cdk-local 0.107.1 → 0.109.0

package/dist/{local-studio-BWrmJblg.js → local-studio-CxVVLdJw.js}

@@ -17201,123 +17201,14 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 		const targetLabel = lambda.kind === "zip" ? lambda.runtime : "container image";
 		logger.info(`Target: ${lambda.stack.stackName}/${lambda.logicalId} (${targetLabel})`);
 		imagePlan = await resolveImagePlan(lambda, options);
-		let stateAudit;
-		let templateEnv = getTemplateEnv(lambda.resource);
-		let stateForRoleHint;
-		const stateProvider = createLocalStateProvider(options, lambda.stack.stackName, await resolveCfnFallbackRegion(options, lambda.stack.region), extraStateProviders);
-		if (stateProvider) try {
-			const loaded = await stateProvider.load(lambda.stack.stackName, lambda.stack.region);
-			if (loaded) {
-				stateForRoleHint = {
-					version: 1,
-					stackName: lambda.stack.stackName,
-					resources: loaded.resources,
-					outputs: loaded.outputs,
-					lastModified: 0
-				};
-				const subContext = {
-					resources: loaded.resources,
-					consumerRegion: loaded.region
-				};
-				if (envHasIntrinsicValue(templateEnv)) {
-					const pseudo = await resolvePseudoParametersForInvoke(lambda.stack.region, options);
-					if (pseudo) subContext.pseudoParameters = pseudo;
-				}
-				if (envHasIntrinsicValue(templateEnv) && stateProvider.resolveTemplateSsmParameters) {
-					const ssmParams = await stateProvider.resolveTemplateSsmParameters(lambda.stack.template);
-					if (Object.keys(ssmParams.values).length > 0) subContext.parameters = ssmParams.values;
-					if (ssmParams.secureStringLogicalIds.length > 0) subContext.sensitiveParameters = new Set(ssmParams.secureStringLogicalIds);
-				}
-				if (envHasCrossStackIntrinsic(templateEnv)) {
-					const resolver = await stateProvider.buildCrossStackResolver(loaded.region);
-					if (resolver) subContext.crossStackResolver = resolver;
-				}
-				const { env, audit } = await substituteEnvVarsFromStateAsync(templateEnv, subContext);
-				templateEnv = env;
-				const label = stateProvider.label;
-				for (const key of audit.resolvedKeys) logger.debug(`${label}: substituted env var ${key}`);
-				let unresolved = audit.unresolved;
-				const resolvedKeys = [...audit.resolvedKeys];
-				if (unresolved.length > 0 && stateProvider.resolveDeployedFunctionEnv) {
-					const physicalId = loaded.resources[lambda.logicalId]?.physicalId;
-					if (physicalId) {
-						const deployedEnv = await stateProvider.resolveDeployedFunctionEnv(physicalId);
-						const fb = applyDeployedEnvFallback(templateEnv, unresolved, deployedEnv);
-						templateEnv = fb.env;
-						unresolved = fb.stillUnresolved;
-						for (const key of fb.filled) {
-							resolvedKeys.push(key);
-							logger.debug(`${label}: filled env var ${key} from deployed function config`);
-						}
-					}
-				}
-				stateAudit = {
-					resolvedKeys,
-					unresolved,
-					sensitiveKeys: audit.sensitiveKeys
-				};
-				for (const { key, reason } of unresolved) logger.warn(`${label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
-			}
-		} catch (err) {
-			stateProvider.dispose();
-			throw err;
-		}
-		const overrides = readEnvOverridesFile$3(options.envVars);
-		const lambdaCdkPath = readCdkPathOrUndefined(lambda.resource);
-		const envResult = resolveEnvVars$1(lambda.logicalId, lambdaCdkPath, templateEnv, overrides);
-		for (const key of envResult.unresolved) {
-			if (stateAudit && stateAudit.unresolved.some((u) => u.key === key)) continue;
-			const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? lambda.logicalId;
-			logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to recover deployed values.`);
-		}
-		let resolvedAssumeRoleArn;
-		try {
-			resolvedAssumeRoleArn = await resolveAssumeRoleArnForLambda(options.assumeRole, stateForRoleHint, stateProvider, lambda.logicalId);
-		} finally {
-			stateProvider?.dispose();
+		const containerEnv = await resolveLambdaContainerEnv(lambda, options, profileCredentials, extraStateProviders);
+		const dockerEnv = containerEnv.env;
+		if (options.assumeRole === void 0 && containerEnv.stateForRoleHint) suggestAssumeRoleFromState(containerEnv.stateForRoleHint, lambda.logicalId);
+		if (!containerEnv.assumeRoleApplied && profileCredsFile) {
+			dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = profileCredsFile.containerPath;
+			dockerEnv["AWS_PROFILE"] = profileCredsFile.profileName;
 		}
-		if (options.assumeRole === void 0 && stateForRoleHint) suggestAssumeRoleFromState(stateForRoleHint, lambda.logicalId);
 		const event = await readEvent$1(options);
-		const dockerEnv = {
-			AWS_LAMBDA_FUNCTION_NAME: lambda.logicalId,
-			AWS_LAMBDA_FUNCTION_MEMORY_SIZE: String(lambda.memoryMb),
-			AWS_LAMBDA_FUNCTION_TIMEOUT: String(lambda.timeoutSec),
-			AWS_LAMBDA_FUNCTION_VERSION: "$LATEST",
-			AWS_LAMBDA_LOG_GROUP_NAME: `/aws/lambda/${lambda.logicalId}`,
-			AWS_LAMBDA_LOG_STREAM_NAME: "local",
-			...envResult.resolved
-		};
-		let assumeSucceeded = false;
-		if (resolvedAssumeRoleArn) {
-			const stsRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
-			try {
-				const creds = await assumeLambdaExecutionRole(resolvedAssumeRoleArn, stsRegion, options.profile);
-				dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
-				dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
-				dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
-				if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
-				assumeSucceeded = true;
-			} catch (err) {
-				const reason = err instanceof Error ? err.message : String(err);
-				logger.warn(`--assume-role: STS AssumeRole(${resolvedAssumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
-			}
-		}
-		if (!assumeSucceeded) {
-			forwardAwsEnv$2(dockerEnv);
-			applyProfileCredentialsOverlay(dockerEnv, profileCredentials, false);
-			if (profileCredsFile) {
-				dockerEnv["AWS_SHARED_CREDENTIALS_FILE"] = profileCredsFile.containerPath;
-				dockerEnv["AWS_PROFILE"] = profileCredsFile.profileName;
-			}
-		}
-		if (!dockerEnv["AWS_REGION"] && !dockerEnv["AWS_DEFAULT_REGION"]) {
-			const fallbackRegion = resolveContainerFallbackRegion({
-				stackRegionOverride: options.region,
-				synthRegion: lambda.stack.region,
-				profileRegion: profileCredentials?.region
-			});
-			if (fallbackRegion) dockerEnv["AWS_REGION"] = fallbackRegion;
-		}
 		let debugPort;
 		if (options.debugPort) {
 			debugPort = Number(options.debugPort);
@@ -17339,7 +17230,7 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 			mounts: imagePlan.mounts,
 			extraMounts: extraMountsWithProfile,
 			env: dockerEnv,
-			...stateAudit && stateAudit.sensitiveKeys.length > 0 && { sensitiveEnvKeys: new Set(stateAudit.sensitiveKeys) },
+			...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) },
 			cmd: imagePlan.cmd,
 			hostPort,
 			host: containerHost,
@@ -17627,6 +17518,141 @@ function applyProfileCredentialsOverlay(env, profileCreds, assumeRoleActive) {
 	if (profileCreds.sessionToken) env["AWS_SESSION_TOKEN"] = profileCreds.sessionToken;
 	else delete env["AWS_SESSION_TOKEN"];
 }
+/**
+* Resolve the full container environment for a Lambda: its declared env vars
+* (literal + `--env-vars` overrides + intrinsic values substituted against a
+* `--from-cfn-stack` deployed stack — SSM / cross-stack / deployed-env
+* fallback included), the `AWS_LAMBDA_*` runtime vars, and AWS credentials
+* (an `--assume-role` STS assume, else the dev shell's forwarded creds + a
+* `--profile` overlay), plus a fallback `AWS_REGION`.
+*
+* This is the single source of truth shared by `cdkl invoke` AND the
+* front-door Lambda boot path (`start-cloudfront`'s Function URL origin,
+* `start-alb`'s Lambda targets — issue #380), so a CDN- / ALB-fronted Lambda
+* reaches the same deployed resources as a direct `cdkl invoke`. The caller
+* layers any command-specific concerns (a `--profile` credentials-file
+* bind-mount, `--debug-port`) on top of `env`.
+*/
+async function resolveLambdaContainerEnv(lambda, options, profileCredentials, extraStateProviders) {
+	const logger = getLogger();
+	let stateAudit;
+	let templateEnv = getTemplateEnv(lambda.resource);
+	let stateForRoleHint;
+	const stateProvider = createLocalStateProvider(options, lambda.stack.stackName, await resolveCfnFallbackRegion(options, lambda.stack.region), extraStateProviders);
+	if (stateProvider) try {
+		const loaded = await stateProvider.load(lambda.stack.stackName, lambda.stack.region);
+		if (loaded) {
+			stateForRoleHint = {
+				version: 1,
+				stackName: lambda.stack.stackName,
+				resources: loaded.resources,
+				outputs: loaded.outputs,
+				lastModified: 0
+			};
+			const subContext = {
+				resources: loaded.resources,
+				consumerRegion: loaded.region
+			};
+			if (envHasIntrinsicValue(templateEnv)) {
+				const pseudo = await resolvePseudoParametersForInvoke(lambda.stack.region, options);
+				if (pseudo) subContext.pseudoParameters = pseudo;
+			}
+			if (envHasIntrinsicValue(templateEnv) && stateProvider.resolveTemplateSsmParameters) {
+				const ssmParams = await stateProvider.resolveTemplateSsmParameters(lambda.stack.template);
+				if (Object.keys(ssmParams.values).length > 0) subContext.parameters = ssmParams.values;
+				if (ssmParams.secureStringLogicalIds.length > 0) subContext.sensitiveParameters = new Set(ssmParams.secureStringLogicalIds);
+			}
+			if (envHasCrossStackIntrinsic(templateEnv)) {
+				const resolver = await stateProvider.buildCrossStackResolver(loaded.region);
+				if (resolver) subContext.crossStackResolver = resolver;
+			}
+			const { env, audit } = await substituteEnvVarsFromStateAsync(templateEnv, subContext);
+			templateEnv = env;
+			const label = stateProvider.label;
+			for (const key of audit.resolvedKeys) logger.debug(`${label}: substituted env var ${key}`);
+			let unresolved = audit.unresolved;
+			const resolvedKeys = [...audit.resolvedKeys];
+			if (unresolved.length > 0 && stateProvider.resolveDeployedFunctionEnv) {
+				const physicalId = loaded.resources[lambda.logicalId]?.physicalId;
+				if (physicalId) {
+					const deployedEnv = await stateProvider.resolveDeployedFunctionEnv(physicalId);
+					const fb = applyDeployedEnvFallback(templateEnv, unresolved, deployedEnv);
+					templateEnv = fb.env;
+					unresolved = fb.stillUnresolved;
+					for (const key of fb.filled) {
+						resolvedKeys.push(key);
+						logger.debug(`${label}: filled env var ${key} from deployed function config`);
+					}
+				}
+			}
+			stateAudit = {
+				resolvedKeys,
+				unresolved,
+				sensitiveKeys: audit.sensitiveKeys
+			};
+			for (const { key, reason } of unresolved) logger.warn(`${label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
+		}
+	} catch (err) {
+		stateProvider.dispose();
+		throw err;
+	}
+	const overrides = readEnvOverridesFile$3(options.envVars);
+	const lambdaCdkPath = readCdkPathOrUndefined(lambda.resource);
+	const envResult = resolveEnvVars$1(lambda.logicalId, lambdaCdkPath, templateEnv, overrides);
+	for (const key of envResult.unresolved) {
+		if (stateAudit && stateAudit.unresolved.some((u) => u.key === key)) continue;
+		const overrideKeyExample = lambdaCdkPath?.replace(/\/Resource$/, "") ?? lambda.logicalId;
+		logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to recover deployed values.`);
+	}
+	let resolvedAssumeRoleArn;
+	try {
+		resolvedAssumeRoleArn = await resolveAssumeRoleArnForLambda(options.assumeRole, stateForRoleHint, stateProvider, lambda.logicalId);
+	} finally {
+		stateProvider?.dispose();
+	}
+	const dockerEnv = {
+		AWS_LAMBDA_FUNCTION_NAME: lambda.logicalId,
+		AWS_LAMBDA_FUNCTION_MEMORY_SIZE: String(lambda.memoryMb),
+		AWS_LAMBDA_FUNCTION_TIMEOUT: String(lambda.timeoutSec),
+		AWS_LAMBDA_FUNCTION_VERSION: "$LATEST",
+		AWS_LAMBDA_LOG_GROUP_NAME: `/aws/lambda/${lambda.logicalId}`,
+		AWS_LAMBDA_LOG_STREAM_NAME: "local",
+		...envResult.resolved
+	};
+	let assumeSucceeded = false;
+	if (resolvedAssumeRoleArn) {
+		const stsRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
+		try {
+			const creds = await assumeLambdaExecutionRole(resolvedAssumeRoleArn, stsRegion, options.profile);
+			dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
+			dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
+			dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
+			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
+			assumeSucceeded = true;
+		} catch (err) {
+			const reason = err instanceof Error ? err.message : String(err);
+			logger.warn(`--assume-role: STS AssumeRole(${resolvedAssumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
+		}
+	}
+	if (!assumeSucceeded) {
+		forwardAwsEnv$2(dockerEnv);
+		applyProfileCredentialsOverlay(dockerEnv, profileCredentials, false);
+	}
+	if (!dockerEnv["AWS_REGION"] && !dockerEnv["AWS_DEFAULT_REGION"]) {
+		const fallbackRegion = resolveContainerFallbackRegion({
+			stackRegionOverride: options.region,
+			synthRegion: lambda.stack.region,
+			profileRegion: profileCredentials?.region
+		});
+		if (fallbackRegion) dockerEnv["AWS_REGION"] = fallbackRegion;
+	}
+	return {
+		env: dockerEnv,
+		sensitiveEnvKeys: stateAudit?.sensitiveKeys ?? [],
+		...stateForRoleHint !== void 0 && { stateForRoleHint },
+		assumeRoleApplied: assumeSucceeded
+	};
+}
 function materializeInlineCode$1(handler, source, fileExtension) {
 	const lastDot = handler.lastIndexOf(".");
 	if (lastDot <= 0) throw new Error(`Handler '${handler}' is malformed: expected '<modulePath>.<exportName>'.`);
@@ -24435,7 +24461,7 @@ function createFrontDoorLambdaRunner(lambda, opts) {
 		const port = await pickFreePort();
 		hostPort = port;
 		const name = `${getEmbedConfig().resourceNamePrefix}-alblambda-${lambda.logicalId}-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
-		const env = {
+		const env = opts.containerEnv ? { ...opts.containerEnv } : {
 			AWS_LAMBDA_FUNCTION_NAME: lambda.logicalId,
 			AWS_LAMBDA_FUNCTION_MEMORY_SIZE: String(lambda.memoryMb),
 			AWS_LAMBDA_FUNCTION_TIMEOUT: String(lambda.timeoutSec),
@@ -24449,6 +24475,7 @@ function createFrontDoorLambdaRunner(lambda, opts) {
 			image: plan.image,
 			mounts: plan.mounts,
 			env,
+			...opts.sensitiveEnvKeys && opts.sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys: opts.sensitiveEnvKeys },
 			cmd: plan.cmd,
 			hostPort: port,
 			host: opts.containerHost,
@@ -28959,10 +28986,14 @@ async function bootLambdaUrlOrigins(distribution, stacks, opts) {
 	for (const functionLogicalId of functionLogicalIds) {
 		let runner;
 		try {
-			runner = createFrontDoorLambdaRunner(resolveLambdaTarget(functionLogicalId, stacks), {
+			const lambda = resolveLambdaTarget(functionLogicalId, stacks);
+			const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials);
+			runner = createFrontDoorLambdaRunner(lambda, {
 				containerHost: opts.containerHost,
 				skipPull: opts.skipPull,
-				...opts.region !== void 0 && { region: opts.region }
+				...opts.envOptions.region !== void 0 && { region: opts.envOptions.region },
+				containerEnv: containerEnv.env,
+				...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
 			});
 			logger.info(`Booting Lambda Function URL origin container for ${functionLogicalId} (the backing Lambda runs locally via RIE)...`);
 			await runner.start();
@@ -29030,10 +29061,19 @@ async function localStartCloudFrontCommand(target, options) {
 	};
 	const initial = await synthAndResolve();
 	warnUnsupported(initial.distribution);
+	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
+	const envOptions = {
+		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
+		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
+		...options.region !== void 0 && { region: options.region },
+		...options.profile !== void 0 && { profile: options.profile },
+		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
+	};
 	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, {
 		containerHost: options.host,
 		skipPull: options.pull === false,
-		...options.region !== void 0 && { region: options.region }
+		envOptions,
+		...profileCredentials !== void 0 && { profileCredentials }
 	});
 	let tls;
 	if (tlsRequested) tls = await resolveFrontDoorTlsMaterials({
@@ -29121,7 +29161,7 @@ function createLocalStartCloudFrontCommand(opts = {}) {
 * `cmd`.
 */
 function addStartCloudFrontSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
+	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind a Lambda Function URL origin's backing Lambda to a deployed CloudFormation stack so its env vars resolve to the deployed physical IDs / exports (ListStackResources). Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs. No effect on a pure-S3 distribution.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's deployed execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
@@ -30236,11 +30276,12 @@ const STUDIO_SCRIPT = `
   // --image-override flag to start-service so the deployed-registry-pinned
   // image is rebuilt from local source. Default "(keep pinned image)" => no
   // override.
-  function buildImageOverridePicker() {
-    const sec = el('div', 'section options');
-    sec.appendChild(el('h3', null, 'Image override'));
+  // One labeled Dockerfile <select> row (the discovered Dockerfiles + a
+  // "(keep pinned image)" default). Shared by the ecs single picker and the
+  // alb per-backing-service pickers.
+  function buildImageOverrideRow(labelText) {
     const row = el('div', 'opt-row');
-    row.appendChild(el('span', 'opt-label', 'Local Dockerfile'));
+    row.appendChild(el('span', 'opt-label', labelText));
     const sel = el('select', 'image-override-select');
     const none = el('option', null, '(keep pinned image)');
     none.value = '';
@@ -30251,7 +30292,19 @@ const STUDIO_SCRIPT = `
       sel.appendChild(o);
     });
     row.appendChild(sel);
-    sec.appendChild(row);
+    return {
+      row: row,
+      getValue: function () {
+        return sel.value.trim();
+      },
+    };
+  }
+
+  function buildImageOverridePicker() {
+    const sec = el('div', 'section options');
+    sec.appendChild(el('h3', null, 'Image override'));
+    const r = buildImageOverrideRow('Local Dockerfile');
+    sec.appendChild(r.row);
     const hint = studioDockerfiles.length
       ? 'This image is pinned to a deployed registry — local edits do not take effect. Pick a Dockerfile to rebuild it locally.'
       : 'This image is pinned to a deployed registry, but no Dockerfile was found under the app directory.';
@@ -30259,12 +30312,41 @@ const STUDIO_SCRIPT = `
     return {
       node: sec,
       collect: function () {
-        const v = sel.value.trim();
+        const v = r.getValue();
         return v === '' ? undefined : v;
       },
     };
   }
 
+  // Per-backing-service image-override pickers for a pinned ALB (issue #382):
+  // one Dockerfile select per deployed-registry-pinned service the ALB fronts.
+  // collect() returns a { [serviceId]: dockerfile } map threaded as
+  // imageOverrides (one --image-override service=df per entry).
+  function buildAlbImageOverridePicker(services) {
+    const sec = el('div', 'section options');
+    sec.appendChild(el('h3', null, 'Image override (pinned backing services)'));
+    const rows = services.map(function (svc) {
+      const r = buildImageOverrideRow(svc.label);
+      sec.appendChild(r.row);
+      return { id: svc.id, getValue: r.getValue };
+    });
+    const hint = studioDockerfiles.length
+      ? 'These services behind the ALB are pinned to a deployed registry — local edits do not take effect. Pick a Dockerfile to rebuild one from local source.'
+      : 'These services behind the ALB are pinned to a deployed registry, but no Dockerfile was found under the app directory.';
+    sec.appendChild(el('div', 'opt-hint', hint));
+    return {
+      node: sec,
+      collect: function () {
+        const map = {};
+        rows.forEach(function (r) {
+          const v = r.getValue();
+          if (v !== '') map[r.id] = v;
+        });
+        return Object.keys(map).length ? map : undefined;
+      },
+    };
+  }
+
   // Toggle one target group's body open/closed (groups are collapsed by
   // default so a big Lambda list does not push the APIs below the fold).
   function toggleGroup(titleEl, bodyEl) {
@@ -30350,7 +30432,13 @@ const STUDIO_SCRIPT = `
             t.appendChild(btnSlot);
             t.onclick = () => selectTarget(entry.id, group.kind);
             targetEls.set(entry.id, t);
-            serveMeta.set(entry.id, { dot, btnSlot, kind: group.kind, pinned: entry.pinned === true });
+            serveMeta.set(entry.id, {
+              dot,
+              btnSlot,
+              kind: group.kind,
+              pinned: entry.pinned === true,
+              backingPinnedServices: entry.backingPinnedServices || [],
+            });
             updateServeRow(entry.id);
           }
           body.appendChild(t);
@@ -30487,6 +30575,14 @@ const STUDIO_SCRIPT = `
     if (applied && applied.imageOverride) {
       lines.push('--image-override ' + applied.imageOverride);
     }
+    // An alb serve threads a per-backing-service imageOverrides map (issue
+    // #382); surface one --image-override line each so the picks do not
+    // silently vanish from the running view (the issue #356 contract).
+    if (applied && applied.imageOverrides) {
+      Object.keys(applied.imageOverrides).forEach(function (svc) {
+        lines.push('--image-override ' + svc + '=' + applied.imageOverrides[svc]);
+      });
+    }
     if (applied && applied.rawArgs) {
       const raw = String(applied.rawArgs).trim();
       if (raw !== '') lines.push(raw);
@@ -30494,7 +30590,7 @@ const STUDIO_SCRIPT = `
     return lines;
   }
 
-  async function startServe(id, options, rawArgs, imageOverride) {
+  async function startServe(id, options, rawArgs, imageOverride, imageOverrides) {
     // The serve kind (api / alb / ecs) drives which headless command the
     // server spawns; it is recorded on the row when the target list loads.
     const meta = serveMeta.get(id);
@@ -30502,7 +30598,12 @@ const STUDIO_SCRIPT = `
     // Remember what this serve was Started with so the running workspace can
     // show a read-only "Started with" summary (issue #356) — the per-run
     // option inputs are gone once the composer is replaced by the running view.
-    serveApplied.set(id, { options: options, rawArgs: rawArgs, imageOverride: imageOverride });
+    serveApplied.set(id, {
+      options: options,
+      rawArgs: rawArgs,
+      imageOverride: imageOverride,
+      imageOverrides: imageOverrides,
+    });
     serveState.set(id, { status: 'starting', endpoints: [] });
     updateServeRow(id);
     try {
@@ -30510,6 +30611,7 @@ const STUDIO_SCRIPT = `
       if (options) body.options = options;
       if (rawArgs) body.rawArgs = rawArgs;
       if (imageOverride) body.imageOverride = imageOverride;
+      if (imageOverrides) body.imageOverrides = imageOverrides;
       const res = await fetch('/api/run', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
@@ -30585,6 +30687,7 @@ const STUDIO_SCRIPT = `
     let collectOpts = function () { return undefined; };
     let collectRaw = function () { return undefined; };
     let collectImageOverride = function () { return undefined; };
+    let collectImageOverrides = function () { return undefined; };
     btn.onclick = () => {
       if (running || starting) {
         stopServe(id);
@@ -30595,7 +30698,7 @@ const STUDIO_SCRIPT = `
         serveState.set(id, { status: 'stopped', endpoints: [] });
         renderServeWorkspace(id);
       } else {
-        startServe(id, collectOpts(), collectRaw(), collectImageOverride());
+        startServe(id, collectOpts(), collectRaw(), collectImageOverride(), collectImageOverrides());
       }
     };
     head.appendChild(btn);
@@ -30615,6 +30718,15 @@ const STUDIO_SCRIPT = `
         ws.appendChild(io.node);
         collectImageOverride = io.collect;
       }
+      // An ALB boots its backing ECS services (issue #382); a pinned backing
+      // service has the same "local edits do not take effect" problem, so offer
+      // a per-service Dockerfile picker that threads
+      // --image-override service=dockerfile to start-alb.
+      if (meta && meta.kind === 'alb' && meta.backingPinnedServices && meta.backingPinnedServices.length) {
+        const io = buildAlbImageOverridePicker(meta.backingPinnedServices);
+        ws.appendChild(io.node);
+        collectImageOverrides = io.collect;
+      }
       const opt = buildOptions(kind);
       if (opt.node) ws.appendChild(opt.node);
       collectOpts = opt.collect;
@@ -31798,6 +31910,34 @@ function annotatePinnedEcsTargets(groups, classify) {
 	}
 	return anyPinned;
 }
+/**
+* Annotate each `alb` entry of `groups` with the deployed-registry-pinned ECS
+* services that ALB fronts (issue #382), so the alb composer can offer a
+* per-service image-override Dockerfile picker. `resolveBackingPinned` maps one
+* ALB entry to its pinned backing services (`{ id, label }`, where `id` is the
+* `--image-override` key — `start-alb`'s `Stack:LogicalId` service-boot
+* target); the caller supplies it (studio's boot resolves the ALB via
+* `resolveAlbFrontDoor` and intersects the backing services with the already-
+* classified pinned `ecs` set). Mutates the entries in place and returns whether
+* ANY ALB fronts a pinned service, so the caller can include the Dockerfile
+* scan even when no standalone `ecs` service was pinned. Non-alb groups are
+* left untouched. Exported so a host CLI can reuse it + so the boot logic is
+* unit-testable without a real synth.
+*/
+function annotateAlbPinnedBackingServices(groups, resolveBackingPinned) {
+	let any = false;
+	for (const group of groups) {
+		if (group.kind !== "alb") continue;
+		for (const entry of group.entries) {
+			const pinned = resolveBackingPinned(entry);
+			if (pinned.length > 0) {
+				entry.backingPinnedServices = pinned;
+				any = true;
+			}
+		}
+	}
+	return any;
+}
 /** Compile a `*` / `?` glob to an anchored RegExp matched against a target id. */
 function globToRegExp(glob) {
 	const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
@@ -32911,6 +33051,7 @@ function createStudioServeManager(config) {
 			...buildPerRunArgs(req.kind, req.options),
 			...envFile ? ["--env-vars", envFile] : [],
 			...req.imageOverride && req.imageOverride.trim() !== "" ? ["--image-override", req.targetId + "=" + req.imageOverride.trim()] : [],
+			...Object.entries(req.imageOverrides ?? {}).flatMap(([svc, df]) => df && df.trim() !== "" ? ["--image-override", svc + "=" + df.trim()] : []),
 			...config.watch === true ? ["--watch"] : [],
 			...tokenizeRawArgs(req.rawArgs)
 		];
@@ -33156,7 +33297,7 @@ const STUDIO_TARGET_KINDS = [
 */
 function coerceRunRequest(body) {
 	if (typeof body !== "object" || body === null) throw new Error("Request body must be a JSON object.");
-	const { targetId, kind, event, options, rawArgs, imageOverride } = body;
+	const { targetId, kind, event, options, rawArgs, imageOverride, imageOverrides } = body;
 	if (typeof targetId !== "string" || targetId.trim() === "") throw new Error("Request body must include a non-empty \"targetId\" string.");
 	if (typeof kind !== "string" || !STUDIO_TARGET_KINDS.includes(kind)) throw new Error(`Request body "kind" must be one of: ${STUDIO_TARGET_KINDS.join(", ")}.`);
 	let runOptions;
@@ -33177,13 +33318,24 @@ function coerceRunRequest(body) {
 		if (typeof imageOverride !== "string") throw new Error("Request body \"imageOverride\" must be a string.");
 		if (imageOverride.trim() !== "") runImageOverride = imageOverride;
 	}
+	let runImageOverrides;
+	if (imageOverrides !== void 0) {
+		if (typeof imageOverrides !== "object" || imageOverrides === null || Array.isArray(imageOverrides)) throw new Error("Request body \"imageOverrides\" must be a JSON object keyed by service id.");
+		const collected = {};
+		for (const [svc, df] of Object.entries(imageOverrides)) {
+			if (typeof df !== "string") throw new Error(`Request body "imageOverrides.${svc}" must be a string.`);
+			if (df.trim() !== "") collected[svc] = df.trim();
+		}
+		if (Object.keys(collected).length > 0) runImageOverrides = collected;
+	}
 	return {
 		targetId,
 		kind,
 		event,
 		...runOptions !== void 0 ? { options: runOptions } : {},
 		...runRawArgs !== void 0 ? { rawArgs: runRawArgs } : {},
-		...runImageOverride !== void 0 ? { imageOverride: runImageOverride } : {}
+		...runImageOverride !== void 0 ? { imageOverride: runImageOverride } : {},
+		...runImageOverrides !== void 0 ? { imageOverrides: runImageOverrides } : {}
 	};
 }
 /**
@@ -33463,6 +33615,48 @@ function makePinClassifier(args) {
 		}
 	};
 }
+/**
+* Build the boot-time resolver `annotateAlbPinnedBackingServices` calls per
+* `alb` entry (issue #382). It resolves the ALB to its backing ECS services
+* (`resolveAlbFrontDoor`, template-only) and returns the subset that is in
+* `pinnedEcsByQualifiedId` — the `ecs` services already classified as a
+* deployed-registry pin by {@link makePinClassifier}. Each returned `id` is the
+* service's `Stack:LogicalId` (the `--image-override` key `start-alb` matches
+* against its own service-boot target); `label` is the pinned service's display
+* id. An ALB that cannot be resolved is WARN-logged + contributes no pickers
+* (the start-alb run still works; only the picker is absent). Exported for
+* testing.
+*/
+function makeAlbBackingPinnedResolver(args) {
+	const { stacks, pinnedEcsByQualifiedId, logger } = args;
+	return (albEntry) => {
+		if (pinnedEcsByQualifiedId.size === 0) return [];
+		try {
+			const { stack, albLogicalId } = resolveAlbTarget(albEntry.id, stacks);
+			const resolution = resolveAlbFrontDoor(stack, albLogicalId);
+			const serviceQualifiedIds = /* @__PURE__ */ new Set();
+			for (const listener of resolution.listeners) {
+				const actions = [...listener.defaultAction ? [listener.defaultAction] : [], ...listener.rules.map((r) => r.action)];
+				for (const action of actions) {
+					if (action.kind !== "forward") continue;
+					for (const t of action.targets) if (t.kind === "ecs") serviceQualifiedIds.add(`${stack.stackName}:${t.serviceLogicalId}`);
+				}
+			}
+			const out = [];
+			for (const qid of serviceQualifiedIds) {
+				const label = pinnedEcsByQualifiedId.get(qid);
+				if (label !== void 0) out.push({
+					id: qid,
+					label
+				});
+			}
+			return out;
+		} catch (err) {
+			logger.warn(`studio: could not resolve ALB '${albEntry.id}' backing services for the image-override picker; the alb composer will not offer one. ${err instanceof Error ? err.message : String(err)}`);
+			return [];
+		}
+	};
+}
 async function localStudioCommand(options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
@@ -33499,7 +33693,7 @@ async function localStudioCommand(options) {
 	}
 	const appLabel = stacks.map((s) => s.stackName).join(", ") || appCmd;
 	const servableEcs = new Set(targetGroups.filter((g) => g.kind === "ecs").flatMap((g) => g.entries.filter((e) => e.servable).map((e) => e.id)));
-	const dockerfiles = annotatePinnedEcsTargets(targetGroups, makePinClassifier({
+	const anyPinned = annotatePinnedEcsTargets(targetGroups, makePinClassifier({
 		stacks,
 		contextByStack: await prepareEcsImageContexts({
 			serviceIds: [...servableEcs],
@@ -33508,7 +33702,18 @@ async function localStudioCommand(options) {
 			logger
 		}),
 		logger
-	})) ? discoverDockerfiles(process.cwd()) : [];
+	}));
+	const pinnedEcsByQualifiedId = /* @__PURE__ */ new Map();
+	for (const g of targetGroups) {
+		if (g.kind !== "ecs") continue;
+		for (const e of g.entries) if (e.pinned) pinnedEcsByQualifiedId.set(e.qualifiedId, e.id);
+	}
+	const anyAlbBackingPinned = annotateAlbPinnedBackingServices(targetGroups, makeAlbBackingPinnedResolver({
+		stacks,
+		pinnedEcsByQualifiedId,
+		logger
+	}));
+	const dockerfiles = anyPinned || anyAlbBackingPinned ? discoverDockerfiles(process.cwd()) : [];
 	const bus = new StudioEventBus();
 	const childConfig = {
 		cliEntry: process.argv[1] ?? "",
@@ -33690,5 +33895,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { MAX_TASKS_SUBNET_RANGE_CAP as $, buildMessageEvent as $n, createLocalStartApiCommand as $t, startCloudFrontServer as A, buildCorsConfigByApiId as An, discoverRoutes as Ar, A2A_CONTAINER_PORT as At, runViewerResponse as B, pickResponseTemplate as Bn, resolveAgentCoreTarget as Br, AGENTCORE_SESSION_ID_HEADER as Bt, formatTargetListing as C, buildMethodArn as Cn, listTargets as Cr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Ct, parseOriginOverrides as D, invokeTokenAuthorizer as Dn, filterWebSocketApisByIdentifiers as Dr, addInvokeAgentCoreSpecificOptions as Dt, createLocalStartCloudFrontCommand as E, invokeRequestAuthorizer as En, discoverWebSocketApisOrThrow as Er, attachContainerLogStreamer as Et, pickFunctionUrlLogicalIdFromOrigin as F, translateLambdaResponse as Fn, AGENTCORE_HTTP_PROTOCOL as Fr, MCP_PROTOCOL_VERSION as Ft, resolveAlbTarget as G, probeHostGatewaySupport as Gn, LocalInvokeBuildError as Gr, buildAgentCoreCodeImage as Gt, albStrategy as H, tryParseStatus as Hn, formatStateRemedy as Hr, waitForAgentCorePing as Ht, pickTargetFunctionLogicalId as I, applyAuthorizerOverlay as In, AGENTCORE_MCP_PROTOCOL as Ir, mcpInvokeOnce as It, addStartServiceSpecificOptions as J, buildMgmtEndpointEnvUrl as Jn, toCmdArgv as Jt, isApplicationLoadBalancer as K, bufferToBody as Kn, buildStsClientConfig as Kr, computeCodeImageTag as Kt, resolveCloudFrontDistribution as L, buildHttpApiV2Event as Ln, AGENTCORE_RUNTIME_TYPE as Lr, parseSseForJsonRpc as Lt, serveLambdaUrlOrigin as M, isFunctionUrlOacFronted as Mn, resolveLambdaArnIntrinsic as Mr, a2aInvokeOnce as Mt, CLOUDFRONT_DISTRIBUTION_TYPE as N, matchPreflight as Nn, AGENTCORE_A2A_PROTOCOL as Nr, MCP_CONTAINER_PORT as Nt, resolveCloudFrontTarget as O, attachAuthorizers as On, parseSelectionExpressionPath as Or, createLocalInvokeAgentCoreCommand as Ot, isCloudFrontDistribution as P, matchRoute as Pn, AGENTCORE_AGUI_PROTOCOL as Pr, MCP_PATH as Pt, createLocalRunTaskCommand as Q, buildDisconnectEvent as Qn, addStartApiSpecificOptions as Qt, compileCloudFrontFunction as R, buildRestV1Event as Rn, AgentCoreResolutionError as Rr, AGENTCORE_SIGV4_SERVICE as Rt, createLocalListCommand as S, verifyJwtViaDiscovery as Sn, countTargets as Sr, DEFAULT_SHADOW_READY_TIMEOUT_MS as St, addStartCloudFrontSpecificOptions as T, evaluateCachedLambdaPolicy as Tn, discoverWebSocketApis as Tr, getContainerNetworkIp as Tt, createLocalStartAlbCommand as U, VtlEvaluationError as Un, substituteImagePlaceholders as Ur, downloadAndExtractS3Bundle as Ut, addAlbSpecificOptions as V, selectIntegrationResponse as Vn, derivePseudoParametersFromRegion as Vr, invokeAgentCore as Vt, parseLbPortOverrides as W, HOST_GATEWAY_MIN_VERSION as Wn, tryResolveImageFnJoin as Wr, SUPPORTED_CODE_RUNTIMES as Wt, serviceStrategy as X, parseConnectionsPath as Xn, addInvokeSpecificOptions as Xt, createLocalStartServiceCommand as Y, handleConnectionsRequest as Yn, classifySourceChange as Yt, addRunTaskSpecificOptions as Z, buildConnectEvent as Zn, createLocalInvokeCommand as Zt, toStudioTargetGroups as _, buildCognitoJwksUrl as _n, CfnLocalStateProvider as _r, describePinnedImageUri as _t, createLocalStudioCommand as a, buildStageMap as an, EcsTaskResolutionError as ar, parseMaxTasks as at, StudioEventBus as b, verifyCognitoJwt as bn, resolveWatchConfig as br, buildCloudMapIndex as bt, startStudioProxy as c, availableApiIdentifiers as cn, substituteEnvVarsFromState as cr, resolveSharedSidecarCredentials as ct, createStudioDispatcher as d, groupRoutesByServer as dn, createLocalStateProvider as dr, buildImageOverrideTag as dt, createWatchPredicates as en, architectureToPlatform as er, addCommonEcsServiceOptions as et, filterStudioCustomResources as f, readMtlsMaterialsFromDisk as fn, isCfnFlagPresent as fr, enforceImageOverrideOrphans as ft, startStudioServer as g, defaultCredentialsLoader as gn, resolveCfnStackName as gr, runImageOverrideBuilds as gt, filterStudioTargetGroups as h, resolveServiceIntegrationParameters as hn, resolveCfnRegion as hr, resolveImageOverrides as ht, coerceStopRequest as i, attachStageContext as in, resolveRuntimeImage as ir, ecsClusterOption as it, serveFromStaticOrigin as j, buildCorsConfigFromCloudFrontChain as jn, pickRefLogicalId as jr, A2A_PATH as jt, matchBehavior as k, applyCorsResponseHeaders as kn, webSocketApiMatchesIdentifier as kr, invokeAgentCoreWs as kt, relayServeRequest as l, filterRoutesByApiIdentifier as ln, substituteEnvVarsFromStateAsync as lr, runEcsServiceEmulator as lt, annotatePinnedEcsTargets as m, resolveSelectionExpression as mn, resolveCfnFallbackRegion as mr, parseImageOverrideFlags as mt, coerceRunRequest as n, createAuthorizerCache as nn, resolveRuntimeCodeMountPath as nr, addImageOverrideOptions as nt, resolveServeBaseUrl as o, materializeLayerFromArn as on, substituteAgainstState as or, parseRestartPolicy as ot, isCustomResourceLambdaTarget as p, startApiServer as pn, rejectExplicitCfnStackWithMultipleStacks as pr, mergeForService as pt, resolveAlbFrontDoor as q, ConnectionRegistry as qn, resolveProfileCredentials as qr, renderCodeDockerfile as qt, coerceServeRequest as r, createFileWatcher as rn, resolveRuntimeFileExtension as rr, buildEcsImageResolutionContext$1 as rt, createStudioServeManager as s, resolveEnvVars$1 as sn, substituteAgainstStateAsync as sr, resolveEcsAssumeRoleOption as st, addStudioSpecificOptions as t, resolveApiTargetSubset as tn, buildContainerImage as tr, addEcsAssumeRoleOptions as tt, reinvoke as u, filterRoutesByApiIdentifiers as un, LocalStateSourceError as ur, ImageOverrideError as ut, renderStudioHtml as v, buildJwksUrlFromIssuer as vn, collectSsmParameterRefs as vr, isLocalCdkAssetImage as vt, LocalStartCloudFrontError as w, computeRequestIdentityHash as wn, availableWebSocketApiIdentifiers as wr, setShadowReadyTimeoutMs as wt, addListSpecificOptions as x, verifyJwtAuthorizer as xn, resolveSingleTarget as xr, CloudMapRegistry as xt, createStudioStore as y, createJwksCache as yn, resolveSsmParameters as yr, listPinnedTargets as yt, runViewerRequest as z, evaluateResponseParameters as zn, pickAgentCoreCandidateStack as zr, signAgentCoreInvocation as zt };
-//# sourceMappingURL=local-studio-BWrmJblg.js.map
+export { createLocalRunTaskCommand as $, buildDisconnectEvent as $n, addStartApiSpecificOptions as $t, matchBehavior as A, applyCorsResponseHeaders as An, webSocketApiMatchesIdentifier as Ar, invokeAgentCoreWs as At, runViewerRequest as B, evaluateResponseParameters as Bn, pickAgentCoreCandidateStack as Br, signAgentCoreInvocation as Bt, createLocalListCommand as C, verifyJwtViaDiscovery as Cn, countTargets as Cr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Ct, createLocalStartCloudFrontCommand as D, invokeRequestAuthorizer as Dn, discoverWebSocketApisOrThrow as Dr, attachContainerLogStreamer as Dt, addStartCloudFrontSpecificOptions as E, evaluateCachedLambdaPolicy as En, discoverWebSocketApis as Er, getContainerNetworkIp as Et, isCloudFrontDistribution as F, matchRoute as Fn, AGENTCORE_AGUI_PROTOCOL as Fr, MCP_PATH as Ft, parseLbPortOverrides as G, HOST_GATEWAY_MIN_VERSION as Gn, tryResolveImageFnJoin as Gr, SUPPORTED_CODE_RUNTIMES as Gt, addAlbSpecificOptions as H, selectIntegrationResponse as Hn, derivePseudoParametersFromRegion as Hr, invokeAgentCore as Ht, pickFunctionUrlLogicalIdFromOrigin as I, translateLambdaResponse as In, AGENTCORE_HTTP_PROTOCOL as Ir, MCP_PROTOCOL_VERSION as It, resolveAlbFrontDoor as J, ConnectionRegistry as Jn, resolveProfileCredentials as Jr, renderCodeDockerfile as Jt, resolveAlbTarget as K, probeHostGatewaySupport as Kn, LocalInvokeBuildError as Kr, buildAgentCoreCodeImage as Kt, pickTargetFunctionLogicalId as L, applyAuthorizerOverlay as Ln, AGENTCORE_MCP_PROTOCOL as Lr, mcpInvokeOnce as Lt, serveFromStaticOrigin as M, buildCorsConfigFromCloudFrontChain as Mn, pickRefLogicalId as Mr, A2A_PATH as Mt, serveLambdaUrlOrigin as N, isFunctionUrlOacFronted as Nn, resolveLambdaArnIntrinsic as Nr, a2aInvokeOnce as Nt, parseOriginOverrides as O, invokeTokenAuthorizer as On, filterWebSocketApisByIdentifiers as Or, addInvokeAgentCoreSpecificOptions as Ot, CLOUDFRONT_DISTRIBUTION_TYPE as P, matchPreflight as Pn, AGENTCORE_A2A_PROTOCOL as Pr, MCP_CONTAINER_PORT as Pt, addRunTaskSpecificOptions as Q, buildConnectEvent as Qn, createLocalInvokeCommand as Qt, resolveCloudFrontDistribution as R, buildHttpApiV2Event as Rn, AGENTCORE_RUNTIME_TYPE as Rr, parseSseForJsonRpc as Rt, addListSpecificOptions as S, verifyJwtAuthorizer as Sn, resolveSingleTarget as Sr, CloudMapRegistry as St, LocalStartCloudFrontError as T, computeRequestIdentityHash as Tn, availableWebSocketApiIdentifiers as Tr, setShadowReadyTimeoutMs as Tt, albStrategy as U, tryParseStatus as Un, formatStateRemedy as Ur, waitForAgentCorePing as Ut, runViewerResponse as V, pickResponseTemplate as Vn, resolveAgentCoreTarget as Vr, AGENTCORE_SESSION_ID_HEADER as Vt, createLocalStartAlbCommand as W, VtlEvaluationError as Wn, substituteImagePlaceholders as Wr, downloadAndExtractS3Bundle as Wt, createLocalStartServiceCommand as X, handleConnectionsRequest as Xn, classifySourceChange as Xt, addStartServiceSpecificOptions as Y, buildMgmtEndpointEnvUrl as Yn, toCmdArgv as Yt, serviceStrategy as Z, parseConnectionsPath as Zn, addInvokeSpecificOptions as Zt, startStudioServer as _, defaultCredentialsLoader as _n, resolveCfnStackName as _r, runImageOverrideBuilds as _t, createLocalStudioCommand as a, attachStageContext as an, resolveRuntimeImage as ar, ecsClusterOption as at, createStudioStore as b, createJwksCache as bn, resolveSsmParameters as br, listPinnedTargets as bt, startStudioProxy as c, resolveEnvVars$1 as cn, substituteAgainstStateAsync as cr, resolveEcsAssumeRoleOption as ct, createStudioDispatcher as d, filterRoutesByApiIdentifiers as dn, LocalStateSourceError as dr, ImageOverrideError as dt, createLocalStartApiCommand as en, buildMessageEvent as er, MAX_TASKS_SUBNET_RANGE_CAP as et, filterStudioCustomResources as f, groupRoutesByServer as fn, createLocalStateProvider as fr, buildImageOverrideTag as ft, filterStudioTargetGroups as g, resolveServiceIntegrationParameters as gn, resolveCfnRegion as gr, resolveImageOverrides as gt, annotatePinnedEcsTargets as h, resolveSelectionExpression as hn, resolveCfnFallbackRegion as hr, parseImageOverrideFlags as ht, coerceStopRequest as i, createFileWatcher as in, resolveRuntimeFileExtension as ir, buildEcsImageResolutionContext$1 as it, startCloudFrontServer as j, buildCorsConfigByApiId as jn, discoverRoutes as jr, A2A_CONTAINER_PORT as jt, resolveCloudFrontTarget as k, attachAuthorizers as kn, parseSelectionExpressionPath as kr, createLocalInvokeAgentCoreCommand as kt, relayServeRequest as l, availableApiIdentifiers as ln, substituteEnvVarsFromState as lr, resolveSharedSidecarCredentials as lt, annotateAlbPinnedBackingServices as m, startApiServer as mn, rejectExplicitCfnStackWithMultipleStacks as mr, mergeForService as mt, coerceRunRequest as n, resolveApiTargetSubset as nn, buildContainerImage as nr, addEcsAssumeRoleOptions as nt, resolveServeBaseUrl as o, buildStageMap as on, EcsTaskResolutionError as or, parseMaxTasks as ot, isCustomResourceLambdaTarget as p, readMtlsMaterialsFromDisk as pn, isCfnFlagPresent as pr, enforceImageOverrideOrphans as pt, isApplicationLoadBalancer as q, bufferToBody as qn, buildStsClientConfig as qr, computeCodeImageTag as qt, coerceServeRequest as r, createAuthorizerCache as rn, resolveRuntimeCodeMountPath as rr, addImageOverrideOptions as rt, createStudioServeManager as s, materializeLayerFromArn as sn, substituteAgainstState as sr, parseRestartPolicy as st, addStudioSpecificOptions as t, createWatchPredicates as tn, architectureToPlatform as tr, addCommonEcsServiceOptions as tt, reinvoke as u, filterRoutesByApiIdentifier as un, substituteEnvVarsFromStateAsync as ur, runEcsServiceEmulator as ut, toStudioTargetGroups as v, buildCognitoJwksUrl as vn, CfnLocalStateProvider as vr, describePinnedImageUri as vt, formatTargetListing as w, buildMethodArn as wn, listTargets as wr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as wt, StudioEventBus as x, verifyCognitoJwt as xn, resolveWatchConfig as xr, buildCloudMapIndex as xt, renderStudioHtml as y, buildJwksUrlFromIssuer as yn, collectSsmParameterRefs as yr, isLocalCdkAssetImage as yt, compileCloudFrontFunction as z, buildRestV1Event as zn, AgentCoreResolutionError as zr, AGENTCORE_SIGV4_SERVICE as zt };
+//# sourceMappingURL=local-studio-CxVVLdJw.js.map