cdk-local 0.149.5 → 0.149.6

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, St as createLocalStartAlbCommand, a as createLocalStudioCommand, jt as createLocalRunTaskCommand, sn as createLocalInvokeAgentCoreCommand, w as createLocalListCommand } from "./local-studio-CV21zLBM.js";
+import { D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, St as createLocalStartAlbCommand, a as createLocalStudioCommand, jt as createLocalRunTaskCommand, sn as createLocalInvokeAgentCoreCommand, w as createLocalListCommand } from "./local-studio-CLk7iSNq.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.149.5");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.149.6");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalInvokeAgentCoreCommand());
 program.addCommand(createLocalStartApiCommand());

package/dist/index.js

@@ -1,4 +1,4 @@
 import { E as setEmbedConfig, T as resetEmbedConfig, w as getEmbedConfig } from "./docker-cmd-B5yU__zC.js";
-import { $r as resolveCfnStackName, D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Gr as substituteEnvVarsFromState, Jr as createLocalStateProvider, Kr as substituteEnvVarsFromStateAsync, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, Qr as resolveCfnRegion, St as createLocalStartAlbCommand, T as formatTargetListing, Ur as substituteAgainstState, Wr as substituteAgainstStateAsync, Xr as rejectExplicitCfnStackWithMultipleStacks, Yr as isCfnFlagPresent, Zr as resolveCfnFallbackRegion, a as createLocalStudioCommand, ai as countTargets, ei as CfnLocalStateProvider, jt as createLocalRunTaskCommand, ni as resolveSsmParameters, oi as listTargets, qr as LocalStateSourceError, sn as createLocalInvokeAgentCoreCommand, ti as collectSsmParameterRefs, w as createLocalListCommand } from "./local-studio-CV21zLBM.js";
+import { $r as resolveCfnStackName, D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Gr as substituteEnvVarsFromState, Jr as createLocalStateProvider, Kr as substituteEnvVarsFromStateAsync, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, Qr as resolveCfnRegion, St as createLocalStartAlbCommand, T as formatTargetListing, Ur as substituteAgainstState, Wr as substituteAgainstStateAsync, Xr as rejectExplicitCfnStackWithMultipleStacks, Yr as isCfnFlagPresent, Zr as resolveCfnFallbackRegion, a as createLocalStudioCommand, ai as countTargets, ei as CfnLocalStateProvider, jt as createLocalRunTaskCommand, ni as resolveSsmParameters, oi as listTargets, qr as LocalStateSourceError, sn as createLocalInvokeAgentCoreCommand, ti as collectSsmParameterRefs, w as createLocalListCommand } from "./local-studio-CLk7iSNq.js";
 
 export { CfnLocalStateProvider, LocalStateSourceError, collectSsmParameterRefs, countTargets, createLocalInvokeAgentCoreCommand, createLocalInvokeCommand, createLocalListCommand, createLocalRunTaskCommand, createLocalStartAgentCoreCommand, createLocalStartAlbCommand, createLocalStartApiCommand, createLocalStartCloudFrontCommand, createLocalStartServiceCommand, createLocalStateProvider, createLocalStudioCommand, formatTargetListing, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resetEmbedConfig, resolveCfnFallbackRegion, resolveCfnRegion, resolveCfnStackName, resolveSsmParameters, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync };

package/dist/internal.js

@@ -1,4 +1,4 @@
 import { _ as describeCredentialLoadFailure, g as describeAwsFailureForWarn } from "./docker-cmd-B5yU__zC.js";
-import { $ as applyEdgeResponseResult, $n as buildJwksUrlFromIssuer, $t as buildCloudMapIndex, A as startAgentCoreHttpServer, Ai as resolveProfileCredentials, An as classifySourceChange, Ar as ConnectionRegistry, At as addRunTaskSpecificOptions, B as idFromArn, Bn as buildStageMap, Br as resolveRuntimeFileExtension, Bt as resolveEcsAssumeRoleOption, C as addListSpecificOptions, Ci as resolveAgentCoreTarget, Cn as waitForAgentCorePing, Cr as tryParseStatus, Ct as parseLbPortOverrides, Di as tryResolveImageFnJoin, Dn as computeCodeImageTag, Dr as probeHostGatewaySupport, Dt as addStartServiceSpecificOptions, E as addStartAgentCoreSpecificOptions, Ei as substituteImagePlaceholders, En as buildAgentCoreCodeImage, Er as HOST_GATEWAY_MIN_VERSION, Et as resolveAlbFrontDoor, Fn as createWatchPredicates, Fr as buildDisconnectEvent, Ft as addImageOverrideOptions, G as classifyS3Error, Gn as filterRoutesByApiIdentifiers, Gt as enforceImageOverrideOrphans, H as createDeployedKvsDataSource, Hn as resolveEnvVars, Hr as EcsTaskResolutionError, Ht as runEcsServiceEmulator, I as normalizeKvsFileKeys, In as resolveApiTargetSubset, Ir as buildMessageEvent, It as buildEcsImageResolutionContext, J as startCloudFrontServer, Jn as startApiServer, Jt as resolveImageOverrides, K as createS3OriginReader, Kn as groupRoutesByServer, Kt as mergeForService, L as parseKvsFileOverrides, Ln as createAuthorizerCache, Lr as architectureToPlatform, Lt as ecsClusterOption, M as startAgentCoreWsBridge, Mi as isProxyEnvConfigured, Mr as handleConnectionsRequest, Mt as MAX_TASKS_SUBNET_RANGE_CAP, N as LocalStartCloudFrontError, Nn as addStartApiSpecificOptions, Nr as parseConnectionsPath, Nt as addCommonEcsServiceOptions, O as buildAgentCoreServeAuthCheck, Oi as LocalInvokeBuildError, On as renderCodeDockerfile, Or as resolveHostGatewayExtraHosts, P as addStartCloudFrontSpecificOptions, Pr as buildConnectEvent, Pt as addEcsAssumeRoleOptions, Q as applyEdgeRequestResult, Qn as buildCognitoJwksUrl, Qt as listPinnedTargets, R as parseOriginOverrides, Rn as createFileWatcher, Rr as buildContainerImage, Rt as parseMaxTasks, S as StudioEventBus, Si as pickAgentCoreCandidateStack, Sn as waitForAgentCoreHttpReady, Sr as selectIntegrationResponse, Ti as formatStateRemedy, Tn as SUPPORTED_CODE_RUNTIMES, Tr as HOST_DOCKER_INTERNAL_GATEWAY, Tt as isApplicationLoadBalancer, U as resolveDeployedKvsArnByName, Un as availableApiIdentifiers, Ut as ImageOverrideError, V as resolveKvsModulesForDistribution, Vn as materializeLayerFromArn, Vr as resolveRuntimeImage, Vt as resolveSharedSidecarCredentials, W as resolveDeployedOriginBucket, Wn as filterRoutesByApiIdentifier, Wt as buildImageOverrideTag, X as serveFromStaticOrigin, Xn as resolveServiceIntegrationParameters, Xt as describePinnedImageUri, Y as resolveErrorResponseCandidates, Yn as resolveSelectionExpression, Yt as runImageOverrideBuilds, Z as serveLambdaUrlOrigin, Zn as defaultCredentialsLoader, Zt as isLocalCdkAssetImage, _ as filterStudioTargetGroups, _i as AGENTCORE_AGUI_PROTOCOL, _n as parseSseForJsonRpc, _r as applyAuthorizerOverlay, _t as createCloudFrontModule, an as attachContainerLogStreamer, ar as computeRequestIdentityHash, at as describeS3OriginDomain, b as renderStudioHtml, bi as AGENTCORE_RUNTIME_TYPE, bn as AGENTCORE_SESSION_ID_HEADER, br as evaluateResponseParameters, bt as addAlbSpecificOptions, c as startStudioProxy, ci as discoverWebSocketApis, cn as bridgeAgentCoreWs, cr as invokeTokenAuthorizer, ct as pickFunctionUrlLogicalIdFromOrigin, d as createStudioDispatcher, di as parseSelectionExpressionPath, dn as A2A_PATH, dr as buildCorsConfigByApiId, dt as pickTargetFunctionLogicalId, en as CloudMapRegistry, er as createJwksCache, et as buildEdgeRequestEvent, f as filterStudioCustomResources, fi as webSocketApiMatchesIdentifier, fn as a2aInvokeOnce, fr as buildCorsConfigFromCloudFrontChain, ft as resolveCloudFrontDistribution, g as annotatePinnedEcsTargets, gi as AGENTCORE_A2A_PROTOCOL, gn as mcpInvokeOnce, gr as translateLambdaResponse, gt as stripCloudFrontImport, h as annotateEcsTaskPinnedTargets, hi as resolveLambdaArnIntrinsic, hn as MCP_PROTOCOL_VERSION, hr as matchRoute, ht as runViewerResponse, i as coerceStopRequest, ii as resolveSingleTarget, in as getContainerNetworkIp, ir as buildMethodArn, it as CLOUDFRONT_DISTRIBUTION_TYPE, j as attachAgentCoreWsBridge, ji as buildProxyClientConfig, jn as addInvokeSpecificOptions, jr as buildMgmtEndpointEnvUrl, k as selectServeInboundAuth, ki as buildStsClientConfig, kn as toCmdArgv, kr as bufferToBody, kt as serviceStrategy, l as relayServeRequest, li as discoverWebSocketApisOrThrow, ln as invokeAgentCoreWs, lr as attachAuthorizers, lt as pickKvsLogicalIdFromArn, m as annotateAlbPinnedBackingServices, mi as pickRefLogicalId, mn as MCP_PATH, mr as matchPreflight, mt as runViewerRequest, n as coerceRunRequest, nn as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, nr as verifyJwtAuthorizer, nt as edgeHeadersToHttp, o as resolveServeBaseUrl, on as addInvokeAgentCoreSpecificOptions, or as evaluateCachedLambdaPolicy, ot as extractKvsAssociations, p as isCustomResourceLambdaTarget, pi as discoverRoutes, pn as MCP_CONTAINER_PORT, pr as isFunctionUrlOacFronted, pt as compileCloudFrontFunction, q as matchBehavior, qn as readMtlsMaterialsFromDisk, qt as parseImageOverrideFlags, r as coerceServeRequest, ri as resolveWatchConfig, rn as setShadowReadyTimeoutMs, rr as verifyJwtViaDiscovery, rt as httpHeadersToEdge, s as createStudioServeManager, si as availableWebSocketApiIdentifiers, sr as invokeRequestAuthorizer, st as isCloudFrontDistribution, t as addStudioSpecificOptions, tn as DEFAULT_SHADOW_READY_TIMEOUT_MS, tr as verifyCognitoJwt, tt as buildEdgeResponseEvent, u as reinvoke, ui as filterWebSocketApisByIdentifiers, un as A2A_CONTAINER_PORT, ur as applyCorsResponseHeaders, ut as pickLambdaEdgeFunctionLogicalId, v as startStudioServer, vi as AGENTCORE_HTTP_PROTOCOL, vn as AGENTCORE_SIGV4_SERVICE, vr as buildHttpApiV2Event, vt as createLocalFileKvsDataSource, wi as derivePseudoParametersFromRegion, wn as downloadAndExtractS3Bundle, wr as VtlEvaluationError, wt as resolveAlbTarget, x as createStudioStore, xi as AgentCoreResolutionError, xn as invokeAgentCore, xr as pickResponseTemplate, xt as albStrategy, y as toStudioTargetGroups, yi as AGENTCORE_MCP_PROTOCOL, yn as signAgentCoreInvocation, yr as buildRestV1Event, yt as createUnboundCloudFrontModule, z as resolveCloudFrontTarget, zn as attachStageContext, zr as resolveRuntimeCodeMountPath, zt as parseRestartPolicy } from "./local-studio-CV21zLBM.js";
+import { $ as applyEdgeResponseResult, $n as buildJwksUrlFromIssuer, $t as buildCloudMapIndex, A as startAgentCoreHttpServer, Ai as resolveProfileCredentials, An as classifySourceChange, Ar as ConnectionRegistry, At as addRunTaskSpecificOptions, B as idFromArn, Bn as buildStageMap, Br as resolveRuntimeFileExtension, Bt as resolveEcsAssumeRoleOption, C as addListSpecificOptions, Ci as resolveAgentCoreTarget, Cn as waitForAgentCorePing, Cr as tryParseStatus, Ct as parseLbPortOverrides, Di as tryResolveImageFnJoin, Dn as computeCodeImageTag, Dr as probeHostGatewaySupport, Dt as addStartServiceSpecificOptions, E as addStartAgentCoreSpecificOptions, Ei as substituteImagePlaceholders, En as buildAgentCoreCodeImage, Er as HOST_GATEWAY_MIN_VERSION, Et as resolveAlbFrontDoor, Fn as createWatchPredicates, Fr as buildDisconnectEvent, Ft as addImageOverrideOptions, G as classifyS3Error, Gn as filterRoutesByApiIdentifiers, Gt as enforceImageOverrideOrphans, H as createDeployedKvsDataSource, Hn as resolveEnvVars, Hr as EcsTaskResolutionError, Ht as runEcsServiceEmulator, I as normalizeKvsFileKeys, In as resolveApiTargetSubset, Ir as buildMessageEvent, It as buildEcsImageResolutionContext, J as startCloudFrontServer, Jn as startApiServer, Jt as resolveImageOverrides, K as createS3OriginReader, Kn as groupRoutesByServer, Kt as mergeForService, L as parseKvsFileOverrides, Ln as createAuthorizerCache, Lr as architectureToPlatform, Lt as ecsClusterOption, M as startAgentCoreWsBridge, Mi as isProxyEnvConfigured, Mr as handleConnectionsRequest, Mt as MAX_TASKS_SUBNET_RANGE_CAP, N as LocalStartCloudFrontError, Nn as addStartApiSpecificOptions, Nr as parseConnectionsPath, Nt as addCommonEcsServiceOptions, O as buildAgentCoreServeAuthCheck, Oi as LocalInvokeBuildError, On as renderCodeDockerfile, Or as resolveHostGatewayExtraHosts, P as addStartCloudFrontSpecificOptions, Pr as buildConnectEvent, Pt as addEcsAssumeRoleOptions, Q as applyEdgeRequestResult, Qn as buildCognitoJwksUrl, Qt as listPinnedTargets, R as parseOriginOverrides, Rn as createFileWatcher, Rr as buildContainerImage, Rt as parseMaxTasks, S as StudioEventBus, Si as pickAgentCoreCandidateStack, Sn as waitForAgentCoreHttpReady, Sr as selectIntegrationResponse, Ti as formatStateRemedy, Tn as SUPPORTED_CODE_RUNTIMES, Tr as HOST_DOCKER_INTERNAL_GATEWAY, Tt as isApplicationLoadBalancer, U as resolveDeployedKvsArnByName, Un as availableApiIdentifiers, Ut as ImageOverrideError, V as resolveKvsModulesForDistribution, Vn as materializeLayerFromArn, Vr as resolveRuntimeImage, Vt as resolveSharedSidecarCredentials, W as resolveDeployedOriginBucket, Wn as filterRoutesByApiIdentifier, Wt as buildImageOverrideTag, X as serveFromStaticOrigin, Xn as resolveServiceIntegrationParameters, Xt as describePinnedImageUri, Y as resolveErrorResponseCandidates, Yn as resolveSelectionExpression, Yt as runImageOverrideBuilds, Z as serveLambdaUrlOrigin, Zn as defaultCredentialsLoader, Zt as isLocalCdkAssetImage, _ as filterStudioTargetGroups, _i as AGENTCORE_AGUI_PROTOCOL, _n as parseSseForJsonRpc, _r as applyAuthorizerOverlay, _t as createCloudFrontModule, an as attachContainerLogStreamer, ar as computeRequestIdentityHash, at as describeS3OriginDomain, b as renderStudioHtml, bi as AGENTCORE_RUNTIME_TYPE, bn as AGENTCORE_SESSION_ID_HEADER, br as evaluateResponseParameters, bt as addAlbSpecificOptions, c as startStudioProxy, ci as discoverWebSocketApis, cn as bridgeAgentCoreWs, cr as invokeTokenAuthorizer, ct as pickFunctionUrlLogicalIdFromOrigin, d as createStudioDispatcher, di as parseSelectionExpressionPath, dn as A2A_PATH, dr as buildCorsConfigByApiId, dt as pickTargetFunctionLogicalId, en as CloudMapRegistry, er as createJwksCache, et as buildEdgeRequestEvent, f as filterStudioCustomResources, fi as webSocketApiMatchesIdentifier, fn as a2aInvokeOnce, fr as buildCorsConfigFromCloudFrontChain, ft as resolveCloudFrontDistribution, g as annotatePinnedEcsTargets, gi as AGENTCORE_A2A_PROTOCOL, gn as mcpInvokeOnce, gr as translateLambdaResponse, gt as stripCloudFrontImport, h as annotateEcsTaskPinnedTargets, hi as resolveLambdaArnIntrinsic, hn as MCP_PROTOCOL_VERSION, hr as matchRoute, ht as runViewerResponse, i as coerceStopRequest, ii as resolveSingleTarget, in as getContainerNetworkIp, ir as buildMethodArn, it as CLOUDFRONT_DISTRIBUTION_TYPE, j as attachAgentCoreWsBridge, ji as buildProxyClientConfig, jn as addInvokeSpecificOptions, jr as buildMgmtEndpointEnvUrl, k as selectServeInboundAuth, ki as buildStsClientConfig, kn as toCmdArgv, kr as bufferToBody, kt as serviceStrategy, l as relayServeRequest, li as discoverWebSocketApisOrThrow, ln as invokeAgentCoreWs, lr as attachAuthorizers, lt as pickKvsLogicalIdFromArn, m as annotateAlbPinnedBackingServices, mi as pickRefLogicalId, mn as MCP_PATH, mr as matchPreflight, mt as runViewerRequest, n as coerceRunRequest, nn as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, nr as verifyJwtAuthorizer, nt as edgeHeadersToHttp, o as resolveServeBaseUrl, on as addInvokeAgentCoreSpecificOptions, or as evaluateCachedLambdaPolicy, ot as extractKvsAssociations, p as isCustomResourceLambdaTarget, pi as discoverRoutes, pn as MCP_CONTAINER_PORT, pr as isFunctionUrlOacFronted, pt as compileCloudFrontFunction, q as matchBehavior, qn as readMtlsMaterialsFromDisk, qt as parseImageOverrideFlags, r as coerceServeRequest, ri as resolveWatchConfig, rn as setShadowReadyTimeoutMs, rr as verifyJwtViaDiscovery, rt as httpHeadersToEdge, s as createStudioServeManager, si as availableWebSocketApiIdentifiers, sr as invokeRequestAuthorizer, st as isCloudFrontDistribution, t as addStudioSpecificOptions, tn as DEFAULT_SHADOW_READY_TIMEOUT_MS, tr as verifyCognitoJwt, tt as buildEdgeResponseEvent, u as reinvoke, ui as filterWebSocketApisByIdentifiers, un as A2A_CONTAINER_PORT, ur as applyCorsResponseHeaders, ut as pickLambdaEdgeFunctionLogicalId, v as startStudioServer, vi as AGENTCORE_HTTP_PROTOCOL, vn as AGENTCORE_SIGV4_SERVICE, vr as buildHttpApiV2Event, vt as createLocalFileKvsDataSource, wi as derivePseudoParametersFromRegion, wn as downloadAndExtractS3Bundle, wr as VtlEvaluationError, wt as resolveAlbTarget, x as createStudioStore, xi as AgentCoreResolutionError, xn as invokeAgentCore, xr as pickResponseTemplate, xt as albStrategy, y as toStudioTargetGroups, yi as AGENTCORE_MCP_PROTOCOL, yn as signAgentCoreInvocation, yr as buildRestV1Event, yt as createUnboundCloudFrontModule, z as resolveCloudFrontTarget, zn as attachStageContext, zr as resolveRuntimeCodeMountPath, zt as parseRestartPolicy } from "./local-studio-CLk7iSNq.js";
 
 export { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_HTTP_PROTOCOL, AGENTCORE_MCP_PROTOCOL, AGENTCORE_RUNTIME_TYPE, AGENTCORE_SESSION_ID_HEADER, AGENTCORE_SIGV4_SERVICE, AgentCoreResolutionError, CLOUDFRONT_DISTRIBUTION_TYPE, CloudMapRegistry, ConnectionRegistry, DEFAULT_SHADOW_READY_TIMEOUT_MS, EcsTaskResolutionError, HOST_DOCKER_INTERNAL_GATEWAY, HOST_GATEWAY_MIN_VERSION, ImageOverrideError, LocalInvokeBuildError, LocalStartCloudFrontError, MAX_TASKS_SUBNET_RANGE_CAP, MCP_CONTAINER_PORT, MCP_PATH, MCP_PROTOCOL_VERSION, SOFT_RELOAD_COMPLETION_LOG_SUFFIX, SUPPORTED_CODE_RUNTIMES, StudioEventBus, VtlEvaluationError, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addEcsAssumeRoleOptions, addImageOverrideOptions, addInvokeAgentCoreSpecificOptions, addInvokeSpecificOptions, addListSpecificOptions, addRunTaskSpecificOptions, addStartAgentCoreSpecificOptions, addStartApiSpecificOptions, addStartCloudFrontSpecificOptions, addStartServiceSpecificOptions, addStudioSpecificOptions, albStrategy, annotateAlbPinnedBackingServices, annotateEcsTaskPinnedTargets, annotatePinnedEcsTargets, applyAuthorizerOverlay, applyCorsResponseHeaders, applyEdgeRequestResult, applyEdgeResponseResult, architectureToPlatform, attachAgentCoreWsBridge, attachAuthorizers, attachContainerLogStreamer, attachStageContext, availableApiIdentifiers, availableWebSocketApiIdentifiers, bridgeAgentCoreWs, bufferToBody, buildAgentCoreCodeImage, buildAgentCoreServeAuthCheck, buildCloudMapIndex, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildEcsImageResolutionContext, buildEdgeRequestEvent, buildEdgeResponseEvent, buildHttpApiV2Event, buildImageOverrideTag, buildJwksUrlFromIssuer, buildMessageEvent, buildMethodArn, buildMgmtEndpointEnvUrl, buildProxyClientConfig, buildRestV1Event, buildStageMap, buildStsClientConfig, classifyS3Error, classifySourceChange, coerceRunRequest, coerceServeRequest, coerceStopRequest, compileCloudFrontFunction, computeCodeImageTag, computeRequestIdentityHash, createAuthorizerCache, createCloudFrontModule, createDeployedKvsDataSource, createFileWatcher, createJwksCache, createLocalFileKvsDataSource, createS3OriginReader, createStudioDispatcher, createStudioServeManager, createStudioStore, createUnboundCloudFrontModule, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describeAwsFailureForWarn, describeCredentialLoadFailure, describePinnedImageUri, describeS3OriginDomain, discoverRoutes, discoverWebSocketApis, discoverWebSocketApisOrThrow, downloadAndExtractS3Bundle, ecsClusterOption, edgeHeadersToHttp, enforceImageOverrideOrphans, evaluateCachedLambdaPolicy, evaluateResponseParameters, extractKvsAssociations, filterRoutesByApiIdentifier, filterRoutesByApiIdentifiers, filterStudioCustomResources, filterStudioTargetGroups, filterWebSocketApisByIdentifiers, formatStateRemedy, getContainerNetworkIp, groupRoutesByServer, handleConnectionsRequest, httpHeadersToEdge, idFromArn, invokeAgentCore, invokeAgentCoreWs, invokeRequestAuthorizer, invokeTokenAuthorizer, isApplicationLoadBalancer, isCloudFrontDistribution, isCustomResourceLambdaTarget, isFunctionUrlOacFronted, isLocalCdkAssetImage, isProxyEnvConfigured, listPinnedTargets, matchBehavior, matchPreflight, matchRoute, materializeLayerFromArn, mcpInvokeOnce, mergeForService, normalizeKvsFileKeys, parseConnectionsPath, parseImageOverrideFlags, parseKvsFileOverrides, parseLbPortOverrides, parseMaxTasks, parseOriginOverrides, parseRestartPolicy, parseSelectionExpressionPath, parseSseForJsonRpc, pickAgentCoreCandidateStack, pickFunctionUrlLogicalIdFromOrigin, pickKvsLogicalIdFromArn, pickLambdaEdgeFunctionLogicalId, pickRefLogicalId, pickResponseTemplate, pickTargetFunctionLogicalId, probeHostGatewaySupport, readMtlsMaterialsFromDisk, reinvoke, relayServeRequest, renderCodeDockerfile, renderStudioHtml, resolveAgentCoreTarget, resolveAlbFrontDoor, resolveAlbTarget, resolveApiTargetSubset, resolveCloudFrontDistribution, resolveCloudFrontTarget, resolveDeployedKvsArnByName, resolveDeployedOriginBucket, resolveEcsAssumeRoleOption, resolveEnvVars, resolveErrorResponseCandidates, resolveHostGatewayExtraHosts, resolveImageOverrides, resolveKvsModulesForDistribution, resolveLambdaArnIntrinsic, resolveProfileCredentials, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSelectionExpression, resolveServeBaseUrl, resolveServiceIntegrationParameters, resolveSharedSidecarCredentials, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, runImageOverrideBuilds, runViewerRequest, runViewerResponse, selectIntegrationResponse, selectServeInboundAuth, serveFromStaticOrigin, serveLambdaUrlOrigin, serviceStrategy, setShadowReadyTimeoutMs, signAgentCoreInvocation, startAgentCoreHttpServer, startAgentCoreWsBridge, startApiServer, startCloudFrontServer, startStudioProxy, startStudioServer, stripCloudFrontImport, substituteImagePlaceholders, toCmdArgv, toStudioTargetGroups, translateLambdaResponse, tryParseStatus, tryResolveImageFnJoin, verifyCognitoJwt, verifyJwtAuthorizer, verifyJwtViaDiscovery, waitForAgentCoreHttpReady, waitForAgentCorePing, webSocketApiMatchesIdentifier };

package/dist/{local-studio-CV21zLBM.js → local-studio-CLk7iSNq.js}

@@ -7178,6 +7178,166 @@ function applyDeployedEnvFallback(resolvedEnv, unresolved, deployedEnv) {
 	};
 }
 
+//#endregion
+//#region src/local/ecr-uri.ts
+/**
+* Every ECR private-registry host form, read off the AWS-published `ecr`
+* endpoint list (https://docs.aws.amazon.com/general/latest/gr/ecr.html):
+*
+* - `<acct>.dkr.ecr.<region>.<partition suffix>` — the plain IPv4 endpoint.
+* - `<acct>.dkr.ecr-fips.<region>.<partition suffix>` — FIPS IPv4.
+* - `<acct>.dkr-ecr.<region>.on.aws` — dual-stack (IPv4 + IPv6).
+* - `<acct>.dkr-ecr-fips.<region>.on.aws` — dual-stack FIPS.
+*
+* Every form except the plain one is scoped to the `aws` and `aws-us-gov`
+* partitions, the only ones that endpoint list shows it in: both FIPS forms are
+* listed for `us-east-1` / `us-east-2` / `us-west-1` / `us-west-2` /
+* `us-gov-east-1` / `us-gov-west-1` only, and `on.aws` is the dual-stack DNS of
+* those two partitions (the others serve dual-stack under their own suffixes,
+* which are not listed here). A FIPS or dual-stack host in any other partition
+* is therefore not recognized and is pulled as a public image, as before issue
+* #760. The scope is by PARTITION, not by region: a commercial region AWS adds
+* later is accepted, and a login to an unserved region's FIPS host only fails,
+* because the suffix is still AWS-owned.
+*/
+const FIPS_AND_DUAL_STACK_PARTITIONS = ["aws", "aws-us-gov"];
+const ECR_REGISTRY_HOST_FORMS = [
+	{ labels: "dkr.ecr" },
+	{
+		labels: "dkr.ecr-fips",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	},
+	{
+		labels: "dkr-ecr",
+		fixedUrlSuffix: "on.aws",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	},
+	{
+		labels: "dkr-ecr-fips",
+		fixedUrlSuffix: "on.aws",
+		partitions: FIPS_AND_DUAL_STACK_PARTITIONS
+	}
+];
+const ECR_HOST_FORM_BY_LABELS = new Map(ECR_REGISTRY_HOST_FORMS.map((f) => [f.labels, f]));
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* `<acct>.<labels>.<region>.<suffix>/` — ANCHORED at the start, so nothing
+* (userinfo, a scheme, another host) can precede the account id, and ending at
+* the first `/`, so the captured suffix is the rest of the host.
+*
+* The labels alternation is built from {@link ECR_REGISTRY_HOST_FORMS},
+* ESCAPED (an unescaped `dkr.ecr` would match `dkrxecr`) and longest first, so
+* `dkr.ecr-fips` is tried before its own `dkr.ecr` prefix. The `i` flag makes
+* the labels case-insensitive, as DNS is; it is non-unicode, so it does NOT
+* treat U+212A (Kelvin sign) as `k`, and `\d` is ASCII-only.
+*/
+const ECR_URI_HOST_REGEX = new RegExp(`^(\\d{12})\\.(${[...ECR_REGISTRY_HOST_FORMS].sort((a, b) => b.labels.length - a.labels.length).map((f) => escapeRegExp(f.labels)).join("|")})\\.([^./]+)\\.([^/]+)/`, "i");
+/**
+* A region segment is ASCII alphanumerics plus `-`. Tested on the RAW capture,
+* BEFORE any case fold: `String.prototype.toLowerCase` folds U+212A onto an
+* ASCII `k`, so testing a folded value would admit `us-eKst-1` (Kelvin sign) as
+* the region `us-ekst-1` — a region the host does not name, which then seeds
+* the ECR client and the login endpoint. Today {@link REGION_SHAPE} also
+* refuses that input, because the fold is ASCII-only and the shape is ASCII
+* only, so this guard is DEFENSE IN DEPTH: it keeps the region safe if the fold
+* is ever widened to full Unicode folding.
+*/
+const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+/**
+* The SHAPE of an AWS region id, tested on the FOLDED region after the charset
+* guard above. One alternative per partition, transcribed from the
+* `regionRegex` of each partition in the AWS SDK / botocore `partitions.json`
+* (`\w+` written as `[a-z0-9]+`):
+*
+* - aws: `(us|eu|ap|sa|ca|me|af|il|mx)-X-N`
+* - aws-cn: `cn-X-N`; aws-us-gov: `us-gov-X-N`
+* - aws-iso / -b / -e / -f: `us-iso-X-N`, `us-isob-X-N`, `eu-isoe-X-N`,
+*   `us-isof-X-N`
+* - aws-eusc: `eusc-<cc>-X-N` — broader than upstream's `eusc-(de)-`, matching
+*   `PARTITION_TABLE`'s `eusc-` prefix so a future country is not refused here
+*   while the partition lookup accepts it.
+*
+* It refuses a label that is not a region — `s3`, `lambda-url`,
+* `s3-external-1`, `fips-us-east-1` — so `<acct>.dkr.ecr.s3.amazonaws.com` or
+* `<acct>.dkr-ecr.lambda-url.on.aws` never becomes a login target. Those hosts
+* are AWS-owned, but they are not registries, and only TLS would stop a token
+* sent there (an `insecure-registries` daemon setting turns that off).
+*/
+const REGION_SHAPE = /^(?:(?:us|eu|ap|sa|ca|me|af|il|mx)-[a-z0-9]+-[0-9]+|cn-[a-z0-9]+-[0-9]+|us-gov-[a-z0-9]+-[0-9]+|us-iso-[a-z0-9]+-[0-9]+|us-isob-[a-z0-9]+-[0-9]+|eu-isoe-[a-z0-9]+-[0-9]+|us-isof-[a-z0-9]+-[0-9]+|eusc-[a-z]+-[a-z0-9]+-[0-9]+)$/;
+/**
+* A URL suffix is a dotted name of ASCII alphanumerics and `-`, tested on the
+* raw capture like the region. Today it is DEFENSE IN DEPTH, not the load-
+* bearing check: the fold below is ASCII-only, so `cloud.adc-e.uK` (Kelvin
+* sign) never becomes the `aws-iso-e` suffix, and the exact-suffix comparison
+* already refuses a port (`:`), userinfo (`@`) or any look-alike. It keeps
+* the suffix safe if that fold is ever widened to full Unicode folding.
+*/
+const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
+/**
+* Lower-case ONLY `A`-`Z`. DNS case-insensitivity is ASCII-only, and a full
+* `toLowerCase` would fold U+212A onto `k` and hand the charset guards above an
+* already-ASCII string, defeating them.
+*/
+function foldAsciiUpperCase(value) {
+	return value.replace(/[A-Z]+/g, (run) => run.toLowerCase());
+}
+/** Docker's rule for "component 1 is a registry host, not a repository segment". */
+function isRegistryHostComponent(component) {
+	return component.includes(".") || component.includes(":") || component === "localhost";
+}
+/**
+* Lower-case the REGISTRY HOST of an image reference (ASCII letters only) and
+* leave the repository path and tag byte-identical.
+*
+* Docker's credential store is keyed on the hostname VERBATIM, so a login to
+* one spelling and a pull from another sends no credentials; every
+* docker-facing use of an ECR reference goes through this one spelling. The
+* path is not folded: docker requires it lower-case already, and rewriting it
+* would name a different image. A first component that is not a registry host
+* (`MyOrg/MyRepo:tag` is a Docker Hub path) is left alone for the same reason.
+*/
+function canonicalizeImageUriHost(imageUri) {
+	const slash = imageUri.indexOf("/");
+	if (slash < 0) return imageUri;
+	const host = imageUri.slice(0, slash);
+	if (!isRegistryHostComponent(host)) return imageUri;
+	return foldAsciiUpperCase(host) + imageUri.slice(slash);
+}
+/**
+* The ECR registry an image reference names, or `undefined` when its host is
+* not one of {@link ECR_REGISTRY_HOST_FORMS} with the suffix that form carries
+* for the region it names.
+*
+* The suffix check is what keeps a `docker login` from being pointed at a host
+* cdk-local does not own: `<acct>.dkr.ecr.<region>.example.com`, a look-alike
+* `amazonaws.com.evil.example`, a port or userinfo after the suffix, and a
+* form/suffix mispairing (`dkr-ecr` + `amazonaws.com`, `dkr.ecr` + `on.aws`,
+* an ISO region + `amazonaws.com`) are all refused.
+*/
+function parseEcrRegistryHost(imageUri) {
+	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	if (!m) return void 0;
+	const [, accountId, rawLabels, rawRegion, rawSuffix] = m;
+	if (!CANONICAL_REGION_SEGMENT.test(rawRegion)) return void 0;
+	if (!CANONICAL_URL_SUFFIX.test(rawSuffix)) return void 0;
+	const form = ECR_HOST_FORM_BY_LABELS.get(foldAsciiUpperCase(rawLabels));
+	if (!form) return void 0;
+	const region = foldAsciiUpperCase(rawRegion);
+	if (!REGION_SHAPE.test(region)) return void 0;
+	const suffix = foldAsciiUpperCase(rawSuffix);
+	const partition = derivePartitionAndUrlSuffix(region);
+	if (form.partitions && !form.partitions.includes(partition.partition)) return void 0;
+	if (suffix !== (form.fixedUrlSuffix ?? partition.urlSuffix)) return void 0;
+	return {
+		accountId,
+		region,
+		registryHost: `${accountId}.${form.labels}.${region}.${suffix}`,
+		form
+	};
+}
+
 //#endregion
 //#region src/local/ecs-task-resolver.ts
 var EcsTaskResolutionError = class EcsTaskResolutionError extends Error {
@@ -7692,9 +7852,10 @@ function buildSubstitutionContextFromImageContext(context) {
 * Parse the `Image` field of an ECS container definition.
 *
 * Three shapes:
-*   - `<account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` — same-account
-*     same-region ECR. Cross-account/region is hard-errored (matches
-*     `cdkl invoke`'s ECR-pull semantics).
+*   - `<account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` — ECR, in any
+*     host form `ECR_REGISTRY_HOST_FORMS` lists (FIPS / dual-stack too) and any
+*     partition. Pulled through `pullEcrImage` (cross-account / cross-region
+*     below).
 *   - `Fn::Sub` / `Fn::Join` / `Ref` referencing a `Code.fromAsset`-style
 *     CDK asset image. Surfaces `kind: 'cdk-asset'` with the optional
 *     asset hash so the runner can route through `docker-build.ts`.
@@ -7741,12 +7902,12 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 		if (substituted.includes("AWS::")) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image that references AWS pseudo parameters (${substituted}). ${getEmbedConfig().productName} could not resolve them: confirm AWS credentials are configured so STS GetCallerIdentity succeeds, and that --region / AWS_REGION names the target region. Workaround: build the image locally (ContainerImage.fromAsset) or pin a public image.`);
 		throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image with unresolved \${...} placeholders (${substituted}). ${getEmbedConfig().cliName} only resolves AWS pseudo parameters and same-stack AWS::ECR::Repository refs.`);
 	}
-	const ecrMatch = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\//.exec(substituted);
-	if (ecrMatch) return {
+	const ecrHost = parseEcrRegistryHost(substituted);
+	if (ecrHost) return {
 		kind: "ecr",
 		uri: substituted,
-		account: ecrMatch[1],
-		region: ecrMatch[2]
+		account: ecrHost.accountId,
+		region: ecrHost.region
 	};
 	return {
 		kind: "public",
@@ -7782,12 +7943,12 @@ function classifyResolvedImage(uri) {
 		if (hashMatch) out.assetHash = hashMatch[1];
 		return out;
 	}
-	const ecrMatch = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\//.exec(uri);
-	if (ecrMatch) return {
+	const ecrHost = parseEcrRegistryHost(uri);
+	if (ecrHost) return {
 		kind: "ecr",
 		uri,
-		account: ecrMatch[1],
-		region: ecrMatch[2]
+		account: ecrHost.accountId,
+		region: ecrHost.region
 	};
 	return {
 		kind: "public",
@@ -8805,49 +8966,27 @@ function buildDockerBuildCommand(source, tag, platformOverride) {
 //#endregion
 //#region src/local/ecr-puller.ts
 /**
-* ECR pull fallback for `cdkl invoke` / `cdkl start-api` /
-* `cdkl run-task`. When the image URI resolves to an ECR repo but
-* doesn't match any cdk.out asset (typical when invoking a stack
-* deployed elsewhere or sharing a centralized registry), cdk-local
-* authenticates against the target registry and runs `docker pull`.
-*
-* **Cross-account / cross-region** (#455):
-*   - Same-account, same-region: fast path. No STS hop. The default
-*     credential chain is used directly for `ecr:GetAuthorizationToken`.
-*   - `ecrRoleArn` is provided: `sts:AssumeRole` is issued via the
-*     default credential chain to obtain temporary credentials for the
-*     target account. The resulting credentials authenticate the ECR
-*     client (regardless of region — the ECR client is built for the
-*     URI's region, which can differ from the caller's profile region).
-*   - Cross-account, NO `ecrRoleArn`: cdk-local falls through to the
-*     default credential chain. This works when the caller has been
-*     granted cross-account `ecr:GetAuthorizationToken` +
-*     `ecr:BatchGetImage` permissions on the target repository via an
-*     IAM policy; otherwise AWS rejects the call with `AccessDenied`
-*     and the user is pointed at `--ecr-role-arn`.
-*
-* The `--no-pull` semantics (C3 in the design doc):
-*   - When NOT set: `ecrLogin` + `docker pull <uri>`.
-*   - When set: skip `docker pull`. If the image isn't in the local
-*     cache, the subsequent `docker run` will fail; we surface a clearer
-*     "image not in local cache" error here so the user knows to drop
-*     `--no-pull` or pre-pull manually.
-*/
-/** Regex matching the `<acct>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>` shape. */
-const ECR_URI_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\/([^:]+):(.+)$/;
-/**
 * Parse an ECR image URI. Returns `undefined` for non-ECR URIs (typically:
 * Docker Hub, public.ecr.aws, gcr.io, ...) — those are user-managed
 * images we don't try to authenticate against.
+*
+* Recognizes every host form in `ECR_REGISTRY_HOST_FORMS` (plain, FIPS,
+* dual-stack, dual-stack FIPS) in every partition, each with the suffix that
+* form carries for its region (issue #760) — see `parseEcrRegistryHost`.
 */
 function parseEcrUri(imageUri) {
-	const m = ECR_URI_REGEX.exec(imageUri);
+	const host = parseEcrRegistryHost(imageUri);
+	if (!host) return void 0;
+	const canonicalUri = canonicalizeImageUriHost(imageUri);
+	const m = /^([^:]+):(.+)$/.exec(canonicalUri.slice(canonicalUri.indexOf("/") + 1));
 	if (!m) return void 0;
 	return {
-		accountId: m[1],
-		region: m[2],
-		repository: m[3],
-		tag: m[4]
+		accountId: host.accountId,
+		region: host.region,
+		repository: m[1],
+		tag: m[2],
+		canonicalUri,
+		registryHost: host.registryHost
 	};
 }
 /**
@@ -8887,17 +9026,20 @@ function isCredentialFresh(creds) {
 *
 * Auto-detects cross-account from `STS:GetCallerIdentity` and assumes
 * the supplied role when set. Returns the image URI the caller should
-* pass to `docker run` (same as the input — no rewriting).
+* pass to `docker run`: the input with its registry host ASCII-lower-cased
+* (`ParsedEcrUri.canonicalUri`), so the run names the same spelling the pull
+* and the login used; the repository path and tag are unchanged.
 */
 async function pullEcrImage(imageUri, options) {
 	const logger = getLogger().child("ecr-puller");
 	const parsed = parseEcrUri(imageUri);
 	if (!parsed) throw new LocalInvokeBuildError(`Image URI '${imageUri}' is not an ECR URI. ${getEmbedConfig().cliName} invoke v1 only authenticates against ECR for the deployed-image fallback path.`);
+	const canonicalUri = parsed.canonicalUri;
 	const callerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
 	if (options.skipPull) {
-		logger.info(`Skipping ECR pull (--no-pull). Verifying ${imageUri} is in local cache...`);
-		await verifyImageInLocalCache(imageUri);
-		return imageUri;
+		logger.info(`Skipping ECR pull (--no-pull). Verifying ${canonicalUri} is in local cache...`);
+		await verifyImageInLocalCache(canonicalUri);
+		return canonicalUri;
 	}
 	const callerIdentityKey = `${options.profile ?? "_noprofile"}|${callerRegion ?? "_unset"}`;
 	let callerAccount = CALLER_IDENTITY_CACHE.get(callerIdentityKey);
@@ -8940,17 +9082,21 @@ async function pullEcrImage(imageUri, options) {
 		...assumed ? { credentials: assumed } : options.profile ? { profile: options.profile } : {}
 	});
 	try {
-		await ecrLogin(ecr, parsed.accountId, parsed.region);
+		await ecrLogin(ecr, {
+			accountId: parsed.accountId,
+			region: parsed.region,
+			registryHost: parsed.registryHost
+		});
 	} finally {
 		ecr.destroy();
 	}
-	logger.info(`Pulling ${imageUri}...`);
+	logger.info(`Pulling ${canonicalUri}...`);
 	try {
-		await runDockerForeground(["pull", imageUri]);
+		await runDockerForeground(["pull", canonicalUri]);
 	} catch (err) {
-		throw new LocalInvokeBuildError(`docker pull ${imageUri} failed: ${err.message}`);
+		throw new LocalInvokeBuildError(`docker pull ${canonicalUri} failed: ${err.message}`);
 	}
-	return imageUri;
+	return canonicalUri;
 }
 /**
 * Assume the supplied role via the SDK default credential chain and
@@ -8991,16 +9137,29 @@ async function assumeRoleForEcr(roleArn, callerRegion, profile, logger) {
 * Authenticate the local docker daemon against the target ECR registry.
 * Self-contained in this module so the local-invoke path stays
 * independent of any full asset-publish path's larger surface area.
-*/
-async function ecrLogin(client, accountId, region) {
-	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region})`);
+*
+* The login endpoint is ALWAYS the host the PULL targets (issue #760):
+* docker's credential store is keyed on the hostname verbatim, so a login to
+* any other host leaves the pull with no credentials (`no basic auth
+* credentials`). `GetAuthorizationToken`'s `proxyEndpoint` is therefore NOT
+* used: it names the CALLER's default registry on the plain host, which is the
+* wrong host for a FIPS / dual-stack pull and the wrong ACCOUNT for a
+* cross-account pull made on the caller's own credentials (a repository policy
+* grant, no `--ecr-role-arn`). The token is principal-scoped, not host-scoped:
+* measured on real ECR, one token authenticates the plain, FIPS and dual-stack
+* hosts alike. The password reaches docker only over `--password-stdin`, never
+* argv.
+*/
+async function ecrLogin(client, target) {
+	const { accountId, region, registryHost } = target;
+	getLogger().child("ecr-puller").debug(`ECR login (account=${accountId}, region=${region}, host=${registryHost})`);
 	const authData = (await client.send(new GetAuthorizationTokenCommand({})).catch((err) => {
 		throw new LocalInvokeBuildError(`ECR GetAuthorizationToken failed (account=${accountId}, region=${region}): ${describeAwsFailureForWarn(err, "ECR GetAuthorizationToken")}. Verify the credentials can call ecr:GetAuthorizationToken.`);
 	})).authorizationData?.[0];
 	if (!authData?.authorizationToken) throw new LocalInvokeBuildError("Failed to get ECR authorization token");
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError("ECR authorization token has unexpected shape (missing username/password)");
-	const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.amazonaws.com`;
+	const endpoint = `https://${registryHost}`;
 	try {
 		await runDockerStreaming([
 			"login",
@@ -40920,4 +41079,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, resolveProfileCredentials as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, isProxyEnvConfigured as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildProxyClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, buildStsClientConfig as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-CV21zLBM.js.map
+//# sourceMappingURL=local-studio-CLk7iSNq.js.map