cdk-local 0.149.9 → 0.151.0

package/dist/{local-studio-CcK2y5Gs.js → local-studio-Mta0QWLf.js}

@@ -1,5 +1,5 @@
-import { C as stringifyThrown, E as setEmbedConfig, S as sanitizeServiceExceptionMessage, _ as clampErrorName, a as isDockerClientEnvKey, b as flattenToOneLine, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as resolveAssemblyPath, h as renderAssemblyPathEscape, i as getDockerCmd, l as spawnStreaming, m as namesTheSameDirectory, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as describeAwsFailureForWarn, w as getEmbedConfig, x as isAwsServiceException, y as describeCredentialLoadFailure } from "./docker-cmd-C2kvSLVs.js";
-import { t as getLogger } from "./logger-CuUAMAnt.js";
+import { C as sanitizeServiceExceptionMessage, S as isAwsServiceException, _ as resolveAssemblyPath, a as isDockerClientEnvKey, b as describeCredentialLoadFailure, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as renderAssemblyPathEscape, h as namesTheSameDirectory, i as getDockerCmd, l as spawnStreaming, m as isPasteableCommandArg, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as clampErrorName, w as stringifyThrown, x as flattenToOneLine, y as describeAwsFailureForWarn } from "./docker-cmd-GME6jkl9.js";
+import { a as setEmbedConfig, r as getEmbedConfig, t as getLogger } from "./logger-CGhtqHg0.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path$1 from "node:path";
@@ -326,7 +326,10 @@ async function resolveProfileCredentials(profile) {
 	try {
 		const credsProvider = sts.config.credentials;
 		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
-		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) throw new Error(`--profile '${profile}': credential provider chain resolved without usable credentials. Check \`aws sso login --profile ` + profile + "` for SSO profiles, or `~/.aws/credentials` / `~/.aws/config` for regular profiles.");
+		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) {
+			const ssoHint = isPasteableCommandArg(profile) ? "Check `aws sso login --profile " + profile + "` for SSO profiles" : "For an SSO profile, run `aws sso login` for that profile (the command is not written out because the name as rendered may not be the one your shell would act on)";
+			throw new Error(`--profile ${displayUntrustedValue(profile)}: credential provider chain resolved without usable credentials. ${ssoHint}, or check \`~/.aws/credentials\` / \`~/.aws/config\` for regular profiles.`);
+		}
 		let region;
 		try {
 			const regionProvider = sts.config.region;
@@ -3389,7 +3392,7 @@ async function resolveMultiTarget(provided, params) {
 async function loadSynthDeps() {
 	const [toolkitLib, { CdklIoHost }, { AssetManifestArtifact }] = await Promise.all([
 		import("@aws-cdk/toolkit-lib"),
-		import("./cdkl-io-host-DYuHWzAS.js"),
+		import("./cdkl-io-host-9lPKscRA.js"),
 		import("@aws-cdk/cloud-assembly-api")
 	]);
 	return {
@@ -3916,6 +3919,28 @@ function isCfnFlagPresent(opts) {
 	const v = opts.fromCfnStack;
 	return v !== void 0 && v !== false;
 }
+function hasExtraStateProviderActive(options, extraStateProviders) {
+	if (!extraStateProviders) return false;
+	const bag = options;
+	return Object.keys(extraStateProviders).some((key) => Boolean(bag[key]));
+}
+function isStateSourceActive(options, extraStateProviders) {
+	return isCfnFlagPresent(options) || hasExtraStateProviderActive(options, extraStateProviders);
+}
+function activeStateSourceFlag(options, extraStateProviders) {
+	if (isCfnFlagPresent(options)) return "--from-cfn-stack";
+	if (!extraStateProviders) return void 0;
+	const bag = options;
+	const key = Object.keys(extraStateProviders).find((k) => Boolean(bag[k]));
+	return key === void 0 ? void 0 : toFlagName(key);
+}
+function stateSourceFlagNames(extraStateProviders) {
+	return ["--from-cfn-stack", ...Object.keys(extraStateProviders ?? {}).map(toFlagName)];
+}
+function hostStateSourceFields(options, extraStateProviders) {
+	if (!extraStateProviders || Object.keys(extraStateProviders).length === 0) return {};
+	return { ...options };
+}
 function resolveCfnRegion(options, synthRegion) {
 	const region = options.stackRegion ?? options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? synthRegion;
 	if (region === void 0) throw new LocalStateSourceError("--from-cfn-stack requires a region to query CloudFormation. Set one of: --stack-region <region>, --region <region>, AWS_REGION env var, AWS_DEFAULT_REGION env var, or an env.region on the target CDK stack.");
@@ -11811,7 +11836,7 @@ function getContainerAwsCredentialsPath() {
 }
 async function writeProfileCredentialsFile(profileName, creds) {
 	if (profileName === "") throw new Error("writeProfileCredentialsFile: profile name must not be empty.");
-	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name '${profileName}' contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
+	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name ${displayUntrustedValue(profileName)} contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
 	const dir = await mkdtemp(path$1.join(tmpdir(), `${getEmbedConfig().productName}-profile-creds-`));
 	const hostPath = path$1.join(dir, "credentials");
 	const lines = [
@@ -12959,11 +12984,6 @@ function envHasIntrinsicValue$1(templateEnv) {
 	}
 	return false;
 }
-function hasExtraStateProviderActive(options, extraStateProviders) {
-	if (!extraStateProviders) return false;
-	for (const key of Object.keys(extraStateProviders)) if (options[key]) return true;
-	return false;
-}
 async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options, extraStateProviders) {
 	const logger = getLogger();
 	const out = /* @__PURE__ */ new Map();
@@ -14861,7 +14881,7 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region,
 		return await assumeAgentCoreExecutionRole(assumeRoleArn, region, options.profile);
 	} catch (err) {
 		const sigv4Detail = assumeRoleDetail(err, "STS AssumeRole (--sigv4 signing)");
-		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for --sigv4 signing: ${sigv4Detail}. Falling back to ${options.profile ? `--profile ${options.profile}` : "shell credentials"}.`);
+		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for --sigv4 signing: ${sigv4Detail}. Falling back to ${options.profile ? `--profile ${displayUntrustedValue(options.profile)}` : "shell credentials"}.`);
 	}
 	if (options.profile) {
 		const creds = await resolveProfileCredentials(options.profile);
@@ -14953,7 +14973,7 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 		credentials = await assumeAgentCoreExecutionRole(assumeRoleArn, region, options.profile);
 	} catch (err) {
 		const bundleDetail = assumeRoleDetail(err, "STS AssumeRole (fromS3 bundle download)");
-		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for the fromS3 bundle download: ${bundleDetail}. Falling back to ${options.profile ? `--profile ${options.profile}` : "the default credentials"}.`);
+		logger.warn(`--assume-role: STS AssumeRole(${flattenToOneLine(assumeRoleArn)}) failed for the fromS3 bundle download: ${bundleDetail}. Falling back to ${options.profile ? `--profile ${displayUntrustedValue(options.profile)}` : "the default credentials"}.`);
 	}
 	const bundle = await downloadAndExtractS3Bundle(location, {
 		...region !== void 0 && { region },
@@ -17223,7 +17243,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -17236,7 +17256,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -17247,7 +17267,7 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerRestartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["restart", containerId]);
 };
 let dockerRestartImpl = defaultDockerRestartImpl;
@@ -17265,7 +17285,7 @@ async function disconnectOldFromSharedNetwork(oldInstance) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -17405,7 +17425,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -17415,7 +17435,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C2kvSLVs.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GME6jkl9.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -19431,7 +19451,7 @@ function enforceImageOverrideOrphans(rawFlags, resolvedOverrides) {
 
 //#endregion
 //#region src/cli/commands/ecs-service-emulator.ts
-async function runEcsServiceEmulator(targets, options, strategy, extraStateProviders) {
+async function runEcsServiceEmulator(targets, options, strategy, extraStateProviders, hostSynthesizer) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	const skipPull = options.pull === false;
@@ -19494,7 +19514,7 @@ async function runEcsServiceEmulator(targets, options, strategy, extraStateProvi
 		const appCmd = resolveApp(options.app);
 		if (!appCmd) throw new Error(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
 		logger.info("Synthesizing CDK app...");
-		const synthesizer = new Synthesizer();
+		const synthesizer = hostSynthesizer ?? new Synthesizer();
 		const context = parseContextOptions(options.context);
 		const synthOpts = {
 			app: appCmd,
@@ -19950,6 +19970,7 @@ async function resolveAlbLambdaTargetEnv(plan, options, extraStateProviders) {
 	if (lambdas.size === 0) return out;
 	const effectiveAssumeRole = resolveEcsAssumeRoleOption(options);
 	const envOptions = {
+		...hostStateSourceFields(options, extraStateProviders),
 		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
 		...effectiveAssumeRole !== void 0 && { assumeRole: effectiveAssumeRole },
 		...options.region !== void 0 && { region: options.region },
@@ -20810,7 +20831,7 @@ function serviceStrategy() {
 function createLocalStartServiceCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
 	const cmd = new Command("start-service").description(`Run one or more AWS::ECS::Service resources locally as a long-running emulator. Spins up DesiredCount task replicas per service (clamped by --max-tasks) using the same per-task docker network + metadata sidecar pattern as \`${getEmbedConfig().cliName} run-task\`, then keeps each replica running and restarts it on exit per --restart-policy. ^C tears every replica + sidecar + network down. Each <target> accepts a CDK display path (MyStack/MyService) or stack-qualified logical ID (MyStack:MyServiceXYZ); single-stack apps may omit the stack prefix. When two or more <target>s are supplied, every service is booted into a shared Cloud Map / Service Connect registry so peer services discover each other via docker --add-host overlay. Omit <targets> in an interactive terminal to multi-select the services from a list. To put a local ALB front-door in front of an ALB-fronted service, use \`${getEmbedConfig().cliName} start-alb\` instead.`).argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ECS::Service resources to run (omit to multi-select interactively in a TTY)").action(withErrorHandling(async (targets, options) => {
-		await runEcsServiceEmulator(targets, options, serviceStrategy(), opts.extraStateProviders);
+		await runEcsServiceEmulator(targets, options, serviceStrategy(), opts.extraStateProviders, opts.synthesizer);
 	}));
 	addStartServiceSpecificOptions(cmd);
 	return addCommonEcsServiceOptions(cmd);
@@ -21446,7 +21467,7 @@ function albStrategy(options) {
 function createLocalStartAlbCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
 	const cmd = new Command("start-alb").description("Run an Application Load Balancer locally: name the ALB, and cdk-local boots the ECS service(s) behind its listeners and stands up a local front-door on each listener port that round-robins across the running replicas and routes its listener rules across the backing services — a stable host endpoint, like behind a real load balancer. The symmetric ALB counterpart of `start-api`. Each <target> accepts a CDK display path (MyStack/MyAlb) or stack-qualified logical ID; single-stack apps may omit the stack prefix. Supports HTTP and HTTPS listeners — by default a cloud-HTTPS listener is served over plain HTTP locally (with X-Forwarded-Proto: https preserved). Pass --tls (or --tls-cert / --tls-key) to terminate TLS locally with a self-signed or user-supplied cert. All six ALB rule-condition fields are honored (path-pattern / host-header / http-header / http-request-method / query-string / source-ip); forward (single and weighted), redirect, and fixed-response actions; and ECS or Lambda targets (a Lambda target group is invoked locally via the Lambda RIE). authenticate-cognito / authenticate-oidc actions enforce a local Bearer-JWT check (or AWSELBAuthSessionCookie pass-through) against the same JWKS / OIDC discovery URL the deployed ALB would; use --bearer-token <jwt> to inject a default token or --no-verify-auth to disable the guard. Omit <targets> in an interactive terminal to multi-select the load balancers from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ElasticLoadBalancingV2::LoadBalancer resources to run (omit to multi-select interactively in a TTY)").action(withErrorHandling(async (targets, options) => {
-		await runEcsServiceEmulator(targets, options, albStrategy(options), opts.extraStateProviders);
+		await runEcsServiceEmulator(targets, options, albStrategy(options), opts.extraStateProviders, opts.synthesizer);
 	}));
 	addAlbSpecificOptions(cmd);
 	return addCommonEcsServiceOptions(cmd);
@@ -22642,7 +22663,7 @@ async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3
 		if (!assoc) continue;
 		const invoke = edgeInvokers.get(assoc.functionLogicalId);
 		if (!invoke) {
-			logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (added after start-up); skipping. Restart start-cloudfront.`);
+			logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (it failed to boot at start-up, see the boot warning, or was added after start-up); skipping. Restart start-cloudfront.`);
 			continue;
 		}
 		if (assoc.includeBody && edgeInput.body === void 0) edgeInput = {
@@ -22738,7 +22759,7 @@ async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3
 async function runEdgeResponseStage(assoc, eventType, ctx, edgeInvokers, logger) {
 	const invoke = edgeInvokers.get(assoc.functionLogicalId);
 	if (!invoke) {
-		logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (added after start-up); skipping. Restart start-cloudfront.`);
+		logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (it failed to boot at start-up, see the boot warning, or was added after start-up); skipping. Restart start-cloudfront.`);
 		return;
 	}
 	return applyEdgeResponseResult(await invoke(buildEdgeResponseEvent({
@@ -23214,10 +23235,16 @@ async function attachKvsModules(distribution, stacks, options, profileCredential
 	const stack = stacks.find((s) => s.stackName === distribution.stackName);
 	const synthRegion = stack?.region;
 	const kvsFiles = stack ? normalizeKvsFileKeys(parseKvsFileOverrides(options.kvsFile), stack.template) : parseKvsFileOverrides(options.kvsFile);
-	const resolveDeployedKvs = isCfnFlagPresent(options) ? async (kvsLogicalId) => {
+	const resolveDeployedKvs = isStateSourceActive(options, extraStateProviders) ? async (kvsLogicalId) => {
 		const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
 		if (!provider) return void 0;
-		const physicalId = (await provider.load(distribution.stackName, synthRegion))?.resources[kvsLogicalId]?.physicalId;
+		let record;
+		try {
+			record = await provider.load(distribution.stackName, synthRegion);
+		} finally {
+			provider.dispose();
+		}
+		const physicalId = record?.resources[kvsLogicalId]?.physicalId;
 		if (!physicalId) return void 0;
 		if (physicalId.startsWith("arn:")) {
 			const id = idFromArn(physicalId);
@@ -23285,7 +23312,7 @@ async function bootLambdaUrlOrigins(distribution, stacks, opts) {
 		let runner;
 		try {
 			const lambda = resolveLambdaTarget(functionLogicalId, stacks);
-			const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials);
+			const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
 			runner = createFrontDoorLambdaRunner(lambda, {
 				containerHost: opts.containerHost,
 				skipPull: opts.skipPull,
@@ -23324,7 +23351,7 @@ async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
 	}
 	for (const functionLogicalId of functionLogicalIds) try {
 		const lambda = resolveLambdaTarget(functionLogicalId, stacks);
-		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials);
+		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
 		const runner = createFrontDoorLambdaRunner(lambda, {
 			containerHost: opts.containerHost,
 			skipPull: opts.skipPull,
@@ -23344,25 +23371,53 @@ async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
 		runners
 	};
 }
+function buildLambdaEnvOptions(options, extraStateProviders) {
+	return {
+		...hostStateSourceFields(options, extraStateProviders),
+		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
+		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
+		...options.region !== void 0 && { region: options.region },
+		...options.profile !== void 0 && { profile: options.profile },
+		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
+	};
+}
+function buildLambdaBootOptions(options, profileCredentials, extraStateProviders) {
+	return {
+		containerHost: options.host,
+		skipPull: options.pull === false,
+		envOptions: buildLambdaEnvOptions(options, extraStateProviders),
+		...profileCredentials !== void 0 && { profileCredentials },
+		...extraStateProviders !== void 0 && { extraStateProviders }
+	};
+}
 function warnUnsupported(distribution) {
 	const logger = getLogger();
 	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin '${origin.originId}' is a custom (non-S3, non-Lambda-Function-URL) origin (${origin.domainName}); ${getEmbedConfig().cliName} start-cloudfront serves S3 origins and Lambda Function URL origins only. Requests routed to it return 502.`);
 	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass --from-cfn-stack to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
 }
-function warnUnusedCacheOrigin(options) {
-	if (options.cacheOrigin === true && !isCfnFlagPresent(options)) getLogger().warn("--cache-origin has no effect without --from-cfn-stack: it caches a deployed-S3 read-through origin, which is only built under --from-cfn-stack. A local BucketDeployment / --origin <id>=<dir> origin serves from disk and is not cached. Pass --from-cfn-stack to enable the deployed-S3 origin (then --cache-origin applies), or drop --cache-origin.");
+function warnUnusedCacheOrigin(options, extraStateProviders) {
+	if (options.cacheOrigin === true && !isStateSourceActive(options, extraStateProviders)) {
+		const flags = stateSourceFlagNames(extraStateProviders).join(" or ");
+		getLogger().warn(`--cache-origin has no effect without ${flags}: it caches a deployed-S3 read-through origin, which is only built under a state source. A local BucketDeployment / --origin <id>=<dir> origin serves from disk and is not cached. Pass ${flags} to enable the deployed-S3 origin (then --cache-origin applies), or drop --cache-origin.`);
+	}
 }
 async function resolveDeployedS3Origins(distribution, stacks, options, profileCredentials, logger, extraStateProviders) {
 	const readers = /* @__PURE__ */ new Map();
 	const buckets = /* @__PURE__ */ new Map();
-	if (!isCfnFlagPresent(options)) return {
+	const stateFlag = activeStateSourceFlag(options, extraStateProviders);
+	if (stateFlag === void 0) return {
 		readers,
 		buckets
 	};
 	const synthRegion = stacks.find((s) => s.stackName === distribution.stackName)?.region;
-	const region = options.stackRegion ?? options.region ?? synthRegion;
 	const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
-	const record = provider ? await provider.load(distribution.stackName, synthRegion) : void 0;
+	let record;
+	try {
+		record = provider ? await provider.load(distribution.stackName, synthRegion) : void 0;
+	} finally {
+		provider?.dispose();
+	}
+	const region = options.stackRegion ?? options.region ?? synthRegion ?? record?.region;
 	const distributionId = record?.resources[distribution.logicalId]?.physicalId;
 	for (const origin of [...distribution.origins.values()]) {
 		if (origin.kind !== "s3-unresolved") continue;
@@ -23394,7 +23449,7 @@ async function resolveDeployedS3Origins(distribution, stacks, options, profileCr
 			originId: origin.originId,
 			bucketName
 		});
-		logger.info(`Origin '${origin.originId}': no local BucketDeployment source; serving from deployed S3 (bucket=${bucketName}, resolved via ${via}) on demand under --from-cfn-stack.`);
+		logger.info(`Origin '${origin.originId}': no local BucketDeployment source; serving from deployed S3 (bucket=${bucketName}, resolved via ${via}) on demand under ${stateFlag}.`);
 	}
 	return {
 		readers,
@@ -23411,7 +23466,7 @@ function annotateDeployedS3Origins(distribution, buckets) {
 		});
 	}
 }
-async function localStartCloudFrontCommand(target, options, extraStateProviders) {
+async function localStartCloudFrontCommand(target, options, extraStateProviders, hostSynthesizer) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	const originOverrides = parseOriginOverrides(options.origin);
@@ -23427,7 +23482,7 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders)
 	if (!Number.isFinite(basePort) || basePort < 0 || basePort > 65535) throw new LocalStartCloudFrontError(`--port must be 0..65535 (got ${options.port}).`);
 	const synthAndResolve = async () => {
 		logger.info("Synthesizing CDK app...");
-		const synthesizer = new Synthesizer();
+		const synthesizer = hostSynthesizer ?? new Synthesizer();
 		const context = parseContextOptions(options.context);
 		const synthOpts = {
 			app: appCmd,
@@ -23458,21 +23513,9 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders)
 	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
 	const deployedS3 = await resolveDeployedS3Origins(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
 	warnUnsupported(initial.distribution);
-	warnUnusedCacheOrigin(options);
-	const envOptions = {
-		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
-		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
-		...options.region !== void 0 && { region: options.region },
-		...options.profile !== void 0 && { profile: options.profile },
-		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
-	};
+	warnUnusedCacheOrigin(options, extraStateProviders);
 	await attachKvsModules(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
-	const bootOpts = {
-		containerHost: options.host,
-		skipPull: options.pull === false,
-		envOptions,
-		...profileCredentials !== void 0 && { profileCredentials }
-	};
+	const bootOpts = buildLambdaBootOptions(options, profileCredentials, extraStateProviders);
 	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, bootOpts);
 	const { invokers: edgeInvokers, runners: edgeRunners } = await bootLambdaEdgeFunctions(initial.distribution, initial.stacks, bootOpts);
 	let server;
@@ -23552,8 +23595,8 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders)
 }
 function createLocalStartCloudFrontCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("start-cloudfront").description("Run a long-running local server that serves a CloudFront distribution: its S3 origin content (resolved from the BucketDeployment source in the cloud assembly) and its Lambda Function URL origins (the backing Lambda is run locally via RIE), plus its viewer-request / viewer-response CloudFront Functions, reproducing the distribution routing locally so a rewrite / routing change is verifiable in seconds. Serves S3 and Lambda Function URL origins; other custom origins and Lambda@Edge are not run (warn-and-skip). Tip: omit the target in a terminal to pick interactively.").argument("[target]", "CloudFront distribution to serve. Accepts the CDK Construct path ('MyStack/MyDist'), an ancestor prefix, or the stack-qualified logical id ('MyStack:MyDist'). When omitted in a TTY, an interactive picker opens.").action(withErrorHandling(async (target, options) => {
-		await localStartCloudFrontCommand(target, options, opts.extraStateProviders);
+	const cmd = new Command("start-cloudfront").description("Run a long-running local server that serves a CloudFront distribution: its S3 origin content (resolved from the BucketDeployment source in the cloud assembly) and its Lambda Function URL origins (the backing Lambda is run locally via RIE), plus its viewer-request / viewer-response CloudFront Functions, reproducing the distribution routing locally so a rewrite / routing change is verifiable in seconds. Serves S3 and Lambda Function URL origins, and runs Lambda@Edge functions in local RIE containers. Both Lambda kinds need Docker: a Function URL origin that fails to boot stops start-up, while a Lambda@Edge function that fails to boot is warn-and-skipped (its stage does not run). Other custom origins are not run (warn-and-skip; requests routed to one return 502). Tip: omit the target in a terminal to pick interactively.").argument("[target]", "CloudFront distribution to serve. Accepts the CDK Construct path ('MyStack/MyDist'), an ancestor prefix, or the stack-qualified logical id ('MyStack:MyDist'). When omitted in a TTY, an interactive picker opens.").action(withErrorHandling(async (target, options) => {
+		await localStartCloudFrontCommand(target, options, opts.extraStateProviders, opts.synthesizer);
 	}));
 	addStartCloudFrontSpecificOptions(cmd);
 	[
@@ -23908,7 +23951,7 @@ function resolveAgentCoreServePlan(protocol) {
 		readyPath: void 0
 	};
 }
-async function localStartAgentCoreCommand(target, options, extraStateProviders) {
+async function localStartAgentCoreCommand(target, options, extraStateProviders, hostSynthesizer) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	let containerId;
@@ -23964,7 +24007,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 	const appCmd = resolveApp(options.app);
 	if (!appCmd) throw new Error(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
 	logger.info("Synthesizing CDK app...");
-	const synthesizer = new Synthesizer();
+	const synthesizer = hostSynthesizer ?? new Synthesizer();
 	const context = parseContextOptions(options.context);
 	const synthOpts = {
 		app: appCmd,
@@ -24184,7 +24227,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 function createLocalStartAgentCoreCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
 	const cmd = new Command("start-agentcore").description("Serve a Bedrock AgentCore Runtime's contract locally against a warm container. Boots the AWS::BedrockAgentCore::Runtime container ONCE (same image / env / credential resolution as invoke-agentcore) and keeps it warm, so a client can hit it repeatedly. HTTP / AGUI runtimes serve POST /invocations + GET /ping plus the bidirectional /ws endpoint behind a host bridge (injects the AgentCore session-id, and Authorization under a customJwtAuthorizer, so a header-less client like a browser can connect); MCP runtimes serve POST /mcp, A2A POST /. Target accepts a CDK display path (MyStack/MyAgent) or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C.").argument("[target]", "CDK display path or stack-qualified logical ID of the AgentCore Runtime to serve (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
-		await localStartAgentCoreCommand(target, options, opts.extraStateProviders);
+		await localStartAgentCoreCommand(target, options, opts.extraStateProviders, opts.synthesizer);
 	}));
 	addStartAgentCoreSpecificOptions(cmd);
 	[
@@ -29527,4 +29570,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, DynamicReferenceResolver as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, resolveProfileCredentials as Bi, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, keysOverriddenBy as Fi, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, isProxyEnvConfigured as Hi, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, parseDynamicReference as Ii, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, resolveDynamicReferencesInEnv as Li, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, deployedFillMayBeSecret as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, firstUsableRegion as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, keysNotFromTemplate as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, withoutKeys as Ri, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, buildProxyClientConfig as Vi, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, containsDynamicReference as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, DynamicReferenceResolutionError as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, buildStsClientConfig as zi, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-CcK2y5Gs.js.map
+//# sourceMappingURL=local-studio-Mta0QWLf.js.map