cdk-local 0.106.0 → 0.107.0

package/dist/{local-studio-COb3K0Br.js → local-studio-DG6aiOzK.js}

@@ -7847,7 +7847,7 @@ function buildRequestContext(routeKey, eventType, connectionId, connectedAt, sta
 * deployed behavior by checking the response in the caller.
 */
 function buildConnectEvent(opts) {
-	const headers = normalizeHeaders(opts.snapshot.headers);
+	const headers = normalizeHeaders$1(opts.snapshot.headers);
 	const multiValueHeaders = lowercaseMultiValueHeaders(opts.snapshot.headers);
 	return {
 		...headers !== void 0 && { headers },
@@ -7921,7 +7921,7 @@ function formatRequestTime$1(epochMs) {
 /**
 * Lowercase header keys, comma-join duplicates per AWS spec.
 */
-function normalizeHeaders(headers) {
+function normalizeHeaders$1(headers) {
 	const out = {};
 	let any = false;
 	for (const [name, values] of Object.entries(headers)) {
@@ -8052,7 +8052,7 @@ function safeDecodeURIComponent(s) {
 * forward the buffer through to `WebSocket.send` so binary frames work
 * end to end.
 */
-function readRequestBody(req) {
+function readRequestBody$1(req) {
 	return new Promise((resolve, reject) => {
 		const chunks = [];
 		req.on("data", (chunk) => {
@@ -8105,7 +8105,7 @@ async function handleConnectionsRequest(opts) {
 	if (method === "POST") {
 		let body;
 		try {
-			body = await readRequestBody(req);
+			body = await readRequestBody$1(req);
 		} catch (err) {
 			writeJson(res, 500, { message: `Failed to read request body: ${err instanceof Error ? err.message : String(err)}` });
 			return;
@@ -27142,7 +27142,7 @@ const LISTENER_TYPE = "AWS::ElasticLoadBalancingV2::Listener";
 const LISTENER_RULE_TYPE = "AWS::ElasticLoadBalancingV2::ListenerRule";
 const TARGET_GROUP_TYPE = "AWS::ElasticLoadBalancingV2::TargetGroup";
 const SERVICE_TYPE = "AWS::ECS::Service";
-const LAMBDA_FUNCTION_TYPE = "AWS::Lambda::Function";
+const LAMBDA_FUNCTION_TYPE$1 = "AWS::Lambda::Function";
 /**
 * Resolve an ALB into its front-door listeners + routing tables. Pure — reads
 * only the supplied stack template. Returns an empty `listeners` array (with
@@ -27305,8 +27305,8 @@ function resolveLambdaForwardTarget(tgProps, tgRef, resources, stackName, label,
 		return;
 	}
 	const lambda = resources[lambdaLogicalId];
-	if (!lambda || lambda.Type !== LAMBDA_FUNCTION_TYPE) {
-		warnings.push(`${label} forwards to Lambda target group '${tgRef}', whose target resolves to '${lambdaLogicalId}', but no ${LAMBDA_FUNCTION_TYPE} with that logical id exists in ${stackName}. Skipping that target group.`);
+	if (!lambda || lambda.Type !== LAMBDA_FUNCTION_TYPE$1) {
+		warnings.push(`${label} forwards to Lambda target group '${tgRef}', whose target resolves to '${lambdaLogicalId}', but no ${LAMBDA_FUNCTION_TYPE$1} with that logical id exists in ${stackName}. Skipping that target group.`);
 		return;
 	}
 	return {
@@ -28169,6 +28169,8 @@ function decodePart(s) {
 const CLOUDFRONT_DISTRIBUTION_TYPE = "AWS::CloudFront::Distribution";
 const CLOUDFRONT_FUNCTION_TYPE = "AWS::CloudFront::Function";
 const S3_BUCKET_TYPE = "AWS::S3::Bucket";
+const LAMBDA_URL_TYPE = "AWS::Lambda::Url";
+const LAMBDA_FUNCTION_TYPE = "AWS::Lambda::Function";
 /**
 * Resolve a distribution logical id within a stack into its routing model.
 * `originOverrides` maps an origin id to a local directory (the `--origin`
@@ -28283,6 +28285,11 @@ function resolveOrigins(dc, template, stack, overrides) {
 		}
 		const bucketLogicalId = pickBucketLogicalIdFromOrigin(origin, template);
 		if (!(origin["S3OriginConfig"] !== void 0 || bucketLogicalId !== void 0)) {
+			const lambdaUrl = resolveLambdaUrlOrigin(origin, template, originId);
+			if (lambdaUrl) {
+				out.set(originId, lambdaUrl);
+				continue;
+			}
 			out.set(originId, {
 				kind: "custom",
 				originId,
@@ -28373,6 +28380,58 @@ function getAttLogicalId(value) {
 	const getAtt = value["Fn::GetAtt"];
 	if (Array.isArray(getAtt) && getAtt.length === 2 && typeof getAtt[0] === "string") return getAtt[0];
 }
+/**
+* Resolve a Lambda Function URL custom origin (`origins.FunctionUrlOrigin`) to
+* its backing `AWS::Lambda::Function` logical id, or `undefined` when the
+* origin is not a Function URL (a generic custom HTTP origin). CDK synthesizes
+* a FunctionUrlOrigin's `DomainName` from the Function URL by stripping the
+* scheme + trailing slash:
+* `Fn::Select[2, Fn::Split['/', Fn::GetAtt[<UrlLogicalId>, 'FunctionUrl']]]`.
+* The `AWS::Lambda::Url` resource's `TargetFunctionArn` then points at the
+* function (a `Ref` or `Fn::GetAtt[<fn>, 'Arn']`).
+*/
+function resolveLambdaUrlOrigin(origin, template, originId) {
+	const urlLogicalId = pickFunctionUrlLogicalIdFromOrigin(origin["DomainName"]);
+	if (!urlLogicalId) return void 0;
+	const urlResource = (template.Resources ?? {})[urlLogicalId];
+	if (!urlResource || urlResource.Type !== LAMBDA_URL_TYPE) return void 0;
+	const functionLogicalId = pickTargetFunctionLogicalId((urlResource.Properties ?? {})["TargetFunctionArn"]);
+	if (!functionLogicalId) return void 0;
+	const fnResource = (template.Resources ?? {})[functionLogicalId];
+	if (!fnResource || fnResource.Type !== LAMBDA_FUNCTION_TYPE) return void 0;
+	return {
+		kind: "lambda-url",
+		originId,
+		functionLogicalId,
+		functionUrlLogicalId: urlLogicalId
+	};
+}
+/**
+* Unwrap a FunctionUrlOrigin `DomainName` to its `AWS::Lambda::Url` logical id.
+* Matches the exact synthesized shape
+* `{Fn::Select: [2, {Fn::Split: ['/', {Fn::GetAtt: [<UrlLogicalId>, 'FunctionUrl']}]}]}`.
+*/
+function pickFunctionUrlLogicalIdFromOrigin(value) {
+	const select = asIntrinsic(value, "Fn::Select");
+	if (!Array.isArray(select) || select.length !== 2 || select[0] !== 2) return void 0;
+	const split = asIntrinsic(select[1], "Fn::Split");
+	if (!Array.isArray(split) || split.length !== 2 || split[0] !== "/") return void 0;
+	const getAtt = asIntrinsic(split[1], "Fn::GetAtt");
+	if (Array.isArray(getAtt) && getAtt.length === 2 && typeof getAtt[0] === "string" && getAtt[1] === "FunctionUrl") return getAtt[0];
+}
+/**
+* Unwrap an `AWS::Lambda::Url` `TargetFunctionArn` to the function logical id.
+* CDK emits either a `Ref` (the function's name reference) or a
+* `Fn::GetAtt[<fn>, 'Arn']`.
+*/
+function pickTargetFunctionLogicalId(value) {
+	return refLogicalId(value) ?? getAttLogicalId(value);
+}
+/** Read an intrinsic's payload (e.g. the `Fn::Select` array) from a wrapper object. */
+function asIntrinsic(value, key) {
+	if (!value || typeof value !== "object") return void 0;
+	return value[key];
+}
 function refLogicalId(value) {
 	if (!value || typeof value !== "object") return void 0;
 	const ref = value["Ref"];
@@ -28405,6 +28464,59 @@ function isCloudFrontDistribution(resource) {
 	return resource.Type === CLOUDFRONT_DISTRIBUTION_TYPE;
 }
 
+//#endregion
+//#region src/local/cloudfront-lambda-origin.ts
+/**
+* Build the Function URL v2 event from the request, invoke the Lambda, and
+* translate its response. `invoke` is the warm RIE container's invoke function
+* (from `createFrontDoorLambdaRunner`).
+*/
+async function serveLambdaUrlOrigin(args) {
+	const { request } = args;
+	const event = buildHttpApiV2Event({
+		method: request.method,
+		rawUrl: request.querystring ? `${request.uri}?${request.querystring}` : request.uri,
+		headers: normalizeHeaders(request.headers),
+		body: request.body,
+		...request.sourceIp !== void 0 && { sourceIp: request.sourceIp }
+	}, {
+		route: {
+			method: "ANY",
+			pathPattern: "$default",
+			lambdaLogicalId: args.functionLogicalId,
+			source: "function-url",
+			apiVersion: "v2",
+			stage: "$default",
+			apiLogicalId: args.functionUrlLogicalId,
+			invokeMode: "BUFFERED",
+			declaredAt: args.functionUrlLogicalId
+		},
+		pathParameters: {},
+		matchedPath: request.uri
+	});
+	const translated = translateLambdaResponse(await args.invoke(event), "v2");
+	return {
+		statusCode: translated.statusCode,
+		headers: translated.headers,
+		cookies: translated.cookies,
+		body: translated.body
+	};
+}
+/**
+* Convert Node's incoming-header map (`string | string[] | undefined`) into the
+* `Record<string, string[]>` shape {@link HttpRequestSnapshot} expects. A
+* comma-joined string header (Node's default for most duplicates) is passed
+* through as a single element; an array header is preserved.
+*/
+function normalizeHeaders(headers) {
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) {
+		if (value === void 0) continue;
+		out[name] = Array.isArray(value) ? value : [value];
+	}
+	return out;
+}
+
 //#endregion
 //#region src/local/cloudfront-static-origin.ts
 /**
@@ -28535,9 +28647,10 @@ function contentTypeForKey(key) {
 /** Start the local CloudFront server and resolve once it is listening. */
 async function startCloudFrontServer(options) {
 	const logger = getLogger().child("cloudfront");
+	const lambdaInvokers = options.lambdaInvokers ?? /* @__PURE__ */ new Map();
 	const state = { distribution: options.distribution };
 	const handler = (req, res) => {
-		handleRequest$1(req, res, state, logger).catch((err) => {
+		handleRequest$1(req, res, state, lambdaInvokers, logger).catch((err) => {
 			logger.warn(`Request handling failed: ${err instanceof Error ? err.message : String(err)}`);
 			if (!res.headersSent) {
 				res.statusCode = 500;
@@ -28567,7 +28680,7 @@ async function startCloudFrontServer(options) {
 	};
 }
 /** The per-request pipeline: behavior match -> viewer-request -> origin -> viewer-response. */
-async function handleRequest$1(req, res, state, logger) {
+async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 	const distribution = state.distribution;
 	const rawUrl = req.url ?? "/";
 	const queryIdx = rawUrl.indexOf("?");
@@ -28602,7 +28715,17 @@ async function handleRequest$1(req, res, state, logger) {
 		};
 	}
 	const origin = distribution.origins.get(behavior.targetOriginId);
-	const originResult = serveFromOrigin(origin, behavior, effectiveUri, distribution, logger);
+	const originResult = await serveFromOrigin(origin, behavior, {
+		uri: effectiveUri,
+		querystring,
+		method: req.method ?? "GET",
+		headers: req.headers,
+		readBody: () => readRequestBody(req),
+		sourceIp: req.socket.remoteAddress ?? "127.0.0.1",
+		distribution,
+		lambdaInvokers,
+		logger
+	});
 	if (!originResult) return writePlain(res, 502, originUnavailableMessage(origin, behavior));
 	let finalStatus = originResult.statusCode;
 	let finalHeaders = originResult.headers;
@@ -28615,10 +28738,29 @@ async function handleRequest$1(req, res, state, logger) {
 		finalStatus = mutated.statusCode;
 		finalHeaders = cfHeadersToPlain(mutated.headers, originResult.headers);
 	}
+	const setCookies = [...originResult.setCookies ?? []];
+	for (const name of Object.keys(finalHeaders)) if (name.toLowerCase() === "set-cookie") {
+		setCookies.push(finalHeaders[name]);
+		delete finalHeaders[name];
+	}
 	res.statusCode = finalStatus;
 	setHeadersSafely(res, finalHeaders, logger);
+	if (setCookies.length > 0) try {
+		res.setHeader("set-cookie", setCookies);
+	} catch (err) {
+		logger.warn(`Skipping invalid Set-Cookie header(s): ${err instanceof Error ? err.message : String(err)}`);
+	}
 	res.end(originResult.body);
 }
+/** Read the full request body into a Buffer. */
+function readRequestBody(req) {
+	return new Promise((resolveBody, rejectBody) => {
+		const chunks = [];
+		req.on("data", (chunk) => chunks.push(chunk));
+		req.on("end", () => resolveBody(Buffer.concat(chunks)));
+		req.on("error", rejectBody);
+	});
+}
 /**
 * Set response headers, skipping any whose name / value Node rejects (invalid
 * HTTP token, CR/LF injection) rather than throwing an opaque 500. A CloudFront
@@ -28633,12 +28775,37 @@ function setHeadersSafely(res, headers, logger) {
 		logger.warn(`Skipping invalid response header '${name}': ${err instanceof Error ? err.message : String(err)}`);
 	}
 }
-function serveFromOrigin(origin, behavior, uri, distribution, logger) {
-	if (behavior.hasLambdaEdge) logger.warn(`Behavior ${behavior.pathPattern ?? "(default)"} carries a Lambda@Edge association; cdk-local does not run Lambda@Edge — serving the S3 origin only.`);
-	if (!origin || origin.kind !== "s3") return void 0;
+async function serveFromOrigin(origin, behavior, args) {
+	const { distribution, logger } = args;
+	if (behavior.hasLambdaEdge) logger.warn(`Behavior ${behavior.pathPattern ?? "(default)"} carries a Lambda@Edge association; cdk-local does not run Lambda@Edge — serving the origin only.`);
+	if (!origin) return void 0;
+	if (origin.kind === "lambda-url") {
+		const invoke = args.lambdaInvokers.get(origin.functionLogicalId);
+		if (!invoke) return void 0;
+		const result = await serveLambdaUrlOrigin({
+			invoke,
+			functionUrlLogicalId: origin.functionUrlLogicalId,
+			functionLogicalId: origin.functionLogicalId,
+			request: {
+				method: args.method,
+				uri: args.uri,
+				querystring: args.querystring,
+				headers: args.headers,
+				body: await args.readBody(),
+				sourceIp: args.sourceIp
+			}
+		});
+		return {
+			statusCode: result.statusCode,
+			headers: result.headers,
+			body: result.body,
+			...result.cookies.length > 0 && { setCookies: result.cookies }
+		};
+	}
+	if (origin.kind !== "s3") return void 0;
 	const result = serveFromStaticOrigin({
 		localDirs: origin.localDirs,
-		uri,
+		uri: args.uri,
 		...distribution.defaultRootObject !== void 0 && { defaultRootObject: distribution.defaultRootObject },
 		customErrorResponses: distribution.customErrorResponses
 	});
@@ -28650,7 +28817,8 @@ function serveFromOrigin(origin, behavior, uri, distribution, logger) {
 }
 function originUnavailableMessage(origin, behavior) {
 	if (!origin) return `Behavior ${behavior.pathPattern ?? "(default)"} targets unknown origin '${behavior.targetOriginId}'.\n`;
-	if (origin.kind === "custom") return `Origin '${origin.originId}' is a custom (non-S3) origin (${origin.domainName}). cdkl start-cloudfront serves S3 origins only.
+	if (origin.kind === "lambda-url") return `Origin '${origin.originId}' is a Lambda Function URL origin whose backing function '${origin.functionLogicalId}' was not booted (it was added after start-up). Restart start-cloudfront.\n`;
+	if (origin.kind === "custom") return `Origin '${origin.originId}' is a custom (non-S3) origin (${origin.domainName}). cdkl start-cloudfront serves S3 origins and Lambda Function URL origins only.
 `;
 	return `Origin '${origin.originId}' is an S3 origin with no resolvable local source. Point it at a directory with --origin ${origin.originId}=<dir>.\n`;
 }
@@ -28774,10 +28942,46 @@ function notFound(target, stack, resources) {
 	const available = dists.length > 0 ? ` Available distributions in ${stack.stackName}: ${dists.join(", ")}.` : ` ${stack.stackName} declares no ${CLOUDFRONT_DISTRIBUTION_TYPE} resources.`;
 	return new LocalStartCloudFrontError(`Target '${target}' did not match a CloudFront distribution in ${stack.stackName}.${available}`);
 }
+/**
+* Boot one warm RIE container per unique Lambda Function URL origin in the
+* distribution (issue #376), returning the runners + an invoker map keyed by
+* backing-function logical id for {@link startCloudFrontServer}. Returns empty
+* collections when the distribution has no Function URL origin — start-cloudfront
+* then stays pure-local (no Docker). Booted once at start-up; NOT re-run on a
+* `--watch` reload (the warm containers keep their boot-time image).
+*/
+async function bootLambdaUrlOrigins(distribution, stacks, opts) {
+	const logger = getLogger();
+	const invokers = /* @__PURE__ */ new Map();
+	const runners = [];
+	const functionLogicalIds = /* @__PURE__ */ new Set();
+	for (const origin of distribution.origins.values()) if (origin.kind === "lambda-url") functionLogicalIds.add(origin.functionLogicalId);
+	for (const functionLogicalId of functionLogicalIds) {
+		let runner;
+		try {
+			runner = createFrontDoorLambdaRunner(resolveLambdaTarget(functionLogicalId, stacks), {
+				containerHost: opts.containerHost,
+				skipPull: opts.skipPull,
+				...opts.region !== void 0 && { region: opts.region }
+			});
+			logger.info(`Booting Lambda Function URL origin container for ${functionLogicalId} (the backing Lambda runs locally via RIE)...`);
+			await runner.start();
+		} catch (err) {
+			await Promise.all(runners.map((r) => r.stop().catch(() => void 0)));
+			throw new LocalStartCloudFrontError(`Failed to boot the Lambda Function URL origin's backing function '${functionLogicalId}': ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
+		}
+		runners.push(runner);
+		invokers.set(functionLogicalId, (event) => runner.invoke(event));
+	}
+	return {
+		invokers,
+		runners
+	};
+}
 /** Emit boot-time WARNs for parts of the distribution cdk-local does not serve. */
 function warnUnsupported(distribution) {
 	const logger = getLogger();
-	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin '${origin.originId}' is a custom (non-S3) origin (${origin.domainName}); cdkl start-cloudfront serves S3 origins only. Requests routed to it return 502.`);
+	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin '${origin.originId}' is a custom (non-S3, non-Lambda-Function-URL) origin (${origin.domainName}); ${getEmbedConfig().cliName} start-cloudfront serves S3 origins and Lambda Function URL origins only. Requests routed to it return 502.`);
 	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Point it at a directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
 	if (distribution.behaviors.some((b) => b.hasLambdaEdge)) logger.warn("One or more cache behaviors carry a Lambda@Edge association; cdk-local does not run Lambda@Edge functions — only CloudFront Functions + the S3 origin are served.");
 }
@@ -28815,26 +29019,35 @@ async function localStartCloudFrontCommand(target, options) {
 		});
 		target = chosen;
 		const { stack, logicalId } = resolveCloudFrontTarget(chosen, stacks);
-		return resolveCloudFrontDistribution({
-			stack,
-			logicalId,
-			originOverrides
-		});
+		return {
+			distribution: resolveCloudFrontDistribution({
+				stack,
+				logicalId,
+				originOverrides
+			}),
+			stacks
+		};
 	};
 	const initial = await synthAndResolve();
-	warnUnsupported(initial);
+	warnUnsupported(initial.distribution);
+	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, {
+		containerHost: options.host,
+		skipPull: options.pull === false,
+		...options.region !== void 0 && { region: options.region }
+	});
 	let tls;
 	if (tlsRequested) tls = await resolveFrontDoorTlsMaterials({
 		certPath: options.tlsCert,
 		keyPath: options.tlsKey
 	});
 	const server = await startCloudFrontServer({
-		distribution: initial,
+		distribution: initial.distribution,
 		host: options.host,
 		port: basePort,
-		...tls && { tls }
+		...tls && { tls },
+		...lambdaInvokers.size > 0 && { lambdaInvokers }
 	});
-	process.stdout.write(`CloudFront distribution serving on ${server.url}  (${initial.logicalId})\n`);
+	process.stdout.write(`CloudFront distribution serving on ${server.url}  (${initial.distribution.logicalId})\n`);
 	process.stdout.write("^C to stop.\n");
 	let watcher;
 	let reloadChain = Promise.resolve();
@@ -28854,8 +29067,8 @@ async function localStartCloudFrontCommand(target, options) {
 				reloadChain = reloadChain.then(async () => {
 					try {
 						const reloaded = await synthAndResolve();
-						warnUnsupported(reloaded);
-						server.update(reloaded);
+						warnUnsupported(reloaded.distribution);
+						server.update(reloaded.distribution);
 						logger.info("Reload complete.");
 					} catch (err) {
 						logger.warn(`Reload failed; keeping the previous version serving: ${err instanceof Error ? err.message : String(err)}`);
@@ -28876,6 +29089,9 @@ async function localStartCloudFrontCommand(target, options) {
 		try {
 			await server.close();
 		} catch {}
+		await Promise.all(lambdaRunners.map((r) => r.stop().catch((err) => {
+			logger.debug(`Lambda origin runner stop failed: ${err instanceof Error ? err.message : String(err)}`);
+		})));
 		process.exit(exitCode);
 	};
 	process.on("SIGINT", () => void shutdown("SIGINT", 130));
@@ -28884,7 +29100,7 @@ async function localStartCloudFrontCommand(target, options) {
 }
 function createLocalStartCloudFrontCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("start-cloudfront").description("Run a long-running local server that serves a CloudFront distribution: its S3 origin content (resolved from the BucketDeployment source in the cloud assembly) plus its viewer-request / viewer-response CloudFront Functions, reproducing the distribution routing locally so a rewrite / routing change is verifiable in seconds. Serves S3 origins only; custom origins and Lambda@Edge are not run (warn-and-skip). Tip: omit the target in a terminal to pick interactively.").argument("[target]", "CloudFront distribution to serve. Accepts the CDK Construct path ('MyStack/MyDist'), an ancestor prefix, or the stack-qualified logical id ('MyStack:MyDist'). When omitted in a TTY, an interactive picker opens.").action(withErrorHandling(async (target, options) => {
+	const cmd = new Command("start-cloudfront").description("Run a long-running local server that serves a CloudFront distribution: its S3 origin content (resolved from the BucketDeployment source in the cloud assembly) and its Lambda Function URL origins (the backing Lambda is run locally via RIE), plus its viewer-request / viewer-response CloudFront Functions, reproducing the distribution routing locally so a rewrite / routing change is verifiable in seconds. Serves S3 and Lambda Function URL origins; other custom origins and Lambda@Edge are not run (warn-and-skip). Tip: omit the target in a terminal to pick interactively.").argument("[target]", "CloudFront distribution to serve. Accepts the CDK Construct path ('MyStack/MyDist'), an ancestor prefix, or the stack-qualified logical id ('MyStack:MyDist'). When omitted in a TTY, an interactive picker opens.").action(withErrorHandling(async (target, options) => {
 		await localStartCloudFrontCommand(target, options);
 	}));
 	addStartCloudFrontSpecificOptions(cmd);
@@ -28905,7 +29121,7 @@ function createLocalStartCloudFrontCommand(opts = {}) {
 * `cmd`.
 */
 function addStartCloudFrontSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
+	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
@@ -30337,6 +30553,15 @@ const STUDIO_SCRIPT = `
     const st = serveState.get(id) || { status: 'stopped', endpoints: [] };
     const running = st.status === 'running';
     const starting = st.status === 'starting';
+    // A serve that exited with a failure reason is FAILED, distinct from a
+    // clean user stop. A boot failure arrives as status 'error'; a crash AFTER
+    // the serve was running arrives as status 'stopped' WITH a message (a clean
+    // user stop is 'stopped' with NO message). A failed serve keeps its
+    // "Started with" context + surfaces the reason + offers a Reconfigure
+    // button instead of silently dropping to a blank composer (which reads as
+    // "my inputs vanished" when the serve actually crashed).
+    const failed = st.status === 'error' || (st.status === 'stopped' && !!st.message);
+    const effErr = errMsg || (failed ? st.message : undefined);
     // A NON-running render (serve stopped / starting) tears down any open
     // WebSocket-console socket: its endpoint is gone, and leaving it open would
     // show "● connected" against a dead serve if the same target is restarted.
@@ -30355,20 +30580,32 @@ const STUDIO_SCRIPT = `
     head.appendChild(el('div', 'target-name', (isTaskRun ? 'Run ' : 'Serve ') + id));
     const btn = running || starting
       ? el('button', null, 'Stop')
-      : el('button', null, starting ? 'Starting…' : startLabel);
+      : el('button', null, failed ? 'Reconfigure' : startLabel);
     // Per-run options are only set before a start; collected on the Start click.
     let collectOpts = function () { return undefined; };
     let collectRaw = function () { return undefined; };
     let collectImageOverride = function () { return undefined; };
-    btn.onclick = () => { if (running || starting) stopServe(id); else startServe(id, collectOpts(), collectRaw(), collectImageOverride()); };
+    btn.onclick = () => {
+      if (running || starting) {
+        stopServe(id);
+      } else if (failed) {
+        // Clear the failed state so the composer comes back (the user adjusts
+        // options + restarts) — NOT a blind default restart that would drop
+        // the env-vars / other options the crashed serve was started with.
+        serveState.set(id, { status: 'stopped', endpoints: [] });
+        renderServeWorkspace(id);
+      } else {
+        startServe(id, collectOpts(), collectRaw(), collectImageOverride());
+      }
+    };
     head.appendChild(btn);
-    if (errMsg) {
-      const m = el('div', 'err', errMsg);
+    if (effErr) {
+      const m = el('div', 'err', effErr);
       head.appendChild(m);
     }
     ws.appendChild(head);
 
-    if (!running && !starting) {
+    if (!running && !starting && !failed) {
       // A pinned ECS service (deployed-registry image) does not pick up local
       // source edits — offer an image-override Dockerfile picker so it can be
       // rebuilt locally (issue #301). Local-asset services hot-reload under
@@ -30384,11 +30621,12 @@ const STUDIO_SCRIPT = `
       collectRaw = opt.collectRaw;
     }
 
-    if (running || starting) {
+    if (running || starting || failed) {
       // Issue #356: the per-run option inputs are gone once the composer is
       // replaced by this running view, so surface what the serve was Started
       // with as a read-only summary (so e.g. a chosen --max-tasks stays
-      // visible instead of silently vanishing after Start).
+      // visible instead of silently vanishing after Start). A FAILED serve
+      // keeps this too, so a crash does not read as "my inputs disappeared".
       const lines = formatAppliedOptions(serveApplied.get(id));
       const startedSec = el('div', 'section started-with');
       startedSec.appendChild(el('h3', null, 'Started with'));
@@ -31263,9 +31501,14 @@ const STUDIO_SCRIPT = `
 
   function onServeEvent(ev) {
     // A 'stopped' / 'error' transition clears the running state; otherwise
-    // record the latest status + endpoints for the row + workspace.
+    // record the latest status + endpoints for the row + workspace. Keep the
+    // failure reason (ev.message) so the workspace can surface a crash instead
+    // of silently reverting to a blank composer: a boot failure arrives as
+    // 'error' with a message, a crash AFTER the serve was running arrives as
+    // 'stopped' WITH a message, and a clean user stop is 'stopped' with NO
+    // message (renderServeWorkspace uses message presence to tell them apart).
     if (ev.status === 'stopped' || ev.status === 'error') {
-      serveState.set(ev.target, { status: ev.status, endpoints: [] });
+      serveState.set(ev.target, { status: ev.status, endpoints: [], message: ev.message });
     } else {
       serveState.set(ev.target, { status: ev.status, endpoints: ev.endpoints || [], hostUrl: ev.hostUrl });
     }
@@ -32954,6 +33197,21 @@ function coerceStopRequest(body) {
 	if (typeof targetId !== "string" || targetId.trim() === "") throw new Error("Request body must include a non-empty \"targetId\" string.");
 	return { targetId };
 }
+/**
+* Route a validated `POST /api/run` request to the right runner: the
+* single-shot dispatcher for the invoke kinds (`lambda` / `agentcore`), or the
+* serve manager for every serve kind (`api` / `alb` / `ecs` / `ecs-task` /
+* `cloudfront`). An `ecs` target that is NOT a servable service (a raw curl
+* could POST a task-def id with `kind: 'ecs'`) is rejected at the boundary with
+* a clear message rather than spawning a doomed `start-service`. Extracted from
+* the `onRun` closure so the kind→runner routing is unit-testable without
+* booting the studio server.
+*/
+function routeStudioRun(req, deps) {
+	if (req.kind === "lambda" || req.kind === "agentcore") return deps.dispatcher.run(req);
+	if (req.kind === "ecs" && !deps.servableEcs.has(req.targetId)) return Promise.reject(/* @__PURE__ */ new Error(`'${req.targetId}' is not a servable ECS service (an ECS task definition runs via run-task, not start-service).`));
+	return deps.serveManager.start(req);
+}
 const SERVE_REQUEST_METHODS = new Set([
 	"GET",
 	"POST",
@@ -33286,12 +33544,11 @@ async function localStudioCommand(options) {
 		appLabel,
 		cliName: getEmbedConfig().cliName,
 		store,
-		onRun: (body) => {
-			const req = coerceRunRequest(body);
-			if (req.kind === "lambda" || req.kind === "agentcore") return dispatcher.run(req);
-			if (req.kind === "ecs" && !servableEcs.has(req.targetId)) return Promise.reject(/* @__PURE__ */ new Error(`'${req.targetId}' is not a servable ECS service (an ECS task definition runs via run-task, not start-service).`));
-			return serveManager.start(req);
-		},
+		onRun: (body) => routeStudioRun(coerceRunRequest(body), {
+			dispatcher,
+			serveManager,
+			servableEcs
+		}),
 		onStop: async (body) => {
 			const req = coerceStopRequest(body);
 			await serveManager.stop(req);
@@ -33433,5 +33690,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { addImageOverrideOptions as $, resolveRuntimeCodeMountPath as $n, createAuthorizerCache as $t, startCloudFrontServer as A, matchPreflight as An, AGENTCORE_A2A_PROTOCOL as Ar, MCP_CONTAINER_PORT as At, createLocalStartAlbCommand as B, VtlEvaluationError as Bn, substituteImagePlaceholders as Br, downloadAndExtractS3Bundle as Bt, formatTargetListing as C, invokeRequestAuthorizer as Cn, discoverWebSocketApisOrThrow as Cr, attachContainerLogStreamer as Ct, parseOriginOverrides as D, buildCorsConfigByApiId as Dn, discoverRoutes as Dr, A2A_CONTAINER_PORT as Dt, createLocalStartCloudFrontCommand as E, applyCorsResponseHeaders as En, webSocketApiMatchesIdentifier as Er, invokeAgentCoreWs as Et, compileCloudFrontFunction as F, buildRestV1Event as Fn, AgentCoreResolutionError as Fr, AGENTCORE_SIGV4_SERVICE as Ft, addStartServiceSpecificOptions as G, buildMgmtEndpointEnvUrl as Gn, toCmdArgv as Gt, resolveAlbTarget as H, probeHostGatewaySupport as Hn, LocalInvokeBuildError as Hr, buildAgentCoreCodeImage as Ht, runViewerRequest as I, evaluateResponseParameters as In, pickAgentCoreCandidateStack as Ir, signAgentCoreInvocation as It, addRunTaskSpecificOptions as J, buildConnectEvent as Jn, createLocalInvokeCommand as Jt, createLocalStartServiceCommand as K, handleConnectionsRequest as Kn, classifySourceChange as Kt, runViewerResponse as L, pickResponseTemplate as Ln, resolveAgentCoreTarget as Lr, AGENTCORE_SESSION_ID_HEADER as Lt, CLOUDFRONT_DISTRIBUTION_TYPE as M, translateLambdaResponse as Mn, AGENTCORE_HTTP_PROTOCOL as Mr, MCP_PROTOCOL_VERSION as Mt, isCloudFrontDistribution as N, applyAuthorizerOverlay as Nn, AGENTCORE_MCP_PROTOCOL as Nr, mcpInvokeOnce as Nt, resolveCloudFrontTarget as O, buildCorsConfigFromCloudFrontChain as On, pickRefLogicalId as Or, A2A_PATH as Ot, resolveCloudFrontDistribution as P, buildHttpApiV2Event as Pn, AGENTCORE_RUNTIME_TYPE as Pr, parseSseForJsonRpc as Pt, addEcsAssumeRoleOptions as Q, buildContainerImage as Qn, resolveApiTargetSubset as Qt, addAlbSpecificOptions as R, selectIntegrationResponse as Rn, derivePseudoParametersFromRegion as Rr, invokeAgentCore as Rt, createLocalListCommand as S, evaluateCachedLambdaPolicy as Sn, discoverWebSocketApis as Sr, getContainerNetworkIp as St, addStartCloudFrontSpecificOptions as T, attachAuthorizers as Tn, parseSelectionExpressionPath as Tr, createLocalInvokeAgentCoreCommand as Tt, isApplicationLoadBalancer as U, bufferToBody as Un, buildStsClientConfig as Ur, computeCodeImageTag as Ut, parseLbPortOverrides as V, HOST_GATEWAY_MIN_VERSION as Vn, tryResolveImageFnJoin as Vr, SUPPORTED_CODE_RUNTIMES as Vt, resolveAlbFrontDoor as W, ConnectionRegistry as Wn, resolveProfileCredentials as Wr, renderCodeDockerfile as Wt, MAX_TASKS_SUBNET_RANGE_CAP as X, buildMessageEvent as Xn, createLocalStartApiCommand as Xt, createLocalRunTaskCommand as Y, buildDisconnectEvent as Yn, addStartApiSpecificOptions as Yt, addCommonEcsServiceOptions as Z, architectureToPlatform as Zn, createWatchPredicates as Zt, toStudioTargetGroups as _, verifyCognitoJwt as _n, resolveWatchConfig as _r, buildCloudMapIndex as _t, createLocalStudioCommand as a, availableApiIdentifiers as an, substituteEnvVarsFromState as ar, resolveSharedSidecarCredentials as at, StudioEventBus as b, buildMethodArn as bn, listTargets as br, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as bt, startStudioProxy as c, groupRoutesByServer as cn, createLocalStateProvider as cr, buildImageOverrideTag as ct, createStudioDispatcher as d, resolveSelectionExpression as dn, resolveCfnFallbackRegion as dr, parseImageOverrideFlags as dt, createFileWatcher as en, resolveRuntimeFileExtension as er, buildEcsImageResolutionContext$1 as et, filterStudioCustomResources as f, resolveServiceIntegrationParameters as fn, resolveCfnRegion as fr, resolveImageOverrides as ft, startStudioServer as g, createJwksCache as gn, resolveSsmParameters as gr, listPinnedTargets as gt, filterStudioTargetGroups as h, buildJwksUrlFromIssuer as hn, collectSsmParameterRefs as hr, isLocalCdkAssetImage as ht, coerceStopRequest as i, resolveEnvVars$1 as in, substituteAgainstStateAsync as ir, resolveEcsAssumeRoleOption as it, serveFromStaticOrigin as j, matchRoute as jn, AGENTCORE_AGUI_PROTOCOL as jr, MCP_PATH as jt, matchBehavior as k, isFunctionUrlOacFronted as kn, resolveLambdaArnIntrinsic as kr, a2aInvokeOnce as kt, relayServeRequest as l, readMtlsMaterialsFromDisk as ln, isCfnFlagPresent as lr, enforceImageOverrideOrphans as lt, annotatePinnedEcsTargets as m, buildCognitoJwksUrl as mn, CfnLocalStateProvider as mr, describePinnedImageUri as mt, coerceRunRequest as n, buildStageMap as nn, EcsTaskResolutionError as nr, parseMaxTasks as nt, resolveServeBaseUrl as o, filterRoutesByApiIdentifier as on, substituteEnvVarsFromStateAsync as or, runEcsServiceEmulator as ot, isCustomResourceLambdaTarget as p, defaultCredentialsLoader as pn, resolveCfnStackName as pr, runImageOverrideBuilds as pt, serviceStrategy as q, parseConnectionsPath as qn, addInvokeSpecificOptions as qt, coerceServeRequest as r, materializeLayerFromArn as rn, substituteAgainstState as rr, parseRestartPolicy as rt, createStudioServeManager as s, filterRoutesByApiIdentifiers as sn, LocalStateSourceError as sr, ImageOverrideError as st, addStudioSpecificOptions as t, attachStageContext as tn, resolveRuntimeImage as tr, ecsClusterOption as tt, reinvoke as u, startApiServer as un, rejectExplicitCfnStackWithMultipleStacks as ur, mergeForService as ut, renderStudioHtml as v, verifyJwtAuthorizer as vn, resolveSingleTarget as vr, CloudMapRegistry as vt, LocalStartCloudFrontError as w, invokeTokenAuthorizer as wn, filterWebSocketApisByIdentifiers as wr, addInvokeAgentCoreSpecificOptions as wt, addListSpecificOptions as x, computeRequestIdentityHash as xn, availableWebSocketApiIdentifiers as xr, setShadowReadyTimeoutMs as xt, createStudioStore as y, verifyJwtViaDiscovery as yn, countTargets as yr, DEFAULT_SHADOW_READY_TIMEOUT_MS as yt, albStrategy as z, tryParseStatus as zn, formatStateRemedy as zr, waitForAgentCorePing as zt };
-//# sourceMappingURL=local-studio-COb3K0Br.js.map
+export { MAX_TASKS_SUBNET_RANGE_CAP as $, buildMessageEvent as $n, createLocalStartApiCommand as $t, startCloudFrontServer as A, buildCorsConfigByApiId as An, discoverRoutes as Ar, A2A_CONTAINER_PORT as At, runViewerResponse as B, pickResponseTemplate as Bn, resolveAgentCoreTarget as Br, AGENTCORE_SESSION_ID_HEADER as Bt, formatTargetListing as C, buildMethodArn as Cn, listTargets as Cr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Ct, parseOriginOverrides as D, invokeTokenAuthorizer as Dn, filterWebSocketApisByIdentifiers as Dr, addInvokeAgentCoreSpecificOptions as Dt, createLocalStartCloudFrontCommand as E, invokeRequestAuthorizer as En, discoverWebSocketApisOrThrow as Er, attachContainerLogStreamer as Et, pickFunctionUrlLogicalIdFromOrigin as F, translateLambdaResponse as Fn, AGENTCORE_HTTP_PROTOCOL as Fr, MCP_PROTOCOL_VERSION as Ft, resolveAlbTarget as G, probeHostGatewaySupport as Gn, LocalInvokeBuildError as Gr, buildAgentCoreCodeImage as Gt, albStrategy as H, tryParseStatus as Hn, formatStateRemedy as Hr, waitForAgentCorePing as Ht, pickTargetFunctionLogicalId as I, applyAuthorizerOverlay as In, AGENTCORE_MCP_PROTOCOL as Ir, mcpInvokeOnce as It, addStartServiceSpecificOptions as J, buildMgmtEndpointEnvUrl as Jn, toCmdArgv as Jt, isApplicationLoadBalancer as K, bufferToBody as Kn, buildStsClientConfig as Kr, computeCodeImageTag as Kt, resolveCloudFrontDistribution as L, buildHttpApiV2Event as Ln, AGENTCORE_RUNTIME_TYPE as Lr, parseSseForJsonRpc as Lt, serveLambdaUrlOrigin as M, isFunctionUrlOacFronted as Mn, resolveLambdaArnIntrinsic as Mr, a2aInvokeOnce as Mt, CLOUDFRONT_DISTRIBUTION_TYPE as N, matchPreflight as Nn, AGENTCORE_A2A_PROTOCOL as Nr, MCP_CONTAINER_PORT as Nt, resolveCloudFrontTarget as O, attachAuthorizers as On, parseSelectionExpressionPath as Or, createLocalInvokeAgentCoreCommand as Ot, isCloudFrontDistribution as P, matchRoute as Pn, AGENTCORE_AGUI_PROTOCOL as Pr, MCP_PATH as Pt, createLocalRunTaskCommand as Q, buildDisconnectEvent as Qn, addStartApiSpecificOptions as Qt, compileCloudFrontFunction as R, buildRestV1Event as Rn, AgentCoreResolutionError as Rr, AGENTCORE_SIGV4_SERVICE as Rt, createLocalListCommand as S, verifyJwtViaDiscovery as Sn, countTargets as Sr, DEFAULT_SHADOW_READY_TIMEOUT_MS as St, addStartCloudFrontSpecificOptions as T, evaluateCachedLambdaPolicy as Tn, discoverWebSocketApis as Tr, getContainerNetworkIp as Tt, createLocalStartAlbCommand as U, VtlEvaluationError as Un, substituteImagePlaceholders as Ur, downloadAndExtractS3Bundle as Ut, addAlbSpecificOptions as V, selectIntegrationResponse as Vn, derivePseudoParametersFromRegion as Vr, invokeAgentCore as Vt, parseLbPortOverrides as W, HOST_GATEWAY_MIN_VERSION as Wn, tryResolveImageFnJoin as Wr, SUPPORTED_CODE_RUNTIMES as Wt, serviceStrategy as X, parseConnectionsPath as Xn, addInvokeSpecificOptions as Xt, createLocalStartServiceCommand as Y, handleConnectionsRequest as Yn, classifySourceChange as Yt, addRunTaskSpecificOptions as Z, buildConnectEvent as Zn, createLocalInvokeCommand as Zt, toStudioTargetGroups as _, buildCognitoJwksUrl as _n, CfnLocalStateProvider as _r, describePinnedImageUri as _t, createLocalStudioCommand as a, buildStageMap as an, EcsTaskResolutionError as ar, parseMaxTasks as at, StudioEventBus as b, verifyCognitoJwt as bn, resolveWatchConfig as br, buildCloudMapIndex as bt, startStudioProxy as c, availableApiIdentifiers as cn, substituteEnvVarsFromState as cr, resolveSharedSidecarCredentials as ct, createStudioDispatcher as d, groupRoutesByServer as dn, createLocalStateProvider as dr, buildImageOverrideTag as dt, createWatchPredicates as en, architectureToPlatform as er, addCommonEcsServiceOptions as et, filterStudioCustomResources as f, readMtlsMaterialsFromDisk as fn, isCfnFlagPresent as fr, enforceImageOverrideOrphans as ft, startStudioServer as g, defaultCredentialsLoader as gn, resolveCfnStackName as gr, runImageOverrideBuilds as gt, filterStudioTargetGroups as h, resolveServiceIntegrationParameters as hn, resolveCfnRegion as hr, resolveImageOverrides as ht, coerceStopRequest as i, attachStageContext as in, resolveRuntimeImage as ir, ecsClusterOption as it, serveFromStaticOrigin as j, buildCorsConfigFromCloudFrontChain as jn, pickRefLogicalId as jr, A2A_PATH as jt, matchBehavior as k, applyCorsResponseHeaders as kn, webSocketApiMatchesIdentifier as kr, invokeAgentCoreWs as kt, relayServeRequest as l, filterRoutesByApiIdentifier as ln, substituteEnvVarsFromStateAsync as lr, runEcsServiceEmulator as lt, annotatePinnedEcsTargets as m, resolveSelectionExpression as mn, resolveCfnFallbackRegion as mr, parseImageOverrideFlags as mt, coerceRunRequest as n, createAuthorizerCache as nn, resolveRuntimeCodeMountPath as nr, addImageOverrideOptions as nt, resolveServeBaseUrl as o, materializeLayerFromArn as on, substituteAgainstState as or, parseRestartPolicy as ot, isCustomResourceLambdaTarget as p, startApiServer as pn, rejectExplicitCfnStackWithMultipleStacks as pr, mergeForService as pt, resolveAlbFrontDoor as q, ConnectionRegistry as qn, resolveProfileCredentials as qr, renderCodeDockerfile as qt, coerceServeRequest as r, createFileWatcher as rn, resolveRuntimeFileExtension as rr, buildEcsImageResolutionContext$1 as rt, createStudioServeManager as s, resolveEnvVars$1 as sn, substituteAgainstStateAsync as sr, resolveEcsAssumeRoleOption as st, addStudioSpecificOptions as t, resolveApiTargetSubset as tn, buildContainerImage as tr, addEcsAssumeRoleOptions as tt, reinvoke as u, filterRoutesByApiIdentifiers as un, LocalStateSourceError as ur, ImageOverrideError as ut, renderStudioHtml as v, buildJwksUrlFromIssuer as vn, collectSsmParameterRefs as vr, isLocalCdkAssetImage as vt, LocalStartCloudFrontError as w, computeRequestIdentityHash as wn, availableWebSocketApiIdentifiers as wr, setShadowReadyTimeoutMs as wt, addListSpecificOptions as x, verifyJwtAuthorizer as xn, resolveSingleTarget as xr, CloudMapRegistry as xt, createStudioStore as y, createJwksCache as yn, resolveSsmParameters as yr, listPinnedTargets as yt, runViewerRequest as z, evaluateResponseParameters as zn, pickAgentCoreCandidateStack as zr, signAgentCoreInvocation as zt };
+//# sourceMappingURL=local-studio-DG6aiOzK.js.map