cdk-local 0.119.0 → 0.121.0

package/dist/{local-studio-DPEUB-rH.js → local-studio-D7SkLbCO.js}

@@ -18100,7 +18100,7 @@ function computeCodeImageTag(sourceDir, runtime, entryPoint, dockerfile) {
 async function downloadAndExtractS3Bundle(location, options = {}) {
 	const ref = formatRef(location);
 	getLogger().info(`Downloading fromS3 code bundle ${ref}...`);
-	const bytes = await (options.fetchObject ?? defaultFetchObject(options))(location);
+	const bytes = await (options.fetchObject ?? defaultFetchObject$1(options))(location);
 	let files;
 	try {
 		files = unzipSync(bytes);
@@ -18147,7 +18147,7 @@ function resolveSafeEntryPath(root, entry) {
 	if (dest !== root && !dest.startsWith(rootWithSep)) throw new CdkLocalError(`Refusing to extract a fromS3 bundle entry that escapes the target dir: '${entry}'.`, "LOCAL_INVOKE_AGENTCORE_S3_BUNDLE_ZIP_SLIP");
 	return dest;
 }
-function defaultFetchObject(options) {
+function defaultFetchObject$1(options) {
 	return async (location) => {
 		const { S3Client, GetObjectCommand } = await import("@aws-sdk/client-s3");
 		const client = new S3Client({
@@ -23890,7 +23890,7 @@ function writeRawHttpError(socket, statusCode, message) {
 	if (socket.destroyed) return;
 	const body = `${message}\n`;
 	const lines = [
-		`HTTP/1.1 ${statusCode} ${STATUS_TEXT[statusCode] ?? "Error"}`,
+		`HTTP/1.1 ${statusCode} ${STATUS_TEXT$1[statusCode] ?? "Error"}`,
 		"content-type: text/plain; charset=utf-8",
 		`content-length: ${Buffer.byteLength(body)}`,
 		"connection: close",
@@ -23943,7 +23943,7 @@ function writeRawHttpRedirect(socket, action, req, listenerPort, scheme) {
 function writeRawHttpFixedResponse(socket, action) {
 	if (socket.destroyed) return;
 	const body = action.messageBody ?? "";
-	const statusText = STATUS_TEXT[action.statusCode] ?? "";
+	const statusText = STATUS_TEXT$1[action.statusCode] ?? "";
 	const contentType = sanitizeRawHeaderValue(action.contentType ?? "text/plain; charset=utf-8");
 	const lines = [
 		`HTTP/1.1 ${action.statusCode} ${statusText}`,
@@ -23963,7 +23963,7 @@ function sanitizeRawHeaderValue(value) {
 	return value.replace(/[\r\n]/g, " ");
 }
 /** Minimal HTTP/1.1 status text map for the codes the raw writers emit. */
-const STATUS_TEXT = {
+const STATUS_TEXT$1 = {
 	301: "Moved Permanently",
 	302: "Found",
 	401: "Unauthorized",
@@ -28402,6 +28402,15 @@ function buildViewerResponseEvent(requestEvent, response) {
 		}
 	};
 }
+/** Serialize a CloudFront request's `querystring` object back to a raw string. */
+function serializeCfQueryString(qs) {
+	const parts = [];
+	for (const [key, val] of Object.entries(qs)) {
+		const values = val.multiValue && val.multiValue.length > 0 ? val.multiValue : [{ value: val.value }];
+		for (const v of values) parts.push(v.value === "" ? encodeURIComponent(key) : `${encodeURIComponent(key)}=${encodeURIComponent(v.value)}`);
+	}
+	return parts.join("&");
+}
 function parseQueryStringToCf(raw) {
 	const out = {};
 	if (!raw) return out;
@@ -28460,6 +28469,7 @@ const CLOUDFRONT_FUNCTION_TYPE = "AWS::CloudFront::Function";
 const S3_BUCKET_TYPE = "AWS::S3::Bucket";
 const LAMBDA_URL_TYPE = "AWS::Lambda::Url";
 const LAMBDA_FUNCTION_TYPE = "AWS::Lambda::Function";
+const LAMBDA_VERSION_TYPE = "AWS::Lambda::Version";
 /**
 * Resolve a distribution logical id within a stack into its routing model.
 * `originOverrides` maps an origin id to a local directory (the `--origin`
@@ -28565,10 +28575,9 @@ function resolveBehaviors(dc, functions, distLogicalId, template) {
 	return behaviors;
 }
 function resolveBehavior(behavior, pathPattern, functions, distLogicalId, template) {
-	const resolved = {
-		targetOriginId: typeof behavior["TargetOriginId"] === "string" ? behavior["TargetOriginId"] : "",
-		hasLambdaEdge: Array.isArray(behavior["LambdaFunctionAssociations"]) ? behavior["LambdaFunctionAssociations"].length > 0 : false
-	};
+	const resolved = { targetOriginId: typeof behavior["TargetOriginId"] === "string" ? behavior["TargetOriginId"] : "" };
+	const lambdaEdge = resolveLambdaEdgeAssociations(behavior, template, distLogicalId);
+	if (lambdaEdge) resolved.lambdaEdge = lambdaEdge;
 	if (pathPattern !== void 0) resolved.pathPattern = pathPattern;
 	const cors = resolveResponseHeadersPolicyCors(template, behavior["ResponseHeadersPolicyId"]);
 	if (cors) resolved.cors = cors;
@@ -28600,6 +28609,55 @@ function pickFunctionLogicalIdFromArn(value) {
 	const getAtt = value["Fn::GetAtt"];
 	if (Array.isArray(getAtt) && getAtt.length === 2 && typeof getAtt[0] === "string") return getAtt[0];
 }
+/**
+* Resolve a behavior's `LambdaFunctionAssociations[]` into the per-event-type
+* backing-function map (issue #400). Each association names a
+* `LambdaFunctionARN` (a versioned ARN) + an `EventType` + `IncludeBody`.
+*/
+function resolveLambdaEdgeAssociations(behavior, template, distLogicalId) {
+	const assocs = Array.isArray(behavior["LambdaFunctionAssociations"]) ? behavior["LambdaFunctionAssociations"] : [];
+	const out = {};
+	for (const a of assocs) {
+		if (!a || typeof a !== "object") continue;
+		const assoc = a;
+		const eventType = assoc["EventType"];
+		const functionLogicalId = pickLambdaEdgeFunctionLogicalId(assoc["LambdaFunctionARN"], template);
+		if (!functionLogicalId) {
+			getLogger().warn(`Distribution '${distLogicalId}': a Lambda@Edge association references a LambdaFunctionARN cdk-local could not resolve to a local AWS::Lambda::Function; it will not run.`);
+			continue;
+		}
+		const entry = {
+			functionLogicalId,
+			includeBody: assoc["IncludeBody"] === true
+		};
+		if (eventType === "viewer-request") out.viewerRequest = entry;
+		else if (eventType === "origin-request") out.originRequest = entry;
+		else if (eventType === "origin-response") out.originResponse = entry;
+		else if (eventType === "viewer-response") out.viewerResponse = entry;
+	}
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+/**
+* Resolve a `LambdaFunctionARN` (a versioned function ARN) to the backing
+* `AWS::Lambda::Function` logical id. CDK wires the association to a
+* `lambda.Version` (`{Ref: <Version>}` returns the qualified ARN), whose
+* `FunctionName` references the function. A direct (unqualified) function ref
+* is also accepted. Returns `undefined` when it cannot reach an
+* `AWS::Lambda::Function` (e.g. an imported cross-region EdgeFunction ARN).
+*/
+function pickLambdaEdgeFunctionLogicalId(value, template) {
+	const candidate = refLogicalId(value) ?? getAttLogicalId(value);
+	if (!candidate) return void 0;
+	const resources = template.Resources ?? {};
+	const resource = resources[candidate];
+	if (!resource) return void 0;
+	if (resource.Type === LAMBDA_FUNCTION_TYPE) return candidate;
+	if (resource.Type === LAMBDA_VERSION_TYPE) {
+		const fnName = (resource.Properties ?? {})["FunctionName"];
+		const fnId = refLogicalId(fnName) ?? getAttLogicalId(fnName);
+		if (fnId && resources[fnId]?.Type === LAMBDA_FUNCTION_TYPE) return fnId;
+	}
+}
 function resolveOrigins(dc, template, stack, overrides) {
 	const out = /* @__PURE__ */ new Map();
 	const origins = Array.isArray(dc["Origins"]) ? dc["Origins"] : [];
@@ -28799,6 +28857,261 @@ function isCloudFrontDistribution(resource) {
 	return resource.Type === CLOUDFRONT_DISTRIBUTION_TYPE;
 }
 
+//#endregion
+//#region src/local/cloudfront-edge-event.ts
+/** Convert a normalized HTTP header map into the Lambda@Edge multi-map. */
+function httpHeadersToEdge(headers) {
+	const out = {};
+	for (const [name, values] of Object.entries(headers)) {
+		const lower = name.toLowerCase();
+		out[lower] = values.map((value) => ({
+			key: name,
+			value
+		}));
+	}
+	return out;
+}
+/**
+* Flatten a Lambda@Edge header multi-map into a single-valued `{ name: value }`
+* map (comma-joining duplicates), EXCEPT `set-cookie`, whose values are returned
+* separately so multiple cookies survive. Pseudo / read-only headers CloudFront
+* forbids a function from setting are dropped.
+*/
+function edgeHeadersToHttp(headers) {
+	const out = {};
+	const setCookies = [];
+	for (const [name, entries] of Object.entries(headers)) {
+		if (!Array.isArray(entries)) continue;
+		const lower = name.toLowerCase();
+		if (READ_ONLY_RESPONSE_HEADERS.has(lower)) continue;
+		if (lower === "set-cookie") {
+			for (const e of entries) if (e && typeof e.value === "string") setCookies.push(e.value);
+			continue;
+		}
+		const values = entries.filter((e) => e && typeof e.value === "string").map((e) => e.value);
+		if (values.length > 0) out[lower] = values.join(", ");
+	}
+	return {
+		headers: out,
+		setCookies
+	};
+}
+/**
+* Headers a Lambda@Edge function is not allowed to add/modify on a response (a
+* subset CloudFront blackholes). We drop them rather than fail the response.
+*/
+const READ_ONLY_RESPONSE_HEADERS = new Set([
+	"connection",
+	"content-length",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+/** Build the request-stage event (`viewer-request` / `origin-request`). */
+function buildEdgeRequestEvent(args) {
+	return { Records: [{ cf: {
+		config: {
+			...args.config,
+			eventType: args.eventType
+		},
+		request: toEdgeRequest(args.request, args.includeBody)
+	} }] };
+}
+/** Build the response-stage event (`origin-response` / `viewer-response`). */
+function buildEdgeResponseEvent(args) {
+	return { Records: [{ cf: {
+		config: {
+			...args.config,
+			eventType: args.eventType
+		},
+		request: toEdgeRequest(args.request, false),
+		response: {
+			status: String(args.response.statusCode),
+			statusDescription: statusText(args.response.statusCode),
+			headers: httpHeadersToEdge(toMultiMap(args.response.headers))
+		}
+	} }] };
+}
+function toEdgeRequest(input, includeBody) {
+	const request = {
+		clientIp: input.clientIp,
+		method: input.method,
+		uri: input.uri,
+		querystring: input.querystring,
+		headers: httpHeadersToEdge(input.headers)
+	};
+	if (includeBody) request.body = {
+		action: "read-only",
+		data: (input.body ?? Buffer.alloc(0)).toString("base64"),
+		encoding: "base64",
+		inputTruncated: false
+	};
+	return request;
+}
+function interpretEdgeRequestResult(result, fallback) {
+	if (!result || typeof result !== "object") return {
+		kind: "continue",
+		request: fallback
+	};
+	const obj = result;
+	if ("status" in obj) return {
+		kind: "response",
+		response: coerceEdgeResponse(obj)
+	};
+	return {
+		kind: "continue",
+		request: coerceEdgeRequest(obj, fallback)
+	};
+}
+/** Interpret a response-stage handler's return value as the (modified) response. */
+function interpretEdgeResponseResult(result, fallback) {
+	if (!result || typeof result !== "object") return fallback;
+	return coerceEdgeResponse(result, fallback);
+}
+/** Collapse an {@link EdgeResponse} into the server's status / headers / body. */
+function edgeResponseToResult(response, fallbackBody) {
+	const statusCode = Number.parseInt(response.status, 10);
+	const { headers, setCookies } = edgeHeadersToHttp(response.headers ?? {});
+	let body;
+	if (response.body !== void 0) body = response.bodyEncoding === "base64" ? Buffer.from(response.body, "base64") : Buffer.from(response.body);
+	else body = fallbackBody ?? Buffer.alloc(0);
+	return {
+		statusCode: Number.isFinite(statusCode) ? statusCode : 500,
+		headers,
+		setCookies,
+		body
+	};
+}
+/**
+* Server-facing request-stage orchestration: given a handler's raw return value
+* and the current request input, produce either the (modified) request to
+* continue with, or the generated response to short-circuit.
+*/
+function applyEdgeRequestResult(result, base) {
+	const outcome = interpretEdgeRequestResult(result, toEdgeRequest(base, false));
+	if (outcome.kind === "response") return {
+		kind: "response",
+		response: edgeResponseToResult(outcome.response)
+	};
+	return {
+		kind: "continue",
+		request: applyEdgeRequest(base, outcome.request)
+	};
+}
+/**
+* Server-facing response-stage orchestration: apply a handler's modified
+* response over the current status / headers, keeping the origin body unless the
+* function replaced it.
+*/
+function applyEdgeResponseResult(result, base, originBody) {
+	return edgeResponseToResult(interpretEdgeResponseResult(result, {
+		status: String(base.statusCode),
+		headers: httpHeadersToEdge(toMultiMap(base.headers))
+	}), originBody);
+}
+/** Apply a request-stage function's modified request back onto the server's request input. */
+function applyEdgeRequest(base, request) {
+	const out = {
+		clientIp: base.clientIp,
+		method: typeof request.method === "string" ? request.method : base.method,
+		uri: typeof request.uri === "string" ? request.uri : base.uri,
+		querystring: typeof request.querystring === "string" ? request.querystring : base.querystring,
+		headers: edgeHeadersToRawMap(request.headers) ?? base.headers
+	};
+	if (request.body && request.body.action === "replace" && typeof request.body.data === "string") out.body = request.body.encoding === "base64" ? Buffer.from(request.body.data, "base64") : Buffer.from(request.body.data);
+	else if (base.body !== void 0) out.body = base.body;
+	return out;
+}
+function edgeHeadersToRawMap(headers) {
+	if (!headers || typeof headers !== "object") return void 0;
+	const out = {};
+	for (const [name, entries] of Object.entries(headers)) {
+		if (!Array.isArray(entries)) continue;
+		out[name.toLowerCase()] = entries.filter((e) => e && typeof e.value === "string").map((e) => e.value);
+	}
+	return out;
+}
+function coerceEdgeRequest(obj, fallback) {
+	const out = {
+		clientIp: typeof obj["clientIp"] === "string" ? obj["clientIp"] : fallback.clientIp,
+		method: typeof obj["method"] === "string" ? obj["method"] : fallback.method,
+		uri: typeof obj["uri"] === "string" ? obj["uri"] : fallback.uri,
+		querystring: typeof obj["querystring"] === "string" ? obj["querystring"] : fallback.querystring,
+		headers: coerceEdgeHeaders(obj["headers"]) ?? fallback.headers
+	};
+	const body = obj["body"];
+	if (body && typeof body === "object") {
+		const b = body;
+		out.body = {
+			action: b["action"] === "replace" ? "replace" : "read-only",
+			data: typeof b["data"] === "string" ? b["data"] : "",
+			encoding: b["encoding"] === "text" ? "text" : "base64",
+			inputTruncated: b["inputTruncated"] === true
+		};
+	}
+	return out;
+}
+function coerceEdgeResponse(obj, fallback) {
+	const out = {
+		status: typeof obj["status"] === "string" ? obj["status"] : typeof obj["status"] === "number" ? String(obj["status"]) : fallback?.status ?? "200",
+		headers: coerceEdgeHeaders(obj["headers"]) ?? fallback?.headers ?? {}
+	};
+	if (typeof obj["statusDescription"] === "string") out.statusDescription = obj["statusDescription"];
+	else if (fallback?.statusDescription !== void 0) out.statusDescription = fallback.statusDescription;
+	if (typeof obj["body"] === "string") {
+		out.body = obj["body"];
+		if (obj["bodyEncoding"] === "base64" || obj["bodyEncoding"] === "text") out.bodyEncoding = obj["bodyEncoding"];
+	}
+	return out;
+}
+/** Coerce an arbitrary value into the EdgeHeaders shape, tolerating a bare `{name: 'value'}` map. */
+function coerceEdgeHeaders(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const out = {};
+	for (const [name, raw] of Object.entries(value)) {
+		const lower = name.toLowerCase();
+		if (Array.isArray(raw)) out[lower] = raw.filter((e) => !!e && typeof e === "object").map((e) => ({
+			key: typeof e["key"] === "string" ? e["key"] : name,
+			value: typeof e["value"] === "string" ? e["value"] : String(e["value"] ?? "")
+		}));
+		else if (typeof raw === "string") out[lower] = [{
+			key: name,
+			value: raw
+		}];
+	}
+	return out;
+}
+function toMultiMap(headers) {
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) out[name] = [value];
+	return out;
+}
+function statusText(code) {
+	return STATUS_TEXT[code] ?? "";
+}
+const STATUS_TEXT = {
+	200: "OK",
+	201: "Created",
+	204: "No Content",
+	301: "Moved Permanently",
+	302: "Found",
+	303: "See Other",
+	304: "Not Modified",
+	307: "Temporary Redirect",
+	308: "Permanent Redirect",
+	400: "Bad Request",
+	401: "Unauthorized",
+	403: "Forbidden",
+	404: "Not Found",
+	500: "Internal Server Error",
+	502: "Bad Gateway",
+	503: "Service Unavailable"
+};
+
 //#endregion
 //#region src/local/cloudfront-lambda-origin.ts
 /**
@@ -28869,15 +29182,11 @@ function serveFromStaticOrigin(input) {
 		headers: { "content-type": contentTypeForKey(key) },
 		body: direct
 	};
-	const errorResponses = input.customErrorResponses ?? [];
-	for (const code of [403, 404]) {
-		const match = errorResponses.find((e) => e.errorCode === code);
-		if (!match || !match.responsePagePath) continue;
-		const errorKey = stripLeadingSlash(match.responsePagePath);
-		const body = readKey(input.localDirs, errorKey);
+	for (const candidate of resolveErrorResponseCandidates(input.customErrorResponses)) {
+		const body = readKey(input.localDirs, candidate.errorKey);
 		if (body) return {
-			statusCode: match.responseCode ?? code,
-			headers: { "content-type": contentTypeForKey(errorKey) },
+			statusCode: candidate.responseCode,
+			headers: { "content-type": contentTypeForKey(candidate.errorKey) },
 			body
 		};
 	}
@@ -28888,6 +29197,27 @@ function serveFromStaticOrigin(input) {
 	};
 }
 /**
+* Resolve the ordered list of custom-error-page candidates to try when an
+* origin object is missing/forbidden, shared by the local-dir static origin and
+* the deployed-S3 read-through origin so the 403-then-404 priority + the
+* `ResponseCode` mapping live in ONE place. We try 403 first then 404 because a
+* missing key on an OAC-fronted private bucket returns 403 AccessDenied (the
+* common static-site setup), but an app that mapped 404 instead is also honored.
+*/
+function resolveErrorResponseCandidates(customErrorResponses) {
+	const errorResponses = customErrorResponses ?? [];
+	const out = [];
+	for (const code of [403, 404]) {
+		const match = errorResponses.find((e) => e.errorCode === code);
+		if (!match || !match.responsePagePath) continue;
+		out.push({
+			errorKey: stripLeadingSlash(match.responsePagePath),
+			responseCode: match.responseCode ?? code
+		});
+	}
+	return out;
+}
+/**
 * Map a request URI to an S3 object key. The query string / fragment is
 * dropped, the leading slash is removed, and the root path (`/` or empty)
 * resolves to the default root object. A URI ending in `/` is NOT auto-indexed
@@ -28983,9 +29313,11 @@ function contentTypeForKey(key) {
 async function startCloudFrontServer(options) {
 	const logger = getLogger().child("cloudfront");
 	const lambdaInvokers = options.lambdaInvokers ?? /* @__PURE__ */ new Map();
+	const edgeInvokers = options.edgeInvokers ?? /* @__PURE__ */ new Map();
+	const s3OriginReaders = options.s3OriginReaders ?? /* @__PURE__ */ new Map();
 	const state = { distribution: options.distribution };
 	const handler = (req, res) => {
-		handleRequest$1(req, res, state, lambdaInvokers, logger).catch((err) => {
+		handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger).catch((err) => {
 			logger.warn(`Request handling failed: ${err instanceof Error ? err.message : String(err)}`);
 			if (!res.headersSent) {
 				res.statusCode = 500;
@@ -29015,7 +29347,7 @@ async function startCloudFrontServer(options) {
 	};
 }
 /** The per-request pipeline: behavior match -> viewer-request -> origin -> viewer-response. */
-async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
+async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger) {
 	const distribution = state.distribution;
 	const rawUrl = req.url ?? "/";
 	const queryIdx = rawUrl.indexOf("?");
@@ -29038,54 +29370,121 @@ async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 			return;
 		}
 	}
+	const config = {
+		distributionDomainName: req.headers.host ?? "localhost",
+		distributionId: distribution.logicalId,
+		requestId: `cdkl-${Date.now().toString(36)}-${Math.floor(performance.now()).toString(36)}`
+	};
+	const clientIp = req.socket.remoteAddress ?? "127.0.0.1";
 	let requestEvent = buildViewerRequestEvent({
 		method: req.method ?? "GET",
 		uri,
 		querystring,
 		headers: req.headers,
-		ip: req.socket.remoteAddress ?? "127.0.0.1",
+		ip: clientIp,
 		distributionId: distribution.logicalId,
 		domainName: req.headers.host ?? "localhost",
-		requestId: `cdkl-${Date.now().toString(36)}-${Math.floor(performance.now()).toString(36)}`
+		requestId: config.requestId
 	});
-	let effectiveUri = uri;
 	if (behavior.viewerRequest) {
 		const outcome = await runViewerRequest(behavior.viewerRequest, requestEvent);
 		if (outcome.kind === "response") {
 			writeCfResponse(res, outcome.response, logger);
 			return;
 		}
-		effectiveUri = outcome.request.uri;
 		requestEvent = {
 			...requestEvent,
 			request: outcome.request
 		};
 	}
+	let edgeInput = {
+		clientIp,
+		method: requestEvent.request.method,
+		uri: requestEvent.request.uri,
+		querystring: serializeCfQueryString(requestEvent.request.querystring),
+		headers: cfHeadersToRawMap(requestEvent.request.headers)
+	};
+	for (const eventType of ["viewer-request", "origin-request"]) {
+		const assoc = eventType === "viewer-request" ? behavior.lambdaEdge?.viewerRequest : behavior.lambdaEdge?.originRequest;
+		if (!assoc) continue;
+		const invoke = edgeInvokers.get(assoc.functionLogicalId);
+		if (!invoke) {
+			logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (added after start-up); skipping. Restart start-cloudfront.`);
+			continue;
+		}
+		if (assoc.includeBody && edgeInput.body === void 0) edgeInput = {
+			...edgeInput,
+			body: await readRequestBody(req)
+		};
+		const outcome = applyEdgeRequestResult(await invoke(buildEdgeRequestEvent({
+			eventType,
+			config,
+			request: edgeInput,
+			includeBody: assoc.includeBody
+		})), edgeInput);
+		if (outcome.kind === "response") {
+			writeEdgeResponse(res, outcome.response, behavior, req, logger);
+			return;
+		}
+		edgeInput = outcome.request;
+	}
 	const origin = distribution.origins.get(behavior.targetOriginId);
-	const originResult = await serveFromOrigin(origin, behavior, {
-		uri: effectiveUri,
-		querystring,
-		method: req.method ?? "GET",
-		headers: req.headers,
-		readBody: () => readRequestBody(req),
-		sourceIp: req.socket.remoteAddress ?? "127.0.0.1",
+	const originResult = await serveFromOrigin(origin, {
+		uri: edgeInput.uri,
+		querystring: edgeInput.querystring,
+		method: edgeInput.method,
+		headers: rawMapToIncomingHeaders(edgeInput.headers),
+		readBody: () => edgeInput.body !== void 0 ? Promise.resolve(edgeInput.body) : readRequestBody(req),
+		sourceIp: clientIp,
 		distribution,
 		lambdaInvokers,
+		s3OriginReaders,
 		logger
 	});
 	if (!originResult) return writePlain(res, 502, originUnavailableMessage(origin, behavior));
 	let finalStatus = originResult.statusCode;
 	let finalHeaders = originResult.headers;
+	let finalBody = originResult.body;
+	const setCookies = [...originResult.setCookies ?? []];
+	if (behavior.lambdaEdge?.originResponse) {
+		const r = await runEdgeResponseStage(behavior.lambdaEdge.originResponse, "origin-response", {
+			config,
+			request: edgeInput,
+			statusCode: finalStatus,
+			headers: finalHeaders,
+			body: finalBody
+		}, edgeInvokers, logger);
+		if (r) {
+			finalStatus = r.statusCode;
+			finalHeaders = r.headers;
+			finalBody = r.body;
+			setCookies.push(...r.setCookies);
+		}
+	}
 	if (behavior.viewerResponse) {
 		const responseEvent = buildViewerResponseEvent(requestEvent, {
-			statusCode: originResult.statusCode,
-			headers: originResult.headers
+			statusCode: finalStatus,
+			headers: finalHeaders
 		});
 		const mutated = await runViewerResponse(behavior.viewerResponse, responseEvent);
 		finalStatus = mutated.statusCode;
-		finalHeaders = cfHeadersToPlain(mutated.headers, originResult.headers);
+		finalHeaders = cfHeadersToPlain(mutated.headers, finalHeaders);
+	}
+	if (behavior.lambdaEdge?.viewerResponse) {
+		const r = await runEdgeResponseStage(behavior.lambdaEdge.viewerResponse, "viewer-response", {
+			config,
+			request: edgeInput,
+			statusCode: finalStatus,
+			headers: finalHeaders,
+			body: finalBody
+		}, edgeInvokers, logger);
+		if (r) {
+			finalStatus = r.statusCode;
+			finalHeaders = r.headers;
+			finalBody = r.body;
+			setCookies.push(...r.setCookies);
+		}
 	}
-	const setCookies = [...originResult.setCookies ?? []];
 	for (const name of Object.keys(finalHeaders)) if (name.toLowerCase() === "set-cookie") {
 		setCookies.push(finalHeaders[name]);
 		delete finalHeaders[name];
@@ -29101,7 +29500,54 @@ async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 		const origin = req.headers.origin;
 		applyCorsResponseHeadersFromConfig(res, behavior.cors, typeof origin === "string" ? origin : void 0);
 	}
-	res.end(originResult.body);
+	res.end(finalBody);
+}
+/** Run a Lambda@Edge response-stage function, returning the modified response (or undefined when no invoker). */
+async function runEdgeResponseStage(assoc, eventType, ctx, edgeInvokers, logger) {
+	const invoke = edgeInvokers.get(assoc.functionLogicalId);
+	if (!invoke) {
+		logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (added after start-up); skipping. Restart start-cloudfront.`);
+		return;
+	}
+	return applyEdgeResponseResult(await invoke(buildEdgeResponseEvent({
+		eventType,
+		config: ctx.config,
+		request: ctx.request,
+		response: {
+			statusCode: ctx.statusCode,
+			headers: ctx.headers
+		}
+	})), {
+		statusCode: ctx.statusCode,
+		headers: ctx.headers
+	}, ctx.body);
+}
+/** Write a Lambda@Edge generated response (request-stage short-circuit), incl. CORS. */
+function writeEdgeResponse(res, result, behavior, req, logger) {
+	if (!req.readableEnded) req.resume();
+	res.statusCode = result.statusCode;
+	setHeadersSafely(res, result.headers, logger);
+	if (result.setCookies.length > 0) try {
+		res.setHeader("set-cookie", result.setCookies);
+	} catch {}
+	if (behavior.cors) {
+		const origin = req.headers.origin;
+		applyCorsResponseHeadersFromConfig(res, behavior.cors, typeof origin === "string" ? origin : void 0);
+	}
+	res.end(result.body);
+}
+/** Convert a CloudFront-Function header map (`{name: CfValue}`) into the raw `{name: string[]}` form. */
+function cfHeadersToRawMap(cf) {
+	const out = {};
+	for (const [name, val] of Object.entries(cf)) if (val.multiValue && val.multiValue.length > 0) out[name] = val.multiValue.map((m) => m.value);
+	else out[name] = [val.value];
+	return out;
+}
+/** Convert a raw `{name: string[]}` header map into Node's `IncomingHttpHeaders` shape. */
+function rawMapToIncomingHeaders(headers) {
+	const out = {};
+	for (const [name, values] of Object.entries(headers)) out[name] = values.length === 1 ? values[0] : values;
+	return out;
 }
 /**
 * Convert Node's `IncomingMessage.headers` (`Record<string, string | string[]>`)
@@ -29138,9 +29584,8 @@ function setHeadersSafely(res, headers, logger) {
 		logger.warn(`Skipping invalid response header '${name}': ${err instanceof Error ? err.message : String(err)}`);
 	}
 }
-async function serveFromOrigin(origin, behavior, args) {
-	const { distribution, logger } = args;
-	if (behavior.hasLambdaEdge) logger.warn(`Behavior ${behavior.pathPattern ?? "(default)"} carries a Lambda@Edge association; cdk-local does not run Lambda@Edge — serving the origin only.`);
+async function serveFromOrigin(origin, args) {
+	const { distribution } = args;
 	if (!origin) return void 0;
 	if (origin.kind === "lambda-url") {
 		const invoke = args.lambdaInvokers.get(origin.functionLogicalId);
@@ -29165,6 +29610,20 @@ async function serveFromOrigin(origin, behavior, args) {
 			...result.cookies.length > 0 && { setCookies: result.cookies }
 		};
 	}
+	if (origin.kind === "s3-deployed") {
+		const reader = args.s3OriginReaders.get(origin.originId);
+		if (!reader) return void 0;
+		const result = await reader({
+			uri: args.uri,
+			...distribution.defaultRootObject !== void 0 && { defaultRootObject: distribution.defaultRootObject },
+			customErrorResponses: distribution.customErrorResponses
+		});
+		return {
+			statusCode: result.statusCode,
+			headers: result.headers,
+			body: result.body
+		};
+	}
 	if (origin.kind !== "s3") return void 0;
 	const result = serveFromStaticOrigin({
 		localDirs: origin.localDirs,
@@ -29182,6 +29641,8 @@ function originUnavailableMessage(origin, behavior) {
 	if (!origin) return `Behavior ${behavior.pathPattern ?? "(default)"} targets unknown origin '${behavior.targetOriginId}'.\n`;
 	if (origin.kind === "lambda-url") return `Origin '${origin.originId}' is a Lambda Function URL origin whose backing function '${origin.functionLogicalId}' was not booted (it was added after start-up). Restart start-cloudfront.\n`;
 	if (origin.kind === "custom") return `Origin '${origin.originId}' is a custom (non-S3) origin (${origin.domainName}). cdkl start-cloudfront serves S3 origins and Lambda Function URL origins only.
+`;
+	if (origin.kind === "s3-deployed") return `Origin '${origin.originId}' is a deployed-S3 origin (bucket '${origin.bucketName}') whose reader was not booted (it was promoted after start-up). Restart start-cloudfront.
 `;
 	return `Origin '${origin.originId}' is an S3 origin with no resolvable local source. Point it at a directory with --origin ${origin.originId}=<dir>.\n`;
 }
@@ -29237,6 +29698,101 @@ function listen(server, host, port) {
 	});
 }
 
+//#endregion
+//#region src/local/cloudfront-s3-origin.ts
+/**
+* Build a reader that serves a deployed S3 bucket on demand. The S3 client is
+* created lazily on first read (and reused) so an all-local distribution never
+* touches the SDK. Boot-time bound to one `bucketName`; one reader per origin.
+*/
+function createS3OriginReader(bucketName, options = {}) {
+	const fetchObject = options.fetchObject ?? defaultFetchObject(bucketName, options);
+	let deniedWarned = false;
+	return async (input) => {
+		const key = uriToKey(input.uri, input.defaultRootObject);
+		if (key !== "") {
+			const direct = await fetchObject(key);
+			if (direct.kind === "found") return {
+				statusCode: 200,
+				headers: { "content-type": contentTypeForKey(key) },
+				body: direct.body
+			};
+			if (direct.kind === "denied" && !deniedWarned) {
+				deniedWarned = true;
+				getLogger().warn(`S3 denied reading '${key}' from bucket '${bucketName}'. If this is an OAC-locked / private bucket your credentials cannot read, point the origin at a local directory with --origin <originId>=<dir> (or use credentials with s3:GetObject on the bucket). ${getEmbedConfig().cliName} start-cloudfront reads the origin from real S3.`);
+			}
+			if (direct.kind === "error") getLogger().warn(`S3 read of '${key}' from bucket '${bucketName}' failed: ${direct.message}`);
+		}
+		for (const candidate of resolveErrorResponseCandidates(input.customErrorResponses)) {
+			const page = await fetchObject(candidate.errorKey);
+			if (page.kind === "found") return {
+				statusCode: candidate.responseCode,
+				headers: { "content-type": contentTypeForKey(candidate.errorKey) },
+				body: page.body
+			};
+		}
+		return {
+			statusCode: 404,
+			headers: { "content-type": "text/plain; charset=utf-8" },
+			body: Buffer.from(`Not found: ${input.uri}\n`)
+		};
+	};
+}
+/** The default fetcher: a real S3 `GetObject`, classifying the SDK error into the outcome union. */
+function defaultFetchObject(bucketName, options) {
+	let init = null;
+	const getAccess = () => {
+		if (!init) init = (async () => {
+			const { S3Client, GetObjectCommand } = await import("@aws-sdk/client-s3");
+			return {
+				client: new S3Client({
+					...options.region && { region: options.region },
+					...options.credentials && { credentials: {
+						accessKeyId: options.credentials.accessKeyId,
+						secretAccessKey: options.credentials.secretAccessKey,
+						...options.credentials.sessionToken && { sessionToken: options.credentials.sessionToken }
+					} }
+				}),
+				GetObjectCommand
+			};
+		})();
+		return init;
+	};
+	return async (key) => {
+		try {
+			const { client, GetObjectCommand } = await getAccess();
+			const res = await client.send(new GetObjectCommand({
+				Bucket: bucketName,
+				Key: key
+			}));
+			if (!res.Body) return { kind: "not-found" };
+			const bytes = await res.Body.transformToByteArray();
+			return {
+				kind: "found",
+				body: Buffer.from(bytes)
+			};
+		} catch (err) {
+			return classifyS3Error(err);
+		}
+	};
+}
+/**
+* Classify an S3 SDK error: a missing key (`NoSuchKey` / 404) is `not-found`
+* (try the SPA fallback), an `AccessDenied` / 403 is `denied` (a credential /
+* OAC config problem), anything else is `error`.
+*/
+function classifyS3Error(err) {
+	const e = err;
+	const status = e?.$metadata?.httpStatusCode;
+	const name = e?.name;
+	if (status === 404 || name === "NoSuchKey" || name === "NotFound") return { kind: "not-found" };
+	if (status === 403 || name === "AccessDenied" || name === "Forbidden") return { kind: "denied" };
+	return {
+		kind: "error",
+		message: err instanceof Error ? err.message : String(err)
+	};
+}
+
 //#endregion
 //#region src/local/cloudfront-kvs-client.ts
 /**
@@ -29518,12 +30074,123 @@ async function bootLambdaUrlOrigins(distribution, stacks, opts) {
 		runners
 	};
 }
+/**
+* Boot one warm RIE container per unique Lambda@Edge function across the
+* distribution's behaviors (issue #400), returning the runners + an invoker map
+* keyed by backing-function logical id for {@link startCloudFrontServer}. Each
+* function gets the SAME container env as a direct `cdkl invoke` (declared env
+* vars + `--from-cfn-stack` substitution + `--assume-role` creds) via the shared
+* {@link resolveLambdaContainerEnv}. A function that cannot be booted is
+* warn-and-skipped (its edge stage will not run); booted once at start-up, NOT
+* rebuilt on a `--watch` reload.
+*/
+async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
+	const logger = getLogger();
+	const invokers = /* @__PURE__ */ new Map();
+	const runners = [];
+	const functionLogicalIds = /* @__PURE__ */ new Set();
+	for (const behavior of distribution.behaviors) {
+		const edge = behavior.lambdaEdge;
+		if (!edge) continue;
+		for (const assoc of [
+			edge.viewerRequest,
+			edge.originRequest,
+			edge.originResponse,
+			edge.viewerResponse
+		]) if (assoc) functionLogicalIds.add(assoc.functionLogicalId);
+	}
+	for (const functionLogicalId of functionLogicalIds) try {
+		const lambda = resolveLambdaTarget(functionLogicalId, stacks);
+		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials);
+		const runner = createFrontDoorLambdaRunner(lambda, {
+			containerHost: opts.containerHost,
+			skipPull: opts.skipPull,
+			...opts.envOptions.region !== void 0 && { region: opts.envOptions.region },
+			containerEnv: containerEnv.env,
+			...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
+		});
+		logger.info(`Booting Lambda@Edge container for ${functionLogicalId} (the function runs locally via RIE)...`);
+		await runner.start();
+		runners.push(runner);
+		invokers.set(functionLogicalId, (event) => runner.invoke(event));
+	} catch (err) {
+		logger.warn(`Could not boot Lambda@Edge function '${functionLogicalId}'; its stage will be skipped: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	return {
+		invokers,
+		runners
+	};
+}
 /** Emit boot-time WARNs for parts of the distribution cdk-local does not serve. */
 function warnUnsupported(distribution) {
 	const logger = getLogger();
 	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin '${origin.originId}' is a custom (non-S3, non-Lambda-Function-URL) origin (${origin.domainName}); ${getEmbedConfig().cliName} start-cloudfront serves S3 origins and Lambda Function URL origins only. Requests routed to it return 502.`);
-	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Point it at a directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
-	if (distribution.behaviors.some((b) => b.hasLambdaEdge)) logger.warn("One or more cache behaviors carry a Lambda@Edge association; cdk-local does not run Lambda@Edge functions — only CloudFront Functions + the S3 origin are served.");
+	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass --from-cfn-stack to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
+}
+/**
+* Promote each S3 origin with no local BucketDeployment source (`s3-unresolved`)
+* to a deployed-S3 read-through origin (issue #405), building one
+* {@link S3OriginReader} per origin. This is the front/back-split path: the CDK
+* repo defines the distribution + bucket but the static files were uploaded out
+* of band, so there is nothing in the cloud assembly to serve locally. Under
+* `--from-cfn-stack`, the bucket's physical NAME is resolved from deployed state
+* (`ListStackResources`) and the reader serves it from real S3 on demand.
+*
+* Returns the readers (keyed by origin id, handed to the server) + the
+* origin-id -> bucket-name map (re-applied on each `--watch` reload via
+* {@link annotateDeployedS3Origins}, since the pure resolver re-emits the origin
+* as `s3-unresolved`). A no-op without `--from-cfn-stack` or when the bucket's
+* physical id is not in state (the origin stays `s3-unresolved` -> the existing
+* boot WARN + 502, with `--origin <id>=<dir>` as the escape hatch).
+*/
+async function resolveDeployedS3Origins(distribution, stacks, options, profileCredentials, logger) {
+	const readers = /* @__PURE__ */ new Map();
+	const buckets = /* @__PURE__ */ new Map();
+	if (!isCfnFlagPresent(options)) return {
+		readers,
+		buckets
+	};
+	const synthRegion = stacks.find((s) => s.stackName === distribution.stackName)?.region;
+	const region = options.stackRegion ?? options.region ?? synthRegion;
+	const provider = createLocalStateProvider(options, distribution.stackName, synthRegion);
+	const record = provider ? await provider.load(distribution.stackName, synthRegion) : void 0;
+	for (const origin of [...distribution.origins.values()]) {
+		if (origin.kind !== "s3-unresolved" || origin.bucketLogicalId === void 0) continue;
+		const bucketName = record?.resources[origin.bucketLogicalId]?.physicalId;
+		if (!bucketName) continue;
+		readers.set(origin.originId, createS3OriginReader(bucketName, {
+			...region !== void 0 && { region },
+			...profileCredentials !== void 0 && { credentials: profileCredentials }
+		}));
+		buckets.set(origin.originId, bucketName);
+		distribution.origins.set(origin.originId, {
+			kind: "s3-deployed",
+			originId: origin.originId,
+			bucketName
+		});
+		logger.info(`Origin '${origin.originId}': no local BucketDeployment source; serving from deployed S3 (bucket=${bucketName}) on demand under --from-cfn-stack.`);
+	}
+	return {
+		readers,
+		buckets
+	};
+}
+/**
+* Re-apply the boot-time deployed-S3 promotion to a freshly re-synthed
+* distribution on a `--watch` reload: the pure resolver re-emits the origin as
+* `s3-unresolved`, so rewrite it back to `s3-deployed` (same bucket name) so it
+* dispatches to the boot-time reader. The S3 readers themselves are boot-time
+* only (like the Function URL origin containers), so nothing is rebuilt here.
+*/
+function annotateDeployedS3Origins(distribution, buckets) {
+	for (const [originId, bucketName] of buckets) {
+		const origin = distribution.origins.get(originId);
+		if (origin && origin.kind === "s3-unresolved") distribution.origins.set(originId, {
+			kind: "s3-deployed",
+			originId,
+			bucketName
+		});
+	}
 }
 async function localStartCloudFrontCommand(target, options) {
 	const logger = getLogger();
@@ -29569,8 +30236,9 @@ async function localStartCloudFrontCommand(target, options) {
 		};
 	};
 	const initial = await synthAndResolve();
-	warnUnsupported(initial.distribution);
 	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
+	const deployedS3 = await resolveDeployedS3Origins(initial.distribution, initial.stacks, options, profileCredentials, logger);
+	warnUnsupported(initial.distribution);
 	const envOptions = {
 		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
 		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
@@ -29579,24 +30247,34 @@ async function localStartCloudFrontCommand(target, options) {
 		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
 	};
 	await attachKvsModules(initial.distribution, initial.stacks, options, profileCredentials, logger);
-	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, {
+	const bootOpts = {
 		containerHost: options.host,
 		skipPull: options.pull === false,
 		envOptions,
 		...profileCredentials !== void 0 && { profileCredentials }
-	});
-	let tls;
-	if (tlsRequested) tls = await resolveFrontDoorTlsMaterials({
-		certPath: options.tlsCert,
-		keyPath: options.tlsKey
-	});
-	const server = await startCloudFrontServer({
-		distribution: initial.distribution,
-		host: options.host,
-		port: basePort,
-		...tls && { tls },
-		...lambdaInvokers.size > 0 && { lambdaInvokers }
-	});
+	};
+	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, bootOpts);
+	const { invokers: edgeInvokers, runners: edgeRunners } = await bootLambdaEdgeFunctions(initial.distribution, initial.stacks, bootOpts);
+	let server;
+	try {
+		let tls;
+		if (tlsRequested) tls = await resolveFrontDoorTlsMaterials({
+			certPath: options.tlsCert,
+			keyPath: options.tlsKey
+		});
+		server = await startCloudFrontServer({
+			distribution: initial.distribution,
+			host: options.host,
+			port: basePort,
+			...tls && { tls },
+			...lambdaInvokers.size > 0 && { lambdaInvokers },
+			...edgeInvokers.size > 0 && { edgeInvokers },
+			...deployedS3.readers.size > 0 && { s3OriginReaders: deployedS3.readers }
+		});
+	} catch (err) {
+		await Promise.all([...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch(() => void 0)));
+		throw err;
+	}
 	process.stdout.write(`CloudFront distribution serving on ${server.url}  (${initial.distribution.logicalId})\n`);
 	process.stdout.write("^C to stop.\n");
 	let watcher;
@@ -29617,6 +30295,7 @@ async function localStartCloudFrontCommand(target, options) {
 				reloadChain = reloadChain.then(async () => {
 					try {
 						const reloaded = await synthAndResolve();
+						annotateDeployedS3Origins(reloaded.distribution, deployedS3.buckets);
 						warnUnsupported(reloaded.distribution);
 						await attachKvsModules(reloaded.distribution, reloaded.stacks, options, profileCredentials, logger);
 						server.update(reloaded.distribution);
@@ -29640,8 +30319,8 @@ async function localStartCloudFrontCommand(target, options) {
 		try {
 			await server.close();
 		} catch {}
-		await Promise.all(lambdaRunners.map((r) => r.stop().catch((err) => {
-			logger.debug(`Lambda origin runner stop failed: ${err instanceof Error ? err.message : String(err)}`);
+		await Promise.all([...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch((err) => {
+			logger.debug(`Lambda runner stop failed: ${err instanceof Error ? err.message : String(err)}`);
 		})));
 		process.exit(exitCode);
 	};
@@ -29672,7 +30351,7 @@ function createLocalStartCloudFrontCommand(opts = {}) {
 * `cmd`.
 */
 function addStartCloudFrontSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <kvsLogicalId=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is the AWS::CloudFront::KeyValueStore resource logical id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind a Lambda Function URL origin's backing Lambda to a deployed CloudFormation stack so its env vars resolve to the deployed physical IDs / exports (ListStackResources). Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs. No effect on a pure-S3 distribution.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's deployed execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
+	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <kvsLogicalId=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is the AWS::CloudFront::KeyValueStore resource logical id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind to a deployed CloudFormation stack (ListStackResources). Resolves an S3 origin that has no local BucketDeployment source to its deployed bucket and serves it from real S3 on demand (the front/back-split case: files uploaded out of band), and resolves a Lambda Function URL / Lambda@Edge function's env vars to the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's deployed execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
@@ -34707,5 +35386,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { createUnboundCloudFrontModule as $, pickResponseTemplate as $n, resolveAgentCoreTarget as $r, AGENTCORE_SESSION_ID_HEADER as $t, parseOriginOverrides as A, buildCognitoJwksUrl as An, CfnLocalStateProvider as Ar, describePinnedImageUri as At, CLOUDFRONT_DISTRIBUTION_TYPE as B, invokeTokenAuthorizer as Bn, filterWebSocketApisByIdentifiers as Br, addInvokeAgentCoreSpecificOptions as Bt, addListSpecificOptions as C, filterRoutesByApiIdentifiers as Cn, LocalStateSourceError as Cr, ImageOverrideError as Ct, addStartCloudFrontSpecificOptions as D, resolveSelectionExpression as Dn, resolveCfnFallbackRegion as Dr, parseImageOverrideFlags as Dt, LocalStartCloudFrontError as E, startApiServer as En, rejectExplicitCfnStackWithMultipleStacks as Er, mergeForService as Et, resolveDeployedKvsArnByName as F, verifyJwtViaDiscovery as Fn, countTargets as Fr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Ft, pickTargetFunctionLogicalId as G, isFunctionUrlOacFronted as Gn, resolveLambdaArnIntrinsic as Gr, a2aInvokeOnce as Gt, isCloudFrontDistribution as H, applyCorsResponseHeaders as Hn, webSocketApiMatchesIdentifier as Hr, invokeAgentCoreWs as Ht, matchBehavior as I, buildMethodArn as In, listTargets as Ir, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as It, runViewerRequest as J, translateLambdaResponse as Jn, AGENTCORE_HTTP_PROTOCOL as Jr, MCP_PROTOCOL_VERSION as Jt, resolveCloudFrontDistribution as K, matchPreflight as Kn, AGENTCORE_A2A_PROTOCOL as Kr, MCP_CONTAINER_PORT as Kt, startCloudFrontServer as L, computeRequestIdentityHash as Ln, availableWebSocketApiIdentifiers as Lr, setShadowReadyTimeoutMs as Lt, idFromArn as M, createJwksCache as Mn, resolveSsmParameters as Mr, listPinnedTargets as Mt, resolveKvsModulesForDistribution as N, verifyCognitoJwt as Nn, resolveWatchConfig as Nr, buildCloudMapIndex as Nt, createLocalStartCloudFrontCommand as O, resolveServiceIntegrationParameters as On, resolveCfnRegion as Or, resolveImageOverrides as Ot, createDeployedKvsDataSource as P, verifyJwtAuthorizer as Pn, resolveSingleTarget as Pr, CloudMapRegistry as Pt, createLocalFileKvsDataSource as Q, evaluateResponseParameters as Qn, pickAgentCoreCandidateStack as Qr, signAgentCoreInvocation as Qt, serveFromStaticOrigin as R, evaluateCachedLambdaPolicy as Rn, discoverWebSocketApis as Rr, getContainerNetworkIp as Rt, StudioEventBus as S, filterRoutesByApiIdentifier as Sn, substituteEnvVarsFromStateAsync as Sr, runEcsServiceEmulator as St, formatTargetListing as T, readMtlsMaterialsFromDisk as Tn, isCfnFlagPresent as Tr, enforceImageOverrideOrphans as Tt, pickFunctionUrlLogicalIdFromOrigin as U, buildCorsConfigByApiId as Un, discoverRoutes as Ur, A2A_CONTAINER_PORT as Ut, extractKvsAssociations as V, attachAuthorizers as Vn, parseSelectionExpressionPath as Vr, createLocalInvokeAgentCoreCommand as Vt, pickKvsLogicalIdFromArn as W, buildCorsConfigFromCloudFrontChain as Wn, pickRefLogicalId as Wr, A2A_PATH as Wt, stripCloudFrontImport as X, buildHttpApiV2Event as Xn, AGENTCORE_RUNTIME_TYPE as Xr, parseSseForJsonRpc as Xt, runViewerResponse as Y, applyAuthorizerOverlay as Yn, AGENTCORE_MCP_PROTOCOL as Yr, mcpInvokeOnce as Yt, createCloudFrontModule as Z, buildRestV1Event as Zn, AgentCoreResolutionError as Zr, AGENTCORE_SIGV4_SERVICE as Zt, filterStudioTargetGroups as _, attachStageContext as _n, resolveRuntimeImage as _r, ecsClusterOption as _t, createLocalStudioCommand as a, buildStsClientConfig as ai, computeCodeImageTag as an, bufferToBody as ar, isApplicationLoadBalancer as at, renderStudioHtml as b, resolveEnvVars$1 as bn, substituteAgainstStateAsync as br, resolveEcsAssumeRoleOption as bt, startStudioProxy as c, classifySourceChange as cn, handleConnectionsRequest as cr, createLocalStartServiceCommand as ct, createStudioDispatcher as d, addStartApiSpecificOptions as dn, buildDisconnectEvent as dr, createLocalRunTaskCommand as dt, derivePseudoParametersFromRegion as ei, invokeAgentCore as en, selectIntegrationResponse as er, addAlbSpecificOptions as et, filterStudioCustomResources as f, createLocalStartApiCommand as fn, buildMessageEvent as fr, MAX_TASKS_SUBNET_RANGE_CAP as ft, annotatePinnedEcsTargets as g, createFileWatcher as gn, resolveRuntimeFileExtension as gr, buildEcsImageResolutionContext$1 as gt, annotateEcsTaskPinnedTargets as h, createAuthorizerCache as hn, resolveRuntimeCodeMountPath as hr, addImageOverrideOptions as ht, coerceStopRequest as i, LocalInvokeBuildError as ii, buildAgentCoreCodeImage as in, probeHostGatewaySupport as ir, resolveAlbTarget as it, resolveCloudFrontTarget as j, buildJwksUrlFromIssuer as jn, collectSsmParameterRefs as jr, isLocalCdkAssetImage as jt, parseKvsFileOverrides as k, defaultCredentialsLoader as kn, resolveCfnStackName as kr, runImageOverrideBuilds as kt, relayServeRequest as l, addInvokeSpecificOptions as ln, parseConnectionsPath as lr, serviceStrategy as lt, annotateAlbPinnedBackingServices as m, resolveApiTargetSubset as mn, buildContainerImage as mr, addEcsAssumeRoleOptions as mt, coerceRunRequest as n, substituteImagePlaceholders as ni, downloadAndExtractS3Bundle as nn, VtlEvaluationError as nr, createLocalStartAlbCommand as nt, resolveServeBaseUrl as o, resolveProfileCredentials as oi, renderCodeDockerfile as on, ConnectionRegistry as or, resolveAlbFrontDoor as ot, isCustomResourceLambdaTarget as p, createWatchPredicates as pn, architectureToPlatform as pr, addCommonEcsServiceOptions as pt, compileCloudFrontFunction as q, matchRoute as qn, AGENTCORE_AGUI_PROTOCOL as qr, MCP_PATH as qt, coerceServeRequest as r, tryResolveImageFnJoin as ri, SUPPORTED_CODE_RUNTIMES as rn, HOST_GATEWAY_MIN_VERSION as rr, parseLbPortOverrides as rt, createStudioServeManager as s, toCmdArgv as sn, buildMgmtEndpointEnvUrl as sr, addStartServiceSpecificOptions as st, addStudioSpecificOptions as t, formatStateRemedy as ti, waitForAgentCorePing as tn, tryParseStatus as tr, albStrategy as tt, reinvoke as u, createLocalInvokeCommand as un, buildConnectEvent as ur, addRunTaskSpecificOptions as ut, startStudioServer as v, buildStageMap as vn, EcsTaskResolutionError as vr, parseMaxTasks as vt, createLocalListCommand as w, groupRoutesByServer as wn, createLocalStateProvider as wr, buildImageOverrideTag as wt, createStudioStore as x, availableApiIdentifiers as xn, substituteEnvVarsFromState as xr, resolveSharedSidecarCredentials as xt, toStudioTargetGroups as y, materializeLayerFromArn as yn, substituteAgainstState as yr, parseRestartPolicy as yt, serveLambdaUrlOrigin as z, invokeRequestAuthorizer as zn, discoverWebSocketApisOrThrow as zr, attachContainerLogStreamer as zt };
-//# sourceMappingURL=local-studio-DPEUB-rH.js.map
+export { pickKvsLogicalIdFromArn as $, buildCorsConfigByApiId as $n, discoverRoutes as $r, A2A_CONTAINER_PORT as $t, parseOriginOverrides as A, resolveEnvVars$1 as An, substituteAgainstStateAsync as Ar, resolveEcsAssumeRoleOption as At, resolveErrorResponseCandidates as B, buildCognitoJwksUrl as Bn, CfnLocalStateProvider as Br, describePinnedImageUri as Bt, addListSpecificOptions as C, createWatchPredicates as Cn, architectureToPlatform as Cr, addCommonEcsServiceOptions as Ct, addStartCloudFrontSpecificOptions as D, attachStageContext as Dn, resolveRuntimeImage as Dr, ecsClusterOption as Dt, LocalStartCloudFrontError as E, createFileWatcher as En, resolveRuntimeFileExtension as Er, buildEcsImageResolutionContext$1 as Et, resolveDeployedKvsArnByName as F, readMtlsMaterialsFromDisk as Fn, isCfnFlagPresent as Fr, enforceImageOverrideOrphans as Ft, buildEdgeRequestEvent as G, verifyJwtViaDiscovery as Gn, countTargets as Gr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Gt, serveLambdaUrlOrigin as H, createJwksCache as Hn, resolveSsmParameters as Hr, listPinnedTargets as Ht, classifyS3Error as I, startApiServer as In, rejectExplicitCfnStackWithMultipleStacks as Ir, mergeForService as It, httpHeadersToEdge as J, evaluateCachedLambdaPolicy as Jn, discoverWebSocketApis as Jr, getContainerNetworkIp as Jt, buildEdgeResponseEvent as K, buildMethodArn as Kn, listTargets as Kr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Kt, createS3OriginReader as L, resolveSelectionExpression as Ln, resolveCfnFallbackRegion as Lr, parseImageOverrideFlags as Lt, idFromArn as M, filterRoutesByApiIdentifier as Mn, substituteEnvVarsFromStateAsync as Mr, runEcsServiceEmulator as Mt, resolveKvsModulesForDistribution as N, filterRoutesByApiIdentifiers as Nn, LocalStateSourceError as Nr, ImageOverrideError as Nt, createLocalStartCloudFrontCommand as O, buildStageMap as On, EcsTaskResolutionError as Or, parseMaxTasks as Ot, createDeployedKvsDataSource as P, groupRoutesByServer as Pn, createLocalStateProvider as Pr, buildImageOverrideTag as Pt, pickFunctionUrlLogicalIdFromOrigin as Q, applyCorsResponseHeaders as Qn, webSocketApiMatchesIdentifier as Qr, invokeAgentCoreWs as Qt, matchBehavior as R, resolveServiceIntegrationParameters as Rn, resolveCfnRegion as Rr, resolveImageOverrides as Rt, StudioEventBus as S, createLocalStartApiCommand as Sn, buildMessageEvent as Sr, MAX_TASKS_SUBNET_RANGE_CAP as St, formatTargetListing as T, createAuthorizerCache as Tn, resolveRuntimeCodeMountPath as Tr, addImageOverrideOptions as Tt, applyEdgeRequestResult as U, verifyCognitoJwt as Un, resolveWatchConfig as Ur, buildCloudMapIndex as Ut, serveFromStaticOrigin as V, buildJwksUrlFromIssuer as Vn, collectSsmParameterRefs as Vr, isLocalCdkAssetImage as Vt, applyEdgeResponseResult as W, verifyJwtAuthorizer as Wn, resolveSingleTarget as Wr, CloudMapRegistry as Wt, extractKvsAssociations as X, invokeTokenAuthorizer as Xn, filterWebSocketApisByIdentifiers as Xr, addInvokeAgentCoreSpecificOptions as Xt, CLOUDFRONT_DISTRIBUTION_TYPE as Y, invokeRequestAuthorizer as Yn, discoverWebSocketApisOrThrow as Yr, attachContainerLogStreamer as Yt, isCloudFrontDistribution as Z, attachAuthorizers as Zn, parseSelectionExpressionPath as Zr, createLocalInvokeAgentCoreCommand as Zt, filterStudioTargetGroups as _, toCmdArgv as _n, buildMgmtEndpointEnvUrl as _r, addStartServiceSpecificOptions as _t, createLocalStudioCommand as a, AGENTCORE_MCP_PROTOCOL as ai, mcpInvokeOnce as an, applyAuthorizerOverlay as ar, runViewerResponse as at, renderStudioHtml as b, createLocalInvokeCommand as bn, buildConnectEvent as br, addRunTaskSpecificOptions as bt, startStudioProxy as c, pickAgentCoreCandidateStack as ci, signAgentCoreInvocation as cn, evaluateResponseParameters as cr, createLocalFileKvsDataSource as ct, createStudioDispatcher as d, formatStateRemedy as di, waitForAgentCorePing as dn, tryParseStatus as dr, albStrategy as dt, pickRefLogicalId as ei, A2A_PATH as en, buildCorsConfigFromCloudFrontChain as er, pickLambdaEdgeFunctionLogicalId as et, filterStudioCustomResources as f, substituteImagePlaceholders as fi, downloadAndExtractS3Bundle as fn, VtlEvaluationError as fr, createLocalStartAlbCommand as ft, annotatePinnedEcsTargets as g, resolveProfileCredentials as gi, renderCodeDockerfile as gn, ConnectionRegistry as gr, resolveAlbFrontDoor as gt, annotateEcsTaskPinnedTargets as h, buildStsClientConfig as hi, computeCodeImageTag as hn, bufferToBody as hr, isApplicationLoadBalancer as ht, coerceStopRequest as i, AGENTCORE_HTTP_PROTOCOL as ii, MCP_PROTOCOL_VERSION as in, translateLambdaResponse as ir, runViewerRequest as it, resolveCloudFrontTarget as j, availableApiIdentifiers as jn, substituteEnvVarsFromState as jr, resolveSharedSidecarCredentials as jt, parseKvsFileOverrides as k, materializeLayerFromArn as kn, substituteAgainstState as kr, parseRestartPolicy as kt, relayServeRequest as l, resolveAgentCoreTarget as li, AGENTCORE_SESSION_ID_HEADER as ln, pickResponseTemplate as lr, createUnboundCloudFrontModule as lt, annotateAlbPinnedBackingServices as m, LocalInvokeBuildError as mi, buildAgentCoreCodeImage as mn, probeHostGatewaySupport as mr, resolveAlbTarget as mt, coerceRunRequest as n, AGENTCORE_A2A_PROTOCOL as ni, MCP_CONTAINER_PORT as nn, matchPreflight as nr, resolveCloudFrontDistribution as nt, resolveServeBaseUrl as o, AGENTCORE_RUNTIME_TYPE as oi, parseSseForJsonRpc as on, buildHttpApiV2Event as or, stripCloudFrontImport as ot, isCustomResourceLambdaTarget as p, tryResolveImageFnJoin as pi, SUPPORTED_CODE_RUNTIMES as pn, HOST_GATEWAY_MIN_VERSION as pr, parseLbPortOverrides as pt, edgeHeadersToHttp as q, computeRequestIdentityHash as qn, availableWebSocketApiIdentifiers as qr, setShadowReadyTimeoutMs as qt, coerceServeRequest as r, AGENTCORE_AGUI_PROTOCOL as ri, MCP_PATH as rn, matchRoute as rr, compileCloudFrontFunction as rt, createStudioServeManager as s, AgentCoreResolutionError as si, AGENTCORE_SIGV4_SERVICE as sn, buildRestV1Event as sr, createCloudFrontModule as st, addStudioSpecificOptions as t, resolveLambdaArnIntrinsic as ti, a2aInvokeOnce as tn, isFunctionUrlOacFronted as tr, pickTargetFunctionLogicalId as tt, reinvoke as u, derivePseudoParametersFromRegion as ui, invokeAgentCore as un, selectIntegrationResponse as ur, addAlbSpecificOptions as ut, startStudioServer as v, classifySourceChange as vn, handleConnectionsRequest as vr, createLocalStartServiceCommand as vt, createLocalListCommand as w, resolveApiTargetSubset as wn, buildContainerImage as wr, addEcsAssumeRoleOptions as wt, createStudioStore as x, addStartApiSpecificOptions as xn, buildDisconnectEvent as xr, createLocalRunTaskCommand as xt, toStudioTargetGroups as y, addInvokeSpecificOptions as yn, parseConnectionsPath as yr, serviceStrategy as yt, startCloudFrontServer as z, defaultCredentialsLoader as zn, resolveCfnStackName as zr, runImageOverrideBuilds as zt };
+//# sourceMappingURL=local-studio-D7SkLbCO.js.map