Read a stack's asset manifest, or `undefined` when it ships no assets / is
+* unreadable. We already hold the absolute manifest path on {@link StackInfo},
+* so we read + parse it directly rather than going through the by-stack-name
+* loader.
+*/
+function loadStackManifest(stack) {
+	if (!stack.assetManifestPath) return void 0;
+	try {
+		return JSON.parse(readFileSync(stack.assetManifestPath, "utf-8"));
+	} catch (err) {
+		getLogger().warn(`Could not read asset manifest at ${stack.assetManifestPath}: ${err instanceof Error ? err.message : String(err)}`);
+		return;
+	}
+}
+/**
+* Walk a bucket's `Custom::CDKBucketDeployment*` custom resources back to the
+* local source-asset directories that were staged for it. Returns the resolved
+* local directories (one per matching BucketDeployment source) — empty when the
+* bucket has no BucketDeployment (content uploaded out of band) or the source
+* object key cannot be matched to a manifest file asset.
+*/
+function resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId) {
+	const manifestDir = stack.assetManifestPath ? dirname(stack.assetManifestPath) : void 0;
+	if (!manifestDir) return [];
+	const dirs = [];
+	for (const resource of Object.values(template.Resources ?? {})) {
+		if (!String(resource.Type).startsWith("Custom::CDKBucketDeployment")) continue;
+		const props = resource.Properties ?? {};
+		if (refLogicalId(props["DestinationBucketName"]) !== bucketLogicalId) continue;
+		const keys = Array.isArray(props["SourceObjectKeys"]) ? props["SourceObjectKeys"] : [];
+		for (const key of keys) {
+			if (typeof key !== "string") continue;
+			const asset = findFileAssetByObjectKey(manifest, key);
+			if (!asset) continue;
+			dirs.push(resolve(manifestDir, asset.source.path));
+		}
+	}
+	return dirs;
+}
+/**
+* Find the file asset whose published object key equals `objectKey`. The
+* BucketDeployment `SourceObjectKeys` carries the published key
+* (`<hash>.zip`); matching on the destination object key is more robust than
+* guessing how the hash maps to the manifest key.
+*/
+function findFileAssetByObjectKey(manifest, objectKey) {
+	for (const asset of Object.values(manifest.files ?? {})) for (const dest of Object.values(asset.destinations ?? {})) if (dest.objectKey === objectKey) return asset;
+	const hash = objectKey.replace(/\.zip$/, "");
+	return manifest.files?.[hash];
+}
+/**
+* Extract the S3 bucket logical id an origin's `DomainName` points at. CDK
+* synthesizes an S3 origin's `DomainName` as
+* `{Fn::GetAtt: [<bucket>, "RegionalDomainName"]}` (or `DomainName` /
+* `WebsiteURL`). Returns the logical id only when it resolves to an
+* `AWS::S3::Bucket` in the template.
+*/
+function pickBucketLogicalIdFromOrigin(origin, template) {
+	const candidate = getAttLogicalId(origin["DomainName"]);
+	if (!candidate) return void 0;
+	const resource = (template.Resources ?? {})[candidate];
+	if (resource && resource.Type === S3_BUCKET_TYPE) return candidate;
+}
+function getAttLogicalId(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const getAtt = value["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && getAtt.length === 2 && typeof getAtt[0] === "string") return getAtt[0];
+}
+function refLogicalId(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const ref = value["Ref"];
+	return typeof ref === "string" ? ref : void 0;
+}
+function resolveCustomErrorResponses(dc) {
+	const raw = Array.isArray(dc["CustomErrorResponses"]) ? dc["CustomErrorResponses"] : [];
+	const out = [];
+	for (const e of raw) {
+		if (!e || typeof e !== "object") continue;
+		const entry = e;
+		if (typeof entry["ErrorCode"] !== "number") continue;
+		const resolved = { errorCode: entry["ErrorCode"] };
+		if (typeof entry["ResponsePagePath"] === "string") resolved.responsePagePath = entry["ResponsePagePath"];
+		if (typeof entry["ResponseCode"] === "number") resolved.responseCode = entry["ResponseCode"];
+		out.push(resolved);
+	}
+	return out;
+}
+function describeDomainName(value) {
+	if (typeof value === "string") return value;
+	if (value && typeof value === "object") return JSON.stringify(value);
+	return "<unknown>";
+}
+function resolveDir(dir) {
+	return isAbsolute(dir) ? dir : resolve(process.cwd(), dir);
+}
+/** True when a template resource is an `AWS::CloudFront::Distribution`. */
+function isCloudFrontDistribution(resource) {
+	return resource.Type === CLOUDFRONT_DISTRIBUTION_TYPE;
+}
+
+//#endregion
+//#region src/local/cloudfront-static-origin.ts
+/**
+* Resolve a URI against one or more local origin directories, honoring the
+* default root object and the distribution's custom error responses. The
+* directories are searched in order (a BucketDeployment can layer multiple
+* sources onto one bucket; later sources overlay earlier ones in the cloud, so
+* the first directory that has the key wins here).
+*/
+function serveFromStaticOrigin(input) {
+	const key = uriToKey(input.uri, input.defaultRootObject);
+	const direct = readKey(input.localDirs, key);
+	if (direct) return {
+		statusCode: 200,
+		headers: { "content-type": contentTypeForKey(key) },
+		body: direct
+	};
+	const errorResponses = input.customErrorResponses ?? [];
+	for (const code of [403, 404]) {
+		const match = errorResponses.find((e) => e.errorCode === code);
+		if (!match || !match.responsePagePath) continue;
+		const errorKey = stripLeadingSlash(match.responsePagePath);
+		const body = readKey(input.localDirs, errorKey);
+		if (body) return {
+			statusCode: match.responseCode ?? code,
+			headers: { "content-type": contentTypeForKey(errorKey) },
+			body
+		};
+	}
+	return {
+		statusCode: 404,
+		headers: { "content-type": "text/plain; charset=utf-8" },
+		body: Buffer.from(`Not found: ${input.uri}\n`)
+	};
+}
+/**
+* Map a request URI to an S3 object key. The query string / fragment is
+* dropped, the leading slash is removed, and the root path (`/` or empty)
+* resolves to the default root object. A URI ending in `/` is NOT auto-indexed
+* (CloudFront does not), so it falls through to a missing key unless a function
+* rewrote it.
+*/
+function uriToKey(uri, defaultRootObject) {
+	let path = uri;
+	const q = path.indexOf("?");
+	if (q !== -1) path = path.slice(0, q);
+	const h = path.indexOf("#");
+	if (h !== -1) path = path.slice(0, h);
+	path = decodeURIComponentSafe(path);
+	const stripped = stripLeadingSlash(path);
+	if (stripped === "") return defaultRootObject ? stripLeadingSlash(defaultRootObject) : "";
+	return stripped;
+}
+/**
+* Read a key from the first directory that contains it as a regular file.
+* Path-traversal safe: the resolved absolute path must stay within the origin
+* directory (a `../` in the key, or a symlink escaping the root, yields no
+* read). Returns `undefined` when no directory has the key.
+*/
+function readKey(localDirs, key) {
+	if (key === "") return void 0;
+	for (const dir of localDirs) {
+		const resolved = safeJoin(dir, key);
+		if (!resolved) continue;
+		try {
+			if (statSync(resolved).isFile()) return readFileSync(resolved);
+		} catch {}
+	}
+}
+/**
+* Join `key` onto `dir`, rejecting any result that escapes `dir` (Zip-Slip /
+* path-traversal guard). Returns `undefined` when the key would escape.
+*/
+function safeJoin(dir, key) {
+	const candidate = normalize(join(dir, key));
+	const root = normalize(dir);
+	const rootWithSep = root.endsWith(sep) ? root : root + sep;
+	if (candidate !== root && !candidate.startsWith(rootWithSep)) return void 0;
+	return candidate;
+}
+function stripLeadingSlash(s) {
+	return s.startsWith("/") ? s.replace(/^\/+/, "") : s;
+}
+function decodeURIComponentSafe(s) {
+	try {
+		return decodeURIComponent(s);
+	} catch {
+		return s;
+	}
+}
+/** Minimal extension -> MIME map for the common static-site asset types. */
+const MIME_BY_EXT = {
+	html: "text/html; charset=utf-8",
+	htm: "text/html; charset=utf-8",
+	css: "text/css; charset=utf-8",
+	js: "text/javascript; charset=utf-8",
+	mjs: "text/javascript; charset=utf-8",
+	json: "application/json; charset=utf-8",
+	map: "application/json; charset=utf-8",
+	xml: "application/xml; charset=utf-8",
+	txt: "text/plain; charset=utf-8",
+	svg: "image/svg+xml",
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	gif: "image/gif",
+	webp: "image/webp",
+	avif: "image/avif",
+	ico: "image/x-icon",
+	woff: "font/woff",
+	woff2: "font/woff2",
+	ttf: "font/ttf",
+	otf: "font/otf",
+	eot: "application/vnd.ms-fontobject",
+	pdf: "application/pdf",
+	wasm: "application/wasm",
+	webmanifest: "application/manifest+json"
+};
+/** Resolve a Content-Type for an object key by extension. */
+function contentTypeForKey(key) {
+	const dot = key.lastIndexOf(".");
+	if (dot === -1 || dot === key.length - 1) return "application/octet-stream";
+	return MIME_BY_EXT[key.slice(dot + 1).toLowerCase()] ?? "application/octet-stream";
+}
+
+//#endregion
+//#region src/local/cloudfront-server.ts
+/** Start the local CloudFront server and resolve once it is listening. */
+async function startCloudFrontServer(options) {
+	const logger = getLogger().child("cloudfront");
+	const state = { distribution: options.distribution };
+	const handler = (req, res) => {
+		handleRequest$1(req, res, state, logger).catch((err) => {
+			logger.warn(`Request handling failed: ${err instanceof Error ? err.message : String(err)}`);
+			if (!res.headersSent) {
+				res.statusCode = 500;
+				res.setHeader("content-type", "text/plain; charset=utf-8");
+			}
+			if (!res.writableEnded) res.end("Internal error in cdkl start-cloudfront.\n");
+		});
+	};
+	const scheme = options.tls ? "https" : "http";
+	const server = options.tls ? createServer$2({
+		cert: options.tls.certPem,
+		key: options.tls.keyPem
+	}, handler) : createServer$1(handler);
+	const port = await listen(server, options.host, options.port);
+	return {
+		url: `${scheme}://${options.host}:${port}`,
+		port,
+		scheme,
+		update(distribution) {
+			state.distribution = distribution;
+		},
+		close() {
+			return new Promise((resolveClose) => {
+				server.close(() => resolveClose());
+			});
+		}
+	};
+}
+/** The per-request pipeline: behavior match -> viewer-request -> origin -> viewer-response. */
+async function handleRequest$1(req, res, state, logger) {
+	const distribution = state.distribution;
+	const rawUrl = req.url ?? "/";
+	const queryIdx = rawUrl.indexOf("?");
+	const uri = queryIdx === -1 ? rawUrl : rawUrl.slice(0, queryIdx);
+	const querystring = queryIdx === -1 ? "" : rawUrl.slice(queryIdx + 1);
+	const behavior = matchBehavior(distribution.behaviors, uri);
+	if (!behavior) {
+		writePlain(res, 404, "No cache behavior matched.\n");
+		return;
+	}
+	let requestEvent = buildViewerRequestEvent({
+		method: req.method ?? "GET",
+		uri,
+		querystring,
+		headers: req.headers,
+		ip: req.socket.remoteAddress ?? "127.0.0.1",
+		distributionId: distribution.logicalId,
+		domainName: req.headers.host ?? "localhost",
+		requestId: `cdkl-${Date.now().toString(36)}-${Math.floor(performance.now()).toString(36)}`
+	});
+	let effectiveUri = uri;
+	if (behavior.viewerRequest) {
+		const outcome = await runViewerRequest(behavior.viewerRequest, requestEvent);
+		if (outcome.kind === "response") {
+			writeCfResponse(res, outcome.response, logger);
+			return;
+		}
+		effectiveUri = outcome.request.uri;
+		requestEvent = {
+			...requestEvent,
+			request: outcome.request
+		};
+	}
+	const origin = distribution.origins.get(behavior.targetOriginId);
+	const originResult = serveFromOrigin(origin, behavior, effectiveUri, distribution, logger);
+	if (!originResult) return writePlain(res, 502, originUnavailableMessage(origin, behavior));
+	let finalStatus = originResult.statusCode;
+	let finalHeaders = originResult.headers;
+	if (behavior.viewerResponse) {
+		const responseEvent = buildViewerResponseEvent(requestEvent, {
+			statusCode: originResult.statusCode,
+			headers: originResult.headers
+		});
+		const mutated = await runViewerResponse(behavior.viewerResponse, responseEvent);
+		finalStatus = mutated.statusCode;
+		finalHeaders = cfHeadersToPlain(mutated.headers, originResult.headers);
+	}
+	res.statusCode = finalStatus;
+	setHeadersSafely(res, finalHeaders, logger);
+	res.end(originResult.body);
+}
+/**
+* Set response headers, skipping any whose name / value Node rejects (invalid
+* HTTP token, CR/LF injection) rather than throwing an opaque 500. A CloudFront
+* Function can return an arbitrary header map; a malformed entry should fail
+* loudly on that one header, not the whole response. CR/LF is stripped from
+* values defensively before the set.
+*/
+function setHeadersSafely(res, headers, logger) {
+	for (const [name, value] of Object.entries(headers)) try {
+		res.setHeader(name, value.replace(/[\r\n]/g, ""));
+	} catch (err) {
+		logger.warn(`Skipping invalid response header '${name}': ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+function serveFromOrigin(origin, behavior, uri, distribution, logger) {
+	if (behavior.hasLambdaEdge) logger.warn(`Behavior ${behavior.pathPattern ?? "(default)"} carries a Lambda@Edge association; cdk-local does not run Lambda@Edge — serving the S3 origin only.`);
+	if (!origin || origin.kind !== "s3") return void 0;
+	const result = serveFromStaticOrigin({
+		localDirs: origin.localDirs,
+		uri,
+		...distribution.defaultRootObject !== void 0 && { defaultRootObject: distribution.defaultRootObject },
+		customErrorResponses: distribution.customErrorResponses
+	});
+	return {
+		statusCode: result.statusCode,
+		headers: result.headers,
+		body: result.body
+	};
+}
+function originUnavailableMessage(origin, behavior) {
+	if (!origin) return `Behavior ${behavior.pathPattern ?? "(default)"} targets unknown origin '${behavior.targetOriginId}'.\n`;
+	if (origin.kind === "custom") return `Origin '${origin.originId}' is a custom (non-S3) origin (${origin.domainName}). cdkl start-cloudfront serves S3 origins only.
+`;
+	return `Origin '${origin.originId}' is an S3 origin with no resolvable local source. Point it at a directory with --origin ${origin.originId}=<dir>.\n`;
+}
+/**
+* Pick the cache behavior for a URI: the first `CacheBehaviors[]` entry (in
+* declared order) whose path pattern matches, else the default behavior. The
+* default behavior is the entry with no `pathPattern`.
+*/
+function matchBehavior(behaviors, uri) {
+	let fallback;
+	for (const behavior of behaviors) {
+		if (behavior.pathPattern === void 0) {
+			fallback = behavior;
+			continue;
+		}
+		if (albPathPatternMatches(behavior.pathPattern, uri)) return behavior;
+	}
+	return fallback;
+}
+function writeCfResponse(res, response, logger) {
+	res.statusCode = response.statusCode;
+	setHeadersSafely(res, cfHeadersToPlain(response.headers, {}), logger);
+	const body = cfResponseBody(response);
+	res.end(body);
+}
+function cfResponseBody(response) {
+	if (response.body === void 0) return Buffer.alloc(0);
+	if (typeof response.body === "string") return Buffer.from(response.body);
+	const data = response.body.data ?? "";
+	return response.body.encoding === "base64" ? Buffer.from(data, "base64") : Buffer.from(data);
+}
+/** Flatten a CloudFront header map (`{ name: { value } }`) to `{ name: value }`. */
+function cfHeadersToPlain(cf, base) {
+	const out = { ...base };
+	for (const [name, val] of Object.entries(cf)) if (val.multiValue && val.multiValue.length > 0) out[name] = val.multiValue.map((m) => m.value).join(", ");
+	else out[name] = val.value;
+	return out;
+}
+function writePlain(res, status, body) {
+	res.statusCode = status;
+	res.setHeader("content-type", "text/plain; charset=utf-8");
+	res.end(body);
+}
+function listen(server, host, port) {
+	return new Promise((resolvePort, rejectPort) => {
+		server.once("error", rejectPort);
+		server.listen(port, host, () => {
+			const addr = server.address();
+			const bound = typeof addr === "object" && addr ? addr.port : port;
+			server.removeListener("error", rejectPort);
+			resolvePort(bound);
+		});
+	});
+}
+
+//#endregion
+//#region src/cli/commands/local-start-cloudfront.ts
+/** Error thrown by `cdkl start-cloudfront` for target / option problems. */
+var LocalStartCloudFrontError = class extends CdkLocalError {
+	constructor(message, cause) {
+		super(message, "LOCAL_START_CLOUDFRONT_ERROR", cause);
+	}
+};
+/**
+* Parse the repeatable `--origin <originId>=<dir>` overrides into a map. Each
+* value points one of the distribution's origins at a local directory — the
+* escape hatch for when cdk-local cannot resolve the BucketDeployment source
+* automatically (content uploaded out of band, or a non-CDK bucket).
+*/
+function parseOriginOverrides(values) {
+	const out = /* @__PURE__ */ new Map();
+	for (const raw of values ?? []) {
+		const eq = raw.indexOf("=");
+		if (eq <= 0 || eq === raw.length - 1) throw new LocalStartCloudFrontError(`Invalid --origin '${raw}'. Expected <originId>=<dir> (e.g. MyOrigin=./site).`);
+		out.set(raw.slice(0, eq).trim(), raw.slice(eq + 1).trim());
+	}
+	return out;
+}
+/**
+* Resolve a CloudFront target string (`Stack/Path` display path or
+* `Stack:LogicalId`) to its stack + `AWS::CloudFront::Distribution` logical id.
+* Mirrors the ALB / ECS resolver target grammar.
+*/
+function resolveCloudFrontTarget(target, stacks) {
+	if (stacks.length === 0) throw new LocalStartCloudFrontError("No stacks found in the synthesized assembly.");
+	const parsed = parseEcsTarget(target);
+	const stack = pickStack(parsed.stackPattern, stacks, target);
+	const resources = stack.template.Resources ?? {};
+	if (parsed.isPath) {
+		const index = buildCdkPathIndex(stack.template);
+		const dists = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId }) => {
+			const r = resources[logicalId];
+			return r !== void 0 && r.Type === "AWS::CloudFront::Distribution";
+		});
+		if (dists.length === 0) throw notFound(target, stack, resources);
+		if (dists.length > 1) throw new LocalStartCloudFrontError(`Target '${target}' matches ${dists.length} distributions in ${stack.stackName}: ${dists.map((d) => d.logicalId).join(", ")}. Refine the path or use the stack:LogicalId form.`);
+		return {
+			stack,
+			logicalId: dists[0].logicalId
+		};
+	}
+	const res = resources[parsed.pathOrId];
+	if (!res || res.Type !== "AWS::CloudFront::Distribution") throw notFound(target, stack, resources);
+	return {
+		stack,
+		logicalId: parsed.pathOrId
+	};
+}
+function pickStack(stackPattern, stacks, target) {
+	if (stackPattern === null) {
+		if (stacks.length === 1) return stacks[0];
+		throw new LocalStartCloudFrontError(`Target '${target}' has no stack prefix, and the assembly contains ${stacks.length} stacks: ${stacks.map((s) => s.stackName).join(", ")}. Pass it as 'Stack/Path' or 'Stack:LogicalId'.`);
+	}
+	const matched = matchStacks(stacks, [stackPattern]);
+	if (matched.length === 0) throw new LocalStartCloudFrontError(`No stack matches '${stackPattern}'. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
+	if (matched.length > 1) throw new LocalStartCloudFrontError(`Multiple stacks match '${stackPattern}': ${matched.map((s) => s.stackName).join(", ")}. Refine the pattern.`);
+	return matched[0];
+}
+function notFound(target, stack, resources) {
+	const dists = Object.entries(resources).filter(([, r]) => r.Type === CLOUDFRONT_DISTRIBUTION_TYPE).map(([logicalId]) => logicalId);
+	const available = dists.length > 0 ? ` Available distributions in ${stack.stackName}: ${dists.join(", ")}.` : ` ${stack.stackName} declares no ${CLOUDFRONT_DISTRIBUTION_TYPE} resources.`;
+	return new LocalStartCloudFrontError(`Target '${target}' did not match a CloudFront distribution in ${stack.stackName}.${available}`);
+}
+/** Emit boot-time WARNs for parts of the distribution cdk-local does not serve. */
+function warnUnsupported(distribution) {
+	const logger = getLogger();
+	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin '${origin.originId}' is a custom (non-S3) origin (${origin.domainName}); cdkl start-cloudfront serves S3 origins only. Requests routed to it return 502.`);
+	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Point it at a directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
+	if (distribution.behaviors.some((b) => b.hasLambdaEdge)) logger.warn("One or more cache behaviors carry a Lambda@Edge association; cdk-local does not run Lambda@Edge functions — only CloudFront Functions + the S3 origin are served.");
+}
+async function localStartCloudFrontCommand(target, options) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	const originOverrides = parseOriginOverrides(options.origin);
+	const tlsRequested = options.tls === true || options.tlsCert !== void 0 || options.tlsKey !== void 0;
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region,
+		profile: options.profile
+	});
+	const appCmd = resolveApp(options.app);
+	if (!appCmd) throw new LocalStartCloudFrontError(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
+	const basePort = parseInt(options.port, 10);
+	if (!Number.isFinite(basePort) || basePort < 0 || basePort > 65535) throw new LocalStartCloudFrontError(`--port must be 0..65535 (got ${options.port}).`);
+	const synthAndResolve = async () => {
+		logger.info("Synthesizing CDK app...");
+		const synthesizer = new Synthesizer();
+		const context = parseContextOptions(options.context);
+		const synthOpts = {
+			app: appCmd,
+			output: options.output,
+			...options.region && { region: options.region },
+			...options.profile && { profile: options.profile },
+			...Object.keys(context).length > 0 && { context }
+		};
+		const { stacks } = await synthesizer.synthesize(synthOpts);
+		const chosen = await resolveSingleTarget(target, {
+			entries: listTargets(stacks).cloudFrontDistributions,
+			message: "Select a CloudFront distribution to serve",
+			noun: "CloudFront distributions",
+			onMissing: () => new LocalStartCloudFrontError(`${getEmbedConfig().cliName} start-cloudfront requires a <target>. Pass a distribution path like 'Stack/MyDist', or run it in a TTY to pick interactively.`)
+		});
+		target = chosen;
+		const { stack, logicalId } = resolveCloudFrontTarget(chosen, stacks);
+		return resolveCloudFrontDistribution({
+			stack,
+			logicalId,
+			originOverrides
+		});
+	};
+	const initial = await synthAndResolve();
+	warnUnsupported(initial);
+	let tls;
+	if (tlsRequested) tls = await resolveFrontDoorTlsMaterials({
+		certPath: options.tlsCert,
+		keyPath: options.tlsKey
+	});
+	const server = await startCloudFrontServer({
+		distribution: initial,
+		host: options.host,
+		port: basePort,
+		...tls && { tls }
+	});
+	process.stdout.write(`CloudFront distribution serving on ${server.url}  (${initial.logicalId})\n`);
+	process.stdout.write("^C to stop.\n");
+	let watcher;
+	let reloadChain = Promise.resolve();
+	if (options.watch) {
+		const watchRoot = process.cwd();
+		const { ignored, shouldTrigger, excludePatterns } = createWatchPredicates({
+			watchRoot,
+			output: options.output,
+			watchConfig: resolveWatchConfig()
+		});
+		watcher = createFileWatcher({
+			paths: [watchRoot],
+			ignored,
+			shouldTrigger,
+			onChange: () => {
+				logger.info("Detected source change; reloading...");
+				reloadChain = reloadChain.then(async () => {
+					try {
+						const reloaded = await synthAndResolve();
+						warnUnsupported(reloaded);
+						server.update(reloaded);
+						logger.info("Reload complete.");
+					} catch (err) {
+						logger.warn(`Reload failed; keeping the previous version serving: ${err instanceof Error ? err.message : String(err)}`);
+					}
+				}).catch(() => void 0);
+			}
+		});
+		logger.info(`Watching ${watchRoot} for source changes (excluding ${excludePatterns.join(", ")}).`);
+	}
+	let shuttingDown = false;
+	const shutdown = async (signal, exitCode) => {
+		if (shuttingDown) return;
+		shuttingDown = true;
+		logger.info(`Received ${signal}, shutting down...`);
+		if (watcher) try {
+			await watcher.close();
+		} catch {}
+		try {
+			await server.close();
+		} catch {}
+		process.exit(exitCode);
+	};
+	process.on("SIGINT", () => void shutdown("SIGINT", 130));
+	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
+	await new Promise(() => void 0);
+}
+function createLocalStartCloudFrontCommand(opts = {}) {
+	setEmbedConfig(opts.embedConfig);
+	const cmd = new Command("start-cloudfront").description("Run a long-running local server that serves a CloudFront distribution: its S3 origin content (resolved from the BucketDeployment source in the cloud assembly) plus its viewer-request / viewer-response CloudFront Functions, reproducing the distribution routing locally so a rewrite / routing change is verifiable in seconds. Serves S3 origins only; custom origins and Lambda@Edge are not run (warn-and-skip). Tip: omit the target in a terminal to pick interactively.").argument("[target]", "CloudFront distribution to serve. Accepts the CDK Construct path ('MyStack/MyDist'), an ancestor prefix, or the stack-qualified logical id ('MyStack:MyDist'). When omitted in a TTY, an interactive picker opens.").action(withErrorHandling(async (target, options) => {
+		await localStartCloudFrontCommand(target, options);
+	}));
+	addStartCloudFrontSpecificOptions(cmd);
+	[
+		...commonOptions(),
+		...appOptions(),
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(regionOption);
+	return cmd;
+}
+/**
+* Register the `cdkl start-cloudfront`-only option block on top of the shared
+* common / app / context helpers. Shared between `cdkl start-cloudfront` and
+* any host CLI (e.g. cdkd) that wraps the distribution-serving command, so
+* adding or renaming a `start-cloudfront` flag here propagates to every
+* embedder without duplicate `.addOption(...)` blocks. Chainable: returns
+* `cmd`.
+*/
+function addStartCloudFrontSpecificOptions(cmd) {
+	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
+}
+
 //#endregion
 //#region src/cli/commands/local-list.ts
 async function localListCommand(options) {
@@ -27952,7 +28943,7 @@ async function localListCommand(options) {
 * without running synthesis.
 */
 function formatTargetListing(listing, cliName, options = {}) {
-	if (countTargets(listing) === 0) return `No runnable targets (Lambda functions, APIs, ECS services / tasks, AgentCore Runtimes, load balancers) found in this CDK app.`;
+	if (countTargets(listing) === 0) return `No runnable targets (Lambda functions, APIs, ECS services / tasks, AgentCore Runtimes, load balancers, CloudFront distributions) found in this CDK app.`;
 	const long = options.long ?? false;
 	return "\n" + [
 		formatSection("Lambda Functions", `${cliName} invoke <target>`, listing.lambdas, long),
@@ -27960,7 +28951,8 @@ function formatTargetListing(listing, cliName, options = {}) {
 		formatSection("ECS Services", `${cliName} start-service <target...>`, listing.ecsServices, long),
 		formatSection("ECS Task Definitions", `${cliName} run-task <target>`, listing.ecsTaskDefinitions, long),
 		formatSection("AgentCore Runtimes", `${cliName} invoke-agentcore <target>`, listing.agentCoreRuntimes, long),
-		formatSection("Application Load Balancers", `${cliName} start-alb <target...>`, listing.loadBalancers, long)
+		formatSection("Application Load Balancers", `${cliName} start-alb <target...>`, listing.loadBalancers, long),
+		formatSection("CloudFront Distributions", `${cliName} start-cloudfront <target>`, listing.cloudFrontDistributions, long)
 	].filter((lines) => lines.length > 0).map((lines) => lines.join("\n")).join("\n\n");
 }
 function formatSection(title, command, entries, long) {
@@ -27975,7 +28967,7 @@ function formatSection(title, command, entries, long) {
 }
 function createLocalListCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("list").alias("ls").description("List the runnable targets in the synthesized CDK app, grouped by the command that runs them: Lambda functions (invoke), API Gateway REST v1 / HTTP v2 / Function URL / WebSocket surfaces (start-api), ECS services (start-service), ECS task definitions (run-task), AgentCore Runtimes (invoke-agentcore), and Application Load Balancers (start-alb). Each target is shown by its CDK display path; pass -l to also print the stack-qualified logical ID. Tip: you usually do not need to copy these — just run the command (e.g. `invoke`) with no target in a terminal and pick from the list.").action(withErrorHandling(async (options) => {
+	const cmd = new Command("list").alias("ls").description("List the runnable targets in the synthesized CDK app, grouped by the command that runs them: Lambda functions (invoke), API Gateway REST v1 / HTTP v2 / Function URL / WebSocket surfaces (start-api), ECS services (start-service), ECS task definitions (run-task), AgentCore Runtimes (invoke-agentcore), Application Load Balancers (start-alb), and CloudFront distributions (start-cloudfront). Each target is shown by its CDK display path; pass -l to also print the stack-qualified logical ID. Tip: you usually do not need to copy these — just run the command (e.g. `invoke`) with no target in a terminal and pick from the list.").action(withErrorHandling(async (options) => {
 		await localListCommand(options);
 	}));
 	addListSpecificOptions(cmd);
@@ -32051,6 +33043,111 @@ function resolveBootAssemblyDir(appCmd, output) {
 	const outPath = resolve(output);
 	if (isDir(outPath)) return outPath;
 }
+/**
+* Resolve the {@link StackInfo} an ECS-service target id belongs to.
+*
+* A studio ECS target id is a CDK display path (`Stack/Construct/...`) or a
+* `Stack:LogicalId` form (the same shapes {@link resolveEcsServiceTarget}
+* accepts). We only need the owning stack so we can build that stack's
+* {@link EcsImageResolutionContext}. Returns `undefined` when the id has no
+* stack segment (single-stack app uses the lone stack) or the segment matches
+* no / multiple stacks — the caller then resolves without an image context,
+* which is exactly the no-`--from-cfn-stack` behavior.
+*
+* Exported for unit testing.
+*/
+function resolveEcsServiceStack(targetId, stacks) {
+	const parsed = parseEcsTarget(targetId);
+	if (parsed.stackPattern === null) return stacks.length === 1 ? stacks[0] : void 0;
+	const matched = matchStacks(stacks, [parsed.stackPattern]);
+	return matched.length === 1 ? matched[0] : void 0;
+}
+/**
+* Pre-build the per-stack {@link EcsImageResolutionContext} map the boot-time
+* pin classifier needs (issue #354). `buildEcsImageResolutionContext` is
+* async (it may load deployed state / call STS), but the classify callback
+* `annotatePinnedEcsTargets` invokes is synchronous, so the contexts must be
+* materialized BEFORE classification.
+*
+* When `--from-cfn-stack` is NOT set, returns an empty map and the classifier
+* resolves against the synthed template only (the historical behavior). When
+* it IS set, for every distinct stack that owns a servable ECS service id this
+* builds a `LocalStateProvider` bound to THAT stack (so a multi-stack app with
+* bare `--from-cfn-stack` reads each stack's own CFn counterpart — the CFn
+* provider is stack-bound at construction, `load()` ignores its stack-name
+* argument), then builds + caches that stack's image-resolution context once.
+* Each per-stack provider is disposed before returning.
+*
+* A per-stack build failure is logged as a WARN and that stack maps to
+* `undefined` (resolve without an image context) rather than aborting boot.
+*
+* Exported for unit testing.
+*/
+async function prepareEcsImageContexts(args) {
+	const { serviceIds, stacks, options, logger } = args;
+	const contextByStack = /* @__PURE__ */ new Map();
+	if (!isCfnFlagPresent(options)) return contextByStack;
+	const owningStacks = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const id of serviceIds) {
+		let stack;
+		try {
+			stack = resolveEcsServiceStack(id, stacks);
+		} catch {
+			continue;
+		}
+		if (stack && !seen.has(stack.stackName)) {
+			seen.add(stack.stackName);
+			owningStacks.push(stack);
+		}
+	}
+	rejectExplicitCfnStackWithMultipleStacks(options, owningStacks.length);
+	for (const stack of owningStacks) {
+		const stateProvider = createLocalStateProvider(options, stack.stackName, await resolveCfnFallbackRegion(options, stack.region));
+		try {
+			const ctx = await buildEcsImageResolutionContext(stack, stateProvider, options);
+			contextByStack.set(stack.stackName, ctx);
+		} catch (err) {
+			logger.warn(`studio: could not build deployed-state image context for stack '${stack.stackName}'; ECS services in it resolve against the synthed template only. ${err instanceof Error ? err.message : String(err)}`);
+			contextByStack.set(stack.stackName, void 0);
+		} finally {
+			stateProvider?.dispose();
+		}
+	}
+	return contextByStack;
+}
+/**
+* Build the boot-time ECS pin classifier `annotatePinnedEcsTargets` calls per
+* servable service (issue #354). When `--from-cfn-stack` is set, a service
+* whose container image is an INTRINSIC ECR URI (e.g.
+* `ContainerImage.fromEcrRepository(repo)`) is only resolvable WITH the
+* deployed-state image-resolution context — without it the resolver throws
+* and the service was silently left unmarked, so the UI never offered the
+* image-override picker even though `cdkl start-service --from-cfn-stack`
+* detects the very same pin. This threads each service's owning-stack
+* {@link EcsImageResolutionContext} (pre-built by
+* {@link prepareEcsImageContexts}) into {@link resolveEcsServiceTarget} so
+* the pin resolves, and surfaces a WARN (not a silent DEBUG swallow) when a
+* service still cannot be classified.
+*
+* NOTE: the target list + these pinned flags are computed ONCE at boot. A
+* run-time Session-bar `--from-cfn-stack` change (`PATCH /api/config`) does
+* NOT re-classify — restart studio to re-detect pins under a new binding.
+*
+* Returns a `(id) => boolean` callback (true = pinned). Exported for testing.
+*/
+function makePinClassifier(args) {
+	const { stacks, contextByStack, logger } = args;
+	return (id) => {
+		try {
+			const stack = resolveEcsServiceStack(id, stacks);
+			return !isLocalCdkAssetImage(resolveEcsServiceTarget(id, stacks, stack ? contextByStack.get(stack.stackName) : void 0));
+		} catch (err) {
+			logger.warn(`studio: could not classify image-pin status for ECS service '${id}'; leaving it unmarked (the image-override picker will not be offered). ${err instanceof Error ? err.message : String(err)}`);
+			return false;
+		}
+	};
+}
 async function localStudioCommand(options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
@@ -32087,14 +33184,16 @@ async function localStudioCommand(options) {
 	}
 	const appLabel = stacks.map((s) => s.stackName).join(", ") || appCmd;
 	const servableEcs = new Set(targetGroups.filter((g) => g.kind === "ecs").flatMap((g) => g.entries.filter((e) => e.servable).map((e) => e.id)));
-	const dockerfiles = annotatePinnedEcsTargets(targetGroups, (id) => {
-		try {
-			return !isLocalCdkAssetImage(resolveEcsServiceTarget(id, stacks));
-		} catch (err) {
-			logger.debug(`studio: could not classify pin status for '${id}': ${err instanceof Error ? err.message : String(err)}`);
-			return false;
-		}
-	}) ? discoverDockerfiles(process.cwd()) : [];
+	const dockerfiles = annotatePinnedEcsTargets(targetGroups, makePinClassifier({
+		stacks,
+		contextByStack: await prepareEcsImageContexts({
+			serviceIds: [...servableEcs],
+			stacks,
+			options,
+			logger
+		}),
+		logger
+	})) ? discoverDockerfiles(process.cwd()) : [];
 	const bus = new StudioEventBus();
 	const childConfig = {
 		cliEntry: process.argv[1] ?? "",
@@ -32277,5 +33376,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { runImageOverrideBuilds as $, resolveCfnStackName as $n, defaultCredentialsLoader as $t, resolveAlbFrontDoor as A, ConnectionRegistry as An, resolveProfileCredentials as Ar, renderCodeDockerfile as At, buildEcsImageResolutionContext$1 as B, resolveRuntimeFileExtension as Bn, createFileWatcher as Bt, formatTargetListing as C, pickResponseTemplate as Cn, resolveAgentCoreTarget as Cr, AGENTCORE_SESSION_ID_HEADER as Ct, parseLbPortOverrides as D, HOST_GATEWAY_MIN_VERSION as Dn, tryResolveImageFnJoin as Dr, SUPPORTED_CODE_RUNTIMES as Dt, createLocalStartAlbCommand as E, VtlEvaluationError as En, substituteImagePlaceholders as Er, downloadAndExtractS3Bundle as Et, createLocalRunTaskCommand as F, buildDisconnectEvent as Fn, addStartApiSpecificOptions as Ft, resolveSharedSidecarCredentials as G, substituteEnvVarsFromState as Gn, availableApiIdentifiers as Gt, parseMaxTasks as H, EcsTaskResolutionError as Hn, buildStageMap as Ht, MAX_TASKS_SUBNET_RANGE_CAP as I, buildMessageEvent as In, createLocalStartApiCommand as It, buildImageOverrideTag as J, createLocalStateProvider as Jn, groupRoutesByServer as Jt, runEcsServiceEmulator as K, substituteEnvVarsFromStateAsync as Kn, filterRoutesByApiIdentifier as Kt, addCommonEcsServiceOptions as L, architectureToPlatform as Ln, createWatchPredicates as Lt, createLocalStartServiceCommand as M, handleConnectionsRequest as Mn, classifySourceChange as Mt, serviceStrategy as N, parseConnectionsPath as Nn, addInvokeSpecificOptions as Nt, resolveAlbTarget as O, probeHostGatewaySupport as On, LocalInvokeBuildError as Or, buildAgentCoreCodeImage as Ot, addRunTaskSpecificOptions as P, buildConnectEvent as Pn, createLocalInvokeCommand as Pt, resolveImageOverrides as Q, resolveCfnRegion as Qn, resolveServiceIntegrationParameters as Qt, addEcsAssumeRoleOptions as R, buildContainerImage as Rn, resolveApiTargetSubset as Rt, createLocalListCommand as S, evaluateResponseParameters as Sn, pickAgentCoreCandidateStack as Sr, signAgentCoreInvocation as St, albStrategy as T, tryParseStatus as Tn, formatStateRemedy as Tr, waitForAgentCorePing as Tt, parseRestartPolicy as U, substituteAgainstState as Un, materializeLayerFromArn as Ut, ecsClusterOption as V, resolveRuntimeImage as Vn, attachStageContext as Vt, resolveEcsAssumeRoleOption as W, substituteAgainstStateAsync as Wn, resolveEnvVars$1 as Wt, mergeForService as X, rejectExplicitCfnStackWithMultipleStacks as Xn, startApiServer as Xt, enforceImageOverrideOrphans as Y, isCfnFlagPresent as Yn, readMtlsMaterialsFromDisk as Yt, parseImageOverrideFlags as Z, resolveCfnFallbackRegion as Zn, resolveSelectionExpression as Zt, toStudioTargetGroups as _, matchRoute as _n, AGENTCORE_AGUI_PROTOCOL as _r, MCP_PATH as _t, createLocalStudioCommand as a, verifyJwtViaDiscovery as an, countTargets as ar, DEFAULT_SHADOW_READY_TIMEOUT_MS as at, StudioEventBus as b, buildHttpApiV2Event as bn, AGENTCORE_RUNTIME_TYPE as br, parseSseForJsonRpc as bt, startStudioProxy as c, evaluateCachedLambdaPolicy as cn, discoverWebSocketApis as cr, getContainerNetworkIp as ct, createStudioDispatcher as d, attachAuthorizers as dn, parseSelectionExpressionPath as dr, createLocalInvokeAgentCoreCommand as dt, buildCognitoJwksUrl as en, CfnLocalStateProvider as er, describePinnedImageUri as et, filterStudioCustomResources as f, applyCorsResponseHeaders as fn, webSocketApiMatchesIdentifier as fr, invokeAgentCoreWs as ft, startStudioServer as g, matchPreflight as gn, AGENTCORE_A2A_PROTOCOL as gr, MCP_CONTAINER_PORT as gt, filterStudioTargetGroups as h, isFunctionUrlOacFronted as hn, resolveLambdaArnIntrinsic as hr, a2aInvokeOnce as ht, coerceStopRequest as i, verifyJwtAuthorizer as in, resolveSingleTarget as ir, CloudMapRegistry as it, addStartServiceSpecificOptions as j, buildMgmtEndpointEnvUrl as jn, toCmdArgv as jt, isApplicationLoadBalancer as k, bufferToBody as kn, buildStsClientConfig as kr, computeCodeImageTag as kt, relayServeRequest as l, invokeRequestAuthorizer as ln, discoverWebSocketApisOrThrow as lr, attachContainerLogStreamer as lt, annotatePinnedEcsTargets as m, buildCorsConfigFromCloudFrontChain as mn, pickRefLogicalId as mr, A2A_PATH as mt, coerceRunRequest as n, createJwksCache as nn, resolveSsmParameters as nr, listPinnedTargets as nt, resolveServeBaseUrl as o, buildMethodArn as on, listTargets as or, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as ot, isCustomResourceLambdaTarget as p, buildCorsConfigByApiId as pn, discoverRoutes as pr, A2A_CONTAINER_PORT as pt, ImageOverrideError as q, LocalStateSourceError as qn, filterRoutesByApiIdentifiers as qt, coerceServeRequest as r, verifyCognitoJwt as rn, resolveWatchConfig as rr, buildCloudMapIndex as rt, createStudioServeManager as s, computeRequestIdentityHash as sn, availableWebSocketApiIdentifiers as sr, setShadowReadyTimeoutMs as st, addStudioSpecificOptions as t, buildJwksUrlFromIssuer as tn, collectSsmParameterRefs as tr, isLocalCdkAssetImage as tt, reinvoke as u, invokeTokenAuthorizer as un, filterWebSocketApisByIdentifiers as ur, addInvokeAgentCoreSpecificOptions as ut, renderStudioHtml as v, translateLambdaResponse as vn, AGENTCORE_HTTP_PROTOCOL as vr, MCP_PROTOCOL_VERSION as vt, addAlbSpecificOptions as w, selectIntegrationResponse as wn, derivePseudoParametersFromRegion as wr, invokeAgentCore as wt, addListSpecificOptions as x, buildRestV1Event as xn, AgentCoreResolutionError as xr, AGENTCORE_SIGV4_SERVICE as xt, createStudioStore as y, applyAuthorizerOverlay as yn, AGENTCORE_MCP_PROTOCOL as yr, mcpInvokeOnce as yt, addImageOverrideOptions as z, resolveRuntimeCodeMountPath as zn, createAuthorizerCache as zt };
-//# sourceMappingURL=local-studio-BQC2kT2L.js.map
+export { addImageOverrideOptions as $, resolveRuntimeCodeMountPath as $n, createAuthorizerCache as $t, startCloudFrontServer as A, matchPreflight as An, AGENTCORE_A2A_PROTOCOL as Ar, MCP_CONTAINER_PORT as At, createLocalStartAlbCommand as B, VtlEvaluationError as Bn, substituteImagePlaceholders as Br, downloadAndExtractS3Bundle as Bt, formatTargetListing as C, invokeRequestAuthorizer as Cn, discoverWebSocketApisOrThrow as Cr, attachContainerLogStreamer as Ct, parseOriginOverrides as D, buildCorsConfigByApiId as Dn, discoverRoutes as Dr, A2A_CONTAINER_PORT as Dt, createLocalStartCloudFrontCommand as E, applyCorsResponseHeaders as En, webSocketApiMatchesIdentifier as Er, invokeAgentCoreWs as Et, compileCloudFrontFunction as F, buildRestV1Event as Fn, AgentCoreResolutionError as Fr, AGENTCORE_SIGV4_SERVICE as Ft, addStartServiceSpecificOptions as G, buildMgmtEndpointEnvUrl as Gn, toCmdArgv as Gt, resolveAlbTarget as H, probeHostGatewaySupport as Hn, LocalInvokeBuildError as Hr, buildAgentCoreCodeImage as Ht, runViewerRequest as I, evaluateResponseParameters as In, pickAgentCoreCandidateStack as Ir, signAgentCoreInvocation as It, addRunTaskSpecificOptions as J, buildConnectEvent as Jn, createLocalInvokeCommand as Jt, createLocalStartServiceCommand as K, handleConnectionsRequest as Kn, classifySourceChange as Kt, runViewerResponse as L, pickResponseTemplate as Ln, resolveAgentCoreTarget as Lr, AGENTCORE_SESSION_ID_HEADER as Lt, CLOUDFRONT_DISTRIBUTION_TYPE as M, translateLambdaResponse as Mn, AGENTCORE_HTTP_PROTOCOL as Mr, MCP_PROTOCOL_VERSION as Mt, isCloudFrontDistribution as N, applyAuthorizerOverlay as Nn, AGENTCORE_MCP_PROTOCOL as Nr, mcpInvokeOnce as Nt, resolveCloudFrontTarget as O, buildCorsConfigFromCloudFrontChain as On, pickRefLogicalId as Or, A2A_PATH as Ot, resolveCloudFrontDistribution as P, buildHttpApiV2Event as Pn, AGENTCORE_RUNTIME_TYPE as Pr, parseSseForJsonRpc as Pt, addEcsAssumeRoleOptions as Q, buildContainerImage as Qn, resolveApiTargetSubset as Qt, addAlbSpecificOptions as R, selectIntegrationResponse as Rn, derivePseudoParametersFromRegion as Rr, invokeAgentCore as Rt, createLocalListCommand as S, evaluateCachedLambdaPolicy as Sn, discoverWebSocketApis as Sr, getContainerNetworkIp as St, addStartCloudFrontSpecificOptions as T, attachAuthorizers as Tn, parseSelectionExpressionPath as Tr, createLocalInvokeAgentCoreCommand as Tt, isApplicationLoadBalancer as U, bufferToBody as Un, buildStsClientConfig as Ur, computeCodeImageTag as Ut, parseLbPortOverrides as V, HOST_GATEWAY_MIN_VERSION as Vn, tryResolveImageFnJoin as Vr, SUPPORTED_CODE_RUNTIMES as Vt, resolveAlbFrontDoor as W, ConnectionRegistry as Wn, resolveProfileCredentials as Wr, renderCodeDockerfile as Wt, MAX_TASKS_SUBNET_RANGE_CAP as X, buildMessageEvent as Xn, createLocalStartApiCommand as Xt, createLocalRunTaskCommand as Y, buildDisconnectEvent as Yn, addStartApiSpecificOptions as Yt, addCommonEcsServiceOptions as Z, architectureToPlatform as Zn, createWatchPredicates as Zt, toStudioTargetGroups as _, verifyCognitoJwt as _n, resolveWatchConfig as _r, buildCloudMapIndex as _t, createLocalStudioCommand as a, availableApiIdentifiers as an, substituteEnvVarsFromState as ar, resolveSharedSidecarCredentials as at, StudioEventBus as b, buildMethodArn as bn, listTargets as br, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as bt, startStudioProxy as c, groupRoutesByServer as cn, createLocalStateProvider as cr, buildImageOverrideTag as ct, createStudioDispatcher as d, resolveSelectionExpression as dn, resolveCfnFallbackRegion as dr, parseImageOverrideFlags as dt, createFileWatcher as en, resolveRuntimeFileExtension as er, buildEcsImageResolutionContext$1 as et, filterStudioCustomResources as f, resolveServiceIntegrationParameters as fn, resolveCfnRegion as fr, resolveImageOverrides as ft, startStudioServer as g, createJwksCache as gn, resolveSsmParameters as gr, listPinnedTargets as gt, filterStudioTargetGroups as h, buildJwksUrlFromIssuer as hn, collectSsmParameterRefs as hr, isLocalCdkAssetImage as ht, coerceStopRequest as i, resolveEnvVars$1 as in, substituteAgainstStateAsync as ir, resolveEcsAssumeRoleOption as it, serveFromStaticOrigin as j, matchRoute as jn, AGENTCORE_AGUI_PROTOCOL as jr, MCP_PATH as jt, matchBehavior as k, isFunctionUrlOacFronted as kn, resolveLambdaArnIntrinsic as kr, a2aInvokeOnce as kt, relayServeRequest as l, readMtlsMaterialsFromDisk as ln, isCfnFlagPresent as lr, enforceImageOverrideOrphans as lt, annotatePinnedEcsTargets as m, buildCognitoJwksUrl as mn, CfnLocalStateProvider as mr, describePinnedImageUri as mt, coerceRunRequest as n, buildStageMap as nn, EcsTaskResolutionError as nr, parseMaxTasks as nt, resolveServeBaseUrl as o, filterRoutesByApiIdentifier as on, substituteEnvVarsFromStateAsync as or, runEcsServiceEmulator as ot, isCustomResourceLambdaTarget as p, defaultCredentialsLoader as pn, resolveCfnStackName as pr, runImageOverrideBuilds as pt, serviceStrategy as q, parseConnectionsPath as qn, addInvokeSpecificOptions as qt, coerceServeRequest as r, materializeLayerFromArn as rn, substituteAgainstState as rr, parseRestartPolicy as rt, createStudioServeManager as s, filterRoutesByApiIdentifiers as sn, LocalStateSourceError as sr, ImageOverrideError as st, addStudioSpecificOptions as t, attachStageContext as tn, resolveRuntimeImage as tr, ecsClusterOption as tt, reinvoke as u, startApiServer as un, rejectExplicitCfnStackWithMultipleStacks as ur, mergeForService as ut, renderStudioHtml as v, verifyJwtAuthorizer as vn, resolveSingleTarget as vr, CloudMapRegistry as vt, LocalStartCloudFrontError as w, invokeTokenAuthorizer as wn, filterWebSocketApisByIdentifiers as wr, addInvokeAgentCoreSpecificOptions as wt, addListSpecificOptions as x, computeRequestIdentityHash as xn, availableWebSocketApiIdentifiers as xr, setShadowReadyTimeoutMs as xt, createStudioStore as y, verifyJwtViaDiscovery as yn, countTargets as yr, DEFAULT_SHADOW_READY_TIMEOUT_MS as yt, albStrategy as z, tryParseStatus as zn, formatStateRemedy as zr, waitForAgentCorePing as zt };
+//# sourceMappingURL=local-studio-ix442f3q.js.map