cdk-local 0.109.0 → 0.111.0

package/dist/{local-studio-CxVVLdJw.js → local-studio-HtgyKdTW.js}

@@ -11359,6 +11359,34 @@ function buildCorsConfigFromCloudFrontChain(template) {
 	return out;
 }
 /**
+* Resolve one cache behavior's `ResponseHeadersPolicyId` to its CORS config.
+*
+* `start-cloudfront` (cloudfront-resolver) calls this per behavior so the
+* local CloudFront server reproduces the distribution's
+* `AWS::CloudFront::ResponseHeadersPolicy` CORS — answering an OPTIONS
+* preflight and adding `Access-Control-Allow-Origin` to actual responses, the
+* same way CloudFront does at the edge. (The `start-api` path uses
+* {@link buildCorsConfigFromCloudFrontChain}, which is keyed by the fronted
+* Function URL logical id; this is the direct per-behavior form, so a
+* distribution's `CacheBehaviors[]` can each carry their own policy.)
+*
+* Returns undefined unless the value is a `{ Ref: <logicalId> }` to a local
+* `AWS::CloudFront::ResponseHeadersPolicy` whose `CorsConfig` has at least one
+* value-bearing field (an AWS-managed-policy id literal, or a policy with only
+* `SecurityHeadersConfig` / `CustomHeadersConfig`, yields undefined).
+*/
+function resolveResponseHeadersPolicyCors(template, responseHeadersPolicyId) {
+	const rhpId = pickRhpRefLogicalId(responseHeadersPolicyId);
+	if (!rhpId) return void 0;
+	const rhpResource = (template.Resources ?? {})[rhpId];
+	if (!rhpResource || rhpResource.Type !== "AWS::CloudFront::ResponseHeadersPolicy") return;
+	const rhpConfig = (rhpResource.Properties ?? {})["ResponseHeadersPolicyConfig"];
+	if (!rhpConfig || typeof rhpConfig !== "object") return void 0;
+	const corsConfig = rhpConfig["CorsConfig"];
+	if (!corsConfig || typeof corsConfig !== "object" || Array.isArray(corsConfig)) return void 0;
+	return parseCloudFrontCorsConfig(corsConfig);
+}
+/**
 * Determine whether a Function URL (`AWS::Lambda::Url`, identified by its
 * logical id) is fronted by a CloudFront Distribution origin that uses
 * Origin Access Control (OAC) to SIGN origin requests.
@@ -11449,6 +11477,10 @@ function pickFnUrlLogicalIdFromOriginDomainName(value) {
 * ID. CDK 2.x synthesizes this as `{ Ref: <id> }`. Returns undefined
 * for the AWS-managed-policy ID form (literal UUID string) since
 * cdk-local can't fetch those — and for any non-Ref shape.
+*
+* Exported so `start-cloudfront`'s per-behavior resolver
+* (cloudfront-resolver) can resolve a behavior's `ResponseHeadersPolicyId`
+* to its CORS config via {@link resolveResponseHeadersPolicyCors}.
 */
 function pickRhpRefLogicalId(value) {
 	if (!value || typeof value !== "object") return void 0;
@@ -11463,6 +11495,10 @@ function pickRhpRefLogicalId(value) {
 * see `buildCorsConfigFromCloudFrontChain` JSDoc for the field mapping.
 *
 * Returns undefined when every value-bearing field is missing.
+*
+* Exported so `start-cloudfront`'s per-behavior resolver
+* (cloudfront-resolver) can parse a `ResponseHeadersPolicy`'s CORS block;
+* see {@link resolveResponseHeadersPolicyCors}.
 */
 function parseCloudFrontCorsConfig(raw) {
 	const allowOrigins = pickItemsStringArray(raw["AccessControlAllowOrigins"]);
@@ -11568,6 +11604,22 @@ function applyCorsResponseHeaders(res, apiLogicalId, corsConfigByApiId, requestO
 	if (!apiLogicalId) return;
 	const cors = corsConfigByApiId.get(apiLogicalId);
 	if (!cors) return;
+	applyCorsResponseHeadersFromConfig(res, cors, requestOrigin);
+}
+/**
+* Apply actual-response CORS headers from an already-resolved
+* {@link CorsConfig} (no map lookup). The map-keyed
+* {@link applyCorsResponseHeaders} delegates here so the two share one
+* implementation; `start-cloudfront`'s server (cloudfront-server) calls this
+* form directly with the matched behavior's
+* `AWS::CloudFront::ResponseHeadersPolicy` CORS config.
+*
+* No-op when the request has no `Origin` header or the Origin is not in
+* `AllowOrigins` (the browser would block the response anyway; we don't
+* smuggle an unauthorized origin through). See {@link applyCorsResponseHeaders}
+* for the header set + `Vary: Origin` / credentials rationale.
+*/
+function applyCorsResponseHeadersFromConfig(res, cors, requestOrigin) {
 	if (!requestOrigin) return;
 	const originMatch = matchOrigin(requestOrigin, cors.AllowOrigins);
 	if (!originMatch) return;
@@ -11575,8 +11627,9 @@ function applyCorsResponseHeaders(res, apiLogicalId, corsConfigByApiId, requestO
 	res.setHeader("Access-Control-Allow-Origin", allowOrigin);
 	if (allowOrigin !== "*") {
 		const existing = res.getHeader("Vary");
-		if (typeof existing === "string" && existing.length > 0) {
-			if (!existing.split(",").map((t) => t.trim()).some((t) => t.toLowerCase() === "origin")) res.setHeader("Vary", `${existing}, Origin`);
+		const existingStr = Array.isArray(existing) ? existing.join(", ") : typeof existing === "string" ? existing : "";
+		if (existingStr.length > 0) {
+			if (!existingStr.split(",").map((t) => t.trim()).some((t) => t.toLowerCase() === "origin")) res.setHeader("Vary", `${existingStr}, Origin`);
 		} else res.setHeader("Vary", "Origin");
 	}
 	if (cors.AllowCredentials === true) res.setHeader("Access-Control-Allow-Credentials", "true");
@@ -28212,7 +28265,7 @@ function resolveCloudFrontDistribution(args) {
 	const distConfig = (resource.Properties ?? {})["DistributionConfig"];
 	if (!distConfig || typeof distConfig !== "object") throw new Error(`Distribution '${logicalId}' has no DistributionConfig.`);
 	const dc = distConfig;
-	const behaviors = resolveBehaviors(dc, compileDistributionFunctions(template), logicalId);
+	const behaviors = resolveBehaviors(dc, compileDistributionFunctions(template), logicalId, template);
 	const origins = resolveOrigins(dc, template, stack, args.originOverrides ?? /* @__PURE__ */ new Map());
 	const customErrorResponses = resolveCustomErrorResponses(dc);
 	const result = {
@@ -28242,10 +28295,10 @@ function compileDistributionFunctions(template) {
 	}
 	return out;
 }
-function resolveBehaviors(dc, functions, distLogicalId) {
+function resolveBehaviors(dc, functions, distLogicalId, template) {
 	const behaviors = [];
 	const def = dc["DefaultCacheBehavior"];
-	if (def && typeof def === "object") behaviors.push(resolveBehavior(def, void 0, functions, distLogicalId));
+	if (def && typeof def === "object") behaviors.push(resolveBehavior(def, void 0, functions, distLogicalId, template));
 	const extra = Array.isArray(dc["CacheBehaviors"]) ? dc["CacheBehaviors"] : [];
 	for (const b of extra) {
 		if (!b || typeof b !== "object") continue;
@@ -28254,16 +28307,18 @@ function resolveBehaviors(dc, functions, distLogicalId) {
 			getLogger().warn(`Distribution '${distLogicalId}': a cache behavior has no literal PathPattern; cdk-local cannot route it and is skipping it.`);
 			continue;
 		}
-		behaviors.push(resolveBehavior(behavior, behavior["PathPattern"], functions, distLogicalId));
+		behaviors.push(resolveBehavior(behavior, behavior["PathPattern"], functions, distLogicalId, template));
 	}
 	return behaviors;
 }
-function resolveBehavior(behavior, pathPattern, functions, distLogicalId) {
+function resolveBehavior(behavior, pathPattern, functions, distLogicalId, template) {
 	const resolved = {
 		targetOriginId: typeof behavior["TargetOriginId"] === "string" ? behavior["TargetOriginId"] : "",
 		hasLambdaEdge: Array.isArray(behavior["LambdaFunctionAssociations"]) ? behavior["LambdaFunctionAssociations"].length > 0 : false
 	};
 	if (pathPattern !== void 0) resolved.pathPattern = pathPattern;
+	const cors = resolveResponseHeadersPolicyCors(template, behavior["ResponseHeadersPolicyId"]);
+	if (cors) resolved.cors = cors;
 	if (typeof behavior["ViewerProtocolPolicy"] === "string") resolved.viewerProtocolPolicy = behavior["ViewerProtocolPolicy"];
 	const assocs = Array.isArray(behavior["FunctionAssociations"]) ? behavior["FunctionAssociations"] : [];
 	for (const a of assocs) {
@@ -28718,6 +28773,18 @@ async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 		writePlain(res, 404, "No cache behavior matched.\n");
 		return;
 	}
+	if (behavior.cors) {
+		const preflight = matchPreflight({
+			method: req.method ?? "GET",
+			headers: nodeHeadersToRecord(req.headers)
+		}, behavior.cors);
+		if (preflight) {
+			res.statusCode = preflight.statusCode;
+			setHeadersSafely(res, preflight.headers, logger);
+			res.end();
+			return;
+		}
+	}
 	let requestEvent = buildViewerRequestEvent({
 		method: req.method ?? "GET",
 		uri,
@@ -28777,8 +28844,24 @@ async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 	} catch (err) {
 		logger.warn(`Skipping invalid Set-Cookie header(s): ${err instanceof Error ? err.message : String(err)}`);
 	}
+	if (behavior.cors) {
+		const origin = req.headers.origin;
+		applyCorsResponseHeadersFromConfig(res, behavior.cors, typeof origin === "string" ? origin : void 0);
+	}
 	res.end(originResult.body);
 }
+/**
+* Convert Node's `IncomingMessage.headers` (`Record<string, string | string[]>`)
+* to the lowercased `Record<string, string[]>` shape `matchPreflight` expects.
+*/
+function nodeHeadersToRecord(headers) {
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) {
+		if (value === void 0) continue;
+		out[name.toLowerCase()] = Array.isArray(value) ? value : [value];
+	}
+	return out;
+}
 /** Read the full request body into a Buffer. */
 function readRequestBody(req) {
 	return new Promise((resolveBody, rejectBody) => {
@@ -30072,6 +30155,7 @@ const STUDIO_SCRIPT = `
   let shownDetailId = null;        // captured request whose read-only detail is shown
   let pendingReqPrefill = null;    // {method,path,headers,body} to seed the next serve request composer (re-invoke)
   let studioDockerfiles = [];      // Dockerfiles scanned at boot (pinned-ecs image-override picker)
+  let lastAppliedCfn = null;       // last-applied --from-cfn-stack (null | true | name) — a change re-loads targets (issue #385)
 
   function el(tag, cls, text) {
     const e = document.createElement(tag);
@@ -30318,7 +30402,7 @@ const STUDIO_SCRIPT = `
     };
   }
 
-  // Per-backing-service image-override pickers for a pinned ALB (issue #382):
+  // Per-backing-service image-override pickers for a pinned ALB (issue #384):
   // one Dockerfile select per deployed-registry-pinned service the ALB fronts.
   // collect() returns a { [serviceId]: dockerfile } map threaded as
   // imageOverrides (one --image-override service=df per entry).
@@ -30576,7 +30660,7 @@ const STUDIO_SCRIPT = `
       lines.push('--image-override ' + applied.imageOverride);
     }
     // An alb serve threads a per-backing-service imageOverrides map (issue
-    // #382); surface one --image-override line each so the picks do not
+    // #384); surface one --image-override line each so the picks do not
     // silently vanish from the running view (the issue #356 contract).
     if (applied && applied.imageOverrides) {
       Object.keys(applied.imageOverrides).forEach(function (svc) {
@@ -30718,7 +30802,7 @@ const STUDIO_SCRIPT = `
         ws.appendChild(io.node);
         collectImageOverride = io.collect;
       }
-      // An ALB boots its backing ECS services (issue #382); a pinned backing
+      // An ALB boots its backing ECS services (issue #384); a pinned backing
       // service has the same "local edits do not take effect" problem, so offer
       // a per-service Dockerfile picker that threads
       // --image-override service=dockerfile to start-alb.
@@ -31671,6 +31755,9 @@ const STUDIO_SCRIPT = `
       cfn.checked = on;
       cfnName.value = typeof c.fromCfnStack === 'string' ? c.fromCfnStack : '';
       cfnName.style.display = on ? '' : 'none';
+      // Seed the last-applied from-cfn-stack signature so the first Session-bar
+      // edit only re-loads targets if it actually changes the binding (#385).
+      lastAppliedCfn = on ? (typeof c.fromCfnStack === 'string' && c.fromCfnStack ? c.fromCfnStack : true) : null;
       // assume-role is now checkbox-gated, symmetric with from-cfn-stack
       // (issue #343): the ARN input appears only when the box is checked.
       const roleOn = document.getElementById('sess-role-on');
@@ -31699,8 +31786,9 @@ const STUDIO_SCRIPT = `
     const role = document.getElementById('sess-role');
     const roleOn = document.getElementById('sess-role-on');
     const msg = document.getElementById('sess-msg');
+    const nextCfn = cfn.checked ? cfnName.value.trim() || true : null;
     const body = {
-      fromCfnStack: cfn.checked ? cfnName.value.trim() || true : null,
+      fromCfnStack: nextCfn,
       // assume-role is explicit-ARN-only: checked + empty is simply not bound.
       assumeRole: roleOn.checked ? role.value.trim() || null : null,
       watch: document.getElementById('sess-watch').checked,
@@ -31718,17 +31806,32 @@ const STUDIO_SCRIPT = `
       }
       msg.textContent = '✓ applied';
       setTimeout(function () { msg.textContent = ''; }, 1200);
-      // Do NOT re-load from the server here (issue #349): the UI already shows
-      // exactly what was just PATCHed, and re-loading CLOBBERS the controls.
-      // assume-role has no bare server form, so a checked-but-empty assume-role
-      // PATCHes null; re-loading would read that back and immediately UN-check
-      // the box + hide the ARN input — so clicking the checkbox appeared to do
-      // nothing. loadConfig() runs once on init.
+      // Do NOT re-load the SESSION CONTROLS from the server here (issue #349):
+      // the UI already shows exactly what was just PATCHed, and re-loading
+      // CLOBBERS the controls. assume-role has no bare server form, so a
+      // checked-but-empty assume-role PATCHes null; re-loading would read that
+      // back and immediately UN-check the box. loadConfig() runs once on init.
+      //
+      // But a --from-cfn-stack change DID re-classify the targets server-side
+      // (issue #385) — the PATCH response already reflects the new binding, and
+      // the server swapped its target list. Re-fetch /api/targets so the
+      // image-override pickers appear / disappear without restarting studio.
+      // Only when the binding actually changed, so a watch / role toggle does
+      // not needlessly rebuild the target pane. Running-serve rows are
+      // preserved on re-render (serveState + updateServeRow drive them).
+      if (!sameCfn(nextCfn, lastAppliedCfn)) {
+        lastAppliedCfn = nextCfn;
+        await loadTargets();
+      }
     } catch (err) {
       msg.textContent = 'Failed: ' + err;
     }
   }
 
+  // Two --from-cfn-stack values are the same binding when both clear (null),
+  // both bare (true), or the same stack name.
+  function sameCfn(a, b) { return a === b; }
+
   function wireSession() {
     const cfn = document.getElementById('sess-cfn');
     const cfnName = document.getElementById('sess-cfn-name');
@@ -31912,7 +32015,7 @@ function annotatePinnedEcsTargets(groups, classify) {
 }
 /**
 * Annotate each `alb` entry of `groups` with the deployed-registry-pinned ECS
-* services that ALB fronts (issue #382), so the alb composer can offer a
+* services that ALB fronts (issue #384), so the alb composer can offer a
 * per-service image-override Dockerfile picker. `resolveBackingPinned` maps one
 * ALB entry to its pinned backing services (`{ id, label }`, where `id` is the
 * `--image-override` key — `start-alb`'s `Stack:LogicalId` service-boot
@@ -31971,11 +32074,11 @@ async function startStudioServer(options) {
 	const host = options.host ?? "127.0.0.1";
 	const maxBump = options.maxPortBump ?? 20;
 	const html = renderStudioHtml(options.appLabel, options.cliName);
-	const targetsJson = JSON.stringify({
+	let targetsJson = JSON.stringify({
 		groups: options.targetGroups,
 		dockerfiles: options.dockerfiles ?? []
 	});
-	const server = createServer$1((req, res) => handleRequest(req, res, options.bus, html, targetsJson, options));
+	const server = createServer$1((req, res) => handleRequest(req, res, options.bus, html, () => targetsJson, options));
 	const boundPort = await listenWithBump(server, host, options.port, maxBump);
 	return {
 		url: `http://${host}:${boundPort}`,
@@ -31983,10 +32086,16 @@ async function startStudioServer(options) {
 		close: () => new Promise((resolveClose, reject) => {
 			server.close((err) => err ? reject(err) : resolveClose());
 			server.closeAllConnections?.();
-		})
+		}),
+		setTargets: (groups, dockerfiles) => {
+			targetsJson = JSON.stringify({
+				groups,
+				dockerfiles: dockerfiles ?? []
+			});
+		}
 	};
 }
-function handleRequest(req, res, bus, html, targetsJson, options) {
+function handleRequest(req, res, bus, html, getTargetsJson, options) {
 	const url = req.url ?? "/";
 	const path = url.split("?")[0];
 	if (req.method === "GET" && (path === "/" || path === "/index.html")) {
@@ -31996,7 +32105,7 @@ function handleRequest(req, res, bus, html, targetsJson, options) {
 	}
 	if (req.method === "GET" && path === "/api/targets") {
 		res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
-		res.end(targetsJson);
+		res.end(getTargetsJson());
 		return;
 	}
 	if (req.method === "GET" && path === "/api/running") {
@@ -33597,9 +33706,10 @@ async function prepareEcsImageContexts(args) {
 * the pin resolves, and surfaces a WARN (not a silent DEBUG swallow) when a
 * service still cannot be classified.
 *
-* NOTE: the target list + these pinned flags are computed ONCE at boot. A
-* run-time Session-bar `--from-cfn-stack` change (`PATCH /api/config`) does
-* NOT re-classify — restart studio to re-detect pins under a new binding.
+* The classifier is re-run whenever the Session-bar `--from-cfn-stack` binding
+* changes (`PATCH /api/config`), so the pickers appear / disappear under the
+* new binding without restarting studio (issue #385) — `classifyTargets`
+* re-invokes this against a fresh clone of the un-annotated target groups.
 *
 * Returns a `(id) => boolean` callback (true = pinned). Exported for testing.
 */
@@ -33617,7 +33727,7 @@ function makePinClassifier(args) {
 }
 /**
 * Build the boot-time resolver `annotateAlbPinnedBackingServices` calls per
-* `alb` entry (issue #382). It resolves the ALB to its backing ECS services
+* `alb` entry (issue #384). It resolves the ALB to its backing ECS services
 * (`resolveAlbFrontDoor`, template-only) and returns the subset that is in
 * `pinnedEcsByQualifiedId` — the `ecs` services already classified as a
 * deployed-registry pin by {@link makePinClassifier}. Each returned `id` is the
@@ -33657,6 +33767,86 @@ function makeAlbBackingPinnedResolver(args) {
 		}
 	};
 }
+/**
+* Classify the studio target list for a given `--from-cfn-stack` binding
+* (issue #385): annotate a FRESH clone of the un-annotated base groups with the
+* `pinned` (ecs services) + `backingPinnedServices` (alb entries) image-override
+* hints, and scan the app dir for Dockerfiles when at least one target is
+* pinned. Returns the annotated groups + dockerfiles; the un-annotated
+* `baseGroups` argument is left untouched so it can be re-classified under a
+* different binding (the Session-bar `--from-cfn-stack` change path —
+* `PATCH /api/config` — re-runs this and swaps the served target list, so the
+* pickers appear without restarting studio). Runs once at boot and again per
+* binding change.
+*
+* The clone means a re-classify never inherits stale pins; the `fromCfnStack`
+* override is threaded into the state-source options so the pin classifier
+* resolves INTRINSIC-ECR images against the right (or no) deployed stack
+* (issue #354). Exported for unit testing.
+*/
+async function classifyStudioTargets(args) {
+	const { baseGroups, stacks, servableEcs, options, fromCfnStack, logger } = args;
+	const groups = structuredClone(baseGroups);
+	const classifyOptions = {
+		...options,
+		fromCfnStack
+	};
+	const anyPinned = annotatePinnedEcsTargets(groups, makePinClassifier({
+		stacks,
+		contextByStack: await prepareEcsImageContexts({
+			serviceIds: [...servableEcs],
+			stacks,
+			options: classifyOptions,
+			logger
+		}),
+		logger
+	}));
+	const pinnedEcsByQualifiedId = /* @__PURE__ */ new Map();
+	for (const g of groups) {
+		if (g.kind !== "ecs") continue;
+		for (const e of g.entries) if (e.pinned) pinnedEcsByQualifiedId.set(e.qualifiedId, e.id);
+	}
+	const anyAlbBackingPinned = annotateAlbPinnedBackingServices(groups, makeAlbBackingPinnedResolver({
+		stacks,
+		pinnedEcsByQualifiedId,
+		logger
+	}));
+	return {
+		groups,
+		dockerfiles: anyPinned || anyAlbBackingPinned ? discoverDockerfiles(process.cwd()) : []
+	};
+}
+/**
+* Re-classify the studio target list when the Session-bar `--from-cfn-stack`
+* binding changes (issue #385), and swap the served list via `applyTargets`.
+* The orchestration the `PATCH /api/config` handler runs, extracted so its
+* branches are unit-testable without booting the studio server:
+*
+*  - **change gate**: returns immediately when `after === before` (a watch /
+*    assume-role toggle does not change the pin classification);
+*  - **latest-wins**: bumps `tokenRef.current` before the async `classify` and
+*    applies the result ONLY if its token is still current — so a slow earlier
+*    re-classify cannot clobber a newer binding's result when patches arrive in
+*    quick succession;
+*  - **fail-soft**: a `classify` rejection is WARN-logged and the previous
+*    target list is kept (never throws — the PATCH still returns the config).
+*
+* `after` (the post-patch binding) is threaded into `classify`, never the boot
+* value, so the pin classifier resolves against the new stack. Exported for
+* unit testing.
+*/
+async function reclassifyTargetsOnBindingChange(args) {
+	const { before, after, classify, applyTargets, tokenRef, logger } = args;
+	if (after === before) return;
+	logger.info("--from-cfn-stack binding changed; re-classifying targets...");
+	const myToken = ++tokenRef.current;
+	try {
+		const { groups, dockerfiles } = await classify(after);
+		if (myToken === tokenRef.current) applyTargets(groups, dockerfiles);
+	} catch (err) {
+		logger.warn(`studio: could not re-classify targets after a --from-cfn-stack change; the target list keeps its previous pins (restart studio to retry). ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
 async function localStudioCommand(options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
@@ -33693,27 +33883,16 @@ async function localStudioCommand(options) {
 	}
 	const appLabel = stacks.map((s) => s.stackName).join(", ") || appCmd;
 	const servableEcs = new Set(targetGroups.filter((g) => g.kind === "ecs").flatMap((g) => g.entries.filter((e) => e.servable).map((e) => e.id)));
-	const anyPinned = annotatePinnedEcsTargets(targetGroups, makePinClassifier({
-		stacks,
-		contextByStack: await prepareEcsImageContexts({
-			serviceIds: [...servableEcs],
-			stacks,
-			options,
-			logger
-		}),
-		logger
-	}));
-	const pinnedEcsByQualifiedId = /* @__PURE__ */ new Map();
-	for (const g of targetGroups) {
-		if (g.kind !== "ecs") continue;
-		for (const e of g.entries) if (e.pinned) pinnedEcsByQualifiedId.set(e.qualifiedId, e.id);
-	}
-	const anyAlbBackingPinned = annotateAlbPinnedBackingServices(targetGroups, makeAlbBackingPinnedResolver({
+	const baseTargetGroups = targetGroups;
+	const classifyTargets = (fromCfnStack) => classifyStudioTargets({
+		baseGroups: baseTargetGroups,
 		stacks,
-		pinnedEcsByQualifiedId,
+		servableEcs,
+		options,
+		fromCfnStack,
 		logger
-	}));
-	const dockerfiles = anyPinned || anyAlbBackingPinned ? discoverDockerfiles(process.cwd()) : [];
+	});
+	const { groups: initialGroups, dockerfiles: initialDockerfiles } = await classifyTargets(options.fromCfnStack);
 	const bus = new StudioEventBus();
 	const childConfig = {
 		cliEntry: process.argv[1] ?? "",
@@ -33741,11 +33920,13 @@ async function localStudioCommand(options) {
 		watch: childConfig.watch
 	});
 	const store = createStudioStore(bus);
+	let serverRef;
+	const reclassifyToken = { current: 0 };
 	const server = await startStudioServer({
 		port,
 		bus,
-		targetGroups,
-		dockerfiles,
+		targetGroups: initialGroups,
+		dockerfiles: initialDockerfiles,
 		appLabel,
 		cliName: getEmbedConfig().cliName,
 		store,
@@ -33785,11 +33966,21 @@ async function localStudioCommand(options) {
 		},
 		getRunning: () => ({ running: serveManager.list() }),
 		getConfig: () => sessionConfigSnapshot(),
-		patchConfig: (body) => {
+		patchConfig: async (body) => {
+			const beforeFromCfn = childConfig.fromCfnStack;
 			applyConfigPatch(body, childConfig);
-			return Promise.resolve(sessionConfigSnapshot());
+			await reclassifyTargetsOnBindingChange({
+				before: beforeFromCfn,
+				after: childConfig.fromCfnStack,
+				classify: classifyTargets,
+				applyTargets: (groups, dockerfiles) => serverRef?.setTargets(groups, dockerfiles),
+				tokenRef: reclassifyToken,
+				logger
+			});
+			return sessionConfigSnapshot();
 		}
 	});
+	serverRef = server;
 	const cliName = getEmbedConfig().cliName;
 	logger.info(`${cliName} studio is running at ${server.url}`);
 	if (childConfig.watch) logger.info("Watch mode: ON — serves started from the UI hot-reload on CDK source changes.");
@@ -33896,4 +34087,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { createLocalRunTaskCommand as $, buildDisconnectEvent as $n, addStartApiSpecificOptions as $t, matchBehavior as A, applyCorsResponseHeaders as An, webSocketApiMatchesIdentifier as Ar, invokeAgentCoreWs as At, runViewerRequest as B, evaluateResponseParameters as Bn, pickAgentCoreCandidateStack as Br, signAgentCoreInvocation as Bt, createLocalListCommand as C, verifyJwtViaDiscovery as Cn, countTargets as Cr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Ct, createLocalStartCloudFrontCommand as D, invokeRequestAuthorizer as Dn, discoverWebSocketApisOrThrow as Dr, attachContainerLogStreamer as Dt, addStartCloudFrontSpecificOptions as E, evaluateCachedLambdaPolicy as En, discoverWebSocketApis as Er, getContainerNetworkIp as Et, isCloudFrontDistribution as F, matchRoute as Fn, AGENTCORE_AGUI_PROTOCOL as Fr, MCP_PATH as Ft, parseLbPortOverrides as G, HOST_GATEWAY_MIN_VERSION as Gn, tryResolveImageFnJoin as Gr, SUPPORTED_CODE_RUNTIMES as Gt, addAlbSpecificOptions as H, selectIntegrationResponse as Hn, derivePseudoParametersFromRegion as Hr, invokeAgentCore as Ht, pickFunctionUrlLogicalIdFromOrigin as I, translateLambdaResponse as In, AGENTCORE_HTTP_PROTOCOL as Ir, MCP_PROTOCOL_VERSION as It, resolveAlbFrontDoor as J, ConnectionRegistry as Jn, resolveProfileCredentials as Jr, renderCodeDockerfile as Jt, resolveAlbTarget as K, probeHostGatewaySupport as Kn, LocalInvokeBuildError as Kr, buildAgentCoreCodeImage as Kt, pickTargetFunctionLogicalId as L, applyAuthorizerOverlay as Ln, AGENTCORE_MCP_PROTOCOL as Lr, mcpInvokeOnce as Lt, serveFromStaticOrigin as M, buildCorsConfigFromCloudFrontChain as Mn, pickRefLogicalId as Mr, A2A_PATH as Mt, serveLambdaUrlOrigin as N, isFunctionUrlOacFronted as Nn, resolveLambdaArnIntrinsic as Nr, a2aInvokeOnce as Nt, parseOriginOverrides as O, invokeTokenAuthorizer as On, filterWebSocketApisByIdentifiers as Or, addInvokeAgentCoreSpecificOptions as Ot, CLOUDFRONT_DISTRIBUTION_TYPE as P, matchPreflight as Pn, AGENTCORE_A2A_PROTOCOL as Pr, MCP_CONTAINER_PORT as Pt, addRunTaskSpecificOptions as Q, buildConnectEvent as Qn, createLocalInvokeCommand as Qt, resolveCloudFrontDistribution as R, buildHttpApiV2Event as Rn, AGENTCORE_RUNTIME_TYPE as Rr, parseSseForJsonRpc as Rt, addListSpecificOptions as S, verifyJwtAuthorizer as Sn, resolveSingleTarget as Sr, CloudMapRegistry as St, LocalStartCloudFrontError as T, computeRequestIdentityHash as Tn, availableWebSocketApiIdentifiers as Tr, setShadowReadyTimeoutMs as Tt, albStrategy as U, tryParseStatus as Un, formatStateRemedy as Ur, waitForAgentCorePing as Ut, runViewerResponse as V, pickResponseTemplate as Vn, resolveAgentCoreTarget as Vr, AGENTCORE_SESSION_ID_HEADER as Vt, createLocalStartAlbCommand as W, VtlEvaluationError as Wn, substituteImagePlaceholders as Wr, downloadAndExtractS3Bundle as Wt, createLocalStartServiceCommand as X, handleConnectionsRequest as Xn, classifySourceChange as Xt, addStartServiceSpecificOptions as Y, buildMgmtEndpointEnvUrl as Yn, toCmdArgv as Yt, serviceStrategy as Z, parseConnectionsPath as Zn, addInvokeSpecificOptions as Zt, startStudioServer as _, defaultCredentialsLoader as _n, resolveCfnStackName as _r, runImageOverrideBuilds as _t, createLocalStudioCommand as a, attachStageContext as an, resolveRuntimeImage as ar, ecsClusterOption as at, createStudioStore as b, createJwksCache as bn, resolveSsmParameters as br, listPinnedTargets as bt, startStudioProxy as c, resolveEnvVars$1 as cn, substituteAgainstStateAsync as cr, resolveEcsAssumeRoleOption as ct, createStudioDispatcher as d, filterRoutesByApiIdentifiers as dn, LocalStateSourceError as dr, ImageOverrideError as dt, createLocalStartApiCommand as en, buildMessageEvent as er, MAX_TASKS_SUBNET_RANGE_CAP as et, filterStudioCustomResources as f, groupRoutesByServer as fn, createLocalStateProvider as fr, buildImageOverrideTag as ft, filterStudioTargetGroups as g, resolveServiceIntegrationParameters as gn, resolveCfnRegion as gr, resolveImageOverrides as gt, annotatePinnedEcsTargets as h, resolveSelectionExpression as hn, resolveCfnFallbackRegion as hr, parseImageOverrideFlags as ht, coerceStopRequest as i, createFileWatcher as in, resolveRuntimeFileExtension as ir, buildEcsImageResolutionContext$1 as it, startCloudFrontServer as j, buildCorsConfigByApiId as jn, discoverRoutes as jr, A2A_CONTAINER_PORT as jt, resolveCloudFrontTarget as k, attachAuthorizers as kn, parseSelectionExpressionPath as kr, createLocalInvokeAgentCoreCommand as kt, relayServeRequest as l, availableApiIdentifiers as ln, substituteEnvVarsFromState as lr, resolveSharedSidecarCredentials as lt, annotateAlbPinnedBackingServices as m, startApiServer as mn, rejectExplicitCfnStackWithMultipleStacks as mr, mergeForService as mt, coerceRunRequest as n, resolveApiTargetSubset as nn, buildContainerImage as nr, addEcsAssumeRoleOptions as nt, resolveServeBaseUrl as o, buildStageMap as on, EcsTaskResolutionError as or, parseMaxTasks as ot, isCustomResourceLambdaTarget as p, readMtlsMaterialsFromDisk as pn, isCfnFlagPresent as pr, enforceImageOverrideOrphans as pt, isApplicationLoadBalancer as q, bufferToBody as qn, buildStsClientConfig as qr, computeCodeImageTag as qt, coerceServeRequest as r, createAuthorizerCache as rn, resolveRuntimeCodeMountPath as rr, addImageOverrideOptions as rt, createStudioServeManager as s, materializeLayerFromArn as sn, substituteAgainstState as sr, parseRestartPolicy as st, addStudioSpecificOptions as t, createWatchPredicates as tn, architectureToPlatform as tr, addCommonEcsServiceOptions as tt, reinvoke as u, filterRoutesByApiIdentifier as un, substituteEnvVarsFromStateAsync as ur, runEcsServiceEmulator as ut, toStudioTargetGroups as v, buildCognitoJwksUrl as vn, CfnLocalStateProvider as vr, describePinnedImageUri as vt, formatTargetListing as w, buildMethodArn as wn, listTargets as wr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as wt, StudioEventBus as x, verifyCognitoJwt as xn, resolveWatchConfig as xr, buildCloudMapIndex as xt, renderStudioHtml as y, buildJwksUrlFromIssuer as yn, collectSsmParameterRefs as yr, isLocalCdkAssetImage as yt, compileCloudFrontFunction as z, buildRestV1Event as zn, AgentCoreResolutionError as zr, AGENTCORE_SIGV4_SERVICE as zt };
-//# sourceMappingURL=local-studio-CxVVLdJw.js.map
+//# sourceMappingURL=local-studio-HtgyKdTW.js.map