cdk-local 0.164.1 → 0.164.3

package/dist/{local-studio-Bo1NL6UK.js → local-studio-CMq3n7mt.js}

@@ -1,8 +1,8 @@
-import { a as displayIdent, c as getEmbedConfig, i as STACK_REF_MAX_CODE_POINTS, o as displayStackName, s as displayToolOutput, t as getLogger, u as setEmbedConfig } from "./logger-25be7ULc.js";
-import { At as hostFromAuthority, C as effectiveLoopbackPorts, Ct as readEnvVarsFileText, Dt as isWildcardHostname, Et as isLoopbackHostname, F as resolveHostDefaultCredentials, J as awsEndpointOverrideClientConfig, Ot as formatAuthority, R as takeAwsEmulatorStateSourceHint, St as applyEnvOverrideMap, Tt as defineOwnKey, X as deployArtifactClientConfig, Z as deployArtifactsReadEmulator, b as awsEmulatorEnvName, d as workloadStsClientConfig, et as isAwsServiceRoutedToEmulator, kt as formatHostForAuthority, l as warnWorkloadCredentialsStripped, lt as createMixedModeStateProvider, n as accountLookupStsClientConfig, q as awsEmulatorRealServices, r as applyWorkloadEnvCredentials, rt as proxyAwareFetch, u as workloadClientConfig, v as activateWorkloadAwsWiring, w as getActiveWorkloadAwsWiring, wt as resolveEnvVars$1, y as applyWorkloadAwsWiringToEnv, z as workloadGetsEmulatorKeysOnly } from "./workload-identity-BQBoBgdT.js";
-import { c as clampErrorName, d as flattenToOneLine, f as isAwsServiceException, l as describeAwsFailureForWarn, m as stringifyThrown, o as renderAssemblyPathEscape, p as sanitizeServiceExceptionMessage, r as displayUntrustedValue, s as resolveAssemblyPath, t as absoluteAssemblyPathEscape, u as describeCredentialLoadFailure } from "./assembly-path-4qK96UfP.js";
-import { $ as isIamRoleArn, A as buildDockerImage, B as substituteImagePlaceholders, D as isImageInLocalCache, E as warnIfEmulatedPlatform, F as parseEcrRegistryHost, G as LocalStartServiceError, H as CdkLocalError, I as contextForContainer, J as withErrorHandling, K as RouteDiscoveryError, L as derivePartitionAndUrlSuffix, M as createShutdownSignalHandler, N as signalExitCode, O as parseEcrUri, P as describeExitWithoutArgv, Q as describeRejectedRoleArn, R as derivePseudoParametersFromRegion, T as buildContainerImage, U as InteractiveTtyRequiredError, V as tryResolveImageFnJoin, W as LocalInvokeBuildError, X as applyRoleArnIfSet, Y as AssumeRoleFailure, Z as assumeRoleCredentials, a as describeRefusedSensitiveEnvKeys, c as execEnvForSecrets, d as rememberForwardedPorts, et as refusedRoleArnMessage, f as removeContainer, h as streamLogs, i as attachLoopbackForwarder, j as resolveAssetSourcePath, k as pullEcrImage, l as pickFreePort, m as startNamespaceOwnerForwarder, n as SENSITIVE_ENV_KEYS, nt as resolveProfileCredentials, p as runDetached, q as TargetSelectionCancelledError, r as appendEnvFlags, s as ensureDockerAvailable, t as DockerRunnerError, tt as buildStsClientConfig, u as pullImage, w as architectureToPlatform, z as formatStateRemedy } from "./docker-runner-C0Igd4LD.js";
-import { a as isDockerClientEnvKey, c as runDockerStreaming, i as getDockerCmd, n as finchSecretArgvRefusal, o as isMalformedEnvKey, u as warnFinchArgvExposure } from "./docker-cmd-C_Hfs3eo.js";
+import { a as displayIdent, c as getEmbedConfig, i as STACK_REF_MAX_CODE_POINTS, o as displayStackName, s as displayToolOutput, t as getLogger, u as setEmbedConfig } from "./logger-uzapot2X.js";
+import { $ as formatHostForAuthority, B as describeCredentialLoadFailure, H as isAwsServiceException, I as renderAssemblyPathEscape, J as resolveEnvVars$1, K as applyEnvOverrideMap, L as resolveAssemblyPath, N as displayUntrustedValue, Q as formatAuthority, R as clampErrorName, U as sanitizeServiceExceptionMessage, V as flattenToOneLine, W as stringifyThrown, X as isLoopbackHostname, Y as defineOwnKey, Z as isWildcardHostname, et as hostFromAuthority, j as absoluteAssemblyPathEscape, n as awsEmulatorRealServices, o as deployArtifactClientConfig, p as proxyAwareFetch, q as readEnvVarsFileText, r as awsEndpointOverrideClientConfig, s as deployArtifactsReadEmulator, u as isAwsServiceRoutedToEmulator, y as createMixedModeStateProvider, z as describeAwsFailureForWarn } from "./aws-proxy-CtjweaLu.js";
+import { $ as isIamRoleArn, A as buildDockerImage, B as substituteImagePlaceholders, D as isImageInLocalCache, E as warnIfEmulatedPlatform, F as parseEcrRegistryHost, G as LocalStartServiceError, H as CdkLocalError, I as contextForContainer, J as withErrorHandling, K as RouteDiscoveryError, L as derivePartitionAndUrlSuffix, M as createShutdownSignalHandler, N as signalExitCode, O as parseEcrUri, P as describeExitWithoutArgv, Q as describeRejectedRoleArn, R as derivePseudoParametersFromRegion, T as buildContainerImage, U as InteractiveTtyRequiredError, V as tryResolveImageFnJoin, W as LocalInvokeBuildError, X as applyRoleArnIfSet, Y as AssumeRoleFailure, Z as assumeRoleCredentials, a as describeRefusedSensitiveEnvKeys, c as execEnvForSecrets, d as rememberForwardedPorts, et as refusedRoleArnMessage, f as removeContainer, h as streamLogs, i as attachLoopbackForwarder, j as resolveAssetSourcePath, k as pullEcrImage, l as pickFreePort, m as startNamespaceOwnerForwarder, n as SENSITIVE_ENV_KEYS, nt as resolveProfileCredentials, p as runDetached, q as TargetSelectionCancelledError, r as appendEnvFlags, s as ensureDockerAvailable, t as DockerRunnerError, tt as buildStsClientConfig, u as pullImage, w as architectureToPlatform, z as formatStateRemedy } from "./docker-runner-3CL99fDP.js";
+import { C as effectiveLoopbackPorts, F as resolveHostDefaultCredentials, R as takeAwsEmulatorStateSourceHint, b as awsEmulatorEnvName, d as workloadStsClientConfig, l as warnWorkloadCredentialsStripped, n as accountLookupStsClientConfig, r as applyWorkloadEnvCredentials, u as workloadClientConfig, v as activateWorkloadAwsWiring, w as getActiveWorkloadAwsWiring, y as applyWorkloadAwsWiringToEnv, z as workloadGetsEmulatorKeysOnly } from "./workload-identity-BONcukjU.js";
+import { a as isDockerClientEnvKey, c as runDockerStreaming, f as noImplicitEcrPullArgs, i as getDockerCmd, n as finchSecretArgvRefusal, o as isMalformedEnvKey, u as warnFinchArgvExposure } from "./docker-cmd-6JZnWXBN.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, promises, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { Command, InvalidArgumentError, Option } from "commander";
 import { STSClient } from "@aws-sdk/client-sts";
@@ -2767,7 +2767,7 @@ async function resolveMultiTarget(provided, params) {
 async function loadSynthDeps() {
 	const [toolkitLib, { CdklIoHost }, { AssetManifestArtifact }] = await Promise.all([
 		import("@aws-cdk/toolkit-lib"),
-		import("./cdkl-io-host-b34gsrHs.js"),
+		import("./cdkl-io-host-DHcFlfj1.js"),
 		import("@aws-cdk/cloud-assembly-api")
 	]);
 	return {
@@ -10269,7 +10269,8 @@ function layerFailureDetail(err, operation) {
 async function materializeLayerFromArn(layer, options = {}) {
 	const logger = getLogger();
 	let credentials;
-	if (options.roleArn) try {
+	if (options.roleArn && deployArtifactsReadEmulator("LAMBDA", options.workload)) logger.debug("--layer-role-arn is not assumed under --aws-emulator: the layer is read from AWS Emulator.");
+	else if (options.roleArn) try {
 		credentials = await assumeRoleForLayer(options.roleArn, layer.region, options);
 		logger.debug(`Layer ${displayUntrustedValue(layer.arn)}: assumed role ${options.roleArn} for GetLayerVersion`);
 	} catch (err) {
@@ -10305,7 +10306,7 @@ async function materializeLayerFromArn(layer, options = {}) {
 	return dir;
 }
 async function fetchLayerContentUrl(layer, credentials, options) {
-	const client = (options.lambdaClientFactory ?? await defaultLambdaClientFactory())(layer.region, credentials);
+	const client = (options.lambdaClientFactory ?? await defaultLambdaClientFactory(options.workload))(layer.region, credentials);
 	try {
 		const versionSuffix = /^(.*):(\d+)$/.exec(layer.arn);
 		if (!versionSuffix) throw new LayerMaterializationError(`Layer ${displayUntrustedValue(layer.arn)}: not a layer-version ARN (no ':<version>' suffix to strip). Expected arn:<partition>:lambda:<region>:<account>:layer:<name>:<version>.`);
@@ -10334,12 +10335,15 @@ async function assumeRoleForLayer(roleArn, region, options) {
 		client.destroy?.();
 	}
 }
-async function defaultLambdaClientFactory() {
+async function defaultLambdaClientFactory(workload) {
 	const { LambdaClient } = await import("@aws-sdk/client-lambda");
 	return (region, credentials) => new LambdaClient({
-		...deployArtifactsReadEmulator() ? deployArtifactClientConfig() : workloadClientConfig(),
+		...workloadClientConfig({
+			service: "LAMBDA",
+			workload
+		}),
 		region,
-		...credentials && !deployArtifactsReadEmulator() && { credentials: {
+		...credentials && !deployArtifactsReadEmulator("LAMBDA", workload) && { credentials: {
 			accessKeyId: credentials.accessKeyId,
 			secretAccessKey: credentials.secretAccessKey,
 			...credentials.sessionToken !== void 0 && { sessionToken: credentials.sessionToken }
@@ -11443,7 +11447,10 @@ async function buildContainerSpec(args) {
 			codeDir = materialized.dir;
 			if (materialized.tmpDir) inlineTmpDirs.add(materialized.tmpDir);
 		} else codeDir = materializeInlineCode$2(lambda.handler, lambda.inlineCode ?? "", resolveRuntimeFileExtension(lambda.runtime), inlineTmpDirs);
-		optDir = await materializeLambdaLayers$1(lambda.layers, layerTmpDirs, layerRoleArn);
+		optDir = await materializeLambdaLayers$1(lambda.layers, layerTmpDirs, layerRoleArn, {
+			logicalId: lambda.logicalId,
+			cdkPath: readCdkPathOrUndefined(lambda.resource)
+		});
 	} else {
 		imageRef = (await resolveContainerImageForStartApi(lambda, skipPull, args.profile, {
 			...args.skipBuild !== void 0 && { noBuild: args.skipBuild },
@@ -11611,12 +11618,20 @@ async function resolveContainerImageForStartApi(lambda, skipPull, profile, optio
 	if (localBuild) return { imageRef: await buildContainerImage(localBuild.asset, localBuild.cdkOutDir, {
 		architecture: lambda.architecture,
 		assetOutdir: localBuild.assetOutdir,
+		workload: {
+			logicalId: lambda.logicalId,
+			cdkPath: readCdkPathOrUndefined(lambda.resource)
+		},
 		...options?.noBuild !== void 0 && { noBuild: options.noBuild }
 	}) };
 	if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda ${displayIdent(lambda.logicalId)} has no matching asset in cdk.out, and Code.ImageUri ${displayUntrustedValue(String(lambda.imageUri))} is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
 	logger.info(`No matching cdk.out asset for ${lambda.imageUri}; falling back to ECR pull...`);
 	return { imageRef: await pullEcrImage(lambda.imageUri, {
 		skipPull,
+		workload: {
+			logicalId: lambda.logicalId,
+			cdkPath: readCdkPathOrUndefined(lambda.resource)
+		},
 		...profile !== void 0 && { profile },
 		...options?.ecrRoleArn !== void 0 && { ecrRoleArn: options.ecrRoleArn },
 		...options?.region !== void 0 && { region: options.region }
@@ -11636,7 +11651,7 @@ async function resolveLocalBuildPlan$1(lambda) {
 		assetOutdir: assetPathDirs(lambda.stack).assetOutdir
 	};
 }
-async function materializeLambdaLayers$1(layers, layerTmpDirs, layerRoleArn) {
+async function materializeLambdaLayers$1(layers, layerTmpDirs, layerRoleArn, workload) {
 	if (layers.length === 0) return void 0;
 	const flat = [];
 	for (const layer of layers) {
@@ -11647,7 +11662,10 @@ async function materializeLambdaLayers$1(layers, layerTmpDirs, layerRoleArn) {
 			});
 			continue;
 		}
-		const dir = await materializeLayerFromArn(layer, { ...layerRoleArn !== void 0 && { roleArn: layerRoleArn } });
+		const dir = await materializeLayerFromArn(layer, {
+			...layerRoleArn !== void 0 && { roleArn: layerRoleArn },
+			...workload !== void 0 && { workload }
+		});
 		layerTmpDirs.add(dir);
 		flat.push({
 			logicalId: layer.arn,
@@ -12302,7 +12320,7 @@ async function resolveZipImagePlan$1(lambda, options) {
 	const image = resolveRuntimeImage(lambda.runtime);
 	const platform = architectureToPlatform(lambda.architecture);
 	await pullImage(image, options.pull === false, platform);
-	const layerPlan = await materializeLambdaLayersIncludingArns(lambda.layers, options);
+	const layerPlan = await materializeLambdaLayersIncludingArns(lambda.layers, options, lambdaWorkload(lambda));
 	const containerCodePath = resolveRuntimeCodeMountPath(lambda.runtime);
 	const tmpfs = resolveTmpfsForLambda(lambda);
 	return {
@@ -12325,7 +12343,7 @@ async function resolveZipImagePlan$1(lambda, options) {
 function assumeRoleDetail(err, op) {
 	return err instanceof AssumeRoleFailure ? err.detail : describeAwsFailureForWarn(err, op);
 }
-async function materializeLambdaLayersIncludingArns(layers, options) {
+async function materializeLambdaLayersIncludingArns(layers, options, workload) {
 	const extraTmpDirs = [];
 	const flat = [];
 	for (const layer of layers) {
@@ -12336,7 +12354,10 @@ async function materializeLambdaLayersIncludingArns(layers, options) {
 			});
 			continue;
 		}
-		const dir = await materializeLayerFromArn(layer, { ...options.layerRoleArn !== void 0 && { roleArn: options.layerRoleArn } });
+		const dir = await materializeLayerFromArn(layer, {
+			...options.layerRoleArn !== void 0 && { roleArn: options.layerRoleArn },
+			...workload !== void 0 && { workload }
+		});
 		extraTmpDirs.push(dir);
 		flat.push({
 			logicalId: layer.arn,
@@ -12392,7 +12413,8 @@ async function resolveContainerImagePlan$1(lambda, options) {
 	if (localBuild) imageRef = await buildContainerImage(localBuild.asset, localBuild.cdkOutDir, {
 		architecture: lambda.architecture,
 		noBuild: options.build === false,
-		assetOutdir: localBuild.assetOutdir
+		assetOutdir: localBuild.assetOutdir,
+		workload: lambdaWorkload(lambda)
 	});
 	else {
 		if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda ${displayIdent(lambda.logicalId)} has no matching asset in cdk.out, and Code.ImageUri ${displayUntrustedValue(String(lambda.imageUri))} is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
@@ -12401,7 +12423,8 @@ async function resolveContainerImagePlan$1(lambda, options) {
 			skipPull: options.pull === false,
 			...options.region !== void 0 && { region: options.region },
 			...options.ecrRoleArn !== void 0 && { ecrRoleArn: options.ecrRoleArn },
-			...options.profile !== void 0 && { profile: options.profile }
+			...options.profile !== void 0 && { profile: options.profile },
+			workload: lambdaWorkload(lambda)
 		});
 	}
 	const tmpfs = resolveTmpfsForLambda(lambda);
@@ -13082,11 +13105,16 @@ function resolveSafeEntryPath(root, entry) {
 function defaultFetchObject$1(options) {
 	return async (location) => {
 		const { S3Client, GetObjectCommand } = await import("@aws-sdk/client-s3");
+		const fromEmulator = deployArtifactsReadEmulator("S3", options.workload);
 		const client = new S3Client({
-			...deployArtifactClientConfig({ profile: options.profile }),
+			...deployArtifactClientConfig({
+				service: "S3",
+				profile: options.profile,
+				workload: options.workload
+			}),
 			...options.region && { region: options.region },
-			...options.profile && !options.credentials && !deployArtifactsReadEmulator() && { profile: options.profile },
-			...options.credentials && !deployArtifactsReadEmulator() && { credentials: {
+			...options.profile && !options.credentials && !fromEmulator && { profile: options.profile },
+			...options.credentials && !fromEmulator && { credentials: {
 				accessKeyId: options.credentials.accessKeyId,
 				secretAccessKey: options.credentials.secretAccessKey,
 				...options.credentials.sessionToken && { sessionToken: options.credentials.sessionToken }
@@ -13999,7 +14027,11 @@ async function resolveAgentCoreImage(resolved, options, loaded, stateProvider) {
 			if (entry) return buildContainerImage(entry.asset, cdkOutDir, {
 				architecture,
 				noBuild: options.build === false,
-				assetOutdir: assetPathDirs(resolved.stack).assetOutdir
+				assetOutdir: assetPathDirs(resolved.stack).assetOutdir,
+				workload: {
+					logicalId: resolved.logicalId,
+					cdkPath: readCdkPathOrUndefined(resolved.resource)
+				}
 			});
 		}
 	}
@@ -14009,7 +14041,11 @@ async function resolveAgentCoreImage(resolved, options, loaded, stateProvider) {
 			skipPull: options.pull === false,
 			...options.region !== void 0 && { region: options.region },
 			...options.ecrRoleArn !== void 0 && { ecrRoleArn: options.ecrRoleArn },
-			...options.profile !== void 0 && { profile: options.profile }
+			...options.profile !== void 0 && { profile: options.profile },
+			workload: {
+				logicalId: resolved.logicalId,
+				cdkPath: readCdkPathOrUndefined(resolved.resource)
+			}
 		});
 	}
 	await pullImage(containerUri, options.pull === false);
@@ -14059,7 +14095,11 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 	const bundle = await downloadAndExtractS3Bundle(location, {
 		...region !== void 0 && { region },
 		...options.profile !== void 0 && { profile: options.profile },
-		...credentials !== void 0 && { credentials }
+		...credentials !== void 0 && { credentials },
+		workload: {
+			logicalId: resolved.logicalId,
+			cdkPath: readCdkPathOrUndefined(resolved.resource)
+		}
 	});
 	try {
 		return await buildAgentCoreCodeImage({
@@ -15647,6 +15687,7 @@ async function prepareOneImage(task, container, options) {
 			return image.uri;
 		case "ecr": return pullEcrImage(image.uri, {
 			skipPull: options.skipPull,
+			workload: { containerName: container.name },
 			...options.region !== void 0 && { region: options.region },
 			...options.ecrRoleArn !== void 0 && { ecrRoleArn: options.ecrRoleArn },
 			...options.profile !== void 0 && { profile: options.profile }
@@ -15676,7 +15717,8 @@ async function prepareOneImage(task, container, options) {
 				assetOutdir: assetPathDirs(task.stack).assetOutdir,
 				...options.platformOverride !== void 0 && { platform: options.platformOverride },
 				wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for ECS container ${displayIdent(container.name)} (${displayUntrustedValue(asset.source.directory ?? asset.source.executable?.[0] ?? "")}): ${stderr}`),
-				progressLabel: `Building container image for ${displayIdent(container.name)}`
+				progressLabel: `Building container image for ${displayIdent(container.name)}`,
+				workload: { containerName: container.name }
 			});
 			if (actualTag !== tag) try {
 				await runDockerStreaming([
@@ -15950,7 +15992,7 @@ function buildDockerRunArgs(opts) {
 		both("--entrypoint", container.entryPoint[0]);
 		entryPointTail = container.entryPoint.slice(1);
 	}
-	both(image, ...entryPointTail, ...container.command ?? []);
+	both(...noImplicitEcrPullArgs(image), image, ...entryPointTail, ...container.command ?? []);
 	const loopbackPorts = wiring ? effectiveLoopbackPorts(finalEnv, wiring) : [];
 	return {
 		args,
@@ -16790,7 +16832,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C_Hfs3eo.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-6JZnWXBN.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -16803,7 +16845,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C_Hfs3eo.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-6JZnWXBN.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -16814,19 +16856,19 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerStopImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C_Hfs3eo.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-6JZnWXBN.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["stop", containerId]);
 };
 const defaultDockerStartImpl = async (containerId, opts = {}) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C_Hfs3eo.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-6JZnWXBN.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["start", containerId]);
 	if (opts.joinedForwarder) return;
-	const { getActiveWorkloadAwsWiring } = await import("./workload-identity-BQBoBgdT.js").then((n) => n.B);
+	const { getActiveWorkloadAwsWiring } = await import("./workload-identity-BONcukjU.js").then((n) => n.B);
 	const wiring = getActiveWorkloadAwsWiring();
 	if (wiring) {
-		const { attachLoopbackForwarder } = await import("./docker-runner-C0Igd4LD.js").then((n) => n.o);
+		const { attachLoopbackForwarder } = await import("./docker-runner-3CL99fDP.js").then((n) => n.o);
 		await attachLoopbackForwarder(containerId, wiring);
 	}
 };
@@ -16896,7 +16938,7 @@ async function attachToSharedNetwork(plan, withAliases) {
 const defaultDockerNetworkConnectImpl = async (networkName, containerId, opts) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C_Hfs3eo.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-6JZnWXBN.js").then((n) => n.t);
 	const args = ["network", "connect"];
 	if (opts.ip) args.push("--ip", opts.ip);
 	for (const a of opts.aliases) args.push("--alias", a);
@@ -16907,7 +16949,7 @@ let dockerNetworkConnectImpl = defaultDockerNetworkConnectImpl;
 const defaultDockerInspectPublishesHostPortsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C_Hfs3eo.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-6JZnWXBN.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -16946,7 +16988,7 @@ async function disconnectOldFromSharedNetwork(oldInstance, opts = {}) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C_Hfs3eo.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-6JZnWXBN.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -17037,7 +17079,7 @@ const LISTEN_PROBE_SCRIPT = [
 async function dockerExecListenProbe(containerId, port, timeoutMs = 1e4) {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C_Hfs3eo.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-6JZnWXBN.js").then((n) => n.t);
 	try {
 		await promisify(execFile)(getDockerCmd(), [
 			"exec",
@@ -17191,7 +17233,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C_Hfs3eo.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-6JZnWXBN.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -17201,7 +17243,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-C_Hfs3eo.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-6JZnWXBN.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -18605,7 +18647,11 @@ async function resolveContainerImagePlan(lambda, opts) {
 		if (entry) {
 			imageRef = await buildContainerImage(entry.asset, cdkOutDir, {
 				architecture: lambda.architecture,
-				assetOutdir: assetPathDirs(lambda.stack).assetOutdir
+				assetOutdir: assetPathDirs(lambda.stack).assetOutdir,
+				workload: {
+					logicalId: lambda.logicalId,
+					cdkPath: readCdkPathOrUndefined(lambda.resource)
+				}
 			});
 			localBuilt = true;
 		}
@@ -18615,6 +18661,10 @@ async function resolveContainerImagePlan(lambda, opts) {
 		logger.info(`No matching cdk.out asset for ${displayUntrustedValue(lambda.imageUri)}; falling back to ECR pull...`);
 		imageRef = await pullEcrImage(lambda.imageUri, {
 			skipPull: opts.skipPull === true,
+			workload: {
+				logicalId: lambda.logicalId,
+				cdkPath: readCdkPathOrUndefined(lambda.resource)
+			},
 			...opts.region !== void 0 && { region: opts.region },
 			...opts.ecrRoleArn !== void 0 && { ecrRoleArn: opts.ecrRoleArn }
 		});
@@ -32193,4 +32243,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { postHook as $, withoutKeys as $a, buildConnectEvent as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, filterWebSocketApisByIdentifiers as Aa, buildCorsConfigByApiId as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AGENTCORE_RUNTIME_TYPE as Ba, pickResponseTemplate as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveWatchConfig as Ca, buildMethodArn as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, availableWebSocketApiIdentifiers as Da, invokeTokenAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, listTargets as Ea, invokeRequestAuthorizer as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, resolveLambdaArnIntrinsic as Fa, translateLambdaResponse as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, DynamicReferenceResolver as Ga, HOST_GATEWAY_MIN_VERSION as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, pickAgentCoreCandidateStack as Ha, tryParseStatus as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, AGENTCORE_A2A_PROTOCOL as Ia, applyAuthorizerOverlay as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, firstUsableRegion as Ja, bufferToBody as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, containsDynamicReference as Ka, probeHostGatewaySupport as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_AGUI_PROTOCOL as La, buildHttpApiV2Event as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, webSocketApiMatchesIdentifier as Ma, isFunctionUrlOacFronted as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, discoverRoutes as Na, matchPreflight as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, discoverWebSocketApis as Oa, attachAuthorizers as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, pickRefLogicalId as Pa, matchRoute as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, resolveDynamicReferencesInEnv as Qa, parseConnectionsPath as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_HTTP_PROTOCOL as Ra, buildRestV1Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, resolveSsmParameters as Sa, verifyJwtViaDiscovery as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, countTargets as Ta, evaluateCachedLambdaPolicy as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, resolveAgentCoreTarget as Ua, VtlEvaluationError as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, AgentCoreResolutionError as Va, selectIntegrationResponse as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, DynamicReferenceResolutionError as Wa, HOST_DOCKER_INTERNAL_GATEWAY as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, keysOverriddenBy as Xa, buildMgmtEndpointEnvUrl as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, keysNotFromTemplate as Ya, ConnectionRegistry as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, parseDynamicReference as Za, handleConnectionsRequest as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveCfnFallbackRegion as _a, buildCognitoJwksUrl as _i, pickKvsLogicalIdFromArn as _n, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, EcsTaskResolutionError as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, CfnLocalStateProvider as ba, verifyCognitoJwt as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, substituteAgainstStateAsync as ca, availableApiIdentifiers as ci, buildEdgeRequestEvent as cn, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, LocalStateSourceError as da, groupRoutesByServer as di, httpHeadersToEdge as dn, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildDisconnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, addAwsEndpointOptions as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, UNNAMED_WORKLOAD as fa, readMtlsMaterialsFromDisk as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, rejectExplicitCfnStackWithMultipleStacks as ga, defaultCredentialsLoader as gi, pickFunctionUrlLogicalIdFromOrigin as gn, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, isCfnFlagPresent as ha, resolveServiceIntegrationParameters as hi, isCloudFrontDistribution as hn, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, resolveRuntimeImage as ia, createFileWatcher as ii, serveFromStaticOrigin as in, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, parseSelectionExpressionPath as ja, buildCorsConfigFromCloudFrontChain as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, discoverWebSocketApisOrThrow as ka, applyCorsResponseHeaders as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, substituteEnvVarsFromState as la, filterRoutesByApiIdentifier as li, buildEdgeResponseEvent as ln, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, groupWorkloadsRoutedApart as ma, resolveSelectionExpression as mi, extractKvsAssociations as mn, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, resolveRuntimeCodeMountPath as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, assertEcsTaskImagesResolvable as oa, buildStageMap as oi, applyEdgeRequestResult as on, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, createLocalStateProvider as pa, startApiServer as pi, describeS3OriginDomain as pn, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, deployedFillMayBeSecret as qa, resolveHostGatewayExtraHosts as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, resolveRuntimeFileExtension as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, substituteAgainstState as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildMessageEvent as ta, createWatchPredicates as ti, matchBehavior as tn, awsEndpointOptions as to, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteEnvVarsFromStateAsync as ua, filterRoutesByApiIdentifiers as ui, edgeHeadersToHttp as un, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnRegion as va, buildJwksUrlFromIssuer as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, resolveSingleTarget as wa, computeRequestIdentityHash as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, collectSsmParameterRefs as xa, verifyJwtAuthorizer as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, resolveCfnStackName as ya, createJwksCache as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_MCP_PROTOCOL as za, evaluateResponseParameters as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
-//# sourceMappingURL=local-studio-Bo1NL6UK.js.map
+//# sourceMappingURL=local-studio-CMq3n7mt.js.map