cdk-local 0.146.2 → 0.147.1

package/dist/local-studio-BBA_8Xvk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-studio-BBA_8Xvk.d.ts","names":[],"sources":["../src/types/resource.ts","../src/types/state.ts","../src/local/state-resolver.ts","../src/local/ssm-parameter-resolver.ts","../src/local/local-state-provider.ts","../src/cli/commands/local-state-source.ts","../src/local/embed-config.ts","../src/synthesis/assembly-reader.ts","../src/local/lambda-resolver.ts","../src/cli/commands/local-invoke.ts","../src/local/intrinsic-image.ts","../src/local/agentcore-ws-client.ts","../src/cli/commands/local-invoke-agentcore.ts","../src/cli/config-loader.ts","../src/local/httpv2-service-integration.ts","../src/local/integration-response-selector.ts","../src/local/rest-v1-integrations.ts","../src/local/route-discovery.ts","../src/local/websocket-route-discovery.ts","../src/local/authorizer-resolver.ts","../src/cli/commands/local-start-api.ts","../src/local/ecs-task-resolver.ts","../src/cli/commands/local-run-task.ts","../src/utils/error-handler.ts","../src/local/target-lister.ts","../src/local/ecs-service-runner.ts","../src/local/alb-path-matcher.ts","../src/local/elb-front-door-resolver.ts","../src/cli/commands/ecs-service-emulator.ts","../src/cli/commands/local-start-service.ts","../src/cli/commands/local-start-alb.ts","../src/cli/commands/local-start-cloudfront.ts","../src/cli/commands/local-start-agentcore.ts","../src/cli/commands/local-list.ts","../src/local/studio-events.ts","../src/local/studio-child-args.ts","../src/local/studio-option-specs.ts","../src/local/studio-option-catalog.ts","../src/local/studio-dispatch.ts","../src/local/studio-proxy.ts","../src/local/studio-serve-manager.ts","../src/cli/commands/local-studio.ts"],"mappings":";;;;;;UAGiB;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EACA;IACE;;;;;UC2Ha;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EAwBA;;;;KCrJU;EACN;EAAiB;;EACjB;EAAoB;;UAYT;EACf;EACA;EACA;EACA;;UAqBe;EAMf,cAAc,qBAAqB;EAQnC,sBACE,uBACA,wBACA,qBACC;;UAGY;EAEf,WAAW,eAAe;EAa1B,aAAa;EAUb,sBAAsB;EAStB,gCAAgC;EAEhC,mBAAmB;EAOnB,qBAAqB;EAOrB;;iBAiBc,uBACd,gBACA,oBAAoB,sBAAsB,eAAe,iBACxD;iBA0hBmB,4BACpB,gBACA,oBAAoB,sBAAsB,eAAe,iBACxD,QAAQ;UAiPM;EAEf;EAMA,YAAY;IAAQ;IAAa;;EAOjC;;iBAcc,2BACd,aAAa,qCACb,oBAAoB,sBAAsB,eAAe;EACtD,KAAK;EAAyB,OAAO;;iBAiGpB,gCACpB,aAAa,qCACb,oBAAoB,sBAAsB,eAAe,iBACxD;EAAU,KAAK;EAAyB,OAAO;;;;UCtlCjC;EAEf;EAEA;EAEA;;UAYe;EAEf,QAAQ;EAER;;iBAec,wBACd,UAAU,KAAK,oDACd;iBAiDmB,qBACpB,QAAQ,WACR,eAAe,mBACf,gBACC,QAAQ;;;UC7FM;EAWf,WAAW,eAAe;EAO1B,SAAS;EAOT;;UAsBe;WAMN;EAQT,KAAK,mBAAmB,kCAAkC,QAAQ;EAalE,wBAAwB,yBAAyB,QAAQ;EA4BzD,4BACE,6BACC,QAAQ;EA0BX,+BAA+B,6BAA6B;EA4B5D,gCAAgC,4BAA4B;EA4B5D,8BAA8B,UAAU,yBAAyB,QAAQ;EAiBzE;EAKA;;;;UClNe;EAOf;EAEA;EAEA;EAMA;GAEC;;KAQS,6BAA6B,SAAS,4BAA4B;KAUlE,sBAAsB,eAAe;iBAUjC,oBAAoB,gCAAgC;iBAapD,iBAAiB,MAAM,KAAK;iBAgB5B,iBACd,SAAS,KAAK,oDACd;iBAqCoB,yBACpB,SAAS,KAAK,sDACd,kCACC;cAUU,8BAA8B;EACzC,YAAY;;iBAkBE,yCACd,SAAS,KAAK,0CACd;iBAiCc,yBACd,SAAS,yBACT,mBACA,iCACA,sBAAsB,sBACrB;;;UCrNc;EAMf;EAOA;EAMA;EAOA;EAMA;EAMA;EAQA;EAOA;;UAGe;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAsBc,eAAe,SAAS;iBAcxB,kBAAkB;iBAKlB;;;UC5GC;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAOA;EAcA,kBAAkB;;;;KC3BR,iBAAiB,oBAAoB;UAEvC;EAER,OAAO;EAEP;EAEA,UAAU;EAEV;EAEA;EA6BA,QAAQ;EAmBR;;KAkBU,sBAAsB,2BAA2B;UAE5C;EACf;EAMA;EAQA;;UAGe;EACf;EAMA;EAQA;EAEA;EAEA;EAEA;EAEA;;UAGe,0BAA0B;EACzC;EAEA;EAEA;EASA;EAKA;EAQA;;UAGe,4BAA4B;EAC3C;EASA;EAOA;IACE;IACA;IACA;;EASF;;;;UCjEe;EACf,sBAAsB;EAEtB,cAAc;;iBA4gCA,yBAAyB,OAAM,kCAAuC;iBA0CtE,yBAAyB,KAAK,UAAU;;;UC7qCvC;EAOf;IACE;IACA;IACA;IACA;;EASF,iBAAiB,eAAe;EAWhC,kBAAkB;EAQlB;EAWA;;iBAiBc,kBAAkB,SAAS;iBAiC3B,iCACd,4BACA;EACG;EAAoB;EAAgB;EAAmB;;KAiChD;EACN;;EACA;EAAkB;;EAClB;EAAqB;;EACrB;EAA0B;;iBA2BhB,sBACd,cACA,WAAW,eAAe,mBAC1B,SAAS,qCACR;iBAwSa,4BACd,cACA,WAAW,eAAe,mBAC1B,SAAS;;;UCteM;EAEf;EAEA,YAAY;EAEZ;EAOA;EAUA,cAAc;EAWd,cAAc;EAEd,uBAAuB;;UAGR;EAEf;;UAiBe;EAEf;EAMA;EAEA,YAAY;EAEZ;EAEA,WAAW;EAEX,WAAW,KAAK;EAEhB,cAAc;EAEd,uBAAuB;;UAYR;EAKf,OAAO;EAEP;;iBAUc,kBACd,cACA,cACA,SAAS,2BACR;iBAuFmB,kBACpB,cACA,cACA,gBACA,SAAS,2BACR,QAAQ;;;UCSM;EACf,sBAAsB;EAEtB,cAAc;;iBA0/DA,kCACd,OAAM,2CACL;iBAiDa,kCAAkC,KAAK,UAAU;;;UCruEhD;EAEf;EAEA;;iBAec,sBAAsB;;;KCS1B;;;UCnCK;EAEf;EAOA;EAaA,qBAAqB;EAQrB,oBAAoB;EAEpB;;UAOe;EAEf,OAAO;EAEP;;iBA0Bc,0BACd,SAAS,wCACT,qBACA,8BACC;iBAwDa,eAAe;iBAwCf,2BACd,oBAAoB,oCACpB;EAAQ,iBAAiB,aAAa,eAAe;IACpD;iBA2Ca,qBACd,mBAAmB,oCACnB;EACG;EAAkB;;;;UC/GN;EACf;EAOA;EAEA,WAAW;;UA8FI;EACf;EAEA;EAEA;EAMA,oBAAoB;EAEpB,WAAW;;UAsGI;EACf;EACA;EACA;EACA,oBAAoB;EAEpB,mBAAmB;EACnB,WAAW;;UA2II;EACf;EAEA;EAEA,mBAAmB;EAEnB,WAAW;;;;KClfD,0BACR,wBACA,6BACA,wBACA;UAmCa;EAEf;EAEA;EAEA;EAEA;EAEA;EAUA;EAgBA;EAQA;EAWA;EAOA,iBAAiB;EAWjB;EAsBA;IAAgB;;EAgBhB;IAAa;IAAoB,SAAS;;EAgB1C;IACE,SAAS;IACT,mBAAmB,SAAS;IAC5B,qBAAqB,SAAS,eAAe,SAAS;;EAaxD,oBAAoB;EAEpB;;iBAoBc,eAAe,iBAAiB,cAAc;;;UC9M7C;EAEf;EAEA;EAEA;EAMA;EAQA;EAOA;EAaA,QAAQ;EAiBR;IAAgB;;;UAID;EAEf;EAEA;EAEA;EAEA;;iBAuBc,sBAAsB,iBAAiB;EACrD,MAAM;EACN;;iBA8Bc,6BACd,iBAAiB,cAChB;iBAgJa,6BAA6B;iBA8L7B,8BACd,KAAK,wBACL;iBAiBc,iCACd,eAAe,0BACf,iCACC;iBAWa,iCACd,eAAe;;;UCzdA;EACf;EAEA;EAEA;EAMA;EAEA;EAEA;;UAGe;EACf;EACA;EACA;EAEA,iBAAiB,cAAc;EAE/B;EAEA;EACA;;UASe;EAEf;EAEA;EAEA;;UAGe;EACf;EACA;EAWA,OAAO,cAAc;EAOrB;EAEA;EAEA;EAYA;;UAGe;EACf;EACA;EAEA;EAKA,UAAU;EAMV;EACA;EACA;;UAae;EACf;EAEA;EACA;EAYA;;KAGU,iBACR,wBACA,0BACA,4BACA,gBACA;KAEQ;EACN;EAAgB;;EAChB;EAAe;;EACf;EAAiB;;EACjB;EAAwB;;UAucb;EACf,OADe;EAEf,aAAa;;iBAGC,kBACd,iBAAiB,aACjB,iBADiB,oBAEhB;;;UCpVc;EACf,sBAAsB;EAEtB,cAAc;;UAkiCC;EAEf,UAAU;EAEV,gBAAgB;EAEhB;;iBAmBc,sBAAsB;EACpC;EACA;EACA,aAAa;IACX;UA8Ga;WAEN,UAAU;WAOV,uBAAuB;WAEvB;;iBA2BK,uBACd,iBAAiB,iBACjB,gCACA,+BACA,yBAAwB,2BACvB;iBA4pEa,2BAA2B,OAAM,oCAAyC;iBAuC1E,2BAA2B,KAAK,UAAU;;;UCvrHzC;EAEf,OAAO;EAEP;EAEA,UAAU;EAMV;EAMA;EAeA;EAEA;EACA,YAAY;EACZ,SAAS;EAMT;IAAoB;IAAqC;;EAKzD;;UAGe;EACf;EACA,OAAO;EACP;EACA;EACA;EAEA,aAAa;EAOb;EAEA;IAAW;IAAc;;EAOzB;IACE;IACA;IACA;IACA;;EAEF;IAAe;IAAsB;IAAuB;;EAC5D;IAAa;IAAuB;;EACpC;EAEA;EACA;IACE;IACA;IACA;IACA;IACA;;EAEF;EACA;EACA;EACA;IAAW;IAAc;IAAmB;;EAO5C;;KAGU;EACN;EAAmB;;EACnB;EAAa;EAAa;EAAiB;;EAC3C;EAAgB;;UAEL;EACf;EACA;EAEA;EAKA;IACE;IACA;IACA;IACA,aAAa;IACb,SAAS;;;cAIA,+BAA+B;EAC1C,YAAY;;KAqDF,4BAA4B;;;UCzDvB;EACf,sBAAsB;EAEtB,cAAc;;iBAmkBA,0BAA0B,OAAM,mCAAwC;iBA4JxE,0BAA0B,KAAK,UAAU;;;cC33B5C,sBAAsB;WACjB;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;cAkBxC,8BAA8B;EACzC,YAAY,iBAAiB,QAAQ;;;;UCRtB;EAEf;EAEA;EAKA;EAMA;EAOA;EASA;EAQA;;UAOe;EAEf,SAAS;EAMT,MAAM;EAEN,aAAa;EAEb,oBAAoB;EAEpB,mBAAmB;EAEnB,eAAe;EAEf,yBAAyB;;iBAwKX,YAAY,iBAAiB,cAAc;iBAuC3C,aAAa,SAAS;;;cCvNzB;cA+gCA;iBAgBG,wBAAwB;;;UCtiCvB;EAEf;EAEA;;UAIe;EAEf;EAEA;;;;KCCU,yBAAyB,qBAAqB;UAGzC;EACf;EAEA;EAEA;EAEA;EAEA;EAMA;;UAgBe;EACf;EAEA;EAEA;EAMA;EAMA;;UAIe;EACf;EAEA;EAEA;EAEA;EAEA;EAEA;EAEA;;UAIe;EACf;EAEA;EAEA;EAEA;;UAIe;EACf;EAEA,SAAS;;UAcM;EACf;EAEA;EAEA;EAEA;EAEA;EAOA;EAEA;;KAIU,yBACR,yBACA,0BACA;UAGa;EAEf;EAEA;EAEA;EAEA,sBAAsB;EAEtB;EAEA,uBAAuB;EAEvB;EAEA,QAAQ;EAMR,YAAY;;UAIG;EAEf;EAEA;EAEA;EAOA,gBAAgB;EAKhB,mBAAmB;EAEnB,OAAO;;UAGQ;EAEf,WAAW;EAEX;;iBAQc,oBACd,OAAO,WACP,uBACC;iBA2Ha,0BAA0B,UAAU;;;UCnQnC;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EAEA;EASA;EACA;EASA;EACA;EAEA;EAEA;EASA;EAOA;EAMA;EAOA;EAMA;EACA;EAEA;EAEA;EAKA;EACA;EAaA;EAeA;EAWA;EAOA;EASA;EASA;EASA;EAOA;EAUA;GAEC;;UAIc;EAEf;;KAQU,uBAAuB,0BAA0B;UAG5C;EACf;EAEA;EAEA;EAEA;EAEA;;UAIe;EACf;EAEA,QAAQ;EAER;EAEA;EAEA;;UAIe;EACf;EACA,SAAS;;UAIM;EACf;EACA;EACA;EACA;EACA;EACA;EACA;;UAIe;EACf;EACA;EACA;EACA;;KAIU,gBACR,uBACA,wBACA;UAGa;EAEf;EAEA;EAEA;EAEA,gBAAgB;EAEhB,mBAAmB;EAEnB,OAAO;IACL;IACA;IACA;IACA,sBAAsB;IACtB;IACA,uBAAuB;IACvB;IACA,QAAQ;IAER,YAAY;;;UAKC;EACf,WAAW;;UAgBI;EACf,YAAY,QAAQ,cAAc;EAClC;EACA;EACA,aAAa;EACb,aACE,QAAQ,aACR;IACG,OAAO;IAAe,YAAY;IAAe;;EACtD,iBAAiB;EAQjB;EAeA;;iBASoB,sBACpB,mBACA,SAAS,2BACT,UAAU,kBACV,qBAAqB,kCACpB;iBAw4DmB,+BACpB,gBACA,QAAQ,aACR,SAAS,2BACT,eAAe,gCACf;EAAQ;IACP,QAAQ;cA8NE;iBAEG,cAAc;iBAWd,mBAAmB;iBA6Db,gCAAgC;EACpD;IACE;EAAU;EAAqB;EAAyB;;iBAyL5C,oBAAoB;iBAmBpB,wBAAwB,KAAK,UAAU;iBAkDvC,2BAA2B;EACzC;EACA;;iBAwBc,2BAA2B,KAAK,UAAU;iBA6H1C,wBAAwB,KAAK,UAAU;;;UC9gGtC;EACf,sBAAsB;EAEtB,cAAc;;iBAgBA,mBAAmB;iBA2BnB,+BACd,OAAM,wCACL;iBAsDa,+BAA+B,KAAK,UAAU;;;UC9F7C;EACf,sBAAsB;EAEtB,cAAc;;iBAWA,qBAAqB,+BAA+B;iBA+BpD,iBACd,gBACA,QAAQ;EACL,OAAO;EAAW;;iBA8EP,YAAY,SAAS,4BAA4B;iBAmKjD,2BAA2B,OAAM,oCAAyC;iBAyD1E,sBAAsB,KAAK,UAAU;;;cCxTxC,kCAAkC;EAC7C,YAAY,iBAAiB,QAAQ;;UAuDtB;EAEf,cAAc;EAOd,sBAAsB;;iBASR,qBAAqB,+BAA+B;iBAuBpD,sBAAsB,+BAA+B;iBA4DrD,qBACd,UAAU,qBACV,UAAU,yBACT;iBAkGa,wBACd,gBACA,QAAQ;EACL,OAAO;EAAW;;iBA4nBP,kCACd,OAAM,2CACL;iBAsCa,kCAAkC,KAAK,UAAU;;;UC7ShD;EACf,sBAAsB;EAEtB,cAAc;;iBAYA,iCACd,OAAM,0CACL;iBAqCa,iCAAiC,KAAK,UAAU;;;UC/sB/C;EAEf,cAAc;;UAyCC;EAOf;;iBAYc,oBACd,SAAS,eACT,iBACA,UAAS;iBA6EK,uBAAuB,OAAM,gCAAqC;iBA4ClE,uBAAuB,KAAK,UAAU;;;KC5N1C;UAmBK;EAEf;EAEA;EAEA;EAEA,MAAM;EAEN;EAEA;EAEA;EAEA;EAEA;EAKA;;UAQe;EAEf;EAEA;EAEA;EAEA;EAEA;;UAae;EAEf;EAEA;EAEA,MAAM;EAEN;EAMA;EAQA;EAEA;EAEA;;UAMQ;EACR,aAAa;EACb,MAAM;EACN,QAAQ;;cAYG;mBACM;EAEjB;EAMA,KAAK,gBAAgB,gBAAgB,OAAO,MAAM,MAAM,eAAe;EAIvE,GAAG,gBAAgB,gBACjB,OAAO,GACP,cAAc,MAAM,eAAe;EAMrC,IAAI,gBAAgB,gBAClB,OAAO,GACP,cAAc,MAAM,eAAe;EAWrC,cAAc,gBAAgB,gBAAgB,OAAO;;;;UCjJtC;EAEf;EAWA;EAEA;EAEA;EAEA,UAAU;EAOV;EAOA;;;;UCuCe;EACf;EACA;;KAIU,eAAe,kCAAkC;;;KCgNjD,gBAAgB;;;UCxRX;EAEf;EAMA,MAAM;EAEN;EAEA,UAAU;EAQV,cAAc;EAMd;EAMA;EASA,iBAAiB;EAOjB;;UAIe;EAEf;EAEA;EAMA;EAEA;EAEA;EAEA;EAEA;;UAIe,6BAA6B;EAE5C;EAEA,KAAK;EAEL;EAEA;EAEA,iBAAiB;EAEjB;EAEA;;UAIe;EACf,MAAM,KAAK,qBAAqB,QAAQ;;iBA0B1B,uBAAuB,QAAQ,uBAAuB;;;UCtIrD;EAEf,KAAK;EAEL;EAEA,MAAM;EAEN;EAEA;EAEA;EAEA;EAMA;;UAIe;EAEf;EAEA;EAEA,aAAa;;iBAuBC,iBAAiB,QAAQ,oBAAoB,QAAQ;;;UC5CpD;EAEf;EAEA,MAAM;EAEN,UAAU;EAOV,cAAc;EAMd;EAOA;EAQA,iBAAiB;;UAIF;EAEf;;UAIe;EAEf;EAEA,MAAM;EAEN;EAEA;EAWA;EAEA;EAEA;;UAIe,iCAAiC;EAEhD;EAEA,KAAK;EASL;EAEA;EAEA;EAEA,iBAAiB;EAEjB;EAMA;EASA;EAEA,sBAAsB;EAEtB,wBAAwB;EAMxB,gBAAgB,QAAQ,sBAAsB,QAAQ;EAOtD;;UAIe;EAEf,QAAQ,KAAK,uBAAuB,QAAQ;EAE5C,OAAO,KAAK,sBAAsB;EAElC,YAAY;EAEZ,eAAe;;iBAmKD,yBAAyB,QAAQ,2BAA2B;;;iBC3N5D,iBAAiB,gBAAgB;iBA2FjC,kBAAkB,gBAAgB;UA4CjC;EACf;EACA;EACA;EACA,UAAU;EACV;;iBAYc,oBAAoB,OAAO;iBA2F3B,mBAAmB,gBAAgB;UAwtBlC;EAEf,cAAc;;iBA4YA,yBAAyB,OAAM,kCAAuC;iBA4BtE,yBAAyB,KAAK,UAAU"}

package/dist/{local-studio-DHyz2JRw.js → local-studio-BjknISUv.js}

@@ -1,4 +1,4 @@
-import { a as runDockerStreaming, c as resolveConfiguredLogLevel, d as setEmbedConfig, i as runDockerForeground, l as getEmbedConfig, n as formatDockerLoginError, o as spawnStreaming, r as getDockerCmd, s as getLogger } from "./docker-cmd-C6h4cSxa.js";
+import { a as runDockerStreaming, c as resolveConfiguredLogLevel, d as setEmbedConfig, i as runDockerForeground, l as getEmbedConfig, n as formatDockerLoginError, o as spawnStreaming, r as getDockerCmd, s as getLogger } from "./docker-cmd-DLX1TqVw.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path$1 from "node:path";
@@ -231,6 +231,48 @@ function buildStsClientConfig(args) {
 //#endregion
 //#region src/utils/role-arn.ts
 /**
+* Issue an STS AssumeRole for `roleArn` and return the temporary
+* credentials (issue #509).
+*
+* This is the single shared implementation behind every command's
+* `--assume-role` / `--assume-task-role` path (`cdkl invoke`,
+* `start-api`, `run-task`, and the `start-service` / `start-alb`
+* emulator) — each previously carried its own near-identical copy,
+* which kept credential-minting logic OFF this module (the one
+* `/review-pr`'s up-bias security surface lists) and duplicated the
+* issue #245 `--profile` threading fix four times.
+*
+* `sessionNameSuffix` distinguishes the callers in CloudTrail
+* (`<resourceNamePrefix>-<suffix>-<epochMs>`). `makeError` lets a
+* caller surface the no-usable-credentials failure as its own error
+* class (the ECS emulator throws `LocalStartServiceError`); STS
+* transport errors always propagate unwrapped.
+*/
+async function assumeRoleCredentials(opts) {
+	const sts = new STSClient(buildStsClientConfig({
+		region: opts.region,
+		profile: opts.profile
+	}));
+	try {
+		const creds = (await sts.send(new AssumeRoleCommand({
+			RoleArn: opts.roleArn,
+			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-${opts.sessionNameSuffix}-${Date.now()}`,
+			DurationSeconds: 3600
+		}))).Credentials;
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) {
+			const message = `AssumeRole(${opts.roleArn}) returned no usable credentials.`;
+			throw opts.makeError ? opts.makeError(message) : new Error(message);
+		}
+		return {
+			accessKeyId: creds.AccessKeyId,
+			secretAccessKey: creds.SecretAccessKey,
+			sessionToken: creds.SessionToken
+		};
+	} finally {
+		sts.destroy();
+	}
+}
+/**
 * Resolve the role-arn argument (CLI flag or `CDKL_ROLE_ARN` env var) and,
 * when set, assume the role and write the resulting temporary credentials
 * into `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`
@@ -1546,7 +1588,8 @@ function matchRuntime(parsed, target, stack, resources) {
 }
 function notFoundError$2(target, stack, resources) {
 	const available = Object.entries(resources).filter(([, r]) => r.Type === AGENTCORE_RUNTIME_TYPE).map(([id]) => id);
-	return new AgentCoreResolutionError(`Target '${target}' not found. ${available.length > 0 ? `Available AgentCore Runtimes in ${stack.stackName}: ${available.join(", ")}.` : `No ${AGENTCORE_RUNTIME_TYPE} resources found in ${stack.stackName}.`}`);
+	const hint = available.length > 0 ? `Available AgentCore Runtimes in ${stack.stackName}: ${available.join(", ")}.` : `No ${AGENTCORE_RUNTIME_TYPE} resources found in ${stack.stackName}.`;
+	return new AgentCoreResolutionError(`Target '${target}' not found. ${hint}`);
 }
 /** Pull the runtime properties `cdkl invoke-agentcore` cares about. */
 function extractRuntimeProperties(stack, logicalId, resource, resources, imageContext) {
@@ -7284,7 +7327,7 @@ async function runDetached(opts) {
 		const ro = mount.readOnly ? ":ro" : "";
 		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
 	}
-	const sensitiveKeys = opts.sensitiveEnvKeys && opts.sensitiveEnvKeys.size > 0 ? new Set([...SENSITIVE_ENV_KEYS, ...opts.sensitiveEnvKeys]) : SENSITIVE_ENV_KEYS;
+	const sensitiveKeys = opts.sensitiveEnvKeys && opts.sensitiveEnvKeys.size > 0 ? /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...opts.sensitiveEnvKeys]) : SENSITIVE_ENV_KEYS;
 	const passthroughEnv = appendEnvFlags(args, opts.env, sensitiveKeys);
 	if (opts.tmpfs) args.push("--tmpfs", `${opts.tmpfs.target}:rw,size=${opts.tmpfs.sizeMb}m`);
 	if (opts.workingDir) args.push("--workdir", opts.workingDir);
@@ -7401,7 +7444,7 @@ function pickFreePort() {
 * {@link redactAwsCredentialsInArgs} as a defense for any path that
 * still emits the inline `-e <KEY>=<value>` form into the debug log.
 */
-const SENSITIVE_ENV_KEYS = new Set([
+const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
 	"AWS_ACCESS_KEY_ID",
 	"AWS_SECRET_ACCESS_KEY",
 	"AWS_SESSION_TOKEN"
@@ -9290,7 +9333,7 @@ var VtlEvaluator = class {
 					const endIdx = this.skipDirectiveTrailingNewline(block, cursor + 1 + tag.length);
 					const items = this.coerceToIterable(listValue);
 					for (const item of items) {
-						this.scopes.push(new Map([[varName, item]]));
+						this.scopes.push(/* @__PURE__ */ new Map([[varName, item]]));
 						try {
 							this.renderBlock(block.slice(bodyStart, bodyEnd));
 						} finally {
@@ -16594,7 +16637,7 @@ async function buildContainerSpec(args) {
 		stateBundle
 	});
 	if (roleArn) {
-		const creds = await assumeLambdaExecutionRole$1(roleArn, stsRegion, profile);
+		const creds = await assumeLambdaExecutionRole(roleArn, stsRegion, profile);
 		dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
 		dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
 		dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
@@ -17033,31 +17076,18 @@ function resolveContainerFallbackRegion(args) {
 	return args.stackRegionOverride ?? args.synthRegion ?? args.profileRegion;
 }
 /**
-* Issue an STS AssumeRole and return temporary credentials. Mirrors
-* `cdkl invoke`'s helper byte-for-byte; lifted here so the
-* start-api command stays self-contained.
+* Issue an STS AssumeRole and return temporary credentials, via the
+* shared `assumeRoleCredentials` helper in `utils/role-arn.ts`
+* (issue #509 — previously a byte-for-byte copy of `cdkl invoke`'s
+* inline helper).
 */
-async function assumeLambdaExecutionRole$1(roleArn, region, profile) {
-	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+async function assumeLambdaExecutionRole(roleArn, region, profile) {
+	return assumeRoleCredentials({
+		roleArn,
 		region,
-		profile
-	}));
-	try {
-		const creds = (await sts.send(new AssumeRoleCommand({
-			RoleArn: roleArn,
-			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-start-api-${Date.now()}`,
-			DurationSeconds: 3600
-		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
-		return {
-			accessKeyId: creds.AccessKeyId,
-			secretAccessKey: creds.SecretAccessKey,
-			sessionToken: creds.SessionToken
-		};
-	} finally {
-		sts.destroy();
-	}
+		profile,
+		sessionNameSuffix: "start-api"
+	});
 }
 /**
 * Parse / clamp the `--per-lambda-concurrency` flag. Above-cap values
@@ -17817,28 +17847,6 @@ async function readStdin$1() {
 	for await (const chunk of process.stdin) chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
 	return Buffer.concat(chunks).toString("utf-8");
 }
-async function assumeLambdaExecutionRole(roleArn, region, profile) {
-	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
-		region,
-		profile
-	}));
-	try {
-		const creds = (await sts.send(new AssumeRoleCommand({
-			RoleArn: roleArn,
-			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-invoke-${Date.now()}`,
-			DurationSeconds: 3600
-		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
-		return {
-			accessKeyId: creds.AccessKeyId,
-			secretAccessKey: creds.SecretAccessKey,
-			sessionToken: creds.SessionToken
-		};
-	} finally {
-		sts.destroy();
-	}
-}
 function forwardAwsEnv$2(env) {
 	for (const key of [
 		"AWS_ACCESS_KEY_ID",
@@ -17964,7 +17972,12 @@ async function resolveLambdaContainerEnv(lambda, options, profileCredentials, ex
 	if (resolvedAssumeRoleArn) {
 		const stsRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
 		try {
-			const creds = await assumeLambdaExecutionRole(resolvedAssumeRoleArn, stsRegion, options.profile);
+			const creds = await assumeRoleCredentials({
+				roleArn: resolvedAssumeRoleArn,
+				region: stsRegion,
+				profile: options.profile,
+				sessionNameSuffix: "invoke"
+			});
 			dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
 			dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
 			dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
@@ -18117,7 +18130,7 @@ function addInvokeSpecificOptions(cmd) {
 * (Maven, Gradle). Adding a new ecosystem? Append its lockfile +
 * manifest here and add a classifier test row.
 */
-const REBUILD_TRIGGER_BASENAMES = new Set([
+const REBUILD_TRIGGER_BASENAMES = /* @__PURE__ */ new Set([
 	"package.json",
 	"package-lock.json",
 	"pnpm-lock.yaml",
@@ -18167,7 +18180,7 @@ const REBUILD_TRIGGER_BASENAMES = new Set([
 * start, so a `docker cp` + `docker restart` cycle picks them up.
 * Those extensions are NOT in this set.
 */
-const COMPILED_LANGUAGE_EXTENSIONS = new Set([
+const COMPILED_LANGUAGE_EXTENSIONS = /* @__PURE__ */ new Set([
 	".go",
 	".rs",
 	".java",
@@ -21647,7 +21660,7 @@ function buildDockerRunArgs(opts) {
 	args.push("--network", network);
 	args.push("--network-alias", container.name);
 	if (opts.networkAliases && opts.networkAliases.length > 0) {
-		const seen = new Set([container.name]);
+		const seen = /* @__PURE__ */ new Set([container.name]);
 		for (const a of opts.networkAliases) if (!seen.has(a)) {
 			args.push("--network-alias", a);
 			seen.add(a);
@@ -22919,7 +22932,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C6h4cSxa.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -22938,7 +22951,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C6h4cSxa.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -22953,7 +22966,7 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerRestartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C6h4cSxa.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["restart", containerId]);
 };
 let dockerRestartImpl = defaultDockerRestartImpl;
@@ -22993,7 +23006,7 @@ async function disconnectOldFromSharedNetwork(oldInstance) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C6h4cSxa.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -23170,7 +23183,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C6h4cSxa.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -23190,7 +23203,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C6h4cSxa.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-DLX1TqVw.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -24683,7 +24696,7 @@ function parseIpAddress(ip) {
 function parseIpv4(ip) {
 	const parts = ip.split(".");
 	if (parts.length !== 4) return void 0;
-	const bytes = new Uint8Array(4);
+	const bytes = /* @__PURE__ */ new Uint8Array(4);
 	for (let i = 0; i < 4; i++) {
 		const part = parts[i];
 		if (!/^\d+$/.test(part)) return void 0;
@@ -24734,7 +24747,7 @@ function parseIpv6(ip) {
 		if (g === void 0) return void 0;
 		groups[7 - i] = g;
 	}
-	const bytes = new Uint8Array(16);
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
 	for (let i = 0; i < 8; i++) {
 		bytes[i * 2] = groups[i] >> 8 & 255;
 		bytes[i * 2 + 1] = groups[i] & 255;
@@ -25666,7 +25679,7 @@ async function promptForOverridePath(args) {
 * a `dist/` somewhere in a sub-tree (e.g. `packages/foo/dist/`) is also
 * skipped by name match.
 */
-const DOCKERFILE_SCAN_IGNORED_DIRS = new Set([
+const DOCKERFILE_SCAN_IGNORED_DIRS = /* @__PURE__ */ new Set([
 	"node_modules",
 	".git",
 	"cdk.out",
@@ -26240,7 +26253,7 @@ async function reloadAllServices(args) {
 	}
 	const imageOverrideTags = new Map(boottimeImageOverrideTags);
 	for (const [target, entry] of imageOverrideMap.entries()) try {
-		const newTag = (await runImageOverrideBuilds(new Map([[target, entry]]))).get(target);
+		const newTag = (await runImageOverrideBuilds(/* @__PURE__ */ new Map([[target, entry]]))).get(target);
 		if (newTag !== void 0) imageOverrideTags.set(target, newTag);
 	} catch (err) {
 		logger.warn(`Reload of '${target}': --image-override rebuild failed; keeping the previous local image. (${err instanceof Error ? err.message : String(err)})`);
@@ -26552,7 +26565,7 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 	if (hostGatewayExtraHosts.length > 0) taskOpts.hostGatewayExtraHosts = hostGatewayExtraHosts;
 	if (opts.imageOverrideTag !== void 0) {
 		const essential = service.task.containers.find((c) => c.essential) ?? service.task.containers[0];
-		if (essential) taskOpts.imageOverrideByContainer = new Map([[essential.name, opts.imageOverrideTag]]);
+		if (essential) taskOpts.imageOverrideByContainer = /* @__PURE__ */ new Map([[essential.name, opts.imageOverrideTag]]);
 	}
 	return {
 		service,
@@ -26903,26 +26916,13 @@ async function resolvePlaceholderAccount$1(arn, region, profile) {
 	}
 }
 async function assumeTaskRole$1(roleArn, region, profile) {
-	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	return assumeRoleCredentials({
+		roleArn,
 		region,
-		profile
-	}));
-	try {
-		const creds = (await sts.send(new AssumeRoleCommand({
-			RoleArn: roleArn,
-			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-start-service-${Date.now()}`,
-			DurationSeconds: 3600
-		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalStartServiceError(`AssumeRole(${roleArn}) returned no usable credentials.`);
-		return {
-			accessKeyId: creds.AccessKeyId,
-			secretAccessKey: creds.SecretAccessKey,
-			sessionToken: creds.SessionToken
-		};
-	} finally {
-		sts.destroy();
-	}
+		profile,
+		sessionNameSuffix: "start-service",
+		makeError: (message) => new LocalStartServiceError(message)
+	});
 }
 /**
 * Build the substitution context the ECS resolver consumes. Exported for the
@@ -27481,26 +27481,12 @@ async function resolvePlaceholderAccount(arn, region, profile) {
 * Assume `roleArn` and return temp credentials.
 */
 async function assumeTaskRole(roleArn, region, profile) {
-	const { STSClient, AssumeRoleCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(buildStsClientConfig({
+	return assumeRoleCredentials({
+		roleArn,
 		region,
-		profile
-	}));
-	try {
-		const creds = (await sts.send(new AssumeRoleCommand({
-			RoleArn: roleArn,
-			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-run-task-${Date.now()}`,
-			DurationSeconds: 3600
-		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
-		return {
-			accessKeyId: creds.AccessKeyId,
-			secretAccessKey: creds.SecretAccessKey,
-			sessionToken: creds.SessionToken
-		};
-	} finally {
-		sts.destroy();
-	}
+		profile,
+		sessionNameSuffix: "run-task"
+	});
 }
 /**
 * Build the substitution context the ECS task resolver consumes.
@@ -27677,7 +27663,7 @@ async function resolveRunTaskImageOverride(args) {
 	if (options.strictOverrides === true && uncovered.length > 0) throw new Error("--strict-overrides set, but the task definition image is pinned to a deployed registry and no --image-override covered it. Pass --image-override <dockerfile> to rebuild it from local source, or drop --strict-overrides / --from-cfn-stack to run the pinned image as-is.");
 	if (overrides.size === 0) return { pinnedUncovered: pinned };
 	const tag = (await runImageOverrideBuilds(overrides)).get(target);
-	if (tag !== void 0 && essential !== void 0) return { imageOverrideByContainer: new Map([[essential.name, tag]]) };
+	if (tag !== void 0 && essential !== void 0) return { imageOverrideByContainer: /* @__PURE__ */ new Map([[essential.name, tag]]) };
 	return { pinnedUncovered: pinned && uncovered.length > 0 };
 }
 function addRunTaskSpecificOptions(cmd) {
@@ -29504,7 +29490,7 @@ function edgeHeadersToHttp(headers) {
 * Headers a Lambda@Edge function is not allowed to add/modify on a response (a
 * subset CloudFront blackholes). We drop them rather than fail the response.
 */
-const READ_ONLY_RESPONSE_HEADERS = new Set([
+const READ_ONLY_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
 	"connection",
 	"content-length",
 	"keep-alive",
@@ -29908,7 +29894,8 @@ const MIME_BY_EXT = {
 function contentTypeForKey(key) {
 	const dot = key.lastIndexOf(".");
 	if (dot === -1 || dot === key.length - 1) return "application/octet-stream";
-	return MIME_BY_EXT[key.slice(dot + 1).toLowerCase()] ?? "application/octet-stream";
+	const ext = key.slice(dot + 1).toLowerCase();
+	return MIME_BY_EXT[ext] ?? "application/octet-stream";
 }
 
 //#endregion
@@ -32402,7 +32389,7 @@ function resolveEnvVars(kind, values) {
 * catalog so a user does not re-specify them per-run and collide with the
 * session-wide value. Plus the Commander-managed `--help` / `--version`.
 */
-const CATALOG_EXCLUDED_FLAGS = new Set([
+const CATALOG_EXCLUDED_FLAGS = /* @__PURE__ */ new Set([
 	"--app",
 	"--profile",
 	"--region",
@@ -32441,7 +32428,7 @@ const CATALOG_EXCLUDED_FLAGS = new Set([
 * secrets / a target stage, so they get a control (variadic → one value per
 * control; the raw-args box remains for multiple).
 */
-const CATALOG_MANAGED_FLAGS = new Set([
+const CATALOG_MANAGED_FLAGS = /* @__PURE__ */ new Set([
 	"--event",
 	"--response-file",
 	"--host",
@@ -33506,6 +33493,26 @@ const STUDIO_SCRIPT = `
     };
   }
 
+  // Shown for an ecs / ecs-task target whose image-pin status could not be
+  // classified because --from-cfn-stack is unbound (likely an INTRINSIC-ECR
+  // image, e.g. ContainerImage.fromEcrRepository). The terminal boot WARN says
+  // the same thing, but a browser-only user never sees it, so surface the
+  // Session-bar remedy in the composer where the Dockerfile picker would be.
+  function buildPinUnresolvedHint() {
+    const sec = el('div', 'section options image-override');
+    sec.appendChild(el('h3', null, 'Image override unavailable'));
+    sec.appendChild(
+      el(
+        'div',
+        'opt-hint io-hint',
+        'This image could not be classified without deployed state. If it is pinned to a deployed ' +
+          'registry (e.g. ContainerImage.fromEcrRepository), set --from-cfn-stack in the Session bar ' +
+          'so studio can resolve it and offer a Dockerfile picker to rebuild it locally.'
+      )
+    );
+    return sec;
+  }
+
   // Per-backing-service image-override pickers for a pinned ALB (issue #384):
   // one Dockerfile select per deployed-registry-pinned service the ALB fronts.
   // collect() returns a { [serviceId]: dockerfile } map threaded as
@@ -33702,6 +33709,7 @@ const STUDIO_SCRIPT = `
                 btnSlot,
                 kind: group.kind,
                 pinned: entry.pinned === true,
+                pinUnresolved: entry.pinUnresolved === true,
                 backingPinnedServices: entry.backingPinnedServices || [],
                 agentCoreHasWs: entry.agentCoreHasWs === true,
                 agentCoreContractPath: entry.agentCoreContractPath || null,
@@ -34075,6 +34083,15 @@ const STUDIO_SCRIPT = `
         const io = buildImageOverridePicker(applied && applied.imageOverride);
         ws.appendChild(io.node);
         collectImageOverride = io.collect;
+      } else if (
+        meta &&
+        (meta.kind === 'ecs' || meta.kind === 'ecs-task') &&
+        meta.pinUnresolved
+      ) {
+        // Could not classify the image-pin status (no --from-cfn-stack); hint
+        // at the Session-bar remedy instead of a Dockerfile picker (the
+        // terminal-only #484 WARN never reaches a browser-only user).
+        ws.appendChild(buildPinUnresolvedHint());
       }
       // An ALB boots its backing ECS services (issue #384); a pinned backing
       // service has the same "local edits do not take effect" problem, so offer
@@ -35313,6 +35330,8 @@ function renderStudioHtml(appLabel, cliName) {
 	const safeApp = escapeHtml(appLabel);
 	const safeCli = escapeHtml(cliName);
 	const brand = cliName === "cdkl" ? "CDK Local Studio" : `${safeCli} studio`;
+	const optionSpecsJson = JSON.stringify(OPTION_SPECS).replace(/</g, "\\u003c");
+	const flagCatalogJson = JSON.stringify(buildFlagCatalog()).replace(/</g, "\\u003c");
 	return `<!doctype html>
 <html lang="en">
 <head>
@@ -35353,8 +35372,8 @@ function renderStudioHtml(appLabel, cliName) {
     <div id="log-results"></div>
   </section>
 </main>
-<script>window.__OPTION_SPECS__ = ${JSON.stringify(OPTION_SPECS).replace(/</g, "\\u003c")};<\/script>
-<script>window.__FLAG_CATALOG__ = ${JSON.stringify(buildFlagCatalog()).replace(/</g, "\\u003c")};<\/script>
+<script>window.__OPTION_SPECS__ = ${optionSpecsJson};<\/script>
+<script>window.__FLAG_CATALOG__ = ${flagCatalogJson};<\/script>
 <script>${STUDIO_SCRIPT}<\/script>
 </body>
 </html>`;
@@ -36208,7 +36227,7 @@ function tryParseJson(raw) {
 * re-sent client-side through the request composer + the live front door
 * (issue #322), not re-dispatched here, so the proxy still captures it.
 */
-const REINVOKABLE_KINDS = new Set(["lambda", "agentcore"]);
+const REINVOKABLE_KINDS = /* @__PURE__ */ new Set(["lambda", "agentcore"]);
 /**
 * Re-invoke a past timeline row with an edited payload (issue #284, studio
 * Phase 3). Resolves the original target from the recorded invocation and
@@ -36243,7 +36262,7 @@ async function reinvoke(input, deps) {
 //#region src/local/studio-request-relay.ts
 const DEFAULT_TIMEOUT_MS = 3e4;
 const DEFAULT_MAX_BODY = 512 * 1024;
-const BODY_METHODS = new Set([
+const BODY_METHODS = /* @__PURE__ */ new Set([
 	"POST",
 	"PUT",
 	"PATCH",
@@ -36426,7 +36445,7 @@ function startStudioProxy(config) {
 	});
 }
 /** RFC 7230 hop-by-hop headers — never forwarded across a proxy. */
-const HOP_BY_HOP = new Set([
+const HOP_BY_HOP = /* @__PURE__ */ new Set([
 	"connection",
 	"keep-alive",
 	"proxy-authenticate",
@@ -36996,7 +37015,7 @@ function routeStudioRun(req, deps) {
 	if (req.kind === "ecs" && !deps.servableEcs.has(req.targetId)) return Promise.reject(/* @__PURE__ */ new Error(`'${req.targetId}' is not a servable ECS service (an ECS task definition runs via run-task, not start-service).`));
 	return deps.serveManager.start(req);
 }
-const SERVE_REQUEST_METHODS = new Set([
+const SERVE_REQUEST_METHODS = /* @__PURE__ */ new Set([
 	"GET",
 	"POST",
 	"PUT",
@@ -37352,13 +37371,15 @@ async function prepareEcsImageContexts(args) {
 * Returns a `(id) => boolean` callback (true = pinned). Exported for testing.
 */
 function makePinClassifier(args) {
-	const { stacks, contextByStack, logger, stateBound } = args;
+	const { stacks, contextByStack, logger, stateBound, onUnresolved } = args;
 	return (id) => {
 		try {
 			const stack = resolveEcsServiceStack(id, stacks);
-			return !isLocalCdkAssetImage(resolveEcsServiceTarget(id, stacks, stack ? contextByStack.get(stack.stackName) : void 0));
+			const context = stack ? contextByStack.get(stack.stackName) : void 0;
+			return !isLocalCdkAssetImage(resolveEcsServiceTarget(id, stacks, context));
 		} catch (err) {
 			logger.warn(`studio: could not classify image-pin status for ECS service '${id}'; leaving it unmarked (the image-override picker will not be offered).${pinClassifyStateHint(stateBound)} ${err instanceof Error ? err.message : String(err)}`);
+			if (stateBound === false) onUnresolved?.(id);
 			return false;
 		}
 	};
@@ -37389,15 +37410,17 @@ function pinClassifyStateHint(stateBound) {
 * Returns a `(id) => boolean` callback (true = pinned). Exported for testing.
 */
 function makeTaskPinClassifier(args) {
-	const { stacks, contextByStack, logger, stateBound } = args;
+	const { stacks, contextByStack, logger, stateBound, onUnresolved } = args;
 	return (id) => {
 		try {
 			const stack = resolveEcsServiceStack(id, stacks);
-			const task = resolveEcsTaskTarget(id, stacks, stack ? contextByStack.get(stack.stackName) : void 0);
+			const context = stack ? contextByStack.get(stack.stackName) : void 0;
+			const task = resolveEcsTaskTarget(id, stacks, context);
 			const representative = task.containers.find((c) => c.essential) ?? task.containers[0];
 			return representative !== void 0 && representative.image.kind !== "cdk-asset";
 		} catch (err) {
 			logger.warn(`studio: could not classify image-pin status for ECS task definition '${id}'; leaving it unmarked (the image-override picker will not be offered).${pinClassifyStateHint(stateBound)} ${err instanceof Error ? err.message : String(err)}`);
+			if (stateBound === false) onUnresolved?.(id);
 			return false;
 		}
 	};
@@ -37476,18 +37499,28 @@ async function classifyStudioTargets(args) {
 		logger
 	});
 	const stateBound = isCfnFlagPresent(classifyOptions);
+	const unresolvedPinIds = /* @__PURE__ */ new Set();
+	const onUnresolved = (id) => {
+		unresolvedPinIds.add(id);
+	};
 	const anyPinned = annotatePinnedEcsTargets(groups, makePinClassifier({
 		stacks,
 		contextByStack,
 		logger,
-		stateBound
+		stateBound,
+		onUnresolved
 	}));
 	const anyTaskPinned = annotateEcsTaskPinnedTargets(groups, makeTaskPinClassifier({
 		stacks,
 		contextByStack,
 		logger,
-		stateBound
+		stateBound,
+		onUnresolved
 	}));
+	if (unresolvedPinIds.size > 0) for (const g of groups) {
+		if (g.kind !== "ecs" && g.kind !== "ecs-task") continue;
+		for (const e of g.entries) if (!e.pinned && unresolvedPinIds.has(e.id)) e.pinUnresolved = true;
+	}
 	const pinnedEcsByQualifiedId = /* @__PURE__ */ new Map();
 	for (const g of groups) {
 		if (g.kind !== "ecs") continue;
@@ -37786,4 +37819,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, resolveProfileCredentials as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, buildStsClientConfig as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-DHyz2JRw.js.map
+//# sourceMappingURL=local-studio-BjknISUv.js.map