cdk-local 0.153.0 → 0.153.2

package/dist/{local-studio-DIB4WEk6.js → local-studio-DCTVck5l.js}

@@ -74,6 +74,36 @@ function hostFromAuthority(authority) {
 	return authority.slice(0, firstColon);
 }
 
+//#endregion
+//#region src/utils/loopback-host.ts
+function normaliseHostLiteral(hostname) {
+	return hostname.trim().replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
+}
+function isLoopbackLiteral(h) {
+	if (h === "localhost") return true;
+	if (h === "::1" || h === "0:0:0:0:0:0:0:1") return true;
+	const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(h);
+	if (mapped) return parseInt(mapped[1], 16) >> 8 === 127;
+	const dotted = /^(?:::ffff:)?(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
+	if (!dotted) return false;
+	const octets = dotted.slice(1).map(Number);
+	if (octets.some((o) => o > 255)) return false;
+	return octets[0] === 127;
+}
+function isWildcardLiteral(h) {
+	return h === "0.0.0.0" || h === "::" || h === "0:0:0:0:0:0:0:0" || h === "::ffff:0.0.0.0" || h === "::ffff:0:0";
+}
+function isLoopbackHostname(hostname) {
+	return isLoopbackLiteral(normaliseHostLiteral(hostname));
+}
+function isWildcardHostname(hostname) {
+	return isWildcardLiteral(normaliseHostLiteral(hostname));
+}
+function isLoopbackHost(hostname) {
+	const h = normaliseHostLiteral(hostname).replace(/\.$/, "");
+	return h.endsWith(".localhost") || isLoopbackLiteral(h) || isWildcardLiteral(h);
+}
+
 //#endregion
 //#region src/utils/aws-proxy.ts
 const AGENT_OPTS = {
@@ -81,8 +111,23 @@ const AGENT_OPTS = {
 	maxSockets: 50
 };
 function isProxyEnvConfigured() {
-	const env = process.env;
-	return Boolean(env["https_proxy"] || env["HTTPS_PROXY"] || env["http_proxy"] || env["HTTP_PROXY"] || env["all_proxy"] || env["ALL_PROXY"]);
+	return PROXY_ENV_VARIABLES.some((key) => Boolean(process.env[key]));
+}
+const PROXY_ENV_VARIABLES = [
+	"https_proxy",
+	"HTTPS_PROXY",
+	"http_proxy",
+	"HTTP_PROXY",
+	"all_proxy",
+	"ALL_PROXY"
+];
+function isSpeakableProxyEnvValue(value) {
+	return !value.includes("://") || isSpeakableProxy(value.trim());
+}
+const AWS_ENDPOINT_PROBES = ["https://sts.amazonaws.com", "http://sts.amazonaws.com"];
+function everySetProxyEnvValueIsUnspeakable() {
+	const set = PROXY_ENV_VARIABLES.map((key) => process.env[key] ?? "").filter((v) => v !== "");
+	return set.length > 0 && !set.some(isSpeakableProxyEnvValue);
 }
 const warnedProxySchemes = /* @__PURE__ */ new Set();
 function proxySchemeOf(proxyUrl) {
@@ -96,7 +141,7 @@ function warnUnspeakableProxy(proxyUrl) {
 	const scheme = proxySchemeOf(proxyUrl);
 	if (warnedProxySchemes.has(scheme)) return;
 	try {
-		getLogger().child("aws-proxy").warn(`Unsupported proxy scheme "${scheme}" — cdk-local speaks HTTP CONNECT proxies only, so this request went DIRECT instead of through the proxy. Set HTTPS_PROXY / HTTP_PROXY / ALL_PROXY to an http:// or https:// proxy URL. (The proxy URL is withheld here: it can carry credentials.)`);
+		getLogger().child("aws-proxy").warn(`Unsupported proxy scheme "${scheme}" — cdk-local speaks HTTP CONNECT proxies only, so requests it would carry go DIRECT instead of through the proxy. Set HTTPS_PROXY / HTTP_PROXY / ALL_PROXY to an http:// or https:// proxy URL. (The proxy URL is withheld here: it can carry credentials.)`);
 	} catch {
 		return;
 	}
@@ -147,6 +192,10 @@ function buildProxyRequestHandler() {
 }
 function buildProxyClientConfig(opts = {}) {
 	if (!isProxyEnvConfigured()) return {};
+	if (everySetProxyEnvValueIsUnspeakable()) {
+		for (const probe of AWS_ENDPOINT_PROBES) resolveProxyForTarget(probe);
+		return {};
+	}
 	const profile = opts.profile;
 	let chain;
 	const credentials = async (identityProperties) => {
@@ -177,19 +226,6 @@ const REQUEST_STALL_TIMEOUT_MS = 3e5;
 function isRedirectStatus(status) {
 	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
 }
-function isLoopbackHost(hostname) {
-	const host = hostname.trim().replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
-	if (host === "localhost" || host.endsWith(".localhost")) return true;
-	if (host === "::1" || host === "0:0:0:0:0:0:0:1") return true;
-	if (host === "0.0.0.0" || host === "::" || host === "0:0:0:0:0:0:0:0" || host === "::ffff:0.0.0.0" || host === "::ffff:0:0") return true;
-	const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(host);
-	if (mapped) return parseInt(mapped[1], 16) >> 8 === 127;
-	const dotted = /^(?:::ffff:)?(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-	if (!dotted) return false;
-	const octets = dotted.slice(1).map(Number);
-	if (octets.some((o) => o > 255)) return false;
-	return octets[0] === 127;
-}
 function parseHttpUrl(href) {
 	const parsed = new URL(href);
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new TypeError(`Unsupported protocol for a proxied request: "${parsed.protocol}"`);
@@ -476,6 +512,15 @@ function deployAccountStsClientConfig(args) {
 		credentials
 	};
 }
+function accountLookupStsClientConfig(args) {
+	return args.readFromCfnStack ? workloadStsClientConfig({
+		region: args.region,
+		profile: args.profile
+	}) : deployAccountStsClientConfig({
+		region: args.region,
+		profile: args.profile
+	});
+}
 function applyWorkloadEnvCredentials(env) {
 	const rec = callerRecord();
 	if (!rec) return "unchanged";
@@ -13346,9 +13391,10 @@ async function resolvePseudoParametersForStartApi(stateRegion, options) {
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const sts = new STSClient(deployAccountStsClientConfig({
+		const sts = new STSClient(accountLookupStsClientConfig({
 			region,
-			profile: options.profile
+			profile: options.profile,
+			readFromCfnStack: isCfnFlagPresent(options)
 		}));
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
@@ -13731,9 +13777,10 @@ async function resolvePseudoParametersForInvoke(stackRegion, options) {
 	let accountId;
 	try {
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-		const sts = new STSClient(deployAccountStsClientConfig({
+		const sts = new STSClient(accountLookupStsClientConfig({
 			region,
-			profile: options.profile
+			profile: options.profile,
+			readFromCfnStack: isCfnFlagPresent(options)
 		}));
 		try {
 			accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
@@ -15389,7 +15436,7 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 	const region = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? candidate.region;
 	let accountId;
 	try {
-		accountId = await resolveCallerAccountId$2(region, options.profile);
+		accountId = await resolveCallerAccountId$2(region, options.profile, isCfnFlagPresent(options));
 	} catch (err) {
 		logger.warn(`--from-cfn-stack: STS GetCallerIdentity failed: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity")}. A same-stack ECR image URI referencing \${AWS::AccountId} may not resolve.`);
 	}
@@ -15413,11 +15460,12 @@ async function buildAgentCoreImageContext(candidate, stateProvider, options) {
 		loaded: loaded ?? void 0
 	};
 }
-async function resolveCallerAccountId$2(region, profile) {
+async function resolveCallerAccountId$2(region, profile, readFromCfnStack) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(deployAccountStsClientConfig({
+	const sts = new STSClient(accountLookupStsClientConfig({
 		region,
-		profile
+		profile,
+		readFromCfnStack
 	}));
 	try {
 		return (await sts.send(new GetCallerIdentityCommand({}))).Account;
@@ -15893,7 +15941,7 @@ function addInvokeAgentCoreSpecificOptions(cmd) {
 
 //#endregion
 //#region src/local/container-log-streamer.ts
-function attachContainerLogStreamer(prefix, containerId) {
+function attachContainerLogStreamer(prefix, containerId, opts = {}) {
 	let stopping = false;
 	let current;
 	let stdoutBuf = "";
@@ -15928,23 +15976,35 @@ function attachContainerLogStreamer(prefix, containerId) {
 				return;
 			}
 			reattachCount += 1;
-			execFile(getDockerCmd(), [
-				"inspect",
-				"--format",
-				"{{.State.Status}}",
-				containerId
-			], (err, stdout) => {
-				if (stopping) return;
-				if (!err) {
-					const status = stdout.trim().toLowerCase();
-					if (status === "exited" || status === "dead" || status === "removing") return;
+			considerRespawn();
+		});
+	};
+	const considerRespawn = () => {
+		execFile(getDockerCmd(), [
+			"inspect",
+			"--format",
+			"{{.State.Status}}",
+			containerId
+		], (err, stdout) => {
+			if (stopping) return;
+			if (!err) {
+				const status = stdout.trim().toLowerCase();
+				if (status === "exited" || status === "dead" || status === "removing") {
+					if (opts.expectRestart?.()) {
+						pendingRespawn = setTimeout(() => {
+							pendingRespawn = void 0;
+							if (!stopping) considerRespawn();
+						}, 200);
+						return;
+					}
+					return;
 				}
-				pendingRespawn = setTimeout(() => {
-					pendingRespawn = void 0;
-					if (stopping) return;
-					spawnOnce("0s");
-				}, 200);
-			});
+			}
+			pendingRespawn = setTimeout(() => {
+				pendingRespawn = void 0;
+				if (stopping) return;
+				spawnOnce("0s");
+			}, 200);
 		});
 	};
 	spawnOnce(void 0);
@@ -16430,6 +16490,7 @@ async function runEcsTask(task, options, state) {
 			...options.ephemeralPublishContainerPorts && options.ephemeralPublishContainerPorts.length > 0 ? { ephemeralPublishContainerPorts: options.ephemeralPublishContainerPorts } : {},
 			...mergedAddHostFlags.length > 0 ? { addHostFlags: mergedAddHostFlags } : {},
 			...(options.networkAliasesByContainer?.get(container.name)?.length ?? 0) > 0 ? { networkAliases: options.networkAliasesByContainer.get(container.name) } : {},
+			...options.containerNameAliasOmitted?.has(container.name) ? { omitContainerNameAlias: true } : {},
 			...options.profileCredentialsFile && { profileCredentialsFile: options.profileCredentialsFile }
 		});
 		dockerCmds.set(container.name, {
@@ -16745,7 +16806,7 @@ function buildDockerRunArgs(opts) {
 	const publishedEndpoints = [];
 	args.push("--name", `${getEmbedConfig().resourceNamePrefix}-${task.family}-${container.name}-${randHex(3)}`);
 	args.push("--network", network);
-	args.push("--network-alias", container.name);
+	if (!opts.omitContainerNameAlias) args.push("--network-alias", container.name);
 	if (opts.networkAliases && opts.networkAliases.length > 0) {
 		const seen = /* @__PURE__ */ new Set([container.name]);
 		for (const a of opts.networkAliases) if (!seen.has(a)) {
@@ -17111,6 +17172,7 @@ var EcsServiceRunnerError = class EcsServiceRunnerError extends Error {
 	}
 };
 const SOFT_RELOAD_COMPLETION_LOG_SUFFIX = "restart + TCP-ready probe complete; Cloud Map + front-door re-published.";
+const SOFT_RELOAD_PROBE_TIMEOUT_LOG_SUFFIX = "restarted, but the TCP-ready probe timed out; Cloud Map + front-door re-published anyway.";
 function createServiceRunState() {
 	return {
 		replicas: [],
@@ -17237,7 +17299,7 @@ function buildNetworkAliasesByContainer(service) {
 	}
 	return out;
 }
-async function bootReplica(service, options, instance) {
+async function bootReplica(service, options, instance, bootOpts = {}) {
 	const logger = getLogger().child("ecs-service");
 	const gen = instance.generation;
 	const genSuffix = gen > 0 ? `-g${gen}` : "";
@@ -17249,6 +17311,18 @@ async function bootReplica(service, options, instance) {
 	const networkAliasesByContainer = buildNetworkAliasesByContainer(service);
 	const skipHostPortPublish = computeReplicaCount(service.desiredCount, options.maxTasks) > 1;
 	const ephemeralPublishContainerPorts = options.frontDoor ? [...new Set(options.frontDoor.pools.map((p) => p.targetContainerPort))] : [];
+	const withheldAliasContainers = [];
+	if (bootOpts.deferPublish && sharedNetwork) for (const container of service.task.containers) {
+		if (!networkAliasesByContainer.has(container.name)) continue;
+		if (containerPublishesHostPorts(container, {
+			skipHostPortPublish,
+			ephemeralPublishContainerPorts
+		})) continue;
+		networkAliasesByContainer.delete(container.name);
+		withheldAliasContainers.push(container.name);
+	}
+	const containerNameAliasOmitted = new Set(withheldAliasContainers.filter((name) => (buildNetworkAliasesByContainer(service).get(name) ?? []).includes(name)));
+	instance.withheldAliasContainers = withheldAliasContainers;
 	const perReplicaTaskOptions = {
 		...options.taskOptions,
 		cluster: perReplicaCluster,
@@ -17257,17 +17331,62 @@ async function bootReplica(service, options, instance) {
 		...sharedNetwork ? { existingNetwork: sharedNetwork } : { subnetOctet: pickSubnetOctet(instance.index) },
 		...addHostFlags.length > 0 ? { addHostFlags } : {},
 		...networkAliasesByContainer.size > 0 ? { networkAliasesByContainer } : {},
+		...containerNameAliasOmitted.size > 0 ? { containerNameAliasOmitted } : {},
 		...ephemeralPublishContainerPorts.length > 0 ? { ephemeralPublishContainerPorts } : {}
 	};
 	logger.info(`Booting replica ${instance.index} (${perReplicaCluster})`);
 	await runEcsTask(service.task, perReplicaTaskOptions, instance.state);
 	if (options.streamLogs !== false) for (const started of instance.state.startedContainers) {
 		const prefix = `[svc=${service.serviceDisplayName} r=${instance.index} c=${started.name}] `;
-		instance.state.logStoppers.push(attachContainerLogStreamer(prefix, started.id));
+		instance.state.logStoppers.push(attachContainerLogStreamer(prefix, started.id, { expectRestart: () => instance.softReloadInProgress === true }));
 	}
+	if (options.discovery && !bootOpts.deferPublish) await publishReplicaToCloudMap(service, instance, options.discovery, ownerKeyPrefix);
+	if (options.frontDoor && !bootOpts.deferPublish) await publishReplicaToFrontDoor(service, instance, options.frontDoor, options.taskOptions.containerHost, ownerKeyPrefix);
+	instance.lastDeployedAssetHash = pickEssentialAssetHash(service);
+}
+function containerPublishesHostPorts(container, opts) {
+	if (container.portMappings.length === 0) return false;
+	if (!opts.skipHostPortPublish) return true;
+	return container.portMappings.some((pm) => opts.ephemeralPublishContainerPorts.includes(pm.containerPort));
+}
+async function publishGatedReplica(service, options, instance, deadline, isShuttingDown, label = `Shadow replica r${instance.index} (gen ${instance.generation})`) {
+	const network = instance.state.network;
+	const withheld = instance.withheldAliasContainers ?? [];
+	if (network && withheld.length > 0) {
+		const fullAliases = buildNetworkAliasesByContainer(service);
+		for (const name of withheld) {
+			if (isShuttingDown()) return;
+			const container = service.task.containers.find((c) => c.name === name);
+			const started = instance.state.startedContainers.find((c) => c.name === name);
+			if (!container || !started) continue;
+			const port = container.portMappings[0]?.containerPort;
+			if (port !== void 0) {
+				if (await waitForContainerListening(started.id, port, deadline) === "exited") {
+					getLogger().child("ecs-service").debug(`${label}: '${name}' exited before listening; leaving its aliases withheld.`);
+					continue;
+				}
+			}
+			if (isShuttingDown()) return;
+			const ip = await getContainerNetworkIp(started.id, network.networkName);
+			if (!ip) throw new EcsServiceRunnerError(`${label}: no docker IP for '${name}' on ${network.networkName}; cannot attach its Service Connect aliases.`);
+			const aliases = [name];
+			for (const a of fullAliases.get(name) ?? []) if (!aliases.includes(a)) aliases.push(a);
+			await dockerNetworkDisconnectImpl(network.networkName, started.id);
+			await dockerNetworkConnectImpl(network.networkName, started.id, {
+				ip,
+				aliases
+			});
+		}
+		instance.withheldAliasContainers = [];
+	}
+	if (isShuttingDown()) return;
+	const ownerKeyPrefix = replicaOwnerKeyPrefix(service, instance);
 	if (options.discovery) await publishReplicaToCloudMap(service, instance, options.discovery, ownerKeyPrefix);
 	if (options.frontDoor) await publishReplicaToFrontDoor(service, instance, options.frontDoor, options.taskOptions.containerHost, ownerKeyPrefix);
-	instance.lastDeployedAssetHash = pickEssentialAssetHash(service);
+}
+function replicaOwnerKeyPrefix(service, instance) {
+	const genSuffix = instance.generation > 0 ? `:g${instance.generation}` : "";
+	return `${service.serviceLogicalId}:r${instance.index}${genSuffix}`;
 }
 function pickEssentialAssetHash(service) {
 	const essential = service.task.containers.find((c) => c.essential) ?? service.task.containers[0];
@@ -17421,11 +17540,14 @@ async function rollServiceReplica(args) {
 		if (oldIdx !== -1) controller.runState.replicas.splice(oldIdx, 1);
 	} else logger.info(`Rolling replica ${shadow.index} (gen ${shadow.generation}): booting shadow before retiring old.`);
 	const bootPromise = (async () => {
-		await bootReplica(newService, newOptions, shadow);
+		await bootReplica(newService, newOptions, shadow, { deferPublish: !teardownOldFirst });
+		const deadline = Date.now() + shadowReadyTimeoutMs;
 		await waitForReplicaTcpReady(newService, shadow, {
-			timeoutMs: shadowReadyTimeoutMs,
-			intervalMs: shadowReadyIntervalMs
+			timeoutMs: Math.max(1, deadline - Date.now()),
+			intervalMs: shadowReadyIntervalMs,
+			isShuttingDown: () => shadow.shuttingDown || controller.runState.shuttingDown
 		});
+		if (!teardownOldFirst) await publishGatedReplica(newService, newOptions, shadow, deadline, () => shadow.shuttingDown || controller.runState.shuttingDown);
 	})();
 	shadow.inFlightBoot = bootPromise;
 	try {
@@ -17433,6 +17555,7 @@ async function rollServiceReplica(args) {
 	} catch (err) {
 		const shadowIdx = controller.runState.replicas.indexOf(shadow);
 		if (shadowIdx !== -1) controller.runState.replicas.splice(shadowIdx, 1);
+		await disconnectOldFromSharedNetwork(shadow).catch(() => void 0);
 		try {
 			await cleanupEcsRun(shadow.state, { keepRunning: false });
 		} catch {}
@@ -17453,7 +17576,8 @@ async function rollServiceReplica(args) {
 		oldInstance.cloudMapHandles = [];
 	}
 	unregisterReplicaFromFrontDoor(oldInstance, newOptions.frontDoor);
-	await disconnectOldFromSharedNetwork(oldInstance).catch((err) => {
+	oldInstance.shuttingDown = true;
+	await disconnectOldFromSharedNetwork(oldInstance, { drain: true }).catch((err) => {
 		logger.debug(`Rolling replica ${oldInstance.index}: shared-network disconnect of old (gen ${oldInstance.generation}) failed: ${err instanceof Error ? err.message : String(err)}. Proceeding with cleanup (the docker-rm step still tears it down).`);
 	});
 	oldInstance.shuttingDown = true;
@@ -17480,13 +17604,19 @@ async function softReloadReplica(args) {
 	const containersToCycle = essentialContainers.length > 0 ? essentialContainers : newService.task.containers.length > 0 ? [newService.task.containers[0]] : [];
 	if (containersToCycle.length === 0) throw new EcsServiceRunnerError(`softReloadReplica: service '${newService.serviceLogicalId}' has no containers to cycle.`);
 	const startedById = new Map(instance.state.startedContainers.map((c) => [c.name, c.id]));
+	const networkAliasesByContainer = buildNetworkAliasesByContainer(newService);
 	const targets = [];
 	for (const container of containersToCycle) {
 		const id = startedById.get(container.name);
 		if (!id) throw new EcsServiceRunnerError(`softReloadReplica: replica r${instance.index} has no started container named '${container.name}' (started: ${[...startedById.keys()].join(", ") || "none"}).`);
+		const aliases = [container.name];
+		for (const a of networkAliasesByContainer.get(container.name) ?? []) if (!aliases.includes(a)) aliases.push(a);
+		const port = container.portMappings[0]?.containerPort;
 		targets.push({
 			name: container.name,
-			id
+			id,
+			aliases,
+			...port !== void 0 ? { port } : {}
 		});
 	}
 	const controllerOptions = controller.options;
@@ -17499,6 +17629,7 @@ async function softReloadReplica(args) {
 	unregisterReplicaFromFrontDoor(instance, controllerOptions.frontDoor);
 	instance.softReloadInProgress = true;
 	instance.softReloadGeneration = (instance.softReloadGeneration ?? 0) + 1;
+	const attachPlans = /* @__PURE__ */ new Map();
 	try {
 		logger.info(`Soft-reloading replica r${instance.index} (gen ${instance.generation}): docker cp ${flattenToOneLine(sourceDirToCopy)} -> ${targets.length} essential container(s); restart.`);
 		for (const target of targets) {
@@ -17514,23 +17645,72 @@ async function softReloadReplica(args) {
 			} catch (err) {
 				throw new EcsServiceRunnerError(`softReloadReplica: docker cp into '${target.name}' (${target.id}:${workdir}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
 			}
-			try {
-				await dockerRestartImpl(target.id);
-			} catch (err) {
-				throw new EcsServiceRunnerError(`softReloadReplica: docker restart of '${target.name}' (${target.id}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
+		}
+		const sharedNetworkName = instance.state.network?.ownedByCaller ? instance.state.network.networkName : void 0;
+		if (sharedNetworkName) {
+			for (const target of targets) {
+				const plan = await detachFromSharedNetwork(target, sharedNetworkName);
+				if (plan) attachPlans.set(target.id, plan);
+			}
+			if (await reattachForDrain(attachPlans)) await sleep(reloadDrainMs);
+		}
+		for (const target of targets) try {
+			await dockerStopImpl(target.id);
+			const plan = attachPlans.get(target.id);
+			if (plan && (plan.publishesHostPorts || !plan.attached)) {
+				if (plan.attached) {
+					await dockerNetworkDisconnectImpl(plan.networkName, target.id);
+					plan.attached = false;
+				}
+				await attachToSharedNetwork(target.id, plan, plan.publishesHostPorts);
 			}
+			await dockerStartImpl(target.id);
+		} catch (err) {
+			throw new EcsServiceRunnerError(`softReloadReplica: docker stop / start of '${target.name}' (${target.id}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
 		}
-		await waitForReplicaTcpReady(newService, instance, {
+		const aliasDeadline = Date.now() + shadowReadyTimeoutMs;
+		const ready = await waitForReplicaTcpReady(newService, instance, {
 			timeoutMs: shadowReadyTimeoutMs,
 			intervalMs: shadowReadyIntervalMs,
 			label: `Soft-reloaded replica r${instance.index} (gen ${instance.generation})`
-		});
-		const ownerKeyGenSuffix = instance.generation > 0 ? `:g${instance.generation}` : "";
-		const ownerKeyPrefix = `${newService.serviceLogicalId}:r${instance.index}${ownerKeyGenSuffix}`;
+		}) === "ready";
+		for (const target of targets) {
+			const plan = attachPlans.get(target.id);
+			if (!plan || plan.aliasesAttached) continue;
+			if (target.port !== void 0) await waitForContainerListening(target.id, target.port, aliasDeadline);
+			try {
+				await dockerNetworkDisconnectImpl(plan.networkName, target.id);
+				plan.attached = false;
+				await attachToSharedNetwork(target.id, plan, true);
+			} catch (err) {
+				throw new EcsServiceRunnerError(`softReloadReplica: restoring the network aliases of '${target.name}' (${target.id}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
+			}
+		}
+		const ownerKeyPrefix = replicaOwnerKeyPrefix(newService, instance);
 		if (controllerOptions.discovery) await publishReplicaToCloudMap(newService, instance, controllerOptions.discovery, ownerKeyPrefix);
 		if (controllerOptions.frontDoor) await publishReplicaToFrontDoor(newService, instance, controllerOptions.frontDoor, controllerOptions.taskOptions.containerHost, ownerKeyPrefix);
 		instance.lastDeployedAssetHash = pickEssentialAssetHash(newService);
-		logger.info(`Soft-reloaded replica r${instance.index} (gen ${instance.generation}): ${SOFT_RELOAD_COMPLETION_LOG_SUFFIX}`);
+		logger.info(`Soft-reloaded replica r${instance.index} (gen ${instance.generation}): ` + (ready ? SOFT_RELOAD_COMPLETION_LOG_SUFFIX : SOFT_RELOAD_PROBE_TIMEOUT_LOG_SUFFIX));
+	} catch (err) {
+		for (const [id, plan] of attachPlans) {
+			if (plan.aliasesAttached) continue;
+			try {
+				if (plan.attached) {
+					await dockerNetworkDisconnectImpl(plan.networkName, id);
+					plan.attached = false;
+				}
+				try {
+					await attachToSharedNetwork(id, plan, true);
+				} catch {
+					await dockerNetworkConnectImpl(plan.networkName, id, { aliases: plan.aliases });
+					plan.attached = true;
+					plan.aliasesAttached = true;
+				}
+			} catch (restoreErr) {
+				logger.debug(`Soft-reload of replica r${instance.index}: re-attaching container ${id} to ${plan.networkName} failed: ${restoreErr instanceof Error ? restoreErr.message : String(restoreErr)}`);
+			}
+		}
+		throw err;
 	} finally {
 		instance.softReloadInProgress = false;
 	}
@@ -17559,23 +17739,122 @@ const defaultDockerCpImpl = async (src, dst) => {
 	], { maxBuffer: 64 * 1024 * 1024 });
 };
 let dockerCpImpl = defaultDockerCpImpl;
-const defaultDockerRestartImpl = async (containerId) => {
+const defaultDockerStopImpl = async (containerId) => {
+	const { execFile } = await import("node:child_process");
+	const { promisify } = await import("node:util");
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	await promisify(execFile)(getDockerCmd(), ["stop", containerId]);
+};
+const defaultDockerStartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
 	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
-	await promisify(execFile)(getDockerCmd(), ["restart", containerId]);
+	await promisify(execFile)(getDockerCmd(), ["start", containerId]);
 };
-let dockerRestartImpl = defaultDockerRestartImpl;
-async function disconnectOldFromSharedNetwork(oldInstance) {
+let dockerStopImpl = defaultDockerStopImpl;
+let dockerStartImpl = defaultDockerStartImpl;
+async function detachFromSharedNetwork(target, networkName) {
+	const logger = getLogger().child("ecs-service");
+	let ip;
+	try {
+		ip = await getContainerNetworkIp(target.id, networkName);
+	} catch {
+		ip = void 0;
+	}
+	if (!ip) {
+		logger.debug(`Soft-reload: no IP for '${target.name}' (${target.id}) on ${networkName}; restarting it in place without detaching its network aliases first.`);
+		return;
+	}
+	let publishesHostPorts;
+	try {
+		publishesHostPorts = await dockerInspectPublishesHostPortsImpl(target.id);
+	} catch {
+		publishesHostPorts = true;
+	}
+	try {
+		await dockerNetworkDisconnectImpl(networkName, target.id);
+	} catch (err) {
+		logger.debug(`Soft-reload: detaching '${target.name}' (${target.id}) from ${networkName} failed: ${err instanceof Error ? err.message : String(err)}. Restarting it in place.`);
+		return;
+	}
+	return {
+		networkName,
+		ip,
+		aliases: target.aliases,
+		publishesHostPorts,
+		attached: false,
+		aliasesAttached: false
+	};
+}
+const DEFAULT_RELOAD_DRAIN_MS = 1e3;
+let reloadDrainMs = DEFAULT_RELOAD_DRAIN_MS;
+async function reattachForDrain(plans) {
+	let any = false;
+	for (const [id, plan] of plans) try {
+		await attachToSharedNetwork(id, plan, false);
+		any = true;
+	} catch (err) {
+		getLogger().child("ecs-service").debug(`Soft-reload: drain re-attach of ${id} to ${plan.networkName} failed: ${err instanceof Error ? err.message : String(err)}. Stopping it without a drain.`);
+	}
+	return any;
+}
+async function attachToSharedNetwork(containerId, plan, withAliases) {
+	await dockerNetworkConnectImpl(plan.networkName, containerId, {
+		ip: plan.ip,
+		aliases: withAliases ? plan.aliases : []
+	});
+	plan.attached = true;
+	plan.aliasesAttached = withAliases;
+}
+const defaultDockerNetworkConnectImpl = async (networkName, containerId, opts) => {
+	const { execFile } = await import("node:child_process");
+	const { promisify } = await import("node:util");
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const args = ["network", "connect"];
+	if (opts.ip) args.push("--ip", opts.ip);
+	for (const a of opts.aliases) args.push("--alias", a);
+	args.push(networkName, containerId);
+	await promisify(execFile)(getDockerCmd(), args);
+};
+let dockerNetworkConnectImpl = defaultDockerNetworkConnectImpl;
+const defaultDockerInspectPublishesHostPortsImpl = async (containerId) => {
+	const { execFile } = await import("node:child_process");
+	const { promisify } = await import("node:util");
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const { stdout } = await promisify(execFile)(getDockerCmd(), [
+		"inspect",
+		"--format",
+		"{{json .HostConfig.PortBindings}}",
+		containerId
+	]);
+	const parsed = JSON.parse(stdout.trim() || "null");
+	if (!parsed || typeof parsed !== "object") return false;
+	return Object.values(parsed).some((bindings) => Array.isArray(bindings) && bindings.length > 0);
+};
+let dockerInspectPublishesHostPortsImpl = defaultDockerInspectPublishesHostPortsImpl;
+async function disconnectOldFromSharedNetwork(oldInstance, opts = {}) {
 	const network = oldInstance.state.network;
 	if (!network || !network.ownedByCaller) return;
 	const networkName = network.networkName;
-	const targets = [];
-	if (network.sidecarContainerId) targets.push(network.sidecarContainerId);
-	for (const c of oldInstance.state.startedContainers) targets.push(c.id);
+	const drainIps = /* @__PURE__ */ new Map();
+	if (opts.drain) for (const c of oldInstance.state.startedContainers) {
+		const ip = await getContainerNetworkIp(c.id, networkName).catch(() => void 0);
+		if (ip) drainIps.set(c.id, ip);
+	}
+	const targets = oldInstance.state.startedContainers.map((c) => c.id);
 	for (const id of targets) try {
 		await dockerNetworkDisconnectImpl(networkName, id);
 	} catch (err) {}
+	if (drainIps.size === 0) return;
+	let reattached = false;
+	for (const [id, ip] of drainIps) try {
+		await dockerNetworkConnectImpl(networkName, id, {
+			ip,
+			aliases: []
+		});
+		reattached = true;
+	} catch {}
+	if (reattached) await sleep(reloadDrainMs);
 }
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
@@ -17594,36 +17873,129 @@ async function waitForReplicaTcpReady(service, replica, opts) {
 	const logger = getLogger().child("ecs-service");
 	const label = opts.label ?? `Shadow replica r${replica.index} (gen ${replica.generation})`;
 	const networkName = replica.state.network?.networkName;
-	if (!networkName) return;
+	if (!networkName) return "ready";
 	const essential = service.task.containers.find((c) => c.essential) ?? service.task.containers[0];
-	if (!essential || essential.portMappings.length === 0) return;
+	if (!essential || essential.portMappings.length === 0) return "ready";
 	const started = replica.state.startedContainers.find((c) => c.name === essential.name);
-	if (!started) return;
-	let ip;
-	try {
-		const resolved = await getContainerNetworkIp(started.id, networkName);
-		if (!resolved) return;
-		ip = resolved;
-	} catch (err) {
-		logger.warn(`${label}: TCP-ready probe could not resolve docker IP: ${err instanceof Error ? err.message : String(err)}. Proceeding.`);
-		return;
-	}
+	if (!started) return "ready";
 	const port = essential.portMappings[0].containerPort;
 	const startedAt = Date.now();
 	const deadline = startedAt + opts.timeoutMs;
 	let lastErr;
+	let target = formatAuthority(started.name, port);
+	let inContainer = true;
+	let ip;
 	while (Date.now() < deadline) {
-		try {
-			await tcpProbeImpl(ip, port);
-			const elapsedMs = Date.now() - startedAt;
-			logger.debug(`${label}: TCP probe ${ip}:${port} accepted in ${elapsedMs}ms.`);
-			return;
-		} catch (err) {
-			lastErr = err instanceof Error ? err.message : String(err);
+		if (opts.isShuttingDown?.()) return "not-ready";
+		if (inContainer) {
+			const result = await listenProbeImpl(started.id, port, deadline - Date.now());
+			if (result.kind === "listening") {
+				logger.debug(`${label}: port ${port} listening in ${Date.now() - startedAt}ms (in-container check).`);
+				return "ready";
+			}
+			if (result.kind === "unsupported") {
+				logger.debug(`${label}: in-container LISTEN check unavailable (${result.detail}); falling back to a host-side TCP connect.`);
+				inContainer = false;
+				continue;
+			}
+			if (result.kind === "exited") {
+				logger.warn(`${label}: the container exited before port ${port} listened. Proceeding.`);
+				return "exited";
+			}
+			lastErr = result.kind === "not-listening" ? "not listening yet" : result.detail;
+		} else {
+			if (ip === void 0) {
+				try {
+					ip = await getContainerNetworkIp(started.id, networkName);
+				} catch (err) {
+					logger.warn(`${label}: TCP-ready probe could not resolve docker IP: ${err instanceof Error ? err.message : String(err)}. Proceeding.`);
+					return "not-ready";
+				}
+				if (!ip) {
+					logger.warn(`${label}: TCP-ready probe found no docker IP for ${started.name} on ${networkName}. Proceeding.`);
+					return "not-ready";
+				}
+				target = formatAuthority(ip, port);
+			}
+			try {
+				await tcpProbeImpl(ip, port);
+				logger.debug(`${label}: TCP probe ${target} accepted in ${Date.now() - startedAt}ms.`);
+				return "ready";
+			} catch (err) {
+				lastErr = err instanceof Error ? err.message : String(err);
+			}
 		}
 		await sleep(opts.intervalMs);
 	}
-	logger.warn(`${label}: TCP probe ${ip}:${port} did not accept within ${opts.timeoutMs}ms (last: ${lastErr ?? "n/a"}). Proceeding anyway — the new source is the user intent. Initial requests may 502 until the app finishes binding.`);
+	logger.warn(`${label}: TCP probe ${target} did not accept within ${opts.timeoutMs}ms (last: ${lastErr ?? "n/a"}). Proceeding anyway — the new source is the user intent. Initial requests may 502 until the app finishes binding.`);
+	return "not-ready";
+}
+const LISTEN_PROBE_SCRIPT = [
+	"p=$(printf \"%04X\" \"$1\")",
+	"seen=0",
+	"for f in /proc/net/tcp /proc/net/tcp6; do",
+	"  [ -r \"$f\" ] || continue",
+	"  seen=1",
+	"  while read -r _ l _ s _; do",
+	"    [ \"$s\" = 0A ] || continue",
+	"    case \"$l\" in *:\"$p\") ;; *) continue ;; esac",
+	"    case \"$l\" in ??????7F:*|0000000000000000FFFF0000??????7F:*) continue ;; esac",
+	"    case \"$l\" in 00000000000000000000000001000000:*) continue ;; esac",
+	"    exit 0",
+	"  done < \"$f\"",
+	"done",
+	"[ \"$seen\" = 1 ] && exit 3",
+	"exit 4"
+].join("\n");
+async function dockerExecListenProbe(containerId, port, timeoutMs = 1e4) {
+	const { execFile } = await import("node:child_process");
+	const { promisify } = await import("node:util");
+	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	try {
+		await promisify(execFile)(getDockerCmd(), [
+			"exec",
+			containerId,
+			"sh",
+			"-c",
+			LISTEN_PROBE_SCRIPT,
+			"sh",
+			String(port)
+		], { timeout: Math.max(1, Math.min(1e4, timeoutMs)) });
+		return { kind: "listening" };
+	} catch (err) {
+		const e = err;
+		const ran = typeof e.code === "number" || typeof e.signal === "string";
+		const detail = flattenToOneLine(typeof e.stderr === "string" && e.stderr.trim() || (ran ? `exit ${String(e.code ?? e.signal)}` : e.message || String(err))).slice(0, 200);
+		if (e.code === 3) return { kind: "not-listening" };
+		if (e.code === 4) return {
+			kind: "unsupported",
+			detail: "no readable /proc/net/tcp"
+		};
+		const stderr = typeof e.stderr === "string" ? e.stderr : "";
+		if (/is not running|stopped state/i.test(stderr)) return {
+			kind: "exited",
+			detail
+		};
+		if ((e.code === 126 || e.code === 127) && /not found|no such file/i.test(stderr)) return {
+			kind: "unsupported",
+			detail
+		};
+		return {
+			kind: "error",
+			detail
+		};
+	}
+}
+let listenProbeImpl = dockerExecListenProbe;
+async function waitForContainerListening(containerId, port, deadline) {
+	while (Date.now() < deadline) {
+		const result = await listenProbeImpl(containerId, port, deadline - Date.now());
+		if (result.kind === "listening") return "ready";
+		if (result.kind === "exited") return "exited";
+		if (result.kind === "unsupported") return "not-ready";
+		await sleep(shadowReadyIntervalMs);
+	}
+	return "not-ready";
 }
 const defaultTcpProbeImpl = async (host, port) => {
 	const { createConnection } = await import("node:net");
@@ -17693,7 +18065,19 @@ async function watchReplica(service, options, instance, runState) {
 		}
 		instance.state = createEcsRunState();
 		instance.restartCount += 1;
-		const bootPromise = bootReplica(service, options, instance);
+		const isShuttingDown = () => instance.shuttingDown || runState.shuttingDown;
+		const bootPromise = (async () => {
+			await bootReplica(service, options, instance, { deferPublish: true });
+			const deadline = Date.now() + shadowReadyTimeoutMs;
+			const label = `Restarted replica r${instance.index} (gen ${instance.generation})`;
+			if (await waitForReplicaTcpReady(service, instance, {
+				timeoutMs: shadowReadyTimeoutMs,
+				intervalMs: shadowReadyIntervalMs,
+				label,
+				isShuttingDown
+			}) === "exited") return;
+			await publishGatedReplica(service, options, instance, deadline, isShuttingDown, label);
+		})();
 		instance.inFlightBoot = bootPromise;
 		try {
 			await bootPromise;
@@ -19332,6 +19716,16 @@ function describePinnedImageUri(service) {
 	if (image.kind === "cdk-asset") return void 0;
 	return image.uri;
 }
+function imageOverrideKeyAliases(service) {
+	const out = /* @__PURE__ */ new Set([
+		service.serviceLogicalId,
+		`${service.stack.stackName}:${service.serviceLogicalId}`,
+		service.serviceDisplayName,
+		service.serviceName
+	]);
+	out.delete("");
+	return [...out];
+}
 function listPinnedTargets(resolvedServices) {
 	const out = [];
 	for (const { target, service } of resolvedServices) {
@@ -19339,7 +19733,8 @@ function listPinnedTargets(resolvedServices) {
 		const label = describePinnedImageUri(service);
 		out.push({
 			target,
-			...label !== void 0 && { label }
+			...label !== void 0 && { label },
+			aliases: imageOverrideKeyAliases(service)
 		});
 	}
 	return out;
@@ -19468,6 +19863,70 @@ function parseImageOverrideFlags(input) {
 		perService
 	};
 }
+function canonicalizeImageOverrideKeys(rawFlags, pinnedAliases, knownTargets = []) {
+	const exact = /* @__PURE__ */ new Set([...pinnedAliases.keys(), ...knownTargets]);
+	const targetsByAlias = /* @__PURE__ */ new Map();
+	for (const [target, aliases] of pinnedAliases) for (const alias of aliases) {
+		let set = targetsByAlias.get(alias);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			targetsByAlias.set(alias, set);
+		}
+		set.add(target);
+	}
+	const logger = getLogger();
+	const canonical = (key, flag) => {
+		if (exact.has(key)) return key;
+		const matches = targetsByAlias.get(key);
+		if (!matches) return key;
+		if (matches.size > 1) throw new ImageOverrideError(`${flag} key '${key}' matches more than one pinned target (${[...matches].join(", ")}). Name the target in full instead.`);
+		const target = [...matches][0];
+		logger.debug(`${flag} key '${key}' resolved to pinned target '${target}'.`);
+		return target;
+	};
+	const explicit = /* @__PURE__ */ new Map();
+	const explicitKeyByTarget = /* @__PURE__ */ new Map();
+	for (const [key, dockerfile] of rawFlags.explicit) {
+		const target = canonical(key, "--image-override");
+		const earlier = explicitKeyByTarget.get(target);
+		if (earlier !== void 0) throw new ImageOverrideError(`--image-override keys '${earlier}' and '${key}' both name the pinned target '${target}'. Name each service target at most once.`);
+		explicitKeyByTarget.set(target, key);
+		explicit.set(target, dockerfile);
+	}
+	const perService = /* @__PURE__ */ new Map();
+	for (const [key, overlay] of rawFlags.perService) {
+		const target = canonical(key, "Per-service image-override flag");
+		const into = perService.get(target);
+		if (!into) {
+			perService.set(target, {
+				buildArgs: new Map(overlay.buildArgs),
+				buildSecrets: new Map(overlay.buildSecrets),
+				...overlay.targetStage !== void 0 && { targetStage: overlay.targetStage }
+			});
+			continue;
+		}
+		const conflict = (what) => {
+			throw new ImageOverrideError(`Per-service image-override flags give ${what} two different values for the pinned target '${target}' (one of them keyed '${key}'). Pass it once.`);
+		};
+		for (const [k, v] of overlay.buildArgs) {
+			if (into.buildArgs.has(k) && into.buildArgs.get(k) !== v) conflict(`build arg '${k}'`);
+			into.buildArgs.set(k, v);
+		}
+		for (const [id, src] of overlay.buildSecrets) {
+			if (into.buildSecrets.has(id) && into.buildSecrets.get(id) !== src) conflict(`build secret '${id}'`);
+			into.buildSecrets.set(id, src);
+		}
+		if (overlay.targetStage !== void 0) {
+			if (into.targetStage !== void 0 && into.targetStage !== overlay.targetStage) conflict("the target stage");
+			into.targetStage = overlay.targetStage;
+		}
+	}
+	return {
+		...rawFlags,
+		explicit,
+		perService
+	};
+}
 async function resolveImageOverrides(args) {
 	const logger = getLogger();
 	const { rawFlags, pinnedTargets, noInteractive } = args;
@@ -20117,7 +20576,7 @@ async function rollOneTarget(args) {
 			return;
 		}
 		if (newService.desiredCount !== oldReplicas.length) logger.warn(`Reload of '${newBoot.target}': service DesiredCount=${newService.desiredCount} does not match the ${oldReplicas.length} live replica(s); rolling existing replicas only — scale changes during --watch are not yet supported. \`^C\` and re-run start-service to apply the new replica count.`);
-		if (verdict.kind === "soft-reload") logger.info(`Reload of '${newBoot.target}': soft-reloading ${oldReplicas.length} replica(s) one at a time (docker cp source → docker restart → TCP-ready probe; no rebuild).`);
+		if (verdict.kind === "soft-reload") logger.info(`Reload of '${newBoot.target}': soft-reloading ${oldReplicas.length} replica(s) one at a time (docker cp source → restart → TCP-ready probe; no rebuild).`);
 		else logger.info(`Reload of '${newBoot.target}': rolling ${oldReplicas.length} replica(s) one at a time (start new shadow → swap registrations → stop old).`);
 		for (const oldInstance of oldReplicas) {
 			const idx = controller.runState.replicas.indexOf(oldInstance);
@@ -20200,7 +20659,7 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 	let resolvedRoleArn;
 	if (effectiveAssumeRole === true) {
 		if (!service.task.taskRoleArn) throw new LocalStartServiceError(`--assume-role passed without an ARN but service '${service.serviceLogicalId}' has no resolvable TaskRoleArn. Pass the ARN explicitly: --assume-role <arn>`);
-		resolvedRoleArn = await resolvePlaceholderAccount$1(service.task.taskRoleArn, options.region, options.profile);
+		resolvedRoleArn = await resolveTaskRoleArnForOptions$1(service.task.taskRoleArn, options);
 		assumedCredentials = await assumeTaskRole$1(resolvedRoleArn, options.region, options.profile);
 	} else if (typeof effectiveAssumeRole === "string") {
 		resolvedRoleArn = effectiveAssumeRole;
@@ -20518,12 +20977,13 @@ function describeRuleActionForSummary(action) {
 function describeForwardTargetForSummary(t) {
 	return t.kind === "lambda" ? `<Lambda: ${t.lambda.logicalId}>` : `<ECS: ${t.serviceTarget}>`;
 }
-async function resolvePlaceholderAccount$1(arn, region, profile) {
+async function resolvePlaceholderAccount$1(arn, region, profile, readFromCfnStack) {
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(deployAccountStsClientConfig({
+	const sts = new STSClient(accountLookupStsClientConfig({
 		region,
-		profile
+		profile,
+		readFromCfnStack
 	}));
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
@@ -20536,6 +20996,9 @@ async function resolvePlaceholderAccount$1(arn, region, profile) {
 		sts.destroy();
 	}
 }
+async function resolveTaskRoleArnForOptions$1(arn, options) {
+	return resolvePlaceholderAccount$1(arn, options.region, options.profile, isCfnFlagPresent(options));
+}
 async function assumeTaskRole$1(roleArn, region, profile) {
 	return assumeRoleCredentials({
 		roleArn,
@@ -20558,7 +21021,7 @@ async function buildEcsImageResolutionContext$1(target, stacks, options, statePr
 		if (!region) logger.warn(`Resolver references \${AWS::Region} but ${getEmbedConfig().binaryName} could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.`);
 		let accountId;
 		try {
-			accountId = await resolveCallerAccountId$1(region, options.profile);
+			accountId = await resolveCallerAccountId$1(region, options.profile, isCfnFlagPresent(options));
 		} catch (err) {
 			logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped; affected env / secret entries will be dropped with per-key warnings.`);
 		}
@@ -20600,11 +21063,12 @@ function pickCandidateStack$1(stackPattern, stacks) {
 	const matched = matchStacks(stacks, [stackPattern]);
 	if (matched.length === 1) return matched[0];
 }
-async function resolveCallerAccountId$1(region, profile) {
+async function resolveCallerAccountId$1(region, profile, readFromCfnStack) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(deployAccountStsClientConfig({
+	const sts = new STSClient(accountLookupStsClientConfig({
 		region,
-		profile
+		profile,
+		readFromCfnStack
 	}));
 	try {
 		return (await sts.send(new GetCallerIdentityCommand({}))).Account;
@@ -20709,13 +21173,17 @@ async function resolveAndBuildImageOverrides(args) {
 	const pinnedEntries = listPinnedTargets(resolvedForPeek);
 	const pinnedTargets = pinnedEntries.map((e) => e.target);
 	const pinnedLabels = /* @__PURE__ */ new Map();
-	for (const entry of pinnedEntries) if (entry.label !== void 0) pinnedLabels.set(entry.target, entry.label);
-	const rawFlags = parseImageOverrideFlags({
+	const pinnedAliases = /* @__PURE__ */ new Map();
+	for (const entry of pinnedEntries) {
+		if (entry.label !== void 0) pinnedLabels.set(entry.target, entry.label);
+		pinnedAliases.set(entry.target, entry.aliases);
+	}
+	const rawFlags = canonicalizeImageOverrideKeys(parseImageOverrideFlags({
 		...options.imageOverride && { imageOverride: options.imageOverride },
 		...options.imageBuildArg && { imageBuildArg: options.imageBuildArg },
 		...options.imageBuildSecret && { imageBuildSecret: options.imageBuildSecret },
 		...options.imageTarget && { imageTarget: options.imageTarget }
-	});
+	}), pinnedAliases, perTarget);
 	if (pinnedTargets.length === 0 && rawFlags.explicit.size === 0 && rawFlags.pickerPaths.length === 0 && rawFlags.perService.size === 0) return {
 		tags: /* @__PURE__ */ new Map(),
 		overrides: /* @__PURE__ */ new Map()
@@ -20728,6 +21196,7 @@ async function resolveAndBuildImageOverrides(args) {
 		noInteractive: options.interactiveOverrides === false
 	});
 	enforceImageOverrideOrphans(rawFlags, overrides);
+	enforceStrictOverrides(options.strictOverrides === true, pinnedTargets.filter((t) => !overrides.has(t)));
 	if (overrides.size === 0) return {
 		tags: /* @__PURE__ */ new Map(),
 		overrides: /* @__PURE__ */ new Map()
@@ -20874,7 +21343,7 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 		let resolvedRoleArn;
 		if (effectiveAssumeRole === true) {
 			if (!task.taskRoleArn) throw new Error(`--assume-role passed without an ARN but the task definition has no resolvable TaskRoleArn. Either the task definition does not set TaskRoleArn, or it points at a resource ${getEmbedConfig().binaryName} cannot resolve to an IAM Role at synth time. Pass the ARN explicitly: --assume-role <arn>`);
-			resolvedRoleArn = await resolvePlaceholderAccount(task.taskRoleArn, options.region, options.profile);
+			resolvedRoleArn = await resolveTaskRoleArnForOptions(task.taskRoleArn, options);
 			assumedCredentials = await assumeTaskRole(resolvedRoleArn, options.region, options.profile);
 		} else if (typeof effectiveAssumeRole === "string") {
 			resolvedRoleArn = effectiveAssumeRole;
@@ -20944,12 +21413,13 @@ var PlaceholderAccountError = class PlaceholderAccountError extends Error {
 		Object.setPrototypeOf(this, PlaceholderAccountError.prototype);
 	}
 };
-async function resolvePlaceholderAccount(arn, region, profile) {
+async function resolvePlaceholderAccount(arn, region, profile, readFromCfnStack) {
 	if (!arn.includes("${AWS::AccountId}")) return arn;
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(deployAccountStsClientConfig({
+	const sts = new STSClient(accountLookupStsClientConfig({
 		region,
-		profile
+		profile,
+		readFromCfnStack
 	}));
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
@@ -20964,6 +21434,9 @@ async function resolvePlaceholderAccount(arn, region, profile) {
 		sts.destroy();
 	}
 }
+async function resolveTaskRoleArnForOptions(arn, options) {
+	return resolvePlaceholderAccount(arn, options.region, options.profile, isCfnFlagPresent(options));
+}
 async function assumeTaskRole(roleArn, region, profile) {
 	return assumeRoleCredentials({
 		roleArn,
@@ -20984,7 +21457,7 @@ async function buildEcsImageResolutionContext(candidate, stateProvider, options)
 		if (!region) logger.warn(`Resolver references \${AWS::Region} but ${getEmbedConfig().binaryName} could not determine the target region. Pass --region, set AWS_REGION, or declare env.region on the CDK stack.`);
 		let accountId;
 		try {
-			accountId = await resolveCallerAccountId(region, options.profile);
+			accountId = await resolveCallerAccountId(region, options.profile, isCfnFlagPresent(options));
 		} catch (err) {
 			logger.warn(`Resolver needs \${AWS::AccountId} but STS GetCallerIdentity failed: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity")}. Substitution will be skipped; affected env / secret entries will be dropped with per-key warnings.`);
 		}
@@ -21023,11 +21496,12 @@ function pickCandidateStack(stackPattern, stacks) {
 	const matched = matchStacks(stacks, [stackPattern]);
 	if (matched.length === 1) return matched[0];
 }
-async function resolveCallerAccountId(region, profile) {
+async function resolveCallerAccountId(region, profile, readFromCfnStack) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-	const sts = new STSClient(deployAccountStsClientConfig({
+	const sts = new STSClient(accountLookupStsClientConfig({
 		region,
-		profile
+		profile,
+		readFromCfnStack
 	}));
 	try {
 		return (await sts.send(new GetCallerIdentityCommand({}))).Account;
@@ -21070,6 +21544,16 @@ function createLocalRunTaskCommand(opts = {}) {
 	cmd.addOption(regionOption);
 	return cmd;
 }
+function runTaskOverrideKeyAliases(task) {
+	const id = task.taskDefinitionLogicalId;
+	const out = /* @__PURE__ */ new Set([
+		id,
+		`${task.stack.stackName}:${id}`,
+		deriveServiceDisplayName(void 0, id, task.resource.Metadata)
+	]);
+	out.delete("");
+	return [...out];
+}
 async function resolveRunTaskImageOverride(args) {
 	const { task, target, options, cwd } = args;
 	const essential = task.containers.find((c) => c.essential) ?? task.containers[0];
@@ -21077,12 +21561,14 @@ async function resolveRunTaskImageOverride(args) {
 	const pinnedTargets = pinned ? [target] : [];
 	const pinnedLabels = /* @__PURE__ */ new Map();
 	if (pinned) pinnedLabels.set(target, `${task.stack.stackName}/${task.taskDefinitionLogicalId}`);
-	const rawFlags = parseImageOverrideFlags({
+	const pinnedAliases = /* @__PURE__ */ new Map();
+	if (pinned) pinnedAliases.set(target, runTaskOverrideKeyAliases(task));
+	const rawFlags = canonicalizeImageOverrideKeys(parseImageOverrideFlags({
 		...options.imageOverride && { imageOverride: options.imageOverride },
 		...options.imageBuildArg && { imageBuildArg: options.imageBuildArg },
 		...options.imageBuildSecret && { imageBuildSecret: options.imageBuildSecret },
 		...options.imageTarget && { imageTarget: options.imageTarget }
-	});
+	}), pinnedAliases, [target]);
 	if (pinnedTargets.length === 0 && rawFlags.explicit.size === 0 && rawFlags.pickerPaths.length === 0 && rawFlags.perService.size === 0) return {};
 	const overrides = await resolveImageOverrides({
 		rawFlags,
@@ -21134,7 +21620,7 @@ function createLocalStartServiceCommand(opts = {}) {
 }
 function addStartServiceSpecificOptions(cmd) {
 	addImageOverrideOptions(cmd);
-	return cmd.addOption(new Option("--host-port <containerPort=hostPort...>", "Publish a container port on a specific host port (e.g. 80=8080); repeatable. Default: host port == container port. Use this on macOS to map a privileged container port (< 1024) to a non-privileged host port and avoid the Docker Desktop admin-password prompt. (Single-replica services only — multi-replica services do not publish host ports.)")).addOption(new Option("--watch", "Hot-reload: re-synth + per-replica reload when the CDK source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). A per-firing classifier picks the per-replica primitive: source-only edits on interpreted-language handlers (Node/Python/Ruby/shell) take a bind-mount FAST PATH (`docker cp` the new source into each replica + `docker restart`; no rebuild). Dockerfile / dependency manifest / compiled-language source / ambiguous edits fall through to the rebuild rolling primitive — boot a shadow under a bumped generation suffix, wait for its container port to accept a TCP connection, atomically swap Service-Connect / Cloud Map registrations, then retire the old container. Either path rolls one replica at a time, so peer services see zero connection refusals across the reload even on multi-replica services. Off by default; existing replica(s) keep serving when synth fails mid-reload.").default(false));
+	return cmd.addOption(new Option("--host-port <containerPort=hostPort...>", "Publish a container port on a specific host port (e.g. 80=8080); repeatable. Default: host port == container port. Use this on macOS to map a privileged container port (< 1024) to a non-privileged host port and avoid the Docker Desktop admin-password prompt. (Single-replica services only — multi-replica services do not publish host ports.)")).addOption(new Option("--watch", "Hot-reload: re-synth + per-replica reload when the CDK source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). A per-firing classifier picks the per-replica primitive: source-only edits on interpreted-language handlers (Node/Python/Ruby/shell) take a bind-mount FAST PATH (`docker cp` the new source into each replica + restart it; no rebuild). Dockerfile / dependency manifest / compiled-language source / ambiguous edits fall through to the rebuild rolling primitive — boot a shadow under a bumped generation suffix, wait for its container port to accept a TCP connection, atomically swap Service-Connect / Cloud Map registrations, then retire the old container. Either path rolls one replica at a time, so peer services see zero connection refusals across the reload even on multi-replica services. Off by default; existing replica(s) keep serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
@@ -21770,7 +22256,7 @@ function createLocalStartAlbCommand(opts = {}) {
 }
 function addAlbSpecificOptions(cmd) {
 	addImageOverrideOptions(cmd);
-	return cmd.addOption(new Option("--lb-port <listenerPort=hostPort...>", "Bind the local front-door on a specific host port (e.g. 80=8080); repeatable. Default: host port == ALB listener port. Use this on macOS to remap a privileged listener port (< 1024) to a non-privileged host port.")).addOption(new Option("--tls", "Terminate TLS locally for cloud-HTTPS listeners. Default: a cloud-HTTPS listener is served over plain HTTP locally (X-Forwarded-Proto: https is preserved so the upstream app still sees the deployed listener protocol). Implied by --tls-cert / --tls-key. Use this when local-dev cookies need Secure / SameSite=None, when the upstream app inspects TLS metadata, or for mTLS / SNI testing — otherwise plain HTTP is friendlier (no self-signed cert warnings in curl / browser).")).addOption(new Option("--tls-cert <path>", "PEM-encoded server certificate for HTTPS front-door listeners. Implies --tls. Must be set together with --tls-key. Pass --tls alone (without --tls-cert / --tls-key) to auto-generate a self-signed cert (cached under $XDG_CACHE_HOME/cdk-local/alb-https/, default ~/.cache/cdk-local/alb-https/); requires openssl on PATH. The deployed Listener Certificates[] are NOT fetched (ACM private keys are not retrievable by design). The auto-generated cert lists DNS:localhost,IP:127.0.0.1 as SubjectAltName, so a client validating a non-loopback --container-host will fail the SAN check — pass --tls-cert / --tls-key with a SAN covering that host instead.")).addOption(new Option("--tls-key <path>", "PEM-encoded server private key matching --tls-cert. Implies --tls. Must be set together with --tls-cert.")).addOption(new Option("--no-verify-auth", "Disable local enforcement of authenticate-cognito / authenticate-oidc actions. Every request is served as if the auth check passed. Useful for local dev where you do not want to mint a Bearer token at all.")).addOption(new Option("--bearer-token <jwt>", "Default Bearer JWT this command INJECTS only when an inbound request has none (the default-when-missing role) — `cdkl start-alb` is the local ALB front-door RECEIVING outside-in requests, so this token is the fallback the front-door slots in as Authorization: Bearer <jwt> if the caller did not already supply one. Verified against the same JWKS / OIDC discovery URL the deployed ALB would (signature + iss + aud + exp). Cookie pass-through (AWSELBAuthSessionCookie-*) also bypasses the guard. Contrast with `cdkl invoke-agentcore --bearer-token`, where the role is reversed — that command is the outbound client and ALWAYS presents this token (the supplier).")).addOption(new Option("--watch", "Hot-reload: re-synth + per-replica reload of every ECS service behind the ALB when the CDK source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). A per-firing classifier picks the per-replica primitive: source-only edits on interpreted-language handlers (Node/Python/Ruby/shell) take a bind-mount FAST PATH (`docker cp` the new source into each replica + `docker restart`; no rebuild, front-door pool entry unchanged since the IP/port are preserved). Dockerfile / dependency manifest / compiled-language source / ambiguous edits fall through to the rebuild rolling primitive — boot a shadow under a bumped generation suffix, wait for its container port to accept a TCP connection, atomically register it in the front-door pool, then drop the old entry and retire the old container. Either path rolls one replica at a time, so a continuous external request stream against the listener port sees zero connection refusals across the reload. The host front-door (TLS, JWKS cache, Lambda-target containers, listener sockets) stays up across the reload. Lambda target groups behind the ALB are a no-op on reload (the warm RIE container keeps its boot-time image). Off by default; existing replica(s) keep serving when synth fails mid-reload.").default(false));
+	return cmd.addOption(new Option("--lb-port <listenerPort=hostPort...>", "Bind the local front-door on a specific host port (e.g. 80=8080); repeatable. Default: host port == ALB listener port. Use this on macOS to remap a privileged listener port (< 1024) to a non-privileged host port.")).addOption(new Option("--tls", "Terminate TLS locally for cloud-HTTPS listeners. Default: a cloud-HTTPS listener is served over plain HTTP locally (X-Forwarded-Proto: https is preserved so the upstream app still sees the deployed listener protocol). Implied by --tls-cert / --tls-key. Use this when local-dev cookies need Secure / SameSite=None, when the upstream app inspects TLS metadata, or for mTLS / SNI testing — otherwise plain HTTP is friendlier (no self-signed cert warnings in curl / browser).")).addOption(new Option("--tls-cert <path>", "PEM-encoded server certificate for HTTPS front-door listeners. Implies --tls. Must be set together with --tls-key. Pass --tls alone (without --tls-cert / --tls-key) to auto-generate a self-signed cert (cached under $XDG_CACHE_HOME/cdk-local/alb-https/, default ~/.cache/cdk-local/alb-https/); requires openssl on PATH. The deployed Listener Certificates[] are NOT fetched (ACM private keys are not retrievable by design). The auto-generated cert lists DNS:localhost,IP:127.0.0.1 as SubjectAltName, so a client validating a non-loopback --container-host will fail the SAN check — pass --tls-cert / --tls-key with a SAN covering that host instead.")).addOption(new Option("--tls-key <path>", "PEM-encoded server private key matching --tls-cert. Implies --tls. Must be set together with --tls-cert.")).addOption(new Option("--no-verify-auth", "Disable local enforcement of authenticate-cognito / authenticate-oidc actions. Every request is served as if the auth check passed. Useful for local dev where you do not want to mint a Bearer token at all.")).addOption(new Option("--bearer-token <jwt>", "Default Bearer JWT this command INJECTS only when an inbound request has none (the default-when-missing role) — `cdkl start-alb` is the local ALB front-door RECEIVING outside-in requests, so this token is the fallback the front-door slots in as Authorization: Bearer <jwt> if the caller did not already supply one. Verified against the same JWKS / OIDC discovery URL the deployed ALB would (signature + iss + aud + exp). Cookie pass-through (AWSELBAuthSessionCookie-*) also bypasses the guard. Contrast with `cdkl invoke-agentcore --bearer-token`, where the role is reversed — that command is the outbound client and ALWAYS presents this token (the supplier).")).addOption(new Option("--watch", "Hot-reload: re-synth + per-replica reload of every ECS service behind the ALB when the CDK source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). A per-firing classifier picks the per-replica primitive: source-only edits on interpreted-language handlers (Node/Python/Ruby/shell) take a bind-mount FAST PATH (`docker cp` the new source into each replica + restart it; no rebuild, its front-door pool entry is drained and re-published once it listens again). Dockerfile / dependency manifest / compiled-language source / ambiguous edits fall through to the rebuild rolling primitive — boot a shadow under a bumped generation suffix, wait for its container port to accept a TCP connection, atomically register it in the front-door pool, then drop the old entry and retire the old container. Either path rolls one replica at a time, so a continuous external request stream against the listener port sees zero connection refusals across the reload. The host front-door (TLS, JWKS cache, Lambda-target containers, listener sockets) stays up across the reload. Lambda target groups behind the ALB are a no-op on reload (the warm RIE container keeps its boot-time image). Off by default; existing replica(s) keep serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
@@ -28553,25 +29039,9 @@ async function relayServeRequest(input, fetchFn = fetch, clock = Date.now) {
 //#endregion
 //#region src/local/studio-proxy.ts
 let proxyIdCounter = 0;
-function isLoopbackHostname(hostname) {
-	const h = hostname.trim().replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
-	if (h === "localhost") return true;
-	if (h === "::1" || h === "0:0:0:0:0:0:0:1") return true;
-	const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(h);
-	if (mapped) return parseInt(mapped[1], 16) >> 8 === 127;
-	const dotted = /^(?:::ffff:)?(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
-	if (!dotted) return false;
-	const octets = dotted.slice(1).map(Number);
-	if (octets.some((o) => o > 255)) return false;
-	return octets[0] === 127;
-}
 function stripHostBrackets(hostname) {
 	return hostname.replace(/^\[/, "").replace(/\]$/, "");
 }
-function isWildcardHostname(hostname) {
-	const h = hostname.trim().replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
-	return h === "0.0.0.0" || h === "::" || h === "0:0:0:0:0:0:0:0" || h === "::ffff:0.0.0.0" || h === "::ffff:0:0";
-}
 function rewriteWildcardHostToken(upstream) {
 	const schemeEnd = upstream.indexOf("://");
 	if (schemeEnd === -1) return void 0;
@@ -29865,5 +30335,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, DynamicReferenceResolver as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, assumedRoleRecorded as Bi, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, keysOverriddenBy as Fi, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, workloadClientConfig as Gi, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, readEnvCallerCredentials as Hi, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, parseDynamicReference as Ii, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, resolveProfileCredentials as Ji, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, workloadStsClientConfig as Ki, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, resolveDynamicReferencesInEnv as Li, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, deployedFillMayBeSecret as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, firstUsableRegion as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, keysNotFromTemplate as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, withoutKeys as Ri, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, recordAssumedRole as Ui, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, deployAccountStsClientConfig as Vi, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, resetWorkloadIdentity as Wi, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, isProxyEnvConfigured as Xi, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, buildProxyClientConfig as Yi, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, containsDynamicReference as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, DynamicReferenceResolutionError as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, buildStsClientConfig as qi, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, SECOND_ASSUME_MESSAGE as zi, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-DIB4WEk6.js.map
+export { applyEdgeResponseResult as $, defaultCredentialsLoader as $n, resolveCfnFallbackRegion as $r, isLocalCdkAssetImage as $t, startAgentCoreHttpServer as A, LocalInvokeBuildError as Ai, renderCodeDockerfile as An, resolveHostGatewayExtraHosts as Ar, addRunTaskSpecificOptions as At, idFromArn as B, withoutKeys as Bi, createFileWatcher as Bn, buildContainerImage as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, AgentCoreResolutionError as Ci, invokeAgentCore as Cn, pickResponseTemplate as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, formatStateRemedy as Di, SUPPORTED_CODE_RUNTIMES as Dn, HOST_DOCKER_INTERNAL_GATEWAY as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, derivePseudoParametersFromRegion as Ei, downloadAndExtractS3Bundle as En, VtlEvaluationError as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, firstUsableRegion as Fi, addStartApiSpecificOptions as Fn, parseConnectionsPath as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, recordAssumedRole as Gi, availableApiIdentifiers as Gn, substituteAgainstState as Gr, canonicalizeImageOverrideKeys as Gt, createDeployedKvsDataSource as H, assumedRoleRecorded as Hi, buildStageMap as Hn, resolveRuntimeFileExtension as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, keysNotFromTemplate as Ii, createLocalStartApiCommand as In, buildConnectEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, workloadStsClientConfig as Ji, groupRoutesByServer as Jn, substituteEnvVarsFromStateAsync as Jr, parseImageOverrideFlags as Jt, createS3OriginReader as K, resetWorkloadIdentity as Ki, filterRoutesByApiIdentifier as Kn, substituteAgainstStateAsync as Kr, enforceImageOverrideOrphans as Kt, parseKvsFileOverrides as L, keysOverriddenBy as Li, createWatchPredicates as Ln, buildDisconnectEvent as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, DynamicReferenceResolver as Mi, classifySourceChange as Mn, ConnectionRegistry as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, containsDynamicReference as Ni, addInvokeSpecificOptions as Nn, buildMgmtEndpointEnvUrl as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, substituteImagePlaceholders as Oi, buildAgentCoreCodeImage as On, HOST_GATEWAY_MIN_VERSION as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, deployedFillMayBeSecret as Pi, createLocalInvokeCommand as Pn, handleConnectionsRequest as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, isProxyEnvConfigured as Qi, resolveServiceIntegrationParameters as Qn, rejectExplicitCfnStackWithMultipleStacks as Qr, imageOverrideKeyAliases as Qt, parseOriginOverrides as R, parseDynamicReference as Ri, resolveApiTargetSubset as Rn, buildMessageEvent as Rr, parseMaxTasks as Rt, StudioEventBus as S, AGENTCORE_RUNTIME_TYPE as Si, AGENTCORE_SESSION_ID_HEADER as Sn, evaluateResponseParameters as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, resolveAgentCoreTarget as Ti, waitForAgentCorePing as Tn, tryParseStatus as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, deployAccountStsClientConfig as Ui, materializeLayerFromArn as Un, resolveRuntimeImage as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, SECOND_ASSUME_MESSAGE as Vi, attachStageContext as Vn, resolveRuntimeCodeMountPath as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, readEnvCallerCredentials as Wi, resolveEnvVars$1 as Wn, EcsTaskResolutionError as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveProfileCredentials as Xi, startApiServer as Xn, createLocalStateProvider as Xr, runImageOverrideBuilds as Xt, resolveErrorResponseCandidates as Y, buildStsClientConfig as Yi, readMtlsMaterialsFromDisk as Yn, LocalStateSourceError as Yr, resolveImageOverrides as Yt, serveLambdaUrlOrigin as Z, buildProxyClientConfig as Zi, resolveSelectionExpression as Zn, isCfnFlagPresent as Zr, describePinnedImageUri as Zt, filterStudioTargetGroups as _, resolveLambdaArnIntrinsic as _i, MCP_PROTOCOL_VERSION as _n, matchRoute as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, resolveWatchConfig as ai, setShadowReadyTimeoutMs as an, verifyJwtViaDiscovery as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_HTTP_PROTOCOL as bi, AGENTCORE_SIGV4_SERVICE as bn, buildHttpApiV2Event as br, addAlbSpecificOptions as bt, startStudioProxy as c, listTargets as ci, addInvokeAgentCoreSpecificOptions as cn, evaluateCachedLambdaPolicy as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, discoverWebSocketApisOrThrow as di, invokeAgentCoreWs as dn, attachAuthorizers as dr, pickTargetFunctionLogicalId as dt, resolveCfnRegion as ei, listPinnedTargets as en, buildCognitoJwksUrl as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, filterWebSocketApisByIdentifiers as fi, A2A_CONTAINER_PORT as fn, applyCorsResponseHeaders as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, pickRefLogicalId as gi, MCP_PATH as gn, matchPreflight as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, discoverRoutes as hi, MCP_CONTAINER_PORT as hn, isFunctionUrlOacFronted as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSsmParameters as ii, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as in, verifyJwtAuthorizer as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, DynamicReferenceResolutionError as ji, toCmdArgv as jn, bufferToBody as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, tryResolveImageFnJoin as ki, computeCodeImageTag as kn, probeHostGatewaySupport as kr, serviceStrategy as kt, relayServeRequest as l, availableWebSocketApiIdentifiers as li, createLocalInvokeAgentCoreCommand as ln, invokeRequestAuthorizer as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, webSocketApiMatchesIdentifier as mi, a2aInvokeOnce as mn, buildCorsConfigFromCloudFrontChain as mr, runViewerRequest as mt, coerceRunRequest as n, CfnLocalStateProvider as ni, CloudMapRegistry as nn, createJwksCache as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, resolveSingleTarget as oi, getContainerNetworkIp as on, buildMethodArn as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, parseSelectionExpressionPath as pi, A2A_PATH as pn, buildCorsConfigByApiId as pr, compileCloudFrontFunction as pt, matchBehavior as q, workloadClientConfig as qi, filterRoutesByApiIdentifiers as qn, substituteEnvVarsFromState as qr, mergeForService as qt, coerceServeRequest as r, collectSsmParameterRefs as ri, DEFAULT_SHADOW_READY_TIMEOUT_MS as rn, verifyCognitoJwt as rr, httpHeadersToEdge as rt, createStudioServeManager as s, countTargets as si, attachContainerLogStreamer as sn, computeRequestIdentityHash as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, resolveCfnStackName as ti, buildCloudMapIndex as tn, buildJwksUrlFromIssuer as tr, buildEdgeResponseEvent as tt, reinvoke as u, discoverWebSocketApis as ui, bridgeAgentCoreWs as un, invokeTokenAuthorizer as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_A2A_PROTOCOL as vi, mcpInvokeOnce as vn, translateLambdaResponse as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, pickAgentCoreCandidateStack as wi, waitForAgentCoreHttpReady as wn, selectIntegrationResponse as wr, resolveAlbTarget as wt, createStudioStore as x, AGENTCORE_MCP_PROTOCOL as xi, signAgentCoreInvocation as xn, buildRestV1Event as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_AGUI_PROTOCOL as yi, parseSseForJsonRpc as yn, applyAuthorizerOverlay as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, resolveDynamicReferencesInEnv as zi, createAuthorizerCache as zn, architectureToPlatform as zr, parseRestartPolicy as zt };
+//# sourceMappingURL=local-studio-DCTVck5l.js.map