@aws/agentcore 1.0.0-preview.2 → 1.0.0-preview.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/agentcore",
-  "version": "1.0.0-preview.2",
+  "version": "1.0.0-preview.20",
   "description": "CLI for Amazon Bedrock AgentCore",
   "license": "Apache-2.0",
   "repository": {
@@ -41,6 +41,7 @@
   "files": [
     "dist",
     "scripts",
+    "npm-shrinkwrap.json",
     "!dist/mcp-harness"
   ],
   "scripts": {
@@ -52,11 +53,11 @@
     "build:assets": "node scripts/copy-assets.mjs",
     "build:harness": "BUILD_HARNESS=1 node esbuild.config.mjs",
     "cli": "npx tsx src/cli/index.ts",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint src/",
-    "lint:fix": "eslint src/ --fix",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
+    "typecheck": "tsc --noEmit --incremental",
+    "lint": "eslint --cache src/",
+    "lint:fix": "eslint --cache src/ --fix",
+    "format": "prettier --cache --write .",
+    "format:check": "prettier --cache --check .",
     "secrets:check": "secretlint '**/*'",
     "security:audit": "npm audit --audit-level=high --omit=dev",
     "clean": "node -e \"require('fs').rmSync('dist', {recursive: true, force: true})\"",
@@ -64,35 +65,44 @@
     "test": "vitest run --project unit",
     "test:all": "vitest run",
     "test:watch": "vitest --project unit",
-    "test:integ": "vitest run --project integ",
+    "test:integ": "npm run build && vitest run --project integ",
     "test:unit": "vitest run --project unit --coverage",
     "test:e2e": "vitest run --project e2e",
     "test:update-snapshots": "vitest run --project unit --update",
     "test:tui": "npm run build:harness && vitest run --project tui",
+    "test:browser": "npx playwright test --config browser-tests/playwright.config.ts",
     "bundle": "node scripts/bundle.mjs"
   },
   "dependencies": {
-    "@aws-cdk/toolkit-lib": "^1.16.0",
+    "@aws-cdk/cdk-assets-lib": "^1.4.10",
+    "@aws-cdk/toolkit-lib": "^1.28.0",
     "@aws-sdk/client-application-signals": "^3.1003.0",
     "@aws-sdk/client-bedrock": "^3.1012.0",
     "@aws-sdk/client-bedrock-agent": "^3.1012.0",
-    "@aws-sdk/client-bedrock-agentcore": "^3.1020.0",
-    "@aws-sdk/client-bedrock-agentcore-control": "^3.1020.0",
+    "@aws-sdk/client-bedrock-agentcore": "^3.1061.0",
+    "@aws-sdk/client-bedrock-agentcore-control": "^3.1061.0",
     "@aws-sdk/client-bedrock-runtime": "^3.893.0",
     "@aws-sdk/client-cloudformation": "^3.893.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.893.0",
+    "@aws-sdk/client-efs": "^3.1067.0",
     "@aws-sdk/client-resource-groups-tagging-api": "^3.893.0",
     "@aws-sdk/client-s3": "^3.1012.0",
+    "@aws-sdk/client-s3files": "^3.1067.0",
     "@aws-sdk/client-sts": "^3.893.0",
     "@aws-sdk/client-xray": "^3.1003.0",
     "@aws-sdk/credential-providers": "^3.893.0",
-    "@aws/agent-inspector": "0.2.1",
+    "@aws-sdk/region-config-resolver": "^3.972.13",
+    "@aws/agent-inspector": "0.6.1",
     "@commander-js/extra-typings": "^14.0.0",
-    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/exporter-metrics-otlp-http": "^0.215.0",
     "@opentelemetry/otlp-transformer": "^0.213.0",
+    "@opentelemetry/resources": "^2.6.1",
+    "@opentelemetry/sdk-metrics": "^2.6.1",
     "@smithy/shared-ini-file-loader": "^4.4.2",
     "commander": "^14.0.2",
     "dotenv": "^17.2.3",
+    "fast-json-stable-stringify": "^2.1.0",
     "fflate": "^0.8.2",
     "handlebars": "^4.7.8",
     "ink": "^6.6.0",
@@ -100,29 +110,35 @@
     "ink-spinner": "^5.0.0",
     "js-yaml": "^4.1.1",
     "react": "^19.2.3",
+    "ws": "^8.21.0",
     "yaml": "^2.8.3",
     "zod": "^4.3.5"
   },
+  "optionalDependencies": {
+    "@napi-rs/keyring": "^1.3.0"
+  },
   "peerDependencies": {
-    "aws-cdk-lib": "^2.248.0",
+    "aws-cdk-lib": "^2.258.0",
     "constructs": "^10.0.0"
   },
   "devDependencies": {
     "@aws-sdk/client-cognito-identity-provider": "^3.1018.0",
     "@eslint/js": "^9.39.2",
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@secretlint/secretlint-rule-preset-recommend": "^11.3.0",
+    "@playwright/test": "^1.59.1",
+    "@secretlint/secretlint-rule-preset-recommend": "^12.2.0",
     "@trivago/prettier-plugin-sort-imports": "^6.0.2",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.0.3",
     "@types/react": "^19.2.7",
+    "@types/ws": "^8.18.1",
     "@typescript-eslint/eslint-plugin": "^8.50.0",
     "@typescript-eslint/parser": "^8.50.0",
     "@vitest/coverage-v8": "^4.0.18",
     "@xterm/headless": "^6.0.0",
-    "aws-cdk-lib": "^2.248.0",
+    "aws-cdk-lib": "^2.258.0",
     "constructs": "^10.4.4",
-    "esbuild": "^0.27.2",
+    "esbuild": "^0.28.0",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
@@ -133,10 +149,12 @@
     "eslint-plugin-security": "^4.0.0",
     "husky": "^9.1.7",
     "ink-testing-library": "^4.0.0",
+    "jose": "^6.2.3",
     "lint-staged": "^16.2.7",
     "node-pty": "^1.1.0",
     "prettier": "^3.7.4",
-    "secretlint": "^11.3.0",
+    "secretlint": "^12.2.0",
+    "strip-ansi": "^7.2.0",
     "tsx": "^4.21.0",
     "typescript": "^5",
     "typescript-eslint": "^8.50.1",
@@ -144,23 +162,27 @@
   },
   "overridesComments": {
     "minimatch": "GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74: minimatch 10.0.0-10.2.2 has ReDoS vulnerabilities. Multiple transitive deps (eslint, typescript-eslint, eslint-plugin-import, eslint-plugin-react, prettier-plugin-sort-imports, aws-cdk-lib) pin older versions. Remove this override once upstream packages update their minimatch dependency to >=10.2.3.",
+    "glob": "glob <12 is deprecated and emits npm install warnings (https://github.com/isaacs/node-glob). Pulled in transitively via archiver-utils@5.0.2 (latest), which still pins glob@^10.0.0. archiver-utils only uses glob.sync(pattern, options), which remains compatible in glob@13. Remove this override once archiver-utils updates its glob dependency.",
     "fast-xml-parser": "GHSA-8gc5-j5rx-235r, GHSA-jp2q-39xq-3w4g: fast-xml-parser <=5.5.6 has entity expansion bypass (CVE-2026-33036, CVE-2026-33349). Transitive via @aws-sdk/xml-builder. Remove once @aws-sdk updates to fast-xml-parser >=5.5.7.",
-    "@aws-sdk/xml-builder": "aws/aws-sdk-js-v3#7867: @aws-sdk/xml-builder <3.972.14 does not configure maxTotalExpansions on fast-xml-parser, causing 'Entity expansion limit exceeded' on large CloudFormation responses. Remove once @aws-sdk/client-* deps are bumped past 3.972.14."
+    "@aws-sdk/xml-builder": "aws/aws-sdk-js-v3#7867: @aws-sdk/xml-builder <3.972.14 does not configure maxTotalExpansions on fast-xml-parser, causing 'Entity expansion limit exceeded' on large CloudFormation responses. Remove once @aws-sdk/client-* deps are bumped past 3.972.14.",
+    "protobufjs": "GHSA-f38q-mgvj-vph7, GHSA-wcpc-wj8m-hjx6, GHSA-94rc-8x27-4472: protobufjs <=7.6.2 / 8.0.0-8.5.0 has property shadowing and DoS vulnerabilities. Transitive via @opentelemetry/otlp-transformer. Remove once @opentelemetry updates to protobufjs >=7.6.3 or >=8.5.1."
   },
   "overrides": {
     "minimatch": "10.2.4",
+    "glob": "^13.0.0",
     "fast-xml-parser": "5.5.7",
-    "@aws-sdk/xml-builder": "3.972.15"
+    "@aws-sdk/xml-builder": "3.972.15",
+    "protobufjs": ">=7.6.3"
   },
   "engines": {
     "node": ">=20"
   },
   "lint-staged": {
     "*.{ts,tsx}": [
-      "eslint --max-warnings=10"
+      "eslint --cache --max-warnings=10"
     ],
     "*.{ts,tsx,js,jsx,json,md,css,html,yml,yaml}": [
-      "prettier --check"
+      "prettier --cache --check"
     ],
     "*": [
       "secretlint"

package/scripts/bump-version.ts

@@ -183,7 +183,7 @@ function getGitLog(sinceTag?: string): string {
     } else {
       // Try to get the last tag
       try {
-        const lastTag = execSync('git describe --tags --abbrev=0', { encoding: 'utf-8' }).trim();
+        const lastTag = execSync("git describe --tags --abbrev=0 --match 'v*'", { encoding: 'utf-8' }).trim();
         cmd += ` ${lastTag}..HEAD`;
       } catch {
         // No tags exist, get last 20 commits
@@ -218,11 +218,11 @@ function categorizeCommits(gitLog: string): CategorizedChanges {
 
     const msg = trimmed.slice(2).trim();
 
-    if (msg.startsWith('feat:') || msg.startsWith('feature:')) {
+    if (/^(feat|feature)(\(.*?\))?:/.test(msg)) {
       result.features.push(msg);
-    } else if (msg.startsWith('fix:') || msg.startsWith('bugfix:')) {
+    } else if (/^(fix|bugfix)(\(.*?\))?:/.test(msg)) {
       result.fixes.push(msg);
-    } else if (msg.startsWith('docs:') || msg.startsWith('doc:')) {
+    } else if (/^docs?(\(.*?\))?:/.test(msg)) {
       result.docs.push(msg);
     } else {
       result.other.push(msg);

package/scripts/bundle.mjs

@@ -1,5 +1,5 @@
 /**
- * bundle.mjs — Single command to build CLI + CDK constructs + frontend into one tarball.
+ * bundle.mjs — Single command to build CLI + CDK constructs into one tarball.
  *
  * This is a testing-only workflow. It does NOT modify the default build or
  * deployment flow. The normal `npm run build` + `npm pack` pipeline is unchanged.
@@ -9,16 +9,19 @@
  * At `agentcore create` time, CDKRenderer detects this tarball and installs it
  * after the normal `npm install`, overriding the registry version.
  *
- * It also builds the @aws/agent-inspector frontend and copies its dist-assets
- * into the CLI's dist/agent-inspector/ directory, overriding the npm registry version.
- *
  * Usage:
  *   node scripts/bundle.mjs
  *   npm run bundle
  *
  * Environment variables:
- *   AGENTCORE_CDK_PATH       — absolute path to the agentcore-l3-cdk-constructs repo
- *   AGENT_INSPECTOR_PATH     — absolute path to the agent-inspector repo
+ *   AGENTCORE_CDK_PATH              — path to the agentcore-l3-cdk-constructs repo.
+ *                                     Falls back to ../agentcore-l3-cdk-constructs, then clones from GitHub.
+ *   AGENTCORE_INSPECTOR_PATH         — path to the agent-inspector repo.
+ *                                     Falls back to ../agent-inspector. If found, builds and bundles
+ *                                     the local version instead of the npm-installed one.
+ *   AGENTCORE_TARBALL_OUTPUT        — output path (without .tgz) for the tarball. Relative to cwd.
+ *   AGENTCORE_TARBALL_VERSION_SUFFIX — version prerelease suffix (e.g. "abc12-def34").
+ *                                     Defaults to a timestamp if not set.
  */
 import { execFileSync } from 'node:child_process';
 import * as fs from 'node:fs';
@@ -80,18 +83,19 @@ function resolveCdkPath() {
 }
 
 /**
- * Resolve the agent-inspector repo path. Priority:
- * 1. AGENT_INSPECTOR_PATH env var
+ * Resolve a local agent-inspector repo path. Priority:
+ * 1. AGENTCORE_INSPECTOR_PATH env var
  * 2. Sibling directory ../agent-inspector
+ * 3. null (use npm-installed version)
  */
 function resolveInspectorPath() {
-  if (process.env.AGENT_INSPECTOR_PATH) {
-    const p = path.resolve(process.env.AGENT_INSPECTOR_PATH);
+  if (process.env.AGENTCORE_INSPECTOR_PATH) {
+    const p = path.resolve(process.env.AGENTCORE_INSPECTOR_PATH);
     if (fs.existsSync(path.join(p, 'package.json'))) {
-      log(`Using agent-inspector from AGENT_INSPECTOR_PATH: ${p}`);
+      log(`Using agent-inspector from AGENTCORE_INSPECTOR_PATH: ${p}`);
       return p;
     }
-    console.warn(`  WARNING: AGENT_INSPECTOR_PATH=${p} does not contain package.json, ignoring.`);
+    console.warn(`  WARNING: AGENTCORE_INSPECTOR_PATH=${p} does not contain package.json, ignoring.`);
   }
 
   const sibling = path.resolve(cliRoot, '..', 'agent-inspector');
@@ -109,8 +113,14 @@ function resolveInspectorPath() {
 
 log('Starting bundle process...');
 
-const timestamp = Math.floor(Date.now() / 1000);
-log(`Bundle timestamp: ${timestamp}`);
+const now = new Date();
+const timestamp = now.toISOString().replace(/[-:T]/g, '').slice(0, 14);
+const versionSuffix = process.env.AGENTCORE_TARBALL_VERSION_SUFFIX || timestamp;
+if (!/^[\w.-]+$/.test(versionSuffix)) {
+  console.error(`ERROR: Invalid version suffix: ${versionSuffix}`);
+  process.exit(1);
+}
+log(`Bundle version suffix: ${versionSuffix}`);
 
 // Helper to bump a package version with a unique e2e timestamp tag.
 // Saves the original version so it can be restored after packing.
@@ -119,7 +129,9 @@ function bumpVersion(pkgDir) {
   const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
   const originalVersion = pkg.version;
   const baseVersion = originalVersion.split('-')[0];
-  pkg.version = `${baseVersion}-${timestamp}`;
+  const prerelease = originalVersion.includes('-') ? originalVersion.split('-').slice(1).join('-') : '';
+  const tag = prerelease ? `${prerelease}-${versionSuffix}` : versionSuffix;
+  pkg.version = `${baseVersion}-${tag}`;
   fs.writeFileSync(pkgJsonPath, JSON.stringify(pkg, null, 2) + '\n');
   log(`Bumped ${pkg.name} version: ${originalVersion} -> ${pkg.version}`);
   return { pkgJsonPath, originalVersion, bumpedVersion: pkg.version };
@@ -131,6 +143,17 @@ function restoreVersion({ pkgJsonPath, originalVersion }) {
   fs.writeFileSync(pkgJsonPath, JSON.stringify(pkg, null, 2) + '\n');
 }
 
+/**
+ * If AGENTCORE_TARBALL_OUTPUT is set, return a resolved path using it as base.
+ * Always appends .tgz.
+ */
+function resolveTarballPath(tarballPath) {
+  const envPath = process.env.AGENTCORE_TARBALL_OUTPUT;
+  if (!envPath) return tarballPath;
+  const base = envPath.replace(/\.tgz$/, '');
+  return path.resolve(`${base}.tgz`);
+}
+
 // Step 1: Resolve and build CDK constructs
 const cdkPath = resolveCdkPath();
 
@@ -164,12 +187,7 @@ run('npm', ['install'], { cwd: cliRoot });
 log('Building CLI...');
 run('npm', ['run', 'build'], { cwd: cliRoot });
 
-// Step 4: Copy CDK tarball into dist/assets/ so CDKRenderer can detect it
-const bundledTarballDest = path.join(cliRoot, 'dist', 'assets', 'bundled-agentcore-cdk.tgz');
-fs.copyFileSync(cdkTarballSrc, bundledTarballDest);
-log(`Placed CDK tarball at ${bundledTarballDest}`);
-
-// Step 5: Build and bundle agent-inspector frontend (overrides the npm version)
+// Step 3.5: If local agent-inspector is available, build and overwrite dist/agent-inspector/
 const inspectorPath = resolveInspectorPath();
 if (inspectorPath) {
   log('Installing agent-inspector dependencies...');
@@ -178,24 +196,26 @@ if (inspectorPath) {
   log('Building agent-inspector...');
   run('npm', ['run', 'build'], { cwd: inspectorPath });
 
-  const inspectorDistSrc = path.join(inspectorPath, 'dist-assets');
-  const inspectorDistDest = path.join(cliRoot, 'dist', 'agent-inspector');
-
-  if (fs.existsSync(inspectorDistSrc)) {
-    if (fs.existsSync(inspectorDistDest)) {
-      fs.rmSync(inspectorDistDest, { recursive: true });
-    }
-    fs.cpSync(inspectorDistSrc, inspectorDistDest, { recursive: true });
-    log(`Copied agent-inspector frontend to ${inspectorDistDest}`);
-  } else {
-    console.error(`ERROR: agent-inspector build did not produce dist-assets/ at ${inspectorDistSrc}`);
+  const inspectorDistAssets = path.join(inspectorPath, 'dist-assets');
+  if (!fs.existsSync(inspectorDistAssets)) {
+    console.error(`ERROR: agent-inspector build did not produce dist-assets/ at ${inspectorDistAssets}`);
     process.exit(1);
   }
-} else {
-  log('No local agent-inspector found — using npm registry version.');
+
+  const inspectorDest = path.join(cliRoot, 'dist', 'agent-inspector');
+  if (fs.existsSync(inspectorDest)) {
+    fs.rmSync(inspectorDest, { recursive: true });
+  }
+  fs.cpSync(inspectorDistAssets, inspectorDest, { recursive: true });
+  log(`Replaced dist/agent-inspector/ with local build from ${inspectorPath}`);
 }
 
-// Step 6: Bump CLI version and pack into final tarball (includes the bundled CDK tarball + frontend)
+// Step 4: Copy CDK tarball into dist/assets/ so CDKRenderer can detect it
+const bundledTarballDest = path.join(cliRoot, 'dist', 'assets', 'bundled-agentcore-cdk.tgz');
+fs.copyFileSync(cdkTarballSrc, bundledTarballDest);
+log(`Placed CDK tarball at ${bundledTarballDest}`);
+
+// Step 5: Bump CLI version and pack into final tarball (includes the bundled CDK tarball)
 const cliVersionInfo = bumpVersion(cliRoot);
 try {
   log('Packing CLI tarball...');
@@ -207,10 +227,19 @@ try {
 const cliTarballName = `aws-agentcore-${cliVersionInfo.bumpedVersion}.tgz`;
 const cliTarballPath = path.join(cliRoot, cliTarballName);
 
-if (fs.existsSync(cliTarballPath)) {
-  log(`Done! Tarball: ${cliTarballPath}`);
-  log(`Install with: npm install ${cliTarballPath}`);
-  log('When you run agentcore create, the bundled CDK constructs will be installed automatically.');
-} else {
-  log(`Done! Check ${cliRoot} for the .tgz file.`);
+if (!fs.existsSync(cliTarballPath)) {
+  console.error(`ERROR: Expected tarball at ${cliTarballPath} but not found.`);
+  process.exit(1);
+}
+
+const finalTarballPath = resolveTarballPath(cliTarballPath);
+if (finalTarballPath !== cliTarballPath) {
+  fs.mkdirSync(path.dirname(finalTarballPath), { recursive: true });
+  fs.renameSync(cliTarballPath, finalTarballPath);
+  log(`Renamed tarball to: ${finalTarballPath}`);
 }
+
+// Final output
+log(`Done! Tarball:   ${finalTarballPath}`);
+log(`Install with:    npm install -g ${finalTarballPath}`);
+log('When you run agentcore create, the bundled CDK constructs will be installed automatically.');

package/scripts/run-e2e-dev.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Run E2E tests against your dev account using local credentials.
+#
+# Usage:
+#   ./scripts/run-e2e-dev.sh                          # runs strands-bedrock.test.ts
+#   ./scripts/run-e2e-dev.sh --all                    # runs the full e2e suite
+#   ./scripts/run-e2e-dev.sh e2e-tests/foo.test.ts    # runs a specific test file
+
+set -euo pipefail
+
+REGION="${AWS_REGION:-us-east-1}"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# ── Parse arguments ────────────────────────────────────────────────────────────
+RUN_ALL=false
+TEST_FILES=()
+for arg in "$@"; do
+  if [[ "$arg" == "--all" ]]; then
+    RUN_ALL=true
+  else
+    TEST_FILES+=("$arg")
+  fi
+done
+
+# ── Build & install CLI from source ────────────────────────────────────────────
+cd "$REPO_ROOT"
+npm run build
+TARBALL=$(npm pack | tail -1)
+npm install -g "$TARBALL"
+echo "=== Installed: $(agentcore --version) ==="
+
+# ── Set env vars for tests ─────────────────────────────────────────────────────
+export AWS_REGION="$REGION"
+export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+
+# ── Run tests ──────────────────────────────────────────────────────────────────
+cd "$REPO_ROOT"
+
+EXCLUDE_API_KEY_TESTS=(
+  --exclude 'e2e-tests/*-anthropic*'
+  --exclude 'e2e-tests/*-openai*'
+  --exclude 'e2e-tests/*-gemini*'
+)
+
+if [[ "$RUN_ALL" == "true" ]]; then
+  echo "=== Running full e2e suite ==="
+  npx vitest run --project e2e
+elif [[ ${#TEST_FILES[@]} -gt 0 ]]; then
+  echo "=== Running: ${TEST_FILES[*]} ==="
+  npx vitest run --project e2e "${TEST_FILES[@]}"
+else
+  echo "=== Running all Bedrock/IAM tests (excluding API-key-dependent tests) ==="
+  npx vitest run --project e2e "${EXCLUDE_API_KEY_TESTS[@]}"
+fi

package/scripts/run-e2e-local.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# Run E2E tests locally in the CI account, replicating the GitHub Actions e2e-tests.yml workflow.
+#
+# Required env vars:
+#   E2E_ROLE_ARN    — IAM role ARN to assume (grants access to the test account)
+#   E2E_SECRET_ARN  — Secrets Manager ARN containing ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY,
+#                     and (for payments tests) CDP_API_KEY_ID, CDP_API_KEY_SECRET, CDP_WALLET_SECRET
+#
+# Optional env vars:
+#   AWS_REGION      — defaults to us-east-1
+#   CDK_REPO_PATH   — local path to CDK constructs repo; if set, builds and uses it as CDK_TARBALL
+#
+# Usage:
+#   export E2E_ROLE_ARN=arn:aws:iam::<account>:role/<role>
+#   export E2E_SECRET_ARN=arn:aws:secretsmanager:<region>:<account>:secret:<name>
+#   ./scripts/run-e2e-local.sh                                  # runs strands-bedrock.test.ts (CI default)
+#   ./scripts/run-e2e-local.sh --all                            # runs the full e2e suite
+#   ./scripts/run-e2e-local.sh e2e-tests/foo.test.ts            # runs a specific test file
+#
+# Prerequisites: aws CLI, node >=20.19, npm, git, uv, jq
+
+set -euo pipefail
+
+ROLE_ARN="${E2E_ROLE_ARN:-}"
+SECRET_ARN="${E2E_SECRET_ARN:-}"
+AWS_REGION="${AWS_REGION:-us-east-1}"
+
+if [[ -z "$ROLE_ARN" ]]; then
+  echo "❌ E2E_ROLE_ARN is not set. Export it before running this script:"
+  echo "   export E2E_ROLE_ARN=arn:aws:iam::<account>:role/<role-name>"
+  exit 1
+fi
+
+if [[ -z "$SECRET_ARN" ]]; then
+  echo "❌ E2E_SECRET_ARN is not set. Export it before running this script:"
+  echo "   export E2E_SECRET_ARN=arn:aws:secretsmanager:<region>:<account>:secret:<name>"
+  exit 1
+fi
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# ── Parse arguments ────────────────────────────────────────────────────────────
+RUN_ALL=false
+TEST_FILES=()
+for arg in "$@"; do
+  if [[ "$arg" == "--all" ]]; then
+    RUN_ALL=true
+  else
+    TEST_FILES+=("$arg")
+  fi
+done
+
+echo "=== Assuming IAM role ==="
+CREDS=$(aws sts assume-role \
+  --role-arn "$ROLE_ARN" \
+  --role-session-name "local-e2e-$(date +%s)" \
+  --duration-seconds 3600 \
+  --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
+  --output text)
+
+export AWS_ACCESS_KEY_ID=$(echo "$CREDS" | awk '{print $1}')
+export AWS_SECRET_ACCESS_KEY=$(echo "$CREDS" | awk '{print $2}')
+export AWS_SESSION_TOKEN=$(echo "$CREDS" | awk '{print $3}')
+export AWS_REGION
+
+echo "✅ Assumed role successfully"
+
+echo "=== Fetching API keys from Secrets Manager ==="
+SECRET_JSON=$(aws secretsmanager get-secret-value \
+  --secret-id "$SECRET_ARN" \
+  --region "$AWS_REGION" \
+  --query SecretString \
+  --output text)
+
+# Mirror the GitHub workflow: parse-json-secrets maps keys to E2E_<KEY> then
+# the workflow maps them to the bare names the tests expect.
+export ANTHROPIC_API_KEY=$(echo "$SECRET_JSON" | jq -r '.ANTHROPIC_API_KEY // empty')
+export OPENAI_API_KEY=$(echo "$SECRET_JSON" | jq -r '.OPENAI_API_KEY // empty')
+export GEMINI_API_KEY=$(echo "$SECRET_JSON" | jq -r '.GEMINI_API_KEY // empty')
+
+# Filesystem (BYO EFS / S3 Files) test inputs — required by strands-bedrock-byo-filesystem.test.ts.
+export E2E_EFS_ACCESS_POINT_ARN=$(echo "$SECRET_JSON" | jq -r '.EFS_ACCESS_POINT_ARN // empty')
+export E2E_S3_ACCESS_POINT_ARN=$(echo "$SECRET_JSON" | jq -r '.S3_ACCESS_POINT_ARN // empty')
+export E2E_FILESYSTEM_SUBNET_ID=$(echo "$SECRET_JSON" | jq -r '.FILESYSTEM_SUBNET_ID // empty')
+export E2E_FILESYSTEM_SECURITY_GROUP_ID=$(echo "$SECRET_JSON" | jq -r '.FILESYSTEM_SECURITY_GROUP_ID // empty')
+
+# Payments (CDP) test inputs — required by payment-strands-bedrock.test.ts.
+export CDP_API_KEY_ID=$(echo "$SECRET_JSON" | jq -r '.CDP_API_KEY_ID // empty')
+export CDP_API_KEY_SECRET=$(echo "$SECRET_JSON" | jq -r '.CDP_API_KEY_SECRET // empty')
+export CDP_WALLET_SECRET=$(echo "$SECRET_JSON" | jq -r '.CDP_WALLET_SECRET // empty')
+
+echo "✅ Secrets loaded (keys present: $(echo "$SECRET_JSON" | jq -r 'keys | join(", ")')"
+
+echo "=== Setting AWS account env var ==="
+export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+echo "✅ AWS_ACCOUNT_ID=$AWS_ACCOUNT_ID  AWS_REGION=$AWS_REGION"
+
+cd "$REPO_ROOT"
+
+echo "=== Verifying git is configured (required for agentcore create) ==="
+git_email="$(git config --global user.email || true)"
+git_name="$(git config --global user.name || true)"
+
+if [ -z "$git_email" ] || [ -z "$git_name" ]; then
+  echo "ERROR: git is not configured. 'agentcore create' requires a global git identity." >&2
+  echo "Set it with:" >&2
+  echo "  git config --global user.email \"you@example.com\"" >&2
+  echo "  git config --global user.name \"Your Name\"" >&2
+  exit 1
+fi
+
+echo "git configured as: $git_name <$git_email>"
+
+echo "=== Installing dependencies ==="
+npm ci
+
+echo "=== Building CLI ==="
+npm run build
+
+echo "=== Installing CLI globally ==="
+TARBALL=$(npm pack | tail -1)
+npm install -g "$TARBALL"
+echo "✅ Installed: $(agentcore --version)"
+
+echo "=== Running E2E tests ==="
+if [[ -n "${CDK_REPO_PATH:-}" ]]; then
+  echo "=== Building CDK constructs from $CDK_REPO_PATH ==="
+  pushd "$CDK_REPO_PATH" > /dev/null
+  npm ci
+  npm run build
+  CDK_TARBALL_NAME=$(npm pack | tail -1)
+  export CDK_TARBALL="$CDK_REPO_PATH/$CDK_TARBALL_NAME"
+  popd > /dev/null
+  echo "✅ CDK_TARBALL=$CDK_TARBALL"
+fi
+if [[ "$RUN_ALL" == "true" ]]; then
+  echo "Running full e2e suite"
+  npx vitest run --project e2e
+elif [[ ${#TEST_FILES[@]} -gt 0 ]]; then
+  echo "Running: ${TEST_FILES[*]}"
+  npx vitest run --project e2e "${TEST_FILES[@]}"
+else
+  echo "Running default: e2e-tests/strands-bedrock.test.ts"
+  npx vitest run --project e2e e2e-tests/strands-bedrock.test.ts
+fi

package/dist/lib/errors/config.d.ts

@@ -1,49 +0,0 @@
-import { ZodError } from 'zod';
-/**
- * Base class for all config-related errors
- */
-export declare abstract class ConfigError extends Error {
-    protected constructor(message: string);
-}
-/**
- * Thrown when a config file doesn't exist
- */
-export declare class ConfigNotFoundError extends ConfigError {
-    readonly filePath: string;
-    readonly fileType: string;
-    constructor(filePath: string, fileType: string);
-}
-/**
- * Thrown when a config file can't be read
- */
-export declare class ConfigReadError extends ConfigError {
-    readonly filePath: string;
-    readonly cause: unknown;
-    constructor(filePath: string, cause: unknown);
-}
-/**
- * Thrown when a config file can't be written
- */
-export declare class ConfigWriteError extends ConfigError {
-    readonly filePath: string;
-    readonly cause: unknown;
-    constructor(filePath: string, cause: unknown);
-}
-/**
- * Thrown when config validation fails
- */
-export declare class ConfigValidationError extends ConfigError {
-    readonly filePath: string;
-    readonly fileType: string;
-    readonly zodError: ZodError;
-    constructor(filePath: string, fileType: string, zodError: ZodError);
-}
-/**
- * Thrown when JSON parsing fails
- */
-export declare class ConfigParseError extends ConfigError {
-    readonly filePath: string;
-    readonly cause: unknown;
-    constructor(filePath: string, cause: unknown);
-}
-//# sourceMappingURL=config.d.ts.map

package/dist/lib/errors/config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/lib/errors/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B;;GAEG;AACH,8BAAsB,WAAY,SAAQ,KAAK;IAC7C,SAAS,aAAa,OAAO,EAAE,MAAM;CAKtC;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;aAEhC,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,MAAM;gBADhB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;CAInC;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,WAAW;aAE5B,QAAQ,EAAE,MAAM;aACP,KAAK,EAAE,OAAO;gBADvB,QAAQ,EAAE,MAAM,EACP,KAAK,EAAE,OAAO;CAK1C;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,WAAW;aAE7B,QAAQ,EAAE,MAAM;aACP,KAAK,EAAE,OAAO;gBADvB,QAAQ,EAAE,MAAM,EACP,KAAK,EAAE,OAAO;CAK1C;AA8GD;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,WAAW;aAElC,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,QAAQ;gBAFlB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,QAAQ;CAKrC;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,WAAW;aAE7B,QAAQ,EAAE,MAAM;aACP,KAAK,EAAE,OAAO;gBADvB,QAAQ,EAAE,MAAM,EACP,KAAK,EAAE,OAAO;CAK1C"}

package/dist/lib/errors/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/lib/errors/config.ts"],"names":[],"mappings":";;;AAEA;;GAEG;AACH,MAAsB,WAAY,SAAQ,KAAK;IAC7C,YAAsB,OAAe;QACnC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;CACF;AAND,kCAMC;AAED;;GAEG;AACH,MAAa,mBAAoB,SAAQ,WAAW;IAEhC;IACA;IAFlB,YACkB,QAAgB,EAChB,QAAgB;QAEhC,KAAK,CAAC,GAAG,QAAQ,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QAH3C,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;IAGlC,CAAC;CACF;AAPD,kDAOC;AAED;;GAEG;AACH,MAAa,eAAgB,SAAQ,WAAW;IAE5B;IACS;IAF3B,YACkB,QAAgB,EACP,KAAc;QAEvC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,iCAAiC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;QAJ/C,aAAQ,GAAR,QAAQ,CAAQ;QACP,UAAK,GAAL,KAAK,CAAS;IAIzC,CAAC;CACF;AARD,0CAQC;AAED;;GAEG;AACH,MAAa,gBAAiB,SAAQ,WAAW;IAE7B;IACS;IAF3B,YACkB,QAAgB,EACP,KAAc;QAEvC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,kCAAkC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;QAJhD,aAAQ,GAAR,QAAQ,CAAQ;QACP,UAAK,GAAL,KAAK,CAAS;IAIzC,CAAC;CACF;AARD,4CAQC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,IAAmB;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAClB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CACjG;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAiBD;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAkB;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEpC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,cAAc;YACjB,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBACjC,OAAO,GAAG,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtG,CAAC;gBACD,OAAO,GAAG,IAAI,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,CAAC;YACD,MAAM;QAER,KAAK,oBAAoB,CAAC;QAC1B,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBACjC,OAAO,GAAG,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,WAAW,EAAE,CAAC;gBACnF,CAAC;gBACD,OAAO,GAAG,IAAI,cAAc,WAAW,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,iBAAiB;YACpB,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjE,OAAO,GAAG,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtG,CAAC;YACD,MAAM;QAER,KAAK,mBAAmB;YACtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,OAAO,GAAG,IAAI,4BAA4B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvF,CAAC;YACD,MAAM;QAER,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,wEAAwE;YACxE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,OAAO,GAAG,IAAI,cAAc,KAAK,CAAC,aAAa,SAAS,CAAC;YAC3D,CAAC;YACD,iFAAiF;YACjF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YACpF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,oBAAoB,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACtE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBAChC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU;gBAAE,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM;QACR,CAAC;QAED,KAAK,6BAA6B,CAAC,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,GAAG,IAAI,cAAc,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5E,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,wFAAwF;IACxF,+EAA+E;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC;IAC/D,OAAO,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,WAAW;IAElC;IACA;IACA;IAHlB,YACkB,QAAgB,EAChB,QAAgB,EAChB,QAAkB;QAElC,MAAM,eAAe,GAAI,QAAQ,CAAC,MAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnH,KAAK,CAAC,GAAG,QAAQ,MAAM,eAAe,EAAE,CAAC,CAAC;QAL1B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAU;IAIpC,CAAC;CACF;AATD,sDASC;AAED;;GAEG;AACH,MAAa,gBAAiB,SAAQ,WAAW;IAE7B;IACS;IAF3B,YACkB,QAAgB,EACP,KAAc;QAEvC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,0CAA0C,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;QAJxD,aAAQ,GAAR,QAAQ,CAAQ;QACP,UAAK,GAAL,KAAK,CAAS;IAIzC,CAAC;CACF;AARD,4CAQC"}