cdk-local 0.159.0 → 0.160.1

package/dist/{local-studio-D2McUMmL.js → local-studio-Ur6enHho.js}

@@ -1,8 +1,8 @@
 import { C as sanitizeServiceExceptionMessage, S as isAwsServiceException, _ as resolveAssemblyPath, a as isDockerClientEnvKey, b as describeCredentialLoadFailure, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as renderAssemblyPathEscape, h as namesTheSameDirectory, i as getDockerCmd, l as spawnStreaming, m as isPasteableCommandArg, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as clampErrorName, w as stringifyThrown, x as flattenToOneLine, y as describeAwsFailureForWarn } from "./docker-cmd-CoZdbeos.js";
 import { a as displayIdent, c as getEmbedConfig, i as STACK_REF_MAX_CODE_POINTS, o as displayStackName, s as displayToolOutput, t as getLogger, u as setEmbedConfig } from "./logger-Co5XVwco.js";
-import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, promises, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, hostname, tmpdir } from "node:os";
-import * as path$1 from "node:path";
+import * as nodePath from "node:path";
 import path, { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { Command, InvalidArgumentError, Option } from "commander";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
@@ -6850,6 +6850,10 @@ function extractHashFromImageUri(imageUri) {
 //#endregion
 //#region src/local/rie-client.ts
 const INVOKE_PATH = "/2015-03-31/functions/function/invocations";
+const NOT_AN_RIE_STATUS = /* @__PURE__ */ new Set([404, 405]);
+function notAnRieError(url, status) {
+	return /* @__PURE__ */ new Error(`The container answered the invoke at ${url} with HTTP ${status}, which the Lambda Runtime Interface Emulator never sends for that path: something else is listening on the container's port 8080 (the function's own server?). Check the container logs.`);
+}
 async function waitForRieReady(host, port, timeoutMs = 5e3) {
 	const deadline = Date.now() + timeoutMs;
 	let lastError;
@@ -6910,6 +6914,7 @@ async function invokeRie(host, port, event, timeoutMs) {
 		clearTimeout(timer);
 	}
 	const raw = await response.text();
+	if (NOT_AN_RIE_STATUS.has(response.status)) throw notAnRieError(url, response.status);
 	let payload = raw;
 	try {
 		payload = JSON.parse(raw);
@@ -6965,6 +6970,11 @@ async function invokeRieStreaming(host, port, event, timeoutMs) {
 		if (err.name === "AbortError") throw new Error(`RIE streaming invoke at ${url} timed out after ${timeoutMs}ms. The handler may be hung; check container logs.`);
 		throw err;
 	}
+	if (NOT_AN_RIE_STATUS.has(response.status)) {
+		clearTimeout(timer);
+		await response.body?.cancel().catch(() => void 0);
+		throw notAnRieError(url, response.status);
+	}
 	if (!response.body) {
 		clearTimeout(timer);
 		throw new Error(`RIE streaming invoke at ${url} returned no response body.`);
@@ -8856,11 +8866,11 @@ function createContainerPool(specs, options) {
 		} else containerId = await runDetached({
 			image: spec.image,
 			mounts: [],
-			...spec.profileCredentialsFile && { extraMounts: [{
+			extraMounts: [...spec.rieMount ? [spec.rieMount] : [], ...spec.profileCredentialsFile ? [{
 				hostPath: spec.profileCredentialsFile.hostPath,
 				containerPath: spec.profileCredentialsFile.containerPath,
 				readOnly: true
-			}] },
+			}] : []],
 			env: spec.env,
 			...spec.sensitiveEnvKeys !== void 0 && { sensitiveEnvKeys: spec.sensitiveEnvKeys },
 			cmd: spec.command,
@@ -9077,6 +9087,209 @@ function clampConcurrency(input) {
 	return Math.min(MAX_PER_LAMBDA_CONCURRENCY, Math.max(MIN_PER_LAMBDA_CONCURRENCY, Math.trunc(input)));
 }
 
+//#endregion
+//#region src/utils/cache-home.ts
+function userCacheHome(env = process.env, home = homedir) {
+	const product = getEmbedConfig().productName.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^\.*$/, "-");
+	const xdg = env["XDG_CACHE_HOME"];
+	if (xdg !== void 0 && isAbsolute(xdg)) return join(xdg, product);
+	let dir;
+	try {
+		dir = home();
+	} catch {
+		return;
+	}
+	return isAbsolute(dir) ? join(dir, ".cache", product) : void 0;
+}
+
+//#endregion
+//#region src/local/rie-mount.ts
+const RIE_CONTAINER_PATH = "/var/rapid/aws-lambda-rie";
+const RIE_SOURCE_IMAGE = "public.ecr.aws/lambda/provided:al2023";
+const RIE_SOURCE_PATH = "/usr/local/bin/aws-lambda-rie";
+const RIE_BASENAME = "aws-lambda-rie";
+const ELF_MACHINE_BY_PLATFORM = {
+	"linux/amd64": 62,
+	"linux/arm64": 183
+};
+function rieCacheDirectory(env = process.env) {
+	const root = userCacheHome(env);
+	return root === void 0 ? void 0 : join(root, "lambda-rie");
+}
+const inFlight = /* @__PURE__ */ new Map();
+const warnedNoBinary = /* @__PURE__ */ new Set();
+async function resolveRieWrap(input) {
+	const logger = getLogger().child("rie");
+	let program;
+	try {
+		const own = nonEmpty(input.entryPoint) && nonEmpty(input.command) ? {
+			entrypoint: [],
+			cmd: []
+		} : await inspectImageEntrypointCmd(input.image);
+		const entryPoint = nonEmpty(input.entryPoint) ? [...input.entryPoint] : own.entrypoint;
+		const cmd = nonEmpty(input.command) ? [...input.command] : own.cmd;
+		program = [...entryPoint, ...cmd];
+	} catch (err) {
+		logger.warn(`Could not read the ENTRYPOINT / CMD of image ${displayUntrustedValue(input.image)} (${messageOf(err)}), so no Lambda Runtime Interface Emulator is mounted into it; it runs as built.`);
+		return;
+	}
+	const ownRie = program.find(isRieExecutable);
+	if (ownRie !== void 0) {
+		logger.debug(`Image ${displayUntrustedValue(input.image)} already runs ${displayUntrustedValue(ownRie)}; not mounting another RIE`);
+		return;
+	}
+	let hostPath;
+	try {
+		hostPath = await ensureRieBinary(input.platform, input.skipPull === true);
+	} catch (err) {
+		if (!warnedNoBinary.has(input.platform)) {
+			warnedNoBinary.add(input.platform);
+			logger.warn(`Could not mount the Lambda Runtime Interface Emulator into ${displayUntrustedValue(input.platform)} container-image functions (${messageOf(err)}). They run as built, so only images that ship their own emulator (the AWS Lambda base images do) can be invoked.`);
+		} else logger.debug(`RIE mount skipped for ${displayUntrustedValue(input.image)}: ${messageOf(err)}`);
+		return;
+	}
+	return {
+		mount: {
+			hostPath,
+			containerPath: RIE_CONTAINER_PATH,
+			readOnly: true
+		},
+		entryPoint: [RIE_CONTAINER_PATH],
+		cmd: program
+	};
+}
+function isRieExecutable(path) {
+	return basename(path).startsWith(RIE_BASENAME);
+}
+function messageOf(err) {
+	return displayToolOutput(err instanceof Error ? err.message : String(err));
+}
+function nonEmpty(v) {
+	return v !== void 0 && v.length > 0;
+}
+async function inspectImageEntrypointCmd(image) {
+	let stdout;
+	try {
+		({stdout} = await runDockerStreaming([
+			"image",
+			"inspect",
+			"--format",
+			"{{json .Config}}",
+			image
+		], { streamLive: false }));
+	} catch (err) {
+		throw new Error(`docker image inspect failed: ${messageOf(err)}`);
+	}
+	const config = JSON.parse(stdout.trim());
+	return {
+		entrypoint: stringArray(config?.Entrypoint),
+		cmd: stringArray(config?.Cmd)
+	};
+}
+function stringArray(v) {
+	return Array.isArray(v) && v.every((s) => typeof s === "string") ? v : [];
+}
+async function ensureRieBinary(platform, skipPull) {
+	const machine = ELF_MACHINE_BY_PLATFORM[platform];
+	if (machine === void 0) throw new Error(`unsupported platform '${platform}'`);
+	const root = rieCacheDirectory();
+	if (root === void 0) throw new Error("no cache directory (HOME is not set)");
+	const target = join(root, platform.replace("/", "-"), RIE_BASENAME);
+	if (!isMountableHostPath(target)) throw new Error(`the cache path ${displayUntrustedValue(target)} contains ':'`);
+	let run = inFlight.get(target);
+	if (run === void 0) {
+		run = (async () => {
+			if (await isRegularFile(target) && await isElfFor(target, machine)) return target;
+			await extractRie(platform, target, machine, skipPull);
+			return target;
+		})();
+		inFlight.set(target, run);
+		run.catch(() => inFlight.delete(target));
+	}
+	return run;
+}
+function isMountableHostPath(path, pathApi = nodePath) {
+	return !path.slice(pathApi.parse(path).root.length).includes(":");
+}
+async function isRegularFile(path) {
+	try {
+		return (await promises.lstat(path)).isFile();
+	} catch {
+		return false;
+	}
+}
+async function isElfFor(path, machine) {
+	let handle;
+	try {
+		handle = await promises.open(path, "r");
+		const header = Buffer.alloc(20);
+		const { bytesRead } = await handle.read(header, 0, 20, 0);
+		return bytesRead === 20 && header.readUInt32BE(0) === 2135247942 && header.readUInt16LE(18) === machine;
+	} catch {
+		return false;
+	} finally {
+		await handle?.close().catch(() => void 0);
+	}
+}
+async function extractRie(platform, target, machine, skipPull) {
+	getLogger().child("rie").info(skipPull ? `Copying the Lambda Runtime Interface Emulator for ${platform} out of the local ${RIE_SOURCE_IMAGE} image (one time)...` : `Fetching the Lambda Runtime Interface Emulator for ${platform} from ${RIE_SOURCE_IMAGE} (one time)...`);
+	const dir = dirname(target);
+	await promises.mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	if (!skipPull) try {
+		await runDockerStreaming([
+			"pull",
+			"--platform",
+			platform,
+			RIE_SOURCE_IMAGE
+		], { streamLive: false });
+	} catch (err) {
+		throw new Error(`docker pull failed: ${messageOf(err)}`);
+	}
+	const createArgs = [
+		"create",
+		"--name",
+		`${getEmbedConfig().resourceNamePrefix}-rie-extract-${process.pid}-${randomBytes(4).toString("hex")}`,
+		...skipPull ? ["--pull", "never"] : [],
+		"--platform",
+		platform,
+		RIE_SOURCE_IMAGE
+	];
+	let containerId;
+	try {
+		containerId = (await runDockerStreaming(createArgs, { streamLive: false })).stdout.trim();
+	} catch (err) {
+		throw new Error(`docker create failed: ${messageOf(err)}` + (skipPull ? ` (--no-pull: pull ${RIE_SOURCE_IMAGE} once, or run ${getEmbedConfig().binaryName} without --no-pull)` : ""));
+	}
+	const tmp = join(dir, `.${RIE_BASENAME}.${process.pid}.${randomBytes(4).toString("hex")}`);
+	try {
+		try {
+			await runDockerStreaming([
+				"cp",
+				`${containerId}:${RIE_SOURCE_PATH}`,
+				tmp
+			], { streamLive: false });
+		} catch (err) {
+			throw new Error(`docker cp failed: ${messageOf(err)}`);
+		}
+		if (!await isRegularFile(tmp) || !await isElfFor(tmp, machine)) throw new Error(`the copied ${RIE_SOURCE_PATH} is not a ${platform} executable`);
+		await promises.chmod(tmp, 493);
+		await promises.rename(tmp, target);
+	} finally {
+		await promises.rm(tmp, {
+			force: true,
+			recursive: true
+		}).catch(() => void 0);
+		await runDockerStreaming([
+			"rm",
+			"-f",
+			containerId
+		], { streamLive: false }).catch(() => void 0);
+	}
+}
+
 //#endregion
 //#region src/local/api-gateway-event.ts
 const MOCK_ACCOUNT_ID = "123456789012";
@@ -12337,8 +12550,8 @@ function getContainerAwsCredentialsPath() {
 async function writeProfileCredentialsFile(profileName, creds) {
 	if (profileName === "") throw new Error("writeProfileCredentialsFile: profile name must not be empty.");
 	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name ${displayUntrustedValue(profileName)} contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
-	const dir = await mkdtemp(path$1.join(tmpdir(), `${getEmbedConfig().productName}-profile-creds-`));
-	const hostPath = path$1.join(dir, "credentials");
+	const dir = await mkdtemp(nodePath.join(tmpdir(), `${getEmbedConfig().productName}-profile-creds-`));
+	const hostPath = nodePath.join(dir, "credentials");
 	const lines = [
 		`[${profileName}]`,
 		`aws_access_key_id = ${creds.accessKeyId}`,
@@ -12791,8 +13004,8 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 }
 function createWatchPredicates(args) {
 	const { watchRoot, output, watchConfig } = args;
-	const toRel = (abs) => path$1.relative(watchRoot, abs).split(path$1.sep).join("/");
-	const outputRel = toRel(path$1.resolve(watchRoot, output));
+	const toRel = (abs) => nodePath.relative(watchRoot, abs).split(nodePath.sep).join("/");
+	const outputRel = toRel(nodePath.resolve(watchRoot, output));
 	const excludePatterns = [
 		...outputRel !== "" && !outputRel.startsWith("..") ? [outputRel] : [],
 		"node_modules",
@@ -13159,13 +13372,24 @@ async function buildContainerSpec(args) {
 			containerPath: profileCredsFile.containerPath
 		} }
 	};
+	const rie = await resolveRieWrap({
+		image: imageRef,
+		platform,
+		entryPoint: lambda.imageConfig.entryPoint,
+		command: lambda.imageConfig.command,
+		skipPull
+	});
 	return {
 		kind: "image",
 		lambda,
 		image: imageRef,
 		platform,
-		command: lambda.imageConfig.command ?? [],
-		...lambda.imageConfig.entryPoint !== void 0 && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
+		command: rie ? rie.cmd : lambda.imageConfig.command ?? [],
+		...rie && {
+			entryPoint: rie.entryPoint,
+			rieMount: rie.mount
+		},
+		...!rie && lambda.imageConfig.entryPoint !== void 0 && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
 		...lambda.imageConfig.workingDirectory !== void 0 && { workingDir: lambda.imageConfig.workingDirectory },
 		env: dockerEnv,
 		...sensitiveEnvKeys && { sensitiveEnvKeys },
@@ -13198,7 +13422,7 @@ async function resolveContainerImageForStartApi(lambda, skipPull, profile, optio
 async function resolveLocalBuildPlan$1(lambda) {
 	const manifestPath = lambda.stack.assetManifestPath;
 	if (!manifestPath) return void 0;
-	const cdkOutDir = path$1.dirname(manifestPath);
+	const cdkOutDir = nodePath.dirname(manifestPath);
 	const manifest = await new AssetManifestLoader().loadStackManifest(lambda.stack, cdkOutDir);
 	if (!manifest) return void 0;
 	const entry = getDockerImageBySourceHash(manifest, lambda.imageUri);
@@ -13228,7 +13452,7 @@ async function materializeLambdaLayers$1(layers, layerTmpDirs, layerRoleArn) {
 		});
 	}
 	if (flat.length === 1) return flat[0].assetPath;
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-start-api-layers-`));
+	const dir = mkdtempSync(nodePath.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-start-api-layers-`));
 	try {
 		for (const layer of flat) copyLayerTreeLastWins(layer.assetPath, dir);
 	} catch (error) {
@@ -13369,10 +13593,10 @@ function materializeInlineCode$2(handler, source, fileExtension, tmpDirsOut) {
 	const lastDot = handler.lastIndexOf(".");
 	if (lastDot <= 0) throw new Error(`Handler ${displayUntrustedValue(handler)} is malformed: expected '<modulePath>.<exportName>'.`);
 	const modulePath = handler.substring(0, lastDot);
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-start-api-`));
+	const dir = mkdtempSync(nodePath.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-start-api-`));
 	tmpDirsOut.add(dir);
-	const filePath = path$1.join(dir, `${modulePath}${fileExtension}`);
-	mkdirSync(path$1.dirname(filePath), { recursive: true });
+	const filePath = nodePath.join(dir, `${modulePath}${fileExtension}`);
+	mkdirSync(nodePath.dirname(filePath), { recursive: true });
 	writeFileSync(filePath, source, "utf-8");
 	return dir;
 }
@@ -13896,7 +14120,7 @@ function materializeLambdaLayers(layers) {
 		containerPath: "/opt",
 		readOnly: true
 	} };
-	const tmpDir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-invoke-layers-`));
+	const tmpDir = mkdtempSync(nodePath.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-invoke-layers-`));
 	try {
 		for (const layer of layers) copyLayerTreeLastWins(layer.assetPath, tmpDir);
 	} catch (error) {
@@ -13936,13 +14160,21 @@ async function resolveContainerImagePlan$1(lambda, options) {
 		});
 	}
 	const tmpfs = resolveTmpfsForLambda(lambda);
+	const rie = await resolveRieWrap({
+		image: imageRef,
+		platform,
+		entryPoint: lambda.imageConfig.entryPoint,
+		command: lambda.imageConfig.command,
+		skipPull: options.pull === false
+	});
 	return {
 		image: imageRef,
 		mounts: [],
-		extraMounts: [],
-		cmd: lambda.imageConfig.command ?? [],
+		extraMounts: rie ? [rie.mount] : [],
+		cmd: rie ? rie.cmd : lambda.imageConfig.command ?? [],
 		platform,
-		...lambda.imageConfig.entryPoint && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
+		...rie && { entryPoint: rie.entryPoint },
+		...!rie && lambda.imageConfig.entryPoint && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
 		...lambda.imageConfig.workingDirectory !== void 0 && { workingDir: lambda.imageConfig.workingDirectory },
 		...tmpfs !== void 0 && { tmpfs }
 	};
@@ -14233,9 +14465,9 @@ function materializeInlineCode$1(handler, source, fileExtension) {
 	const lastDot = handler.lastIndexOf(".");
 	if (lastDot <= 0) throw new Error(`Handler ${displayUntrustedValue(handler)} is malformed: expected '<modulePath>.<exportName>'.`);
 	const modulePath = handler.substring(0, lastDot);
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-invoke-`));
-	const filePath = path$1.join(dir, `${modulePath}${fileExtension}`);
-	mkdirSync(path$1.dirname(filePath), { recursive: true });
+	const dir = mkdtempSync(nodePath.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-invoke-`));
+	const filePath = nodePath.join(dir, `${modulePath}${fileExtension}`);
+	mkdirSync(nodePath.dirname(filePath), { recursive: true });
 	writeFileSync(filePath, source, "utf-8");
 	return dir;
 }
@@ -18923,6 +19155,7 @@ const DEFAULT_UPSTREAM_TIMEOUT_MS = 3e4;
 async function startFrontDoorServer(opts) {
 	const logger = getLogger().child("front-door");
 	const host = opts.host ?? "127.0.0.1";
+	if (opts.assumeHost !== void 0 && !/^[\x21-\x7e]+$/.test(opts.assumeHost)) throw new Error(`assumeHost must be a non-empty host name without blanks or control characters (got ${JSON.stringify(opts.assumeHost)}).`);
 	const forwardedProto = opts.forwardedProto ?? (opts.tls ? "https" : "http");
 	const effectiveOpts = {
 		...opts,
@@ -18988,7 +19221,7 @@ function handleProxyRequest(req, res, opts) {
 	if (opts.route) {
 		const action = opts.route({
 			path: url,
-			...hostHeader(req),
+			...routeHost(req, opts),
 			headers: req.headers,
 			...req.method !== void 0 && { method: req.method },
 			...req.socket.remoteAddress !== void 0 && { sourceIp: req.socket.remoteAddress }
@@ -19052,7 +19285,8 @@ function buildNoRuleMatched404Body(req, opts) {
 	const summary = opts.rulesSummary;
 	if (!summary) return `No listener rule matched '${requestPath}' on ${opts.label}, and the listener has no default action forwarding to a local target.`;
 	const rawHost = req.headers.host;
-	const hostValue = Array.isArray(rawHost) ? rawHost[0] : rawHost;
+	const requestHost = Array.isArray(rawHost) ? rawHost[0] : rawHost;
+	const hostValue = opts.assumeHost !== void 0 ? `${opts.assumeHost} (--assume-host; the request sent ${requestHost ?? "no Host header"})` : requestHost;
 	const lines = [];
 	lines.push(`No listener rule matched the request on ${opts.label}, and the listener has no default action forwarding to a local target.`);
 	lines.push("");
@@ -19091,7 +19325,7 @@ function handlePoolRequest(req, res, pool, opts) {
 		};
 		const headers = { ...req.headers };
 		stripHopByHopHeaders(headers);
-		appendForwardedHeaders(headers, req, opts.listenerPort, resolveForwardedProto(opts));
+		appendForwardedHeaders(headers, req, opts);
 		const proxyReq = request({
 			host: endpoint.host,
 			port: endpoint.port,
@@ -19126,7 +19360,8 @@ function handlePoolRequest(req, res, pool, opts) {
 		req.pipe(proxyReq);
 	});
 }
-function hostHeader(req) {
+function routeHost(req, opts) {
+	if (opts.assumeHost !== void 0) return { host: opts.assumeHost };
 	const raw = req.headers.host;
 	const host = Array.isArray(raw) ? raw[0] : raw;
 	return host ? { host } : {};
@@ -19219,7 +19454,7 @@ function handleLambdaRequest(req, res, lambda, opts) {
 					const body = Buffer.concat(chunks);
 					const forwardHeaders = { ...req.headers };
 					stripHopByHopHeaders(forwardHeaders);
-					appendForwardedHeaders(forwardHeaders, req, opts.listenerPort, resolveForwardedProto(opts));
+					appendForwardedHeaders(forwardHeaders, req, opts);
 					const snapshot = snapshotFromIncoming(req, body);
 					for (const [name, value] of Object.entries(forwardHeaders)) {
 						if (value === void 0) continue;
@@ -19273,13 +19508,14 @@ function stripHopByHopHeaders(headers) {
 function resolveForwardedProto(opts) {
 	return opts.forwardedProto ?? (opts.tls ? "https" : "http");
 }
-function appendForwardedHeaders(headers, req, listenerPort, scheme) {
+function appendForwardedHeaders(headers, req, opts) {
 	const clientIp = req.socket.remoteAddress ?? "";
 	const existing = headers["x-forwarded-for"];
 	const chain = Array.isArray(existing) ? existing.join(", ") : existing;
 	headers["x-forwarded-for"] = chain ? `${chain}, ${clientIp}` : clientIp;
-	headers["x-forwarded-proto"] = scheme;
-	headers["x-forwarded-port"] = String(listenerPort);
+	headers["x-forwarded-proto"] = resolveForwardedProto(opts);
+	headers["x-forwarded-port"] = String(opts.listenerPort);
+	if (opts.assumeHost !== void 0) headers["host"] = opts.assumeHost;
 }
 function writeError(res, statusCode, message) {
 	res.writeHead(statusCode, { "content-type": "text/plain; charset=utf-8" });
@@ -19293,7 +19529,7 @@ function handleUpgrade$1(req, clientSocket, head, opts) {
 	}
 	const action = opts.route({
 		path: req.url ?? "/",
-		...hostHeader(req),
+		...routeHost(req, opts),
 		headers: req.headers,
 		...req.method !== void 0 && { method: req.method },
 		...req.socket.remoteAddress !== void 0 && { sourceIp: req.socket.remoteAddress }
@@ -19361,7 +19597,7 @@ function bridgeWebSocket(req, clientSocket, head, pool, opts) {
 		upstream.on("connect", () => {
 			upstreamConnected = true;
 			const headers = { ...req.headers };
-			appendForwardedHeaders(headers, req, opts.listenerPort, resolveForwardedProto(opts));
+			appendForwardedHeaders(headers, req, opts);
 			const lines = [`${req.method ?? "GET"} ${req.url ?? "/"} HTTP/${req.httpVersion}`];
 			for (const [name, value] of Object.entries(headers)) {
 				if (value === void 0) continue;
@@ -19850,9 +20086,9 @@ function materializeInlineCode(handler, source, fileExtension) {
 	const lastDot = handler.lastIndexOf(".");
 	if (lastDot <= 0) throw new Error(`Handler ${displayIdent(handler)} is malformed: expected '<modulePath>.<exportName>'.`);
 	const modulePath = handler.substring(0, lastDot);
-	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-alb-lambda-`));
-	const filePath = path$1.join(dir, `${modulePath}${fileExtension}`);
-	mkdirSync(path$1.dirname(filePath), { recursive: true });
+	const dir = mkdtempSync(nodePath.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-alb-lambda-`));
+	const filePath = nodePath.join(dir, `${modulePath}${fileExtension}`);
+	mkdirSync(nodePath.dirname(filePath), { recursive: true });
 	writeFileSync(filePath, source, "utf-8");
 	return dir;
 }
@@ -19892,7 +20128,7 @@ async function resolveContainerImagePlan(lambda, opts) {
 	let imageRef;
 	let localBuilt = false;
 	if (manifestPath) {
-		const cdkOutDir = path$1.dirname(manifestPath);
+		const cdkOutDir = nodePath.dirname(manifestPath);
 		const manifest = await new AssetManifestLoader().loadStackManifest(lambda.stack, cdkOutDir);
 		const entry = manifest ? getDockerImageBySourceHash(manifest, lambda.imageUri) : void 0;
 		if (entry) {
@@ -19912,12 +20148,20 @@ async function resolveContainerImagePlan(lambda, opts) {
 			...opts.ecrRoleArn !== void 0 && { ecrRoleArn: opts.ecrRoleArn }
 		});
 	}
+	const rie = await resolveRieWrap({
+		image: imageRef,
+		platform,
+		entryPoint: lambda.imageConfig.entryPoint,
+		command: lambda.imageConfig.command,
+		skipPull: opts.skipPull === true
+	});
 	return {
 		image: imageRef,
-		mounts: [],
-		cmd: lambda.imageConfig.command ?? [],
+		mounts: rie ? [rie.mount] : [],
+		cmd: rie ? rie.cmd : lambda.imageConfig.command ?? [],
 		platform,
-		...lambda.imageConfig.entryPoint && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
+		...rie && { entryPoint: rie.entryPoint },
+		...!rie && lambda.imageConfig.entryPoint && lambda.imageConfig.entryPoint.length > 0 && { entryPoint: lambda.imageConfig.entryPoint },
 		...lambda.imageConfig.workingDirectory !== void 0 && { workingDir: lambda.imageConfig.workingDirectory }
 	};
 }
@@ -21293,7 +21537,8 @@ async function buildFrontDoor(plan, options, logger, extraStateProviders) {
 				label: `listener port ${listener.listenerPort}`,
 				forwardedProto,
 				rulesSummary,
-				...tls ? { tls } : {}
+				...tls ? { tls } : {},
+				...listener.assumeHost !== void 0 && { assumeHost: listener.assumeHost }
 			};
 			let server;
 			try {
@@ -21312,6 +21557,7 @@ async function buildFrontDoor(plan, options, logger, extraStateProviders) {
 			}
 			servers.push(server);
 			logger.info(`ALB front-door: ${server.scheme}://${formatAuthority(server.host, server.port)} (listener port ${listener.listenerPort})`);
+			if (listener.assumeHost !== void 0) logger.info(`  assumed host: ${displayUntrustedValue(listener.assumeHost)} (--assume-host; host-header rules see it and the target receives it as Host)`);
 			if (degradedHttps) logger.warn(`listener port ${listener.listenerPort} is HTTPS in the cloud but serving HTTP locally (X-Forwarded-Proto: https preserved). Pass --tls to terminate TLS locally with a self-signed or user-supplied cert.`);
 			if (listener.defaultAction) logger.info(`  default -> ${describeAction(listener.defaultAction)}`);
 			for (const r of [...listener.rules].sort((a, b) => a.priority - b.priority)) logger.info(`  ${describeConditions(r)} (priority ${r.priority}) -> ${describeAction(r.action)}`);
@@ -22612,6 +22858,31 @@ function parseLbPortOverrides(values) {
 	}
 	return out;
 }
+const ASSUME_HOST_PATTERN = /^(?:[A-Za-z0-9_](?:[A-Za-z0-9_.-]*[A-Za-z0-9_])?|\[[0-9A-Fa-f:.]+\])(?::\d{1,5})?$/;
+function parseAssumeHostOverrides(values) {
+	const out = { byListenerPort: {} };
+	const usage = "Expected <host> or <listenerPort>=<host> (e.g. api.example.com or 443=api.example.com).";
+	for (const raw of values ?? []) {
+		const value = raw.trim();
+		const eq = value.indexOf("=");
+		const portPart = eq === -1 ? void 0 : value.slice(0, eq);
+		const host = eq === -1 ? value : value.slice(eq + 1);
+		const hostPort = /:(\d+)$/.exec(host)?.[1];
+		if (!ASSUME_HOST_PATTERN.test(host) || hostPort !== void 0 && !(Number(hostPort) >= 1 && Number(hostPort) <= 65535)) throw new LocalStartServiceError(`Invalid --assume-host ${JSON.stringify(raw)}: ${host === "" ? "the host is empty" : `${JSON.stringify(host)} is not a host name`}. ${usage}`);
+		if (portPart === void 0) {
+			if (/^\d+$/.test(host)) throw new LocalStartServiceError(`Invalid --assume-host ${JSON.stringify(raw)}: a bare number is not a host name (did you mean ${host}=<host>?). ${usage}`);
+			if (out.all !== void 0) throw new LocalStartServiceError(`--assume-host was given two hosts for every listener (${out.all} and ${host}). Pass one, or name each listener as <listenerPort>=<host>.`);
+			out.all = host;
+			continue;
+		}
+		const port = /^\d+$/.test(portPart) ? Number(portPart) : NaN;
+		if (!(port >= 1 && port <= 65535)) throw new LocalStartServiceError(`Invalid --assume-host ${JSON.stringify(raw)}: the listener port must be 1-65535. ${usage}`);
+		const prior = out.byListenerPort[port];
+		if (prior !== void 0) throw new LocalStartServiceError(`--assume-host was given two hosts for listener port ${port} (${prior} and ${host}).`);
+		out.byListenerPort[port] = host;
+	}
+	return out;
+}
 function resolveAlbTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalStartServiceError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
@@ -22653,6 +22924,7 @@ function notFound$1(target, stack, resources) {
 }
 function albStrategy(options) {
 	const lbPortOverrides = parseLbPortOverrides(options.lbPort);
+	const assumeHosts = parseAssumeHostOverrides(options.assumeHost);
 	return {
 		pickEntries: (stacks) => listTargets(stacks).loadBalancers,
 		pickerMessage: "Select one or more Application Load Balancers to run",
@@ -22714,10 +22986,12 @@ function albStrategy(options) {
 						continue;
 					}
 					claimedHostPorts.set(hostPort, listener.listenerPort);
+					const assumeHost = assumeHosts.byListenerPort[listener.listenerPort] ?? assumeHosts.all;
 					listeners.push({
 						listenerPort: listener.listenerPort,
 						hostPort,
 						protocol: listener.listenerProtocol,
+						...assumeHost !== void 0 && { assumeHost },
 						...listener.defaultAction ? { defaultAction: qualify(listener.defaultAction) } : {},
 						...listener.defaultAuthGuard ? { defaultAuthGuard: listener.defaultAuthGuard } : {},
 						rules: listener.rules.map((r) => ({
@@ -22740,6 +23014,10 @@ function albStrategy(options) {
 				const port = Number(portStr);
 				if (!resolvedPorts.has(port)) warnings.push(`--lb-port override for listener port ${port} matched no ALB listener resolved for the named target(s); it was ignored.`);
 			}
+			for (const portStr of Object.keys(assumeHosts.byListenerPort)) {
+				const port = Number(portStr);
+				if (!resolvedPorts.has(port)) warnings.push(`--assume-host for listener port ${port} matched no ALB listener resolved for the named target(s); it was ignored.`);
+			}
 			return {
 				boots,
 				...listeners.length > 0 ? { frontDoor: { listeners } } : {},
@@ -22761,7 +23039,7 @@ function createLocalStartAlbCommand(opts = {}) {
 }
 function addAlbSpecificOptions(cmd) {
 	addImageOverrideOptions(cmd);
-	return cmd.addOption(new Option("--lb-port <listenerPort=hostPort...>", "Bind the local front-door on a specific host port (e.g. 80=8080); repeatable. Default: host port == ALB listener port. Use this on macOS to remap a privileged listener port (< 1024) to a non-privileged host port.")).addOption(new Option("--tls", "Terminate TLS locally for cloud-HTTPS listeners. Default: a cloud-HTTPS listener is served over plain HTTP locally (X-Forwarded-Proto: https is preserved so the upstream app still sees the deployed listener protocol). Implied by --tls-cert / --tls-key. Use this when local-dev cookies need Secure / SameSite=None, when the upstream app inspects TLS metadata, or for mTLS / SNI testing — otherwise plain HTTP is friendlier (no self-signed cert warnings in curl / browser).")).addOption(new Option("--tls-cert <path>", "PEM-encoded server certificate for HTTPS front-door listeners. Implies --tls. Must be set together with --tls-key. Pass --tls alone (without --tls-cert / --tls-key) to auto-generate a self-signed cert (cached under $XDG_CACHE_HOME/cdk-local/alb-https/, default ~/.cache/cdk-local/alb-https/); requires openssl on PATH. The deployed Listener Certificates[] are NOT fetched (ACM private keys are not retrievable by design). The auto-generated cert lists DNS:localhost,IP:127.0.0.1 as SubjectAltName, so a client validating a non-loopback --container-host will fail the SAN check — pass --tls-cert / --tls-key with a SAN covering that host instead.")).addOption(new Option("--tls-key <path>", "PEM-encoded server private key matching --tls-cert. Implies --tls. Must be set together with --tls-cert.")).addOption(new Option("--no-verify-auth", "Disable local enforcement of authenticate-cognito / authenticate-oidc actions. Every request is served as if the auth check passed. Useful for local dev where you do not want to mint a Bearer token at all.")).addOption(new Option("--bearer-token <jwt>", "Default Bearer JWT this command INJECTS only when an inbound request has none (the default-when-missing role) — `cdkl start-alb` is the local ALB front-door RECEIVING outside-in requests, so this token is the fallback the front-door slots in as Authorization: Bearer <jwt> if the caller did not already supply one. Verified against the same JWKS / OIDC discovery URL the deployed ALB would (signature + iss + aud + exp). Cookie pass-through (AWSELBAuthSessionCookie-*) also bypasses the guard. Contrast with `cdkl invoke-agentcore --bearer-token`, where the role is reversed — that command is the outbound client and ALWAYS presents this token (the supplier).")).addOption(new Option("--watch", "Hot-reload: re-synth + per-replica reload of every ECS service behind the ALB when the CDK source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). A per-firing classifier picks the per-replica primitive: source-only edits on interpreted-language handlers (Node/Python/Ruby/shell) take a bind-mount FAST PATH (`docker cp` the new source into each replica + restart it; no rebuild, its front-door pool entry is drained and re-published once it listens again). Dockerfile / dependency manifest / compiled-language source / ambiguous edits fall through to the rebuild rolling primitive — boot a shadow under a bumped generation suffix, wait for its container port to accept a TCP connection, atomically register it in the front-door pool, then drop the old entry and retire the old container. Either path rolls one replica at a time, so a continuous external request stream against the listener port sees zero connection refusals across the reload. The host front-door (TLS, JWKS cache, Lambda-target containers, listener sockets) stays up across the reload. Lambda target groups behind the ALB are a no-op on reload (the warm RIE container keeps its boot-time image). Off by default; existing replica(s) keep serving when synth fails mid-reload.").default(false));
+	return cmd.addOption(new Option("--lb-port <listenerPort=hostPort...>", "Bind the local front-door on a specific host port (e.g. 80=8080); repeatable. Default: host port == ALB listener port. Use this on macOS to remap a privileged listener port (< 1024) to a non-privileged host port.")).addOption(new Option("--assume-host <host>", "Treat every inbound request as if it carried this Host: host-header rule conditions see <host>, and the target (ECS replica or Lambda) receives it as the Host header, as behind the deployed ALB on its own domain name. Use it to reach a listener rule that matches only a production host name (host-header: api.example.com) from a browser or a client that sends Host: localhost. <listenerPort>=<host> (e.g. 443=api.example.com) applies to one listener and wins over a bare <host>; repeatable. Other rule conditions are unaffected, and a redirect action keeps the request Host so the browser stays on the local front-door. Default: the request Host is used as sent.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate TLS locally for cloud-HTTPS listeners. Default: a cloud-HTTPS listener is served over plain HTTP locally (X-Forwarded-Proto: https is preserved so the upstream app still sees the deployed listener protocol). Implied by --tls-cert / --tls-key. Use this when local-dev cookies need Secure / SameSite=None, when the upstream app inspects TLS metadata, or for mTLS / SNI testing — otherwise plain HTTP is friendlier (no self-signed cert warnings in curl / browser).")).addOption(new Option("--tls-cert <path>", "PEM-encoded server certificate for HTTPS front-door listeners. Implies --tls. Must be set together with --tls-key. Pass --tls alone (without --tls-cert / --tls-key) to auto-generate a self-signed cert (cached under $XDG_CACHE_HOME/cdk-local/alb-https/, default ~/.cache/cdk-local/alb-https/); requires openssl on PATH. The deployed Listener Certificates[] are NOT fetched (ACM private keys are not retrievable by design). The auto-generated cert lists DNS:localhost,IP:127.0.0.1 as SubjectAltName, so a client validating a non-loopback --container-host will fail the SAN check — pass --tls-cert / --tls-key with a SAN covering that host instead.")).addOption(new Option("--tls-key <path>", "PEM-encoded server private key matching --tls-cert. Implies --tls. Must be set together with --tls-cert.")).addOption(new Option("--no-verify-auth", "Disable local enforcement of authenticate-cognito / authenticate-oidc actions. Every request is served as if the auth check passed. Useful for local dev where you do not want to mint a Bearer token at all.")).addOption(new Option("--bearer-token <jwt>", "Default Bearer JWT this command INJECTS only when an inbound request has none (the default-when-missing role) — `cdkl start-alb` is the local ALB front-door RECEIVING outside-in requests, so this token is the fallback the front-door slots in as Authorization: Bearer <jwt> if the caller did not already supply one. Verified against the same JWKS / OIDC discovery URL the deployed ALB would (signature + iss + aud + exp). Cookie pass-through (AWSELBAuthSessionCookie-*) also bypasses the guard. Contrast with `cdkl invoke-agentcore --bearer-token`, where the role is reversed — that command is the outbound client and ALWAYS presents this token (the supplier).")).addOption(new Option("--watch", "Hot-reload: re-synth + per-replica reload of every ECS service behind the ALB when the CDK source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). A per-firing classifier picks the per-replica primitive: source-only edits on interpreted-language handlers (Node/Python/Ruby/shell) take a bind-mount FAST PATH (`docker cp` the new source into each replica + restart it; no rebuild, its front-door pool entry is drained and re-published once it listens again). Dockerfile / dependency manifest / compiled-language source / ambiguous edits fall through to the rebuild rolling primitive — boot a shadow under a bumped generation suffix, wait for its container port to accept a TCP connection, atomically register it in the front-door pool, then drop the old entry and retire the old container. Either path rolls one replica at a time, so a continuous external request stream against the listener port sees zero connection refusals across the reload. The host front-door (TLS, JWKS cache, Lambda-target containers, listener sockets) stays up across the reload. Lambda target groups behind the ALB are a no-op on reload (the warm RIE container keeps its boot-time image). Off by default; existing replica(s) keep serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
@@ -25755,7 +26033,7 @@ async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
 	}
 	for (const functionLogicalId of functionLogicalIds) try {
 		const lambda = resolveLambdaTarget(`${distribution.stackName}:${functionLogicalId}`, stacks);
-		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
+		const containerEnv = await resolveLambdaContainerEnv(lambda, lambdaEdgeEnvOptions(opts.envOptions), opts.profileCredentials, opts.extraStateProviders);
 		const runner = createFrontDoorLambdaRunner(lambda, {
 			containerHost: opts.containerHost,
 			skipPull: opts.skipPull,
@@ -25782,9 +26060,15 @@ function buildLambdaEnvOptions(options, extraStateProviders) {
 		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
 		...options.region !== void 0 && { region: options.region },
 		...options.profile !== void 0 && { profile: options.profile },
-		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
+		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion },
+		...options.envVars !== void 0 && { envVars: options.envVars }
 	};
 }
+function lambdaEdgeEnvOptions(envOptions) {
+	const out = { ...envOptions };
+	delete out.envVars;
+	return out;
+}
 function buildLambdaBootOptions(options, profileCredentials, extraStateProviders) {
 	return {
 		containerHost: options.host,
@@ -25805,6 +26089,10 @@ function warnUnusedCacheOrigin(options, extraStateProviders) {
 		getLogger().warn(`--cache-origin has no effect without ${flags}: it caches a deployed-S3 read-through origin, which is only built under a state source. A local BucketDeployment / --origin <id>=<dir> origin serves from disk and is not cached. Pass ${flags} to enable the deployed-S3 origin (then --cache-origin applies), or drop --cache-origin.`);
 	}
 }
+function warnUnusedEnvVars(distribution, options) {
+	if (options.envVars === void 0) return;
+	if (![...distribution.origins.values()].some((o) => o.kind === "lambda-url" || o.kind === "web-function")) getLogger().warn("--env-vars has no effect: the distribution has no Lambda Function URL or Lambda Web Function endpoint origin (CloudFront Functions and Lambda@Edge take no environment variables).");
+}
 async function resolveDeployedS3Origins(distribution, stacks, options, profileCredentials, logger, extraStateProviders) {
 	const readers = /* @__PURE__ */ new Map();
 	const buckets = /* @__PURE__ */ new Map();
@@ -25919,6 +26207,7 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 	const deployedS3 = await resolveDeployedS3Origins(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
 	warnUnsupported(initial.distribution, extraStateProviders);
 	warnUnusedCacheOrigin(options, extraStateProviders);
+	warnUnusedEnvVars(initial.distribution, options);
 	await attachKvsModules(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
 	const bootOpts = buildLambdaBootOptions(options, profileCredentials, extraStateProviders);
 	const webFunctionServes = [];
@@ -26042,7 +26331,7 @@ function createLocalStartCloudFrontCommand(opts = {}) {
 	return cmd;
 }
 function addStartCloudFrontSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <key=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is a KeyValueStore handle — its AWS::CloudFront::KeyValueStore resource logical id, its construct path, or its bare construct id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL / Web Function origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind to a deployed CloudFormation stack (ListStackResources). Resolves an S3 origin that has no local BucketDeployment source to its deployed bucket and serves it from real S3 on demand (the front/back-split case: files uploaded out of band), and resolves a Lambda Function URL / Lambda@Edge function's or a Web Function origin revision's env vars to the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs.")).addOption(new Option("--cache-origin", "For a deployed-S3 origin (served from real S3 under --from-cfn-stack): keep fetched objects in memory for the session instead of re-reading on every request. Faster repeat reads / fewer S3 GETs, but an out-of-band S3 content change is not reflected until a --watch reload (which clears the cache) or a restart. Off by default (every request re-reads, always current). Not CloudFront CDN caching.").default(false)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's (or a Web Function origin revision's) execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
+	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <key=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is a KeyValueStore handle — its AWS::CloudFront::KeyValueStore resource logical id, its construct path, or its bare construct id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL / Web Function origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind to a deployed CloudFormation stack (ListStackResources). Resolves an S3 origin that has no local BucketDeployment source to its deployed bucket and serves it from real S3 on demand (the front/back-split case: files uploaded out of band), and resolves a Lambda Function URL / Lambda@Edge function's or a Web Function origin revision's env vars to the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs.")).addOption(new Option("--cache-origin", "For a deployed-S3 origin (served from real S3 under --from-cfn-stack): keep fetched objects in memory for the session instead of re-reading on every request. Faster repeat reads / fewer S3 GETs, but an out-of-band S3 content change is not reflected until a --watch reload (which clears the cache) or a restart. Off by default (every request re-reads, always current). Not CloudFront CDN caching.").default(false)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's (or a Web Function origin revision's) execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--env-vars <file>", "JSON env-var overrides for the Lambda Function URL and Lambda Web Function endpoint origins (SAM-compatible, the same file as the other commands: {\"Parameters\": {...}} for every origin, {\"<LogicalId or construct path>\": {\"KEY\": \"VALUE\"}} for one — the backing function, or the Web Function revision the endpoint serves; a null value removes the variable). Not applied to Lambda@Edge functions, which cannot carry environment variables in AWS.")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
@@ -28172,6 +28461,13 @@ const OPTION_SPECS = {
 			leftPlaceholder: "listenerPort",
 			rightPlaceholder: "hostPort"
 		},
+		{
+			flag: "--assume-host",
+			kind: "scalar",
+			label: "Assume host",
+			placeholder: "api.example.com",
+			help: "Route and forward every request as if it carried this Host (host-header rules see it; the target receives it). <listenerPort>=<host> limits it to one listener. One value per run here; the CLI flag is repeatable."
+		},
 		{
 			flag: "--bearer-token",
 			kind: "scalar",
@@ -28332,6 +28628,15 @@ const OPTION_SPECS = {
 			leftPlaceholder: "originId",
 			rightPlaceholder: "./dist",
 			help: "Point a distribution origin at a local directory when cdk-local can't resolve its BucketDeployment source."
+		},
+		{
+			flag: "--env-vars",
+			kind: "env-kv",
+			label: "Env vars",
+			sep: "=",
+			leftPlaceholder: "KEY",
+			rightPlaceholder: "value",
+			help: "Overlay the Lambda Function URL / Web Function endpoint origin container env vars — add KEY=VALUE rows or paste a JSON object."
 		}
 	]
 };
@@ -33295,4 +33600,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { postHook as $, deployedFillMayBeSecret as $a, parseConnectionsPath as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, discoverWebSocketApisOrThrow as Aa, applyCorsResponseHeaders as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AGENTCORE_MCP_PROTOCOL as Ba, evaluateResponseParameters as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveSsmParameters as Ca, verifyJwtViaDiscovery as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, listTargets as Da, invokeRequestAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, countTargets as Ea, evaluateCachedLambdaPolicy as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, pickRefLogicalId as Fa, matchRoute as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, derivePseudoParametersFromRegion as Ga, HOST_DOCKER_INTERNAL_GATEWAY as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, AgentCoreResolutionError as Ha, selectIntegrationResponse as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, resolveLambdaArnIntrinsic as Ia, translateLambdaResponse as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, tryResolveImageFnJoin as Ja, resolveHostGatewayExtraHosts as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, formatStateRemedy as Ka, HOST_GATEWAY_MIN_VERSION as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_A2A_PROTOCOL as La, applyAuthorizerOverlay as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, parseSelectionExpressionPath as Ma, buildCorsConfigFromCloudFrontChain as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, webSocketApiMatchesIdentifier as Na, isFunctionUrlOacFronted as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, availableWebSocketApiIdentifiers as Oa, invokeTokenAuthorizer as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, discoverRoutes as Pa, matchPreflight as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, containsDynamicReference as Qa, handleConnectionsRequest as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_AGUI_PROTOCOL as Ra, buildHttpApiV2Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, collectSsmParameterRefs as Sa, verifyJwtAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, resolveSingleTarget as Ta, computeRequestIdentityHash as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, pickAgentCoreCandidateStack as Ua, tryParseStatus as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, AGENTCORE_RUNTIME_TYPE as Va, pickResponseTemplate as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, resolveAgentCoreTarget as Wa, VtlEvaluationError as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, DynamicReferenceResolutionError as Xa, ConnectionRegistry as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, LocalInvokeBuildError as Ya, bufferToBody as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, DynamicReferenceResolver as Za, buildMgmtEndpointEnvUrl as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, rejectExplicitCfnStackWithMultipleStacks as _a, defaultCredentialsLoader as _i, pickKvsLogicalIdFromArn as _n, isProxyEnvConfigured as _o, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, resolveRuntimeCodeMountPath as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, withoutKeys as ao, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, resolveCfnStackName as ba, createJwksCache as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, EcsTaskResolutionError as ca, resolveEnvVars$1 as ci, buildEdgeRequestEvent as cn, deployAccountStsClientConfig as co, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, substituteAgainstStateAsync as da, filterRoutesByApiIdentifiers as di, httpHeadersToEdge as dn, resetWorkloadIdentity as do, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildConnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, firstUsableRegion as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, substituteEnvVarsFromState as fa, groupRoutesByServer as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, workloadClientConfig as fo, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, isCfnFlagPresent as ga, resolveServiceIntegrationParameters as gi, pickFunctionUrlLogicalIdFromOrigin as gn, buildProxyClientConfig as go, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, createLocalStateProvider as ha, resolveSelectionExpression as hi, isCloudFrontDistribution as hn, resolveProfileCredentials as ho, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, buildContainerImage as ia, createFileWatcher as ii, serveFromStaticOrigin as in, resolveDynamicReferencesInEnv as io, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, filterWebSocketApisByIdentifiers as ja, buildCorsConfigByApiId as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, discoverWebSocketApis as ka, attachAuthorizers as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, assertEcsTaskImagesResolvable as la, availableApiIdentifiers as li, buildEdgeResponseEvent as ln, readEnvCallerCredentials as lo, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, LocalStateSourceError as ma, startApiServer as mi, extractKvsAssociations as mn, buildStsClientConfig as mo, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, buildMessageEvent as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, keysOverriddenBy as no, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, resolveRuntimeFileExtension as oa, buildStageMap as oi, applyEdgeRequestResult as on, SECOND_ASSUME_MESSAGE as oo, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, substituteEnvVarsFromStateAsync as pa, readMtlsMaterialsFromDisk as pi, describeS3OriginDomain as pn, workloadStsClientConfig as po, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, substituteImagePlaceholders as qa, probeHostGatewaySupport as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, architectureToPlatform as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, parseDynamicReference as ro, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, resolveRuntimeImage as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, assumedRoleRecorded as so, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildDisconnectEvent as ta, createWatchPredicates as ti, matchBehavior as tn, keysNotFromTemplate as to, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteAgainstState as ua, filterRoutesByApiIdentifier as ui, edgeHeadersToHttp as un, recordAssumedRole as uo, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnFallbackRegion as va, buildCognitoJwksUrl as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, resolveWatchConfig as wa, buildMethodArn as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, CfnLocalStateProvider as xa, verifyCognitoJwt as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, resolveCfnRegion as ya, buildJwksUrlFromIssuer as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_HTTP_PROTOCOL as za, buildRestV1Event as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
-//# sourceMappingURL=local-studio-D2McUMmL.js.map
+//# sourceMappingURL=local-studio-Ur6enHho.js.map