cdk-local 0.108.0 → 0.110.0

package/dist/{local-studio-DWur2ccn.js → local-studio-8hdH7a_R.js}

@@ -11359,6 +11359,34 @@ function buildCorsConfigFromCloudFrontChain(template) {
 	return out;
 }
 /**
+* Resolve one cache behavior's `ResponseHeadersPolicyId` to its CORS config.
+*
+* `start-cloudfront` (cloudfront-resolver) calls this per behavior so the
+* local CloudFront server reproduces the distribution's
+* `AWS::CloudFront::ResponseHeadersPolicy` CORS — answering an OPTIONS
+* preflight and adding `Access-Control-Allow-Origin` to actual responses, the
+* same way CloudFront does at the edge. (The `start-api` path uses
+* {@link buildCorsConfigFromCloudFrontChain}, which is keyed by the fronted
+* Function URL logical id; this is the direct per-behavior form, so a
+* distribution's `CacheBehaviors[]` can each carry their own policy.)
+*
+* Returns undefined unless the value is a `{ Ref: <logicalId> }` to a local
+* `AWS::CloudFront::ResponseHeadersPolicy` whose `CorsConfig` has at least one
+* value-bearing field (an AWS-managed-policy id literal, or a policy with only
+* `SecurityHeadersConfig` / `CustomHeadersConfig`, yields undefined).
+*/
+function resolveResponseHeadersPolicyCors(template, responseHeadersPolicyId) {
+	const rhpId = pickRhpRefLogicalId(responseHeadersPolicyId);
+	if (!rhpId) return void 0;
+	const rhpResource = (template.Resources ?? {})[rhpId];
+	if (!rhpResource || rhpResource.Type !== "AWS::CloudFront::ResponseHeadersPolicy") return;
+	const rhpConfig = (rhpResource.Properties ?? {})["ResponseHeadersPolicyConfig"];
+	if (!rhpConfig || typeof rhpConfig !== "object") return void 0;
+	const corsConfig = rhpConfig["CorsConfig"];
+	if (!corsConfig || typeof corsConfig !== "object" || Array.isArray(corsConfig)) return void 0;
+	return parseCloudFrontCorsConfig(corsConfig);
+}
+/**
 * Determine whether a Function URL (`AWS::Lambda::Url`, identified by its
 * logical id) is fronted by a CloudFront Distribution origin that uses
 * Origin Access Control (OAC) to SIGN origin requests.
@@ -11449,6 +11477,10 @@ function pickFnUrlLogicalIdFromOriginDomainName(value) {
 * ID. CDK 2.x synthesizes this as `{ Ref: <id> }`. Returns undefined
 * for the AWS-managed-policy ID form (literal UUID string) since
 * cdk-local can't fetch those — and for any non-Ref shape.
+*
+* Exported so `start-cloudfront`'s per-behavior resolver
+* (cloudfront-resolver) can resolve a behavior's `ResponseHeadersPolicyId`
+* to its CORS config via {@link resolveResponseHeadersPolicyCors}.
 */
 function pickRhpRefLogicalId(value) {
 	if (!value || typeof value !== "object") return void 0;
@@ -11463,6 +11495,10 @@ function pickRhpRefLogicalId(value) {
 * see `buildCorsConfigFromCloudFrontChain` JSDoc for the field mapping.
 *
 * Returns undefined when every value-bearing field is missing.
+*
+* Exported so `start-cloudfront`'s per-behavior resolver
+* (cloudfront-resolver) can parse a `ResponseHeadersPolicy`'s CORS block;
+* see {@link resolveResponseHeadersPolicyCors}.
 */
 function parseCloudFrontCorsConfig(raw) {
 	const allowOrigins = pickItemsStringArray(raw["AccessControlAllowOrigins"]);
@@ -11568,6 +11604,22 @@ function applyCorsResponseHeaders(res, apiLogicalId, corsConfigByApiId, requestO
 	if (!apiLogicalId) return;
 	const cors = corsConfigByApiId.get(apiLogicalId);
 	if (!cors) return;
+	applyCorsResponseHeadersFromConfig(res, cors, requestOrigin);
+}
+/**
+* Apply actual-response CORS headers from an already-resolved
+* {@link CorsConfig} (no map lookup). The map-keyed
+* {@link applyCorsResponseHeaders} delegates here so the two share one
+* implementation; `start-cloudfront`'s server (cloudfront-server) calls this
+* form directly with the matched behavior's
+* `AWS::CloudFront::ResponseHeadersPolicy` CORS config.
+*
+* No-op when the request has no `Origin` header or the Origin is not in
+* `AllowOrigins` (the browser would block the response anyway; we don't
+* smuggle an unauthorized origin through). See {@link applyCorsResponseHeaders}
+* for the header set + `Vary: Origin` / credentials rationale.
+*/
+function applyCorsResponseHeadersFromConfig(res, cors, requestOrigin) {
 	if (!requestOrigin) return;
 	const originMatch = matchOrigin(requestOrigin, cors.AllowOrigins);
 	if (!originMatch) return;
@@ -11575,8 +11627,9 @@ function applyCorsResponseHeaders(res, apiLogicalId, corsConfigByApiId, requestO
 	res.setHeader("Access-Control-Allow-Origin", allowOrigin);
 	if (allowOrigin !== "*") {
 		const existing = res.getHeader("Vary");
-		if (typeof existing === "string" && existing.length > 0) {
-			if (!existing.split(",").map((t) => t.trim()).some((t) => t.toLowerCase() === "origin")) res.setHeader("Vary", `${existing}, Origin`);
+		const existingStr = Array.isArray(existing) ? existing.join(", ") : typeof existing === "string" ? existing : "";
+		if (existingStr.length > 0) {
+			if (!existingStr.split(",").map((t) => t.trim()).some((t) => t.toLowerCase() === "origin")) res.setHeader("Vary", `${existingStr}, Origin`);
 		} else res.setHeader("Vary", "Origin");
 	}
 	if (cors.AllowCredentials === true) res.setHeader("Access-Control-Allow-Credentials", "true");
@@ -28212,7 +28265,7 @@ function resolveCloudFrontDistribution(args) {
 	const distConfig = (resource.Properties ?? {})["DistributionConfig"];
 	if (!distConfig || typeof distConfig !== "object") throw new Error(`Distribution '${logicalId}' has no DistributionConfig.`);
 	const dc = distConfig;
-	const behaviors = resolveBehaviors(dc, compileDistributionFunctions(template), logicalId);
+	const behaviors = resolveBehaviors(dc, compileDistributionFunctions(template), logicalId, template);
 	const origins = resolveOrigins(dc, template, stack, args.originOverrides ?? /* @__PURE__ */ new Map());
 	const customErrorResponses = resolveCustomErrorResponses(dc);
 	const result = {
@@ -28242,10 +28295,10 @@ function compileDistributionFunctions(template) {
 	}
 	return out;
 }
-function resolveBehaviors(dc, functions, distLogicalId) {
+function resolveBehaviors(dc, functions, distLogicalId, template) {
 	const behaviors = [];
 	const def = dc["DefaultCacheBehavior"];
-	if (def && typeof def === "object") behaviors.push(resolveBehavior(def, void 0, functions, distLogicalId));
+	if (def && typeof def === "object") behaviors.push(resolveBehavior(def, void 0, functions, distLogicalId, template));
 	const extra = Array.isArray(dc["CacheBehaviors"]) ? dc["CacheBehaviors"] : [];
 	for (const b of extra) {
 		if (!b || typeof b !== "object") continue;
@@ -28254,16 +28307,18 @@ function resolveBehaviors(dc, functions, distLogicalId) {
 			getLogger().warn(`Distribution '${distLogicalId}': a cache behavior has no literal PathPattern; cdk-local cannot route it and is skipping it.`);
 			continue;
 		}
-		behaviors.push(resolveBehavior(behavior, behavior["PathPattern"], functions, distLogicalId));
+		behaviors.push(resolveBehavior(behavior, behavior["PathPattern"], functions, distLogicalId, template));
 	}
 	return behaviors;
 }
-function resolveBehavior(behavior, pathPattern, functions, distLogicalId) {
+function resolveBehavior(behavior, pathPattern, functions, distLogicalId, template) {
 	const resolved = {
 		targetOriginId: typeof behavior["TargetOriginId"] === "string" ? behavior["TargetOriginId"] : "",
 		hasLambdaEdge: Array.isArray(behavior["LambdaFunctionAssociations"]) ? behavior["LambdaFunctionAssociations"].length > 0 : false
 	};
 	if (pathPattern !== void 0) resolved.pathPattern = pathPattern;
+	const cors = resolveResponseHeadersPolicyCors(template, behavior["ResponseHeadersPolicyId"]);
+	if (cors) resolved.cors = cors;
 	if (typeof behavior["ViewerProtocolPolicy"] === "string") resolved.viewerProtocolPolicy = behavior["ViewerProtocolPolicy"];
 	const assocs = Array.isArray(behavior["FunctionAssociations"]) ? behavior["FunctionAssociations"] : [];
 	for (const a of assocs) {
@@ -28718,6 +28773,18 @@ async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 		writePlain(res, 404, "No cache behavior matched.\n");
 		return;
 	}
+	if (behavior.cors) {
+		const preflight = matchPreflight({
+			method: req.method ?? "GET",
+			headers: nodeHeadersToRecord(req.headers)
+		}, behavior.cors);
+		if (preflight) {
+			res.statusCode = preflight.statusCode;
+			setHeadersSafely(res, preflight.headers, logger);
+			res.end();
+			return;
+		}
+	}
 	let requestEvent = buildViewerRequestEvent({
 		method: req.method ?? "GET",
 		uri,
@@ -28777,8 +28844,24 @@ async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 	} catch (err) {
 		logger.warn(`Skipping invalid Set-Cookie header(s): ${err instanceof Error ? err.message : String(err)}`);
 	}
+	if (behavior.cors) {
+		const origin = req.headers.origin;
+		applyCorsResponseHeadersFromConfig(res, behavior.cors, typeof origin === "string" ? origin : void 0);
+	}
 	res.end(originResult.body);
 }
+/**
+* Convert Node's `IncomingMessage.headers` (`Record<string, string | string[]>`)
+* to the lowercased `Record<string, string[]>` shape `matchPreflight` expects.
+*/
+function nodeHeadersToRecord(headers) {
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) {
+		if (value === void 0) continue;
+		out[name.toLowerCase()] = Array.isArray(value) ? value : [value];
+	}
+	return out;
+}
 /** Read the full request body into a Buffer. */
 function readRequestBody(req) {
 	return new Promise((resolveBody, rejectBody) => {
@@ -30276,11 +30359,12 @@ const STUDIO_SCRIPT = `
   // --image-override flag to start-service so the deployed-registry-pinned
   // image is rebuilt from local source. Default "(keep pinned image)" => no
   // override.
-  function buildImageOverridePicker() {
-    const sec = el('div', 'section options');
-    sec.appendChild(el('h3', null, 'Image override'));
+  // One labeled Dockerfile <select> row (the discovered Dockerfiles + a
+  // "(keep pinned image)" default). Shared by the ecs single picker and the
+  // alb per-backing-service pickers.
+  function buildImageOverrideRow(labelText) {
     const row = el('div', 'opt-row');
-    row.appendChild(el('span', 'opt-label', 'Local Dockerfile'));
+    row.appendChild(el('span', 'opt-label', labelText));
     const sel = el('select', 'image-override-select');
     const none = el('option', null, '(keep pinned image)');
     none.value = '';
@@ -30291,7 +30375,19 @@ const STUDIO_SCRIPT = `
       sel.appendChild(o);
     });
     row.appendChild(sel);
-    sec.appendChild(row);
+    return {
+      row: row,
+      getValue: function () {
+        return sel.value.trim();
+      },
+    };
+  }
+
+  function buildImageOverridePicker() {
+    const sec = el('div', 'section options');
+    sec.appendChild(el('h3', null, 'Image override'));
+    const r = buildImageOverrideRow('Local Dockerfile');
+    sec.appendChild(r.row);
     const hint = studioDockerfiles.length
       ? 'This image is pinned to a deployed registry — local edits do not take effect. Pick a Dockerfile to rebuild it locally.'
       : 'This image is pinned to a deployed registry, but no Dockerfile was found under the app directory.';
@@ -30299,12 +30395,41 @@ const STUDIO_SCRIPT = `
     return {
       node: sec,
       collect: function () {
-        const v = sel.value.trim();
+        const v = r.getValue();
         return v === '' ? undefined : v;
       },
     };
   }
 
+  // Per-backing-service image-override pickers for a pinned ALB (issue #382):
+  // one Dockerfile select per deployed-registry-pinned service the ALB fronts.
+  // collect() returns a { [serviceId]: dockerfile } map threaded as
+  // imageOverrides (one --image-override service=df per entry).
+  function buildAlbImageOverridePicker(services) {
+    const sec = el('div', 'section options');
+    sec.appendChild(el('h3', null, 'Image override (pinned backing services)'));
+    const rows = services.map(function (svc) {
+      const r = buildImageOverrideRow(svc.label);
+      sec.appendChild(r.row);
+      return { id: svc.id, getValue: r.getValue };
+    });
+    const hint = studioDockerfiles.length
+      ? 'These services behind the ALB are pinned to a deployed registry — local edits do not take effect. Pick a Dockerfile to rebuild one from local source.'
+      : 'These services behind the ALB are pinned to a deployed registry, but no Dockerfile was found under the app directory.';
+    sec.appendChild(el('div', 'opt-hint', hint));
+    return {
+      node: sec,
+      collect: function () {
+        const map = {};
+        rows.forEach(function (r) {
+          const v = r.getValue();
+          if (v !== '') map[r.id] = v;
+        });
+        return Object.keys(map).length ? map : undefined;
+      },
+    };
+  }
+
   // Toggle one target group's body open/closed (groups are collapsed by
   // default so a big Lambda list does not push the APIs below the fold).
   function toggleGroup(titleEl, bodyEl) {
@@ -30390,7 +30515,13 @@ const STUDIO_SCRIPT = `
             t.appendChild(btnSlot);
             t.onclick = () => selectTarget(entry.id, group.kind);
             targetEls.set(entry.id, t);
-            serveMeta.set(entry.id, { dot, btnSlot, kind: group.kind, pinned: entry.pinned === true });
+            serveMeta.set(entry.id, {
+              dot,
+              btnSlot,
+              kind: group.kind,
+              pinned: entry.pinned === true,
+              backingPinnedServices: entry.backingPinnedServices || [],
+            });
             updateServeRow(entry.id);
           }
           body.appendChild(t);
@@ -30527,6 +30658,14 @@ const STUDIO_SCRIPT = `
     if (applied && applied.imageOverride) {
       lines.push('--image-override ' + applied.imageOverride);
     }
+    // An alb serve threads a per-backing-service imageOverrides map (issue
+    // #382); surface one --image-override line each so the picks do not
+    // silently vanish from the running view (the issue #356 contract).
+    if (applied && applied.imageOverrides) {
+      Object.keys(applied.imageOverrides).forEach(function (svc) {
+        lines.push('--image-override ' + svc + '=' + applied.imageOverrides[svc]);
+      });
+    }
     if (applied && applied.rawArgs) {
       const raw = String(applied.rawArgs).trim();
       if (raw !== '') lines.push(raw);
@@ -30534,7 +30673,7 @@ const STUDIO_SCRIPT = `
     return lines;
   }
 
-  async function startServe(id, options, rawArgs, imageOverride) {
+  async function startServe(id, options, rawArgs, imageOverride, imageOverrides) {
     // The serve kind (api / alb / ecs) drives which headless command the
     // server spawns; it is recorded on the row when the target list loads.
     const meta = serveMeta.get(id);
@@ -30542,7 +30681,12 @@ const STUDIO_SCRIPT = `
     // Remember what this serve was Started with so the running workspace can
     // show a read-only "Started with" summary (issue #356) — the per-run
     // option inputs are gone once the composer is replaced by the running view.
-    serveApplied.set(id, { options: options, rawArgs: rawArgs, imageOverride: imageOverride });
+    serveApplied.set(id, {
+      options: options,
+      rawArgs: rawArgs,
+      imageOverride: imageOverride,
+      imageOverrides: imageOverrides,
+    });
     serveState.set(id, { status: 'starting', endpoints: [] });
     updateServeRow(id);
     try {
@@ -30550,6 +30694,7 @@ const STUDIO_SCRIPT = `
       if (options) body.options = options;
       if (rawArgs) body.rawArgs = rawArgs;
       if (imageOverride) body.imageOverride = imageOverride;
+      if (imageOverrides) body.imageOverrides = imageOverrides;
       const res = await fetch('/api/run', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
@@ -30625,6 +30770,7 @@ const STUDIO_SCRIPT = `
     let collectOpts = function () { return undefined; };
     let collectRaw = function () { return undefined; };
     let collectImageOverride = function () { return undefined; };
+    let collectImageOverrides = function () { return undefined; };
     btn.onclick = () => {
       if (running || starting) {
         stopServe(id);
@@ -30635,7 +30781,7 @@ const STUDIO_SCRIPT = `
         serveState.set(id, { status: 'stopped', endpoints: [] });
         renderServeWorkspace(id);
       } else {
-        startServe(id, collectOpts(), collectRaw(), collectImageOverride());
+        startServe(id, collectOpts(), collectRaw(), collectImageOverride(), collectImageOverrides());
       }
     };
     head.appendChild(btn);
@@ -30655,6 +30801,15 @@ const STUDIO_SCRIPT = `
         ws.appendChild(io.node);
         collectImageOverride = io.collect;
       }
+      // An ALB boots its backing ECS services (issue #382); a pinned backing
+      // service has the same "local edits do not take effect" problem, so offer
+      // a per-service Dockerfile picker that threads
+      // --image-override service=dockerfile to start-alb.
+      if (meta && meta.kind === 'alb' && meta.backingPinnedServices && meta.backingPinnedServices.length) {
+        const io = buildAlbImageOverridePicker(meta.backingPinnedServices);
+        ws.appendChild(io.node);
+        collectImageOverrides = io.collect;
+      }
       const opt = buildOptions(kind);
       if (opt.node) ws.appendChild(opt.node);
       collectOpts = opt.collect;
@@ -31838,6 +31993,34 @@ function annotatePinnedEcsTargets(groups, classify) {
 	}
 	return anyPinned;
 }
+/**
+* Annotate each `alb` entry of `groups` with the deployed-registry-pinned ECS
+* services that ALB fronts (issue #382), so the alb composer can offer a
+* per-service image-override Dockerfile picker. `resolveBackingPinned` maps one
+* ALB entry to its pinned backing services (`{ id, label }`, where `id` is the
+* `--image-override` key — `start-alb`'s `Stack:LogicalId` service-boot
+* target); the caller supplies it (studio's boot resolves the ALB via
+* `resolveAlbFrontDoor` and intersects the backing services with the already-
+* classified pinned `ecs` set). Mutates the entries in place and returns whether
+* ANY ALB fronts a pinned service, so the caller can include the Dockerfile
+* scan even when no standalone `ecs` service was pinned. Non-alb groups are
+* left untouched. Exported so a host CLI can reuse it + so the boot logic is
+* unit-testable without a real synth.
+*/
+function annotateAlbPinnedBackingServices(groups, resolveBackingPinned) {
+	let any = false;
+	for (const group of groups) {
+		if (group.kind !== "alb") continue;
+		for (const entry of group.entries) {
+			const pinned = resolveBackingPinned(entry);
+			if (pinned.length > 0) {
+				entry.backingPinnedServices = pinned;
+				any = true;
+			}
+		}
+	}
+	return any;
+}
 /** Compile a `*` / `?` glob to an anchored RegExp matched against a target id. */
 function globToRegExp(glob) {
 	const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
@@ -32951,6 +33134,7 @@ function createStudioServeManager(config) {
 			...buildPerRunArgs(req.kind, req.options),
 			...envFile ? ["--env-vars", envFile] : [],
 			...req.imageOverride && req.imageOverride.trim() !== "" ? ["--image-override", req.targetId + "=" + req.imageOverride.trim()] : [],
+			...Object.entries(req.imageOverrides ?? {}).flatMap(([svc, df]) => df && df.trim() !== "" ? ["--image-override", svc + "=" + df.trim()] : []),
 			...config.watch === true ? ["--watch"] : [],
 			...tokenizeRawArgs(req.rawArgs)
 		];
@@ -33196,7 +33380,7 @@ const STUDIO_TARGET_KINDS = [
 */
 function coerceRunRequest(body) {
 	if (typeof body !== "object" || body === null) throw new Error("Request body must be a JSON object.");
-	const { targetId, kind, event, options, rawArgs, imageOverride } = body;
+	const { targetId, kind, event, options, rawArgs, imageOverride, imageOverrides } = body;
 	if (typeof targetId !== "string" || targetId.trim() === "") throw new Error("Request body must include a non-empty \"targetId\" string.");
 	if (typeof kind !== "string" || !STUDIO_TARGET_KINDS.includes(kind)) throw new Error(`Request body "kind" must be one of: ${STUDIO_TARGET_KINDS.join(", ")}.`);
 	let runOptions;
@@ -33217,13 +33401,24 @@ function coerceRunRequest(body) {
 		if (typeof imageOverride !== "string") throw new Error("Request body \"imageOverride\" must be a string.");
 		if (imageOverride.trim() !== "") runImageOverride = imageOverride;
 	}
+	let runImageOverrides;
+	if (imageOverrides !== void 0) {
+		if (typeof imageOverrides !== "object" || imageOverrides === null || Array.isArray(imageOverrides)) throw new Error("Request body \"imageOverrides\" must be a JSON object keyed by service id.");
+		const collected = {};
+		for (const [svc, df] of Object.entries(imageOverrides)) {
+			if (typeof df !== "string") throw new Error(`Request body "imageOverrides.${svc}" must be a string.`);
+			if (df.trim() !== "") collected[svc] = df.trim();
+		}
+		if (Object.keys(collected).length > 0) runImageOverrides = collected;
+	}
 	return {
 		targetId,
 		kind,
 		event,
 		...runOptions !== void 0 ? { options: runOptions } : {},
 		...runRawArgs !== void 0 ? { rawArgs: runRawArgs } : {},
-		...runImageOverride !== void 0 ? { imageOverride: runImageOverride } : {}
+		...runImageOverride !== void 0 ? { imageOverride: runImageOverride } : {},
+		...runImageOverrides !== void 0 ? { imageOverrides: runImageOverrides } : {}
 	};
 }
 /**
@@ -33503,6 +33698,48 @@ function makePinClassifier(args) {
 		}
 	};
 }
+/**
+* Build the boot-time resolver `annotateAlbPinnedBackingServices` calls per
+* `alb` entry (issue #382). It resolves the ALB to its backing ECS services
+* (`resolveAlbFrontDoor`, template-only) and returns the subset that is in
+* `pinnedEcsByQualifiedId` — the `ecs` services already classified as a
+* deployed-registry pin by {@link makePinClassifier}. Each returned `id` is the
+* service's `Stack:LogicalId` (the `--image-override` key `start-alb` matches
+* against its own service-boot target); `label` is the pinned service's display
+* id. An ALB that cannot be resolved is WARN-logged + contributes no pickers
+* (the start-alb run still works; only the picker is absent). Exported for
+* testing.
+*/
+function makeAlbBackingPinnedResolver(args) {
+	const { stacks, pinnedEcsByQualifiedId, logger } = args;
+	return (albEntry) => {
+		if (pinnedEcsByQualifiedId.size === 0) return [];
+		try {
+			const { stack, albLogicalId } = resolveAlbTarget(albEntry.id, stacks);
+			const resolution = resolveAlbFrontDoor(stack, albLogicalId);
+			const serviceQualifiedIds = /* @__PURE__ */ new Set();
+			for (const listener of resolution.listeners) {
+				const actions = [...listener.defaultAction ? [listener.defaultAction] : [], ...listener.rules.map((r) => r.action)];
+				for (const action of actions) {
+					if (action.kind !== "forward") continue;
+					for (const t of action.targets) if (t.kind === "ecs") serviceQualifiedIds.add(`${stack.stackName}:${t.serviceLogicalId}`);
+				}
+			}
+			const out = [];
+			for (const qid of serviceQualifiedIds) {
+				const label = pinnedEcsByQualifiedId.get(qid);
+				if (label !== void 0) out.push({
+					id: qid,
+					label
+				});
+			}
+			return out;
+		} catch (err) {
+			logger.warn(`studio: could not resolve ALB '${albEntry.id}' backing services for the image-override picker; the alb composer will not offer one. ${err instanceof Error ? err.message : String(err)}`);
+			return [];
+		}
+	};
+}
 async function localStudioCommand(options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
@@ -33539,7 +33776,7 @@ async function localStudioCommand(options) {
 	}
 	const appLabel = stacks.map((s) => s.stackName).join(", ") || appCmd;
 	const servableEcs = new Set(targetGroups.filter((g) => g.kind === "ecs").flatMap((g) => g.entries.filter((e) => e.servable).map((e) => e.id)));
-	const dockerfiles = annotatePinnedEcsTargets(targetGroups, makePinClassifier({
+	const anyPinned = annotatePinnedEcsTargets(targetGroups, makePinClassifier({
 		stacks,
 		contextByStack: await prepareEcsImageContexts({
 			serviceIds: [...servableEcs],
@@ -33548,7 +33785,18 @@ async function localStudioCommand(options) {
 			logger
 		}),
 		logger
-	})) ? discoverDockerfiles(process.cwd()) : [];
+	}));
+	const pinnedEcsByQualifiedId = /* @__PURE__ */ new Map();
+	for (const g of targetGroups) {
+		if (g.kind !== "ecs") continue;
+		for (const e of g.entries) if (e.pinned) pinnedEcsByQualifiedId.set(e.qualifiedId, e.id);
+	}
+	const anyAlbBackingPinned = annotateAlbPinnedBackingServices(targetGroups, makeAlbBackingPinnedResolver({
+		stacks,
+		pinnedEcsByQualifiedId,
+		logger
+	}));
+	const dockerfiles = anyPinned || anyAlbBackingPinned ? discoverDockerfiles(process.cwd()) : [];
 	const bus = new StudioEventBus();
 	const childConfig = {
 		cliEntry: process.argv[1] ?? "",
@@ -33730,5 +33978,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { MAX_TASKS_SUBNET_RANGE_CAP as $, buildMessageEvent as $n, createLocalStartApiCommand as $t, startCloudFrontServer as A, buildCorsConfigByApiId as An, discoverRoutes as Ar, A2A_CONTAINER_PORT as At, runViewerResponse as B, pickResponseTemplate as Bn, resolveAgentCoreTarget as Br, AGENTCORE_SESSION_ID_HEADER as Bt, formatTargetListing as C, buildMethodArn as Cn, listTargets as Cr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Ct, parseOriginOverrides as D, invokeTokenAuthorizer as Dn, filterWebSocketApisByIdentifiers as Dr, addInvokeAgentCoreSpecificOptions as Dt, createLocalStartCloudFrontCommand as E, invokeRequestAuthorizer as En, discoverWebSocketApisOrThrow as Er, attachContainerLogStreamer as Et, pickFunctionUrlLogicalIdFromOrigin as F, translateLambdaResponse as Fn, AGENTCORE_HTTP_PROTOCOL as Fr, MCP_PROTOCOL_VERSION as Ft, resolveAlbTarget as G, probeHostGatewaySupport as Gn, LocalInvokeBuildError as Gr, buildAgentCoreCodeImage as Gt, albStrategy as H, tryParseStatus as Hn, formatStateRemedy as Hr, waitForAgentCorePing as Ht, pickTargetFunctionLogicalId as I, applyAuthorizerOverlay as In, AGENTCORE_MCP_PROTOCOL as Ir, mcpInvokeOnce as It, addStartServiceSpecificOptions as J, buildMgmtEndpointEnvUrl as Jn, toCmdArgv as Jt, isApplicationLoadBalancer as K, bufferToBody as Kn, buildStsClientConfig as Kr, computeCodeImageTag as Kt, resolveCloudFrontDistribution as L, buildHttpApiV2Event as Ln, AGENTCORE_RUNTIME_TYPE as Lr, parseSseForJsonRpc as Lt, serveLambdaUrlOrigin as M, isFunctionUrlOacFronted as Mn, resolveLambdaArnIntrinsic as Mr, a2aInvokeOnce as Mt, CLOUDFRONT_DISTRIBUTION_TYPE as N, matchPreflight as Nn, AGENTCORE_A2A_PROTOCOL as Nr, MCP_CONTAINER_PORT as Nt, resolveCloudFrontTarget as O, attachAuthorizers as On, parseSelectionExpressionPath as Or, createLocalInvokeAgentCoreCommand as Ot, isCloudFrontDistribution as P, matchRoute as Pn, AGENTCORE_AGUI_PROTOCOL as Pr, MCP_PATH as Pt, createLocalRunTaskCommand as Q, buildDisconnectEvent as Qn, addStartApiSpecificOptions as Qt, compileCloudFrontFunction as R, buildRestV1Event as Rn, AgentCoreResolutionError as Rr, AGENTCORE_SIGV4_SERVICE as Rt, createLocalListCommand as S, verifyJwtViaDiscovery as Sn, countTargets as Sr, DEFAULT_SHADOW_READY_TIMEOUT_MS as St, addStartCloudFrontSpecificOptions as T, evaluateCachedLambdaPolicy as Tn, discoverWebSocketApis as Tr, getContainerNetworkIp as Tt, createLocalStartAlbCommand as U, VtlEvaluationError as Un, substituteImagePlaceholders as Ur, downloadAndExtractS3Bundle as Ut, addAlbSpecificOptions as V, selectIntegrationResponse as Vn, derivePseudoParametersFromRegion as Vr, invokeAgentCore as Vt, parseLbPortOverrides as W, HOST_GATEWAY_MIN_VERSION as Wn, tryResolveImageFnJoin as Wr, SUPPORTED_CODE_RUNTIMES as Wt, serviceStrategy as X, parseConnectionsPath as Xn, addInvokeSpecificOptions as Xt, createLocalStartServiceCommand as Y, handleConnectionsRequest as Yn, classifySourceChange as Yt, addRunTaskSpecificOptions as Z, buildConnectEvent as Zn, createLocalInvokeCommand as Zt, toStudioTargetGroups as _, buildCognitoJwksUrl as _n, CfnLocalStateProvider as _r, describePinnedImageUri as _t, createLocalStudioCommand as a, buildStageMap as an, EcsTaskResolutionError as ar, parseMaxTasks as at, StudioEventBus as b, verifyCognitoJwt as bn, resolveWatchConfig as br, buildCloudMapIndex as bt, startStudioProxy as c, availableApiIdentifiers as cn, substituteEnvVarsFromState as cr, resolveSharedSidecarCredentials as ct, createStudioDispatcher as d, groupRoutesByServer as dn, createLocalStateProvider as dr, buildImageOverrideTag as dt, createWatchPredicates as en, architectureToPlatform as er, addCommonEcsServiceOptions as et, filterStudioCustomResources as f, readMtlsMaterialsFromDisk as fn, isCfnFlagPresent as fr, enforceImageOverrideOrphans as ft, startStudioServer as g, defaultCredentialsLoader as gn, resolveCfnStackName as gr, runImageOverrideBuilds as gt, filterStudioTargetGroups as h, resolveServiceIntegrationParameters as hn, resolveCfnRegion as hr, resolveImageOverrides as ht, coerceStopRequest as i, attachStageContext as in, resolveRuntimeImage as ir, ecsClusterOption as it, serveFromStaticOrigin as j, buildCorsConfigFromCloudFrontChain as jn, pickRefLogicalId as jr, A2A_PATH as jt, matchBehavior as k, applyCorsResponseHeaders as kn, webSocketApiMatchesIdentifier as kr, invokeAgentCoreWs as kt, relayServeRequest as l, filterRoutesByApiIdentifier as ln, substituteEnvVarsFromStateAsync as lr, runEcsServiceEmulator as lt, annotatePinnedEcsTargets as m, resolveSelectionExpression as mn, resolveCfnFallbackRegion as mr, parseImageOverrideFlags as mt, coerceRunRequest as n, createAuthorizerCache as nn, resolveRuntimeCodeMountPath as nr, addImageOverrideOptions as nt, resolveServeBaseUrl as o, materializeLayerFromArn as on, substituteAgainstState as or, parseRestartPolicy as ot, isCustomResourceLambdaTarget as p, startApiServer as pn, rejectExplicitCfnStackWithMultipleStacks as pr, mergeForService as pt, resolveAlbFrontDoor as q, ConnectionRegistry as qn, resolveProfileCredentials as qr, renderCodeDockerfile as qt, coerceServeRequest as r, createFileWatcher as rn, resolveRuntimeFileExtension as rr, buildEcsImageResolutionContext$1 as rt, createStudioServeManager as s, resolveEnvVars$1 as sn, substituteAgainstStateAsync as sr, resolveEcsAssumeRoleOption as st, addStudioSpecificOptions as t, resolveApiTargetSubset as tn, buildContainerImage as tr, addEcsAssumeRoleOptions as tt, reinvoke as u, filterRoutesByApiIdentifiers as un, LocalStateSourceError as ur, ImageOverrideError as ut, renderStudioHtml as v, buildJwksUrlFromIssuer as vn, collectSsmParameterRefs as vr, isLocalCdkAssetImage as vt, LocalStartCloudFrontError as w, computeRequestIdentityHash as wn, availableWebSocketApiIdentifiers as wr, setShadowReadyTimeoutMs as wt, addListSpecificOptions as x, verifyJwtAuthorizer as xn, resolveSingleTarget as xr, CloudMapRegistry as xt, createStudioStore as y, createJwksCache as yn, resolveSsmParameters as yr, listPinnedTargets as yt, runViewerRequest as z, evaluateResponseParameters as zn, pickAgentCoreCandidateStack as zr, signAgentCoreInvocation as zt };
-//# sourceMappingURL=local-studio-DWur2ccn.js.map
+export { createLocalRunTaskCommand as $, buildDisconnectEvent as $n, addStartApiSpecificOptions as $t, matchBehavior as A, applyCorsResponseHeaders as An, webSocketApiMatchesIdentifier as Ar, invokeAgentCoreWs as At, runViewerRequest as B, evaluateResponseParameters as Bn, pickAgentCoreCandidateStack as Br, signAgentCoreInvocation as Bt, createLocalListCommand as C, verifyJwtViaDiscovery as Cn, countTargets as Cr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Ct, createLocalStartCloudFrontCommand as D, invokeRequestAuthorizer as Dn, discoverWebSocketApisOrThrow as Dr, attachContainerLogStreamer as Dt, addStartCloudFrontSpecificOptions as E, evaluateCachedLambdaPolicy as En, discoverWebSocketApis as Er, getContainerNetworkIp as Et, isCloudFrontDistribution as F, matchRoute as Fn, AGENTCORE_AGUI_PROTOCOL as Fr, MCP_PATH as Ft, parseLbPortOverrides as G, HOST_GATEWAY_MIN_VERSION as Gn, tryResolveImageFnJoin as Gr, SUPPORTED_CODE_RUNTIMES as Gt, addAlbSpecificOptions as H, selectIntegrationResponse as Hn, derivePseudoParametersFromRegion as Hr, invokeAgentCore as Ht, pickFunctionUrlLogicalIdFromOrigin as I, translateLambdaResponse as In, AGENTCORE_HTTP_PROTOCOL as Ir, MCP_PROTOCOL_VERSION as It, resolveAlbFrontDoor as J, ConnectionRegistry as Jn, resolveProfileCredentials as Jr, renderCodeDockerfile as Jt, resolveAlbTarget as K, probeHostGatewaySupport as Kn, LocalInvokeBuildError as Kr, buildAgentCoreCodeImage as Kt, pickTargetFunctionLogicalId as L, applyAuthorizerOverlay as Ln, AGENTCORE_MCP_PROTOCOL as Lr, mcpInvokeOnce as Lt, serveFromStaticOrigin as M, buildCorsConfigFromCloudFrontChain as Mn, pickRefLogicalId as Mr, A2A_PATH as Mt, serveLambdaUrlOrigin as N, isFunctionUrlOacFronted as Nn, resolveLambdaArnIntrinsic as Nr, a2aInvokeOnce as Nt, parseOriginOverrides as O, invokeTokenAuthorizer as On, filterWebSocketApisByIdentifiers as Or, addInvokeAgentCoreSpecificOptions as Ot, CLOUDFRONT_DISTRIBUTION_TYPE as P, matchPreflight as Pn, AGENTCORE_A2A_PROTOCOL as Pr, MCP_CONTAINER_PORT as Pt, addRunTaskSpecificOptions as Q, buildConnectEvent as Qn, createLocalInvokeCommand as Qt, resolveCloudFrontDistribution as R, buildHttpApiV2Event as Rn, AGENTCORE_RUNTIME_TYPE as Rr, parseSseForJsonRpc as Rt, addListSpecificOptions as S, verifyJwtAuthorizer as Sn, resolveSingleTarget as Sr, CloudMapRegistry as St, LocalStartCloudFrontError as T, computeRequestIdentityHash as Tn, availableWebSocketApiIdentifiers as Tr, setShadowReadyTimeoutMs as Tt, albStrategy as U, tryParseStatus as Un, formatStateRemedy as Ur, waitForAgentCorePing as Ut, runViewerResponse as V, pickResponseTemplate as Vn, resolveAgentCoreTarget as Vr, AGENTCORE_SESSION_ID_HEADER as Vt, createLocalStartAlbCommand as W, VtlEvaluationError as Wn, substituteImagePlaceholders as Wr, downloadAndExtractS3Bundle as Wt, createLocalStartServiceCommand as X, handleConnectionsRequest as Xn, classifySourceChange as Xt, addStartServiceSpecificOptions as Y, buildMgmtEndpointEnvUrl as Yn, toCmdArgv as Yt, serviceStrategy as Z, parseConnectionsPath as Zn, addInvokeSpecificOptions as Zt, startStudioServer as _, defaultCredentialsLoader as _n, resolveCfnStackName as _r, runImageOverrideBuilds as _t, createLocalStudioCommand as a, attachStageContext as an, resolveRuntimeImage as ar, ecsClusterOption as at, createStudioStore as b, createJwksCache as bn, resolveSsmParameters as br, listPinnedTargets as bt, startStudioProxy as c, resolveEnvVars$1 as cn, substituteAgainstStateAsync as cr, resolveEcsAssumeRoleOption as ct, createStudioDispatcher as d, filterRoutesByApiIdentifiers as dn, LocalStateSourceError as dr, ImageOverrideError as dt, createLocalStartApiCommand as en, buildMessageEvent as er, MAX_TASKS_SUBNET_RANGE_CAP as et, filterStudioCustomResources as f, groupRoutesByServer as fn, createLocalStateProvider as fr, buildImageOverrideTag as ft, filterStudioTargetGroups as g, resolveServiceIntegrationParameters as gn, resolveCfnRegion as gr, resolveImageOverrides as gt, annotatePinnedEcsTargets as h, resolveSelectionExpression as hn, resolveCfnFallbackRegion as hr, parseImageOverrideFlags as ht, coerceStopRequest as i, createFileWatcher as in, resolveRuntimeFileExtension as ir, buildEcsImageResolutionContext$1 as it, startCloudFrontServer as j, buildCorsConfigByApiId as jn, discoverRoutes as jr, A2A_CONTAINER_PORT as jt, resolveCloudFrontTarget as k, attachAuthorizers as kn, parseSelectionExpressionPath as kr, createLocalInvokeAgentCoreCommand as kt, relayServeRequest as l, availableApiIdentifiers as ln, substituteEnvVarsFromState as lr, resolveSharedSidecarCredentials as lt, annotateAlbPinnedBackingServices as m, startApiServer as mn, rejectExplicitCfnStackWithMultipleStacks as mr, mergeForService as mt, coerceRunRequest as n, resolveApiTargetSubset as nn, buildContainerImage as nr, addEcsAssumeRoleOptions as nt, resolveServeBaseUrl as o, buildStageMap as on, EcsTaskResolutionError as or, parseMaxTasks as ot, isCustomResourceLambdaTarget as p, readMtlsMaterialsFromDisk as pn, isCfnFlagPresent as pr, enforceImageOverrideOrphans as pt, isApplicationLoadBalancer as q, bufferToBody as qn, buildStsClientConfig as qr, computeCodeImageTag as qt, coerceServeRequest as r, createAuthorizerCache as rn, resolveRuntimeCodeMountPath as rr, addImageOverrideOptions as rt, createStudioServeManager as s, materializeLayerFromArn as sn, substituteAgainstState as sr, parseRestartPolicy as st, addStudioSpecificOptions as t, createWatchPredicates as tn, architectureToPlatform as tr, addCommonEcsServiceOptions as tt, reinvoke as u, filterRoutesByApiIdentifier as un, substituteEnvVarsFromStateAsync as ur, runEcsServiceEmulator as ut, toStudioTargetGroups as v, buildCognitoJwksUrl as vn, CfnLocalStateProvider as vr, describePinnedImageUri as vt, formatTargetListing as w, buildMethodArn as wn, listTargets as wr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as wt, StudioEventBus as x, verifyCognitoJwt as xn, resolveWatchConfig as xr, buildCloudMapIndex as xt, renderStudioHtml as y, buildJwksUrlFromIssuer as yn, collectSsmParameterRefs as yr, isLocalCdkAssetImage as yt, compileCloudFrontFunction as z, buildRestV1Event as zn, AgentCoreResolutionError as zr, AGENTCORE_SIGV4_SERVICE as zt };
+//# sourceMappingURL=local-studio-8hdH7a_R.js.map