@go-to-k/cdkd 0.130.0 → 0.132.0

package/README.md

@@ -4,7 +4,7 @@ Drop-in CDK CLI for existing CDK apps — faster deploys via AWS SDK instead of
 
 - **Drop-in CDK compatible** — your existing CDK app code runs as-is.
 - **Up to 15x faster deploys than the AWS CDK CLI (CloudFormation)**
-- **Local dev for CDK apps** — invoke Lambdas, serve API Gateway routes, and run ECS tasks directly from your CDK code, no `cdk synth → sam local` round-trip.
+- **Local dev for CDK apps** — invoke Lambdas, serve API Gateway routes, and run ECS tasks and services directly from your CDK code, no `cdk synth → sam local` round-trip.
 
 ![cdk deploy vs cdkd deploy — side-by-side, 35s recording, real AWS deploy. cdkd finishes while cdk is still creating its CloudFormation changeset.](assets/cdk-vs-cdkd.gif)
 
@@ -25,7 +25,7 @@ Drop-in CDK CLI for existing CDK apps — faster deploys via AWS SDK instead of
 - **Rollback on failure**: When a deploy errors mid-stack, cdkd rolls back the resources it just created so the stack state stays consistent (CloudFormation parity — but cdkd does this without round-tripping through CFn). Pass `cdkd deploy --no-rollback` to skip rollback and keep the partial state for Terraform-style inspection / repair. See [Rollback behavior](#rollback-behavior).
 - **`--no-wait` for async resources**: Skip the multi-minute wait on CloudFront / RDS / ElastiCache / NAT Gateway and return as soon as the create call returns (CloudFormation always blocks)
 - **VPC route DependsOn relaxation (on by default)**: Drop CDK-injected defensive `DependsOn` edges from VPC Lambdas onto private-subnet routes so `CloudFront::Distribution` and `Lambda::Url` start their ~3-min propagation in parallel with NAT Gateway stabilization (~50% faster on VPC + Lambda + CloudFront stacks). Pass `--no-aggressive-vpc-parallel` to opt out.
-- **Local execution without deploying** (`cdkd local invoke` / `cdkd local start-api` / `cdkd local run-task`): run any Lambda — stand up every API Gateway route as a local HTTP server — or start every container in an `AWS::ECS::TaskDefinition` on a per-task docker network with the AWS-published metadata-endpoints sidecar. SAM-compatible mental model but reuses cdkd's synthesis / asset / route-discovery (no `template.yaml` round-trip). All AWS Lambda runtimes (Node.js / Python / Ruby / Java / .NET / `provided.*`) and one server per discovered API (HTTP API v2 / REST v1 / Function URL) with their own port / authorizers / CORS configs. `local run-task` is Phase 1 (single task, DependsOn ordering, IAM task-role via AssumeRole) — ECS Services / ALB routing / Service Connect are Phase 2 / Phase 3 follow-ups. `cdkd local run-task --from-state` substitutes intrinsic-valued container `Environment[].Value` (`Ref` / `Fn::GetAtt` / `Fn::Sub` / `Fn::Join` / `Fn::ImportValue` / `Fn::GetStackOutput`) and `Secrets[].ValueFrom` against the deployed cdkd state — `table.tableName` / `ecs.Secret.fromSecretsManager(secret)` / `ecs.Secret.fromSsmParameter(param)` / cross-stack output refs Just Work locally instead of silently dropping.
+- **Local execution without deploying** (`cdkd local invoke` / `cdkd local start-api` / `cdkd local run-task` / `cdkd local start-service`): run any Lambda — stand up every API Gateway route as a local HTTP server — start every container in an `AWS::ECS::TaskDefinition` on a per-task docker network with the AWS-published metadata-endpoints sidecar — or boot an `AWS::ECS::Service` long-running with `DesiredCount` replicas + restart-on-exit. SAM-compatible mental model but reuses cdkd's synthesis / asset / route-discovery (no `template.yaml` round-trip). All AWS Lambda runtimes (Node.js / Python / Ruby / Java / .NET / `provided.*`) and one server per discovered API (HTTP API v2 / REST v1 / Function URL) with their own port / authorizers / CORS configs. `local start-service` covers the long-running counterpart of `run-task` (ECS Services with DesiredCount replicas) — local load-balancer emulation, Service Connect / Cloud Map, and `--watch` hot-reload are tracked as follow-ups. `cdkd local run-task --from-state` (also honored by `local start-service`) substitutes intrinsic-valued container `Environment[].Value` (`Ref` / `Fn::GetAtt` / `Fn::Sub` / `Fn::Join` / `Fn::ImportValue` / `Fn::GetStackOutput`) and `Secrets[].ValueFrom` against the deployed cdkd state — `table.tableName` / `ecs.Secret.fromSecretsManager(secret)` / `ecs.Secret.fromSsmParameter(param)` / cross-stack output refs Just Work locally instead of silently dropping.
 - **Bidirectional CloudFormation migration**: `cdkd import` adopts AWS-deployed resources (including `cdk deploy`-managed CloudFormation stacks via `--migrate-from-cloudformation`) into cdkd state without re-creating them; `cdkd export` hands a cdkd-managed stack back to CloudFormation when you're ready to move to production. See [Importing existing resources](#importing-existing-resources) and [Exporting a stack back to CloudFormation](#exporting-a-stack-back-to-cloudformation).
 
 > **Note**: Resource types not covered by either SDK Providers or Cloud Control API cannot be deployed with cdkd. If you encounter an unsupported resource type, deployment will fail with a clear error message.
@@ -160,19 +160,26 @@ cdkd has three command families:
   you don't want to synth. `cdkd state destroy` is the CDK-app-free
   counterpart of `cdkd destroy`.
 - **`cdkd local ...` subcommands** (`local invoke`, `local start-api`,
-  `local run-task`) run synthesized workloads locally inside Docker
-  containers. The Lambda variants (`local invoke` / `local start-api`)
-  bundle the AWS Lambda Runtime Interface Emulator (RIE); `local invoke`
-  runs a single Lambda once, and `local start-api` stands up a
-  long-running HTTP server that maps API Gateway / HTTP API / Function
-  URL routes to local Lambda invocations. `local run-task` is the ECS
-  counterpart — it locates an `AWS::ECS::TaskDefinition` from the
-  synthesized template and stands up every container in `dependsOn`
-  order on a per-task docker network with the AWS-published metadata
-  endpoints sidecar, so containers see `ECS_CONTAINER_METADATA_URI_V4`
-  (and optionally task-role creds via `--assume-task-role`) just like
-  they would on Fargate / ECS. No AWS API calls beyond optional STS /
-  Secrets resolution, no state bucket needed.
+  `local run-task`, `local start-service`) run synthesized workloads
+  locally inside Docker containers. The Lambda variants (`local invoke` /
+  `local start-api`) bundle the AWS Lambda Runtime Interface Emulator
+  (RIE); `local invoke` runs a single Lambda once, and `local start-api`
+  stands up a long-running HTTP server that maps API Gateway / HTTP API /
+  Function URL routes to local Lambda invocations. `local run-task` is
+  the ECS one-shot counterpart — it locates an
+  `AWS::ECS::TaskDefinition` from the synthesized template and stands
+  up every container in `dependsOn` order on a per-task docker network
+  with the AWS-published metadata endpoints sidecar, so containers see
+  `ECS_CONTAINER_METADATA_URI_V4` (and optionally task-role creds via
+  `--assume-task-role`) just like they would on Fargate / ECS.
+  `local start-service` is the long-running counterpart for
+  `AWS::ECS::Service`: it discovers the service, chains into the same
+  per-task machinery for each `DesiredCount` replica (clamped by
+  `--max-tasks`), and keeps every replica running until `^C` — failed
+  replicas restart per `--restart-policy on-failure|always|none`. No
+  AWS API calls beyond optional STS / Secrets resolution, no state
+  bucket needed. Local load-balancer emulation and `--watch` hot-reload
+  for `start-service` are deferred to follow-up PRs.
 
 Options like `--app`, `--state-bucket`, and `--context` can be omitted if configured via `cdk.json` or environment variables (`CDKD_APP`, `CDKD_STATE_BUCKET`).
 
@@ -415,8 +422,8 @@ type-pair allowlist and trade-off notes.
 ## Local execution
 
 The `cdkd local` family runs AWS workloads on the developer's machine
-via Docker — Lambda functions, API Gateway routes, and ECS tasks —
-without an AWS deploy. Modeled on `sam local *` but reuses cdkd's
+via Docker — Lambda functions, API Gateway routes, ECS tasks, and
+long-running ECS services — without an AWS deploy. Modeled on `sam local *` but reuses cdkd's
 synthesis / asset / construct-path plumbing — no `template.yaml` to
 maintain, no `cdk synth | sam ...` round-trip.
 
@@ -425,6 +432,7 @@ maintain, no `cdk synth | sam ...` round-trip.
 | `cdkd local invoke <target>` | One-shot Lambda invoke via the AWS Lambda Runtime Interface Emulator (RIE) |
 | `cdkd local start-api` | Long-running HTTP server for REST v1 / HTTP API / Function URL routes |
 | `cdkd local run-task <target>` | ECS RunTask — every container in a task definition started on a per-task docker network |
+| `cdkd local start-service <target>` | Long-running ECS Service emulator — `DesiredCount` replicas with restart-on-exit (no local load balancer in v1) |
 
 Requires Docker. Pass `--from-state` to substitute deployed physical
 IDs into intrinsic-valued properties (`Ref` / `Fn::GetAtt` / `Fn::Sub` /
@@ -460,12 +468,21 @@ cdkd local start-api --from-state                 # substitute deployed env vars
 
 One server per discovered API — authorizers, CORS configs, and stage
 variables stay scoped to the owning API. Supports REST v1 + HTTP API +
-Function URL with AWS_PROXY integrations; Lambda TOKEN / REQUEST,
-Cognito User Pool, HTTP v2 JWT authorizers (JWKS-verified), and REST v1
-`AuthorizationType: 'AWS_IAM'` (SigV4 signature verification only — IAM
-policy evaluation is not emulated; see `docs/local-emulation.md`); CORS
-preflight (HTTP API v2 `CorsConfiguration` + REST v1 OPTIONS MOCK
-preflight from `defaultCorsPreflightOptions`); hot reload via `--watch`;
+Function URL with **AWS_PROXY** integrations AND every REST v1
+non-AWS_PROXY integration kind: **MOCK** (status-code selection via
+request template + response-template VTL), **HTTP_PROXY** (verbatim
+upstream forward with `RequestParameters` mappings), **HTTP**
+(HTTP_PROXY + bidirectional VTL), and **AWS** Lambda non-proxy
+(request + response VTL via the hand-rolled engine at
+`src/local/vtl-engine.ts`).
+Direct AWS-service integrations (S3 / SQS / SNS / DynamoDB / etc.) are
+NOT emulated — deploy to AWS or use HTTP_PROXY to a local mock instead.
+Authorizers: Lambda TOKEN / REQUEST, Cognito User Pool, HTTP v2 JWT
+(JWKS-verified), and REST v1 `AuthorizationType: 'AWS_IAM'` (SigV4
+signature verification only — IAM policy evaluation is not emulated;
+see `docs/local-emulation.md`). CORS preflight (HTTP API v2
+`CorsConfiguration` + REST v1 OPTIONS MOCK preflight from
+`defaultCorsPreflightOptions`); hot reload via `--watch`;
 deploy-state-backed env var substitution via `--from-state`.
 
 Function URL `InvokeMode: RESPONSE_STREAM` is supported (issue #467):
@@ -475,14 +492,14 @@ Note that AWS's local RIE buffers the response — incremental chunk
 delivery only manifests against the deployed Lambda runtime; locally
 the response shape is correct but arrives in one block.
 
-Routes whose integration cdkd cannot emulate (non-AWS_PROXY REST v1
-types other than the MOCK CORS preflight subset, HTTP API v2 service
-integrations, WebSocket APIs, Function URLs with IAM auth, cross-stack
-Lambda Arn references) **do not block boot** — the server starts with
-a per-route `[warn]` summary and returns HTTP 501 + the reason in the
-JSON body if and when the route is hit. This lets you run the rest of
-your API surface locally while the unsupported routes stay on the
-deployed API.
+Routes whose integration cdkd cannot emulate (REST v1 AWS integration
+to a non-Lambda service, HTTP_PROXY / HTTP with non-literal `Uri`, HTTP
+API v2 service integrations, WebSocket APIs, Function URLs with IAM
+auth, cross-stack Lambda Arn references) **do not block boot** — the
+server starts with a per-route `[warn]` summary and returns HTTP 501 +
+the reason in the JSON body if and when the route is hit. This lets
+you run the rest of your API surface locally while the unsupported
+routes stay on the deployed API.
 
 ### `local run-task`
 

package/dist/{aws-clients-CuHRHcyW.js → aws-clients-BF03Alpe.js}

@@ -1,3 +1,4 @@
+import { t as __exportAll } from "./rolldown-runtime-CjeV3_4I.js";
 import { S3Client } from "@aws-sdk/client-s3";
 import { CloudControlClient } from "@aws-sdk/client-cloudcontrol";
 import { IAMClient } from "@aws-sdk/client-iam";
@@ -17,23 +18,6 @@ import { CloudWatchClient } from "@aws-sdk/client-cloudwatch";
 import { CloudWatchLogsClient } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore-control";
 
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) {
-		__defProp(target, name, {
-			get: all[name],
-			enumerable: true
-		});
-	}
-	if (!no_symbols) {
-		__defProp(target, Symbol.toStringTag, { value: "Module" });
-	}
-	return target;
-};
-
-//#endregion
 //#region src/utils/aws-clients.ts
 var aws_clients_exports = /* @__PURE__ */ __exportAll({
 	AwsClients: () => AwsClients,
@@ -425,4 +409,4 @@ function resetAwsClients() {
 
 //#endregion
 export { setAwsClients as a, resetAwsClients as i, aws_clients_exports as n, getAwsClients as r, AwsClients as t };
-//# sourceMappingURL=aws-clients-CuHRHcyW.js.map
+//# sourceMappingURL=aws-clients-BF03Alpe.js.map

package/dist/{aws-clients-CuHRHcyW.js.map → aws-clients-BF03Alpe.js.map}

@@ -1 +1 @@
-{"version":3,"file":"aws-clients-CuHRHcyW.js","names":[],"sources":["../src/utils/aws-clients.ts"],"sourcesContent":["import { S3Client } from '@aws-sdk/client-s3';\nimport { CloudControlClient } from '@aws-sdk/client-cloudcontrol';\nimport { IAMClient } from '@aws-sdk/client-iam';\nimport { SQSClient } from '@aws-sdk/client-sqs';\nimport { SNSClient } from '@aws-sdk/client-sns';\nimport { LambdaClient } from '@aws-sdk/client-lambda';\nimport { STSClient } from '@aws-sdk/client-sts';\nimport { EC2Client } from '@aws-sdk/client-ec2';\nimport { DynamoDBClient } from '@aws-sdk/client-dynamodb';\nimport { CloudFormationClient } from '@aws-sdk/client-cloudformation';\nimport { APIGatewayClient } from '@aws-sdk/client-api-gateway';\nimport { EventBridgeClient } from '@aws-sdk/client-eventbridge';\nimport { SecretsManagerClient } from '@aws-sdk/client-secrets-manager';\nimport { SSMClient } from '@aws-sdk/client-ssm';\nimport { CloudFrontClient } from '@aws-sdk/client-cloudfront';\nimport { CloudWatchClient } from '@aws-sdk/client-cloudwatch';\nimport { CloudWatchLogsClient } from '@aws-sdk/client-cloudwatch-logs';\nimport { BedrockAgentCoreControlClient } from '@aws-sdk/client-bedrock-agentcore-control';\n\n/**\n * AWS client configuration\n */\nexport interface AwsClientConfig {\n  region?: string;\n  profile?: string;\n  credentials?: {\n    accessKeyId: string;\n    secretAccessKey: string;\n    sessionToken?: string;\n  };\n}\n\n/**\n * AWS clients manager\n */\nexport class AwsClients {\n  private s3Client?: S3Client;\n  private cloudControlClient?: CloudControlClient;\n  private iamClient?: IAMClient;\n  private sqsClient?: SQSClient;\n  private snsClient?: SNSClient;\n  private lambdaClient?: LambdaClient;\n  private stsClient?: STSClient;\n  private ec2Client?: EC2Client;\n  private dynamoDBClient?: DynamoDBClient;\n  private cloudFormationClient?: CloudFormationClient;\n  private apiGatewayClient?: APIGatewayClient;\n  private eventBridgeClient?: EventBridgeClient;\n  private secretsManagerClient?: SecretsManagerClient;\n  private ssmClient?: SSMClient;\n  private cloudFrontClient?: CloudFrontClient;\n  private cloudWatchClient?: CloudWatchClient;\n  private cloudWatchLogsClient?: CloudWatchLogsClient;\n  private bedrockAgentCoreControlClient?: BedrockAgentCoreControlClient;\n  private config: AwsClientConfig;\n\n  constructor(config: AwsClientConfig = {}) {\n    this.config = config;\n  }\n\n  /**\n   * Get S3 client\n   *\n   * Note: If region and credentials are not provided, AWS SDK will use:\n   * 1. Environment variables (AWS_REGION, AWS_ACCESS_KEY_ID, etc.)\n   * 2. AWS credentials file (~/.aws/credentials)\n   * 3. IAM role (if running on EC2/ECS/Lambda)\n   */\n  getS3Client(): S3Client {\n    if (!this.s3Client) {\n      this.s3Client = new S3Client({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n        // Suppress \"Are you using a Stream of unknown length\" warning\n        logger: { debug: () => {}, info: () => {}, warn: () => {}, error: () => {} },\n      });\n    }\n    return this.s3Client;\n  }\n\n  /**\n   * Get Cloud Control API client\n   *\n   * Note: If region and credentials are not provided, AWS SDK will use:\n   * 1. Environment variables (AWS_REGION, AWS_ACCESS_KEY_ID, etc.)\n   * 2. AWS credentials file (~/.aws/credentials)\n   * 3. IAM role (if running on EC2/ECS/Lambda)\n   */\n  getCloudControlClient(): CloudControlClient {\n    if (!this.cloudControlClient) {\n      this.cloudControlClient = new CloudControlClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.cloudControlClient;\n  }\n\n  /**\n   * Get IAM client\n   *\n   * Note: IAM is a global service, but we accept region for consistency.\n   * If not specified, defaults to us-east-1.\n   */\n  getIAMClient(): IAMClient {\n    if (!this.iamClient) {\n      this.iamClient = new IAMClient({\n        region: this.config.region || 'us-east-1',\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.iamClient;\n  }\n\n  /**\n   * Convenience getter for S3 client\n   */\n  get s3(): S3Client {\n    return this.getS3Client();\n  }\n\n  /**\n   * Convenience getter for Cloud Control client\n   */\n  get cloudControl(): CloudControlClient {\n    return this.getCloudControlClient();\n  }\n\n  /**\n   * Convenience getter for IAM client\n   */\n  get iam(): IAMClient {\n    return this.getIAMClient();\n  }\n\n  /**\n   * Get SQS client\n   */\n  getSQSClient(): SQSClient {\n    if (!this.sqsClient) {\n      this.sqsClient = new SQSClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.sqsClient;\n  }\n\n  /**\n   * Convenience getter for SQS client\n   */\n  get sqs(): SQSClient {\n    return this.getSQSClient();\n  }\n\n  /**\n   * Get SNS client\n   */\n  getSNSClient(): SNSClient {\n    if (!this.snsClient) {\n      this.snsClient = new SNSClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.snsClient;\n  }\n\n  /**\n   * Convenience getter for SNS client\n   */\n  get sns(): SNSClient {\n    return this.getSNSClient();\n  }\n\n  /**\n   * Get Lambda client\n   */\n  getLambdaClient(): LambdaClient {\n    if (!this.lambdaClient) {\n      this.lambdaClient = new LambdaClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.lambdaClient;\n  }\n\n  /**\n   * Convenience getter for Lambda client\n   */\n  get lambda(): LambdaClient {\n    return this.getLambdaClient();\n  }\n\n  /**\n   * Get EC2 client\n   */\n  getEC2Client(): EC2Client {\n    if (!this.ec2Client) {\n      this.ec2Client = new EC2Client({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.ec2Client;\n  }\n\n  /**\n   * Convenience getter for EC2 client\n   */\n  get ec2(): EC2Client {\n    return this.getEC2Client();\n  }\n\n  /**\n   * Get STS client\n   */\n  getSTSClient(): STSClient {\n    if (!this.stsClient) {\n      this.stsClient = new STSClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.stsClient;\n  }\n\n  /**\n   * Convenience getter for STS client\n   */\n  get sts(): STSClient {\n    return this.getSTSClient();\n  }\n\n  /**\n   * Get DynamoDB client\n   */\n  getDynamoDBClient(): DynamoDBClient {\n    if (!this.dynamoDBClient) {\n      this.dynamoDBClient = new DynamoDBClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.dynamoDBClient;\n  }\n\n  /**\n   * Convenience getter for DynamoDB client\n   */\n  get dynamoDB(): DynamoDBClient {\n    return this.getDynamoDBClient();\n  }\n\n  /**\n   * Get CloudFormation client\n   */\n  getCloudFormationClient(): CloudFormationClient {\n    if (!this.cloudFormationClient) {\n      this.cloudFormationClient = new CloudFormationClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.cloudFormationClient;\n  }\n\n  /**\n   * Convenience getter for CloudFormation client\n   */\n  get cloudFormation(): CloudFormationClient {\n    return this.getCloudFormationClient();\n  }\n\n  /**\n   * Get API Gateway client\n   */\n  getAPIGatewayClient(): APIGatewayClient {\n    if (!this.apiGatewayClient) {\n      this.apiGatewayClient = new APIGatewayClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.apiGatewayClient;\n  }\n\n  /**\n   * Convenience getter for API Gateway client\n   */\n  get apiGateway(): APIGatewayClient {\n    return this.getAPIGatewayClient();\n  }\n\n  /**\n   * Get EventBridge client\n   */\n  getEventBridgeClient(): EventBridgeClient {\n    if (!this.eventBridgeClient) {\n      this.eventBridgeClient = new EventBridgeClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.eventBridgeClient;\n  }\n\n  /**\n   * Convenience getter for EventBridge client\n   */\n  get eventBridge(): EventBridgeClient {\n    return this.getEventBridgeClient();\n  }\n\n  /**\n   * Get Secrets Manager client\n   */\n  getSecretsManagerClient(): SecretsManagerClient {\n    if (!this.secretsManagerClient) {\n      this.secretsManagerClient = new SecretsManagerClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.secretsManagerClient;\n  }\n\n  /**\n   * Convenience getter for Secrets Manager client\n   */\n  get secretsManager(): SecretsManagerClient {\n    return this.getSecretsManagerClient();\n  }\n\n  /**\n   * Get SSM client\n   */\n  getSSMClient(): SSMClient {\n    if (!this.ssmClient) {\n      this.ssmClient = new SSMClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.ssmClient;\n  }\n\n  /**\n   * Convenience getter for SSM client\n   */\n  get ssm(): SSMClient {\n    return this.getSSMClient();\n  }\n\n  /**\n   * Get CloudFront client\n   */\n  getCloudFrontClient(): CloudFrontClient {\n    if (!this.cloudFrontClient) {\n      this.cloudFrontClient = new CloudFrontClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.cloudFrontClient;\n  }\n\n  /**\n   * Convenience getter for CloudFront client\n   */\n  get cloudFront(): CloudFrontClient {\n    return this.getCloudFrontClient();\n  }\n\n  /**\n   * Get CloudWatch client\n   */\n  getCloudWatchClient(): CloudWatchClient {\n    if (!this.cloudWatchClient) {\n      this.cloudWatchClient = new CloudWatchClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.cloudWatchClient;\n  }\n\n  /**\n   * Convenience getter for CloudWatch client\n   */\n  get cloudWatch(): CloudWatchClient {\n    return this.getCloudWatchClient();\n  }\n\n  /**\n   * Get CloudWatch Logs client\n   */\n  getCloudWatchLogsClient(): CloudWatchLogsClient {\n    if (!this.cloudWatchLogsClient) {\n      this.cloudWatchLogsClient = new CloudWatchLogsClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.cloudWatchLogsClient;\n  }\n\n  /**\n   * Convenience getter for CloudWatch Logs client\n   */\n  get cloudWatchLogs(): CloudWatchLogsClient {\n    return this.getCloudWatchLogsClient();\n  }\n\n  /**\n   * Get BedrockAgentCoreControl client\n   */\n  getBedrockAgentCoreControlClient(): BedrockAgentCoreControlClient {\n    if (!this.bedrockAgentCoreControlClient) {\n      this.bedrockAgentCoreControlClient = new BedrockAgentCoreControlClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.bedrockAgentCoreControlClient;\n  }\n\n  /**\n   * Convenience getter for BedrockAgentCoreControl client\n   */\n  get bedrockAgentCoreControl(): BedrockAgentCoreControlClient {\n    return this.getBedrockAgentCoreControlClient();\n  }\n\n  /**\n   * Destroy all clients\n   */\n  destroy(): void {\n    this.s3Client?.destroy();\n    this.cloudControlClient?.destroy();\n    this.iamClient?.destroy();\n    this.sqsClient?.destroy();\n    this.snsClient?.destroy();\n    this.lambdaClient?.destroy();\n    this.stsClient?.destroy();\n    this.ec2Client?.destroy();\n    this.dynamoDBClient?.destroy();\n    this.cloudFormationClient?.destroy();\n    this.apiGatewayClient?.destroy();\n    this.eventBridgeClient?.destroy();\n    this.secretsManagerClient?.destroy();\n    this.ssmClient?.destroy();\n    this.cloudFrontClient?.destroy();\n    this.cloudWatchClient?.destroy();\n    this.cloudWatchLogsClient?.destroy();\n    this.bedrockAgentCoreControlClient?.destroy();\n  }\n}\n\n/**\n * Global AWS clients instance\n */\nlet globalClients: AwsClients | null = null;\n\n/**\n * Get or create global AWS clients\n */\nexport function getAwsClients(config?: AwsClientConfig): AwsClients {\n  if (!globalClients) {\n    globalClients = new AwsClients(config);\n  }\n  return globalClients;\n}\n\n/**\n * Set global AWS clients instance\n */\nexport function setAwsClients(clients: AwsClients): void {\n  globalClients = clients;\n}\n\n/**\n * Reset global AWS clients (useful for testing)\n */\nexport function resetAwsClients(): void {\n  globalClients?.destroy();\n  globalClients = null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAa,aAAb,MAAwB;CACtB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAY,SAA0B,EAAE,EAAE;AACxC,OAAK,SAAS;;;;;;;;;;CAWhB,cAAwB;AACtB,MAAI,CAAC,KAAK,SACR,MAAK,WAAW,IAAI,SAAS;GAC3B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GAEvE,QAAQ;IAAE,aAAa;IAAI,YAAY;IAAI,YAAY;IAAI,aAAa;IAAI;GAC7E,CAAC;AAEJ,SAAO,KAAK;;;;;;;;;;CAWd,wBAA4C;AAC1C,MAAI,CAAC,KAAK,mBACR,MAAK,qBAAqB,IAAI,mBAAmB;GAC/C,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;;;;CASd,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,QAAQ,KAAK,OAAO,UAAU;GAC9B,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,KAAe;AACjB,SAAO,KAAK,aAAa;;;;;CAM3B,IAAI,eAAmC;AACrC,SAAO,KAAK,uBAAuB;;;;;CAMrC,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,kBAAgC;AAC9B,MAAI,CAAC,KAAK,aACR,MAAK,eAAe,IAAI,aAAa;GACnC,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,SAAuB;AACzB,SAAO,KAAK,iBAAiB;;;;;CAM/B,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,oBAAoC;AAClC,MAAI,CAAC,KAAK,eACR,MAAK,iBAAiB,IAAI,eAAe;GACvC,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,WAA2B;AAC7B,SAAO,KAAK,mBAAmB;;;;;CAMjC,0BAAgD;AAC9C,MAAI,CAAC,KAAK,qBACR,MAAK,uBAAuB,IAAI,qBAAqB;GACnD,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,iBAAuC;AACzC,SAAO,KAAK,yBAAyB;;;;;CAMvC,sBAAwC;AACtC,MAAI,CAAC,KAAK,iBACR,MAAK,mBAAmB,IAAI,iBAAiB;GAC3C,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,aAA+B;AACjC,SAAO,KAAK,qBAAqB;;;;;CAMnC,uBAA0C;AACxC,MAAI,CAAC,KAAK,kBACR,MAAK,oBAAoB,IAAI,kBAAkB;GAC7C,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,cAAiC;AACnC,SAAO,KAAK,sBAAsB;;;;;CAMpC,0BAAgD;AAC9C,MAAI,CAAC,KAAK,qBACR,MAAK,uBAAuB,IAAI,qBAAqB;GACnD,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,iBAAuC;AACzC,SAAO,KAAK,yBAAyB;;;;;CAMvC,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,sBAAwC;AACtC,MAAI,CAAC,KAAK,iBACR,MAAK,mBAAmB,IAAI,iBAAiB;GAC3C,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,aAA+B;AACjC,SAAO,KAAK,qBAAqB;;;;;CAMnC,sBAAwC;AACtC,MAAI,CAAC,KAAK,iBACR,MAAK,mBAAmB,IAAI,iBAAiB;GAC3C,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,aAA+B;AACjC,SAAO,KAAK,qBAAqB;;;;;CAMnC,0BAAgD;AAC9C,MAAI,CAAC,KAAK,qBACR,MAAK,uBAAuB,IAAI,qBAAqB;GACnD,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,iBAAuC;AACzC,SAAO,KAAK,yBAAyB;;;;;CAMvC,mCAAkE;AAChE,MAAI,CAAC,KAAK,8BACR,MAAK,gCAAgC,IAAI,8BAA8B;GACrE,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,0BAAyD;AAC3D,SAAO,KAAK,kCAAkC;;;;;CAMhD,UAAgB;AACd,OAAK,UAAU,SAAS;AACxB,OAAK,oBAAoB,SAAS;AAClC,OAAK,WAAW,SAAS;AACzB,OAAK,WAAW,SAAS;AACzB,OAAK,WAAW,SAAS;AACzB,OAAK,cAAc,SAAS;AAC5B,OAAK,WAAW,SAAS;AACzB,OAAK,WAAW,SAAS;AACzB,OAAK,gBAAgB,SAAS;AAC9B,OAAK,sBAAsB,SAAS;AACpC,OAAK,kBAAkB,SAAS;AAChC,OAAK,mBAAmB,SAAS;AACjC,OAAK,sBAAsB,SAAS;AACpC,OAAK,WAAW,SAAS;AACzB,OAAK,kBAAkB,SAAS;AAChC,OAAK,kBAAkB,SAAS;AAChC,OAAK,sBAAsB,SAAS;AACpC,OAAK,+BAA+B,SAAS;;;;;;AAOjD,IAAI,gBAAmC;;;;AAKvC,SAAgB,cAAc,QAAsC;AAClE,KAAI,CAAC,cACH,iBAAgB,IAAI,WAAW,OAAO;AAExC,QAAO;;;;;AAMT,SAAgB,cAAc,SAA2B;AACvD,iBAAgB;;;;;AAMlB,SAAgB,kBAAwB;AACtC,gBAAe,SAAS;AACxB,iBAAgB"}
+{"version":3,"file":"aws-clients-BF03Alpe.js","names":[],"sources":["../src/utils/aws-clients.ts"],"sourcesContent":["import { S3Client } from '@aws-sdk/client-s3';\nimport { CloudControlClient } from '@aws-sdk/client-cloudcontrol';\nimport { IAMClient } from '@aws-sdk/client-iam';\nimport { SQSClient } from '@aws-sdk/client-sqs';\nimport { SNSClient } from '@aws-sdk/client-sns';\nimport { LambdaClient } from '@aws-sdk/client-lambda';\nimport { STSClient } from '@aws-sdk/client-sts';\nimport { EC2Client } from '@aws-sdk/client-ec2';\nimport { DynamoDBClient } from '@aws-sdk/client-dynamodb';\nimport { CloudFormationClient } from '@aws-sdk/client-cloudformation';\nimport { APIGatewayClient } from '@aws-sdk/client-api-gateway';\nimport { EventBridgeClient } from '@aws-sdk/client-eventbridge';\nimport { SecretsManagerClient } from '@aws-sdk/client-secrets-manager';\nimport { SSMClient } from '@aws-sdk/client-ssm';\nimport { CloudFrontClient } from '@aws-sdk/client-cloudfront';\nimport { CloudWatchClient } from '@aws-sdk/client-cloudwatch';\nimport { CloudWatchLogsClient } from '@aws-sdk/client-cloudwatch-logs';\nimport { BedrockAgentCoreControlClient } from '@aws-sdk/client-bedrock-agentcore-control';\n\n/**\n * AWS client configuration\n */\nexport interface AwsClientConfig {\n  region?: string;\n  profile?: string;\n  credentials?: {\n    accessKeyId: string;\n    secretAccessKey: string;\n    sessionToken?: string;\n  };\n}\n\n/**\n * AWS clients manager\n */\nexport class AwsClients {\n  private s3Client?: S3Client;\n  private cloudControlClient?: CloudControlClient;\n  private iamClient?: IAMClient;\n  private sqsClient?: SQSClient;\n  private snsClient?: SNSClient;\n  private lambdaClient?: LambdaClient;\n  private stsClient?: STSClient;\n  private ec2Client?: EC2Client;\n  private dynamoDBClient?: DynamoDBClient;\n  private cloudFormationClient?: CloudFormationClient;\n  private apiGatewayClient?: APIGatewayClient;\n  private eventBridgeClient?: EventBridgeClient;\n  private secretsManagerClient?: SecretsManagerClient;\n  private ssmClient?: SSMClient;\n  private cloudFrontClient?: CloudFrontClient;\n  private cloudWatchClient?: CloudWatchClient;\n  private cloudWatchLogsClient?: CloudWatchLogsClient;\n  private bedrockAgentCoreControlClient?: BedrockAgentCoreControlClient;\n  private config: AwsClientConfig;\n\n  constructor(config: AwsClientConfig = {}) {\n    this.config = config;\n  }\n\n  /**\n   * Get S3 client\n   *\n   * Note: If region and credentials are not provided, AWS SDK will use:\n   * 1. Environment variables (AWS_REGION, AWS_ACCESS_KEY_ID, etc.)\n   * 2. AWS credentials file (~/.aws/credentials)\n   * 3. IAM role (if running on EC2/ECS/Lambda)\n   */\n  getS3Client(): S3Client {\n    if (!this.s3Client) {\n      this.s3Client = new S3Client({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n        // Suppress \"Are you using a Stream of unknown length\" warning\n        logger: { debug: () => {}, info: () => {}, warn: () => {}, error: () => {} },\n      });\n    }\n    return this.s3Client;\n  }\n\n  /**\n   * Get Cloud Control API client\n   *\n   * Note: If region and credentials are not provided, AWS SDK will use:\n   * 1. Environment variables (AWS_REGION, AWS_ACCESS_KEY_ID, etc.)\n   * 2. AWS credentials file (~/.aws/credentials)\n   * 3. IAM role (if running on EC2/ECS/Lambda)\n   */\n  getCloudControlClient(): CloudControlClient {\n    if (!this.cloudControlClient) {\n      this.cloudControlClient = new CloudControlClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.cloudControlClient;\n  }\n\n  /**\n   * Get IAM client\n   *\n   * Note: IAM is a global service, but we accept region for consistency.\n   * If not specified, defaults to us-east-1.\n   */\n  getIAMClient(): IAMClient {\n    if (!this.iamClient) {\n      this.iamClient = new IAMClient({\n        region: this.config.region || 'us-east-1',\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.iamClient;\n  }\n\n  /**\n   * Convenience getter for S3 client\n   */\n  get s3(): S3Client {\n    return this.getS3Client();\n  }\n\n  /**\n   * Convenience getter for Cloud Control client\n   */\n  get cloudControl(): CloudControlClient {\n    return this.getCloudControlClient();\n  }\n\n  /**\n   * Convenience getter for IAM client\n   */\n  get iam(): IAMClient {\n    return this.getIAMClient();\n  }\n\n  /**\n   * Get SQS client\n   */\n  getSQSClient(): SQSClient {\n    if (!this.sqsClient) {\n      this.sqsClient = new SQSClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.sqsClient;\n  }\n\n  /**\n   * Convenience getter for SQS client\n   */\n  get sqs(): SQSClient {\n    return this.getSQSClient();\n  }\n\n  /**\n   * Get SNS client\n   */\n  getSNSClient(): SNSClient {\n    if (!this.snsClient) {\n      this.snsClient = new SNSClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.snsClient;\n  }\n\n  /**\n   * Convenience getter for SNS client\n   */\n  get sns(): SNSClient {\n    return this.getSNSClient();\n  }\n\n  /**\n   * Get Lambda client\n   */\n  getLambdaClient(): LambdaClient {\n    if (!this.lambdaClient) {\n      this.lambdaClient = new LambdaClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.lambdaClient;\n  }\n\n  /**\n   * Convenience getter for Lambda client\n   */\n  get lambda(): LambdaClient {\n    return this.getLambdaClient();\n  }\n\n  /**\n   * Get EC2 client\n   */\n  getEC2Client(): EC2Client {\n    if (!this.ec2Client) {\n      this.ec2Client = new EC2Client({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.ec2Client;\n  }\n\n  /**\n   * Convenience getter for EC2 client\n   */\n  get ec2(): EC2Client {\n    return this.getEC2Client();\n  }\n\n  /**\n   * Get STS client\n   */\n  getSTSClient(): STSClient {\n    if (!this.stsClient) {\n      this.stsClient = new STSClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.stsClient;\n  }\n\n  /**\n   * Convenience getter for STS client\n   */\n  get sts(): STSClient {\n    return this.getSTSClient();\n  }\n\n  /**\n   * Get DynamoDB client\n   */\n  getDynamoDBClient(): DynamoDBClient {\n    if (!this.dynamoDBClient) {\n      this.dynamoDBClient = new DynamoDBClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.dynamoDBClient;\n  }\n\n  /**\n   * Convenience getter for DynamoDB client\n   */\n  get dynamoDB(): DynamoDBClient {\n    return this.getDynamoDBClient();\n  }\n\n  /**\n   * Get CloudFormation client\n   */\n  getCloudFormationClient(): CloudFormationClient {\n    if (!this.cloudFormationClient) {\n      this.cloudFormationClient = new CloudFormationClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.cloudFormationClient;\n  }\n\n  /**\n   * Convenience getter for CloudFormation client\n   */\n  get cloudFormation(): CloudFormationClient {\n    return this.getCloudFormationClient();\n  }\n\n  /**\n   * Get API Gateway client\n   */\n  getAPIGatewayClient(): APIGatewayClient {\n    if (!this.apiGatewayClient) {\n      this.apiGatewayClient = new APIGatewayClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.apiGatewayClient;\n  }\n\n  /**\n   * Convenience getter for API Gateway client\n   */\n  get apiGateway(): APIGatewayClient {\n    return this.getAPIGatewayClient();\n  }\n\n  /**\n   * Get EventBridge client\n   */\n  getEventBridgeClient(): EventBridgeClient {\n    if (!this.eventBridgeClient) {\n      this.eventBridgeClient = new EventBridgeClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.eventBridgeClient;\n  }\n\n  /**\n   * Convenience getter for EventBridge client\n   */\n  get eventBridge(): EventBridgeClient {\n    return this.getEventBridgeClient();\n  }\n\n  /**\n   * Get Secrets Manager client\n   */\n  getSecretsManagerClient(): SecretsManagerClient {\n    if (!this.secretsManagerClient) {\n      this.secretsManagerClient = new SecretsManagerClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.secretsManagerClient;\n  }\n\n  /**\n   * Convenience getter for Secrets Manager client\n   */\n  get secretsManager(): SecretsManagerClient {\n    return this.getSecretsManagerClient();\n  }\n\n  /**\n   * Get SSM client\n   */\n  getSSMClient(): SSMClient {\n    if (!this.ssmClient) {\n      this.ssmClient = new SSMClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.ssmClient;\n  }\n\n  /**\n   * Convenience getter for SSM client\n   */\n  get ssm(): SSMClient {\n    return this.getSSMClient();\n  }\n\n  /**\n   * Get CloudFront client\n   */\n  getCloudFrontClient(): CloudFrontClient {\n    if (!this.cloudFrontClient) {\n      this.cloudFrontClient = new CloudFrontClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.cloudFrontClient;\n  }\n\n  /**\n   * Convenience getter for CloudFront client\n   */\n  get cloudFront(): CloudFrontClient {\n    return this.getCloudFrontClient();\n  }\n\n  /**\n   * Get CloudWatch client\n   */\n  getCloudWatchClient(): CloudWatchClient {\n    if (!this.cloudWatchClient) {\n      this.cloudWatchClient = new CloudWatchClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.cloudWatchClient;\n  }\n\n  /**\n   * Convenience getter for CloudWatch client\n   */\n  get cloudWatch(): CloudWatchClient {\n    return this.getCloudWatchClient();\n  }\n\n  /**\n   * Get CloudWatch Logs client\n   */\n  getCloudWatchLogsClient(): CloudWatchLogsClient {\n    if (!this.cloudWatchLogsClient) {\n      this.cloudWatchLogsClient = new CloudWatchLogsClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.cloudWatchLogsClient;\n  }\n\n  /**\n   * Convenience getter for CloudWatch Logs client\n   */\n  get cloudWatchLogs(): CloudWatchLogsClient {\n    return this.getCloudWatchLogsClient();\n  }\n\n  /**\n   * Get BedrockAgentCoreControl client\n   */\n  getBedrockAgentCoreControlClient(): BedrockAgentCoreControlClient {\n    if (!this.bedrockAgentCoreControlClient) {\n      this.bedrockAgentCoreControlClient = new BedrockAgentCoreControlClient({\n        ...(this.config.region && { region: this.config.region }),\n        ...(this.config.credentials && { credentials: this.config.credentials }),\n      });\n    }\n    return this.bedrockAgentCoreControlClient;\n  }\n\n  /**\n   * Convenience getter for BedrockAgentCoreControl client\n   */\n  get bedrockAgentCoreControl(): BedrockAgentCoreControlClient {\n    return this.getBedrockAgentCoreControlClient();\n  }\n\n  /**\n   * Destroy all clients\n   */\n  destroy(): void {\n    this.s3Client?.destroy();\n    this.cloudControlClient?.destroy();\n    this.iamClient?.destroy();\n    this.sqsClient?.destroy();\n    this.snsClient?.destroy();\n    this.lambdaClient?.destroy();\n    this.stsClient?.destroy();\n    this.ec2Client?.destroy();\n    this.dynamoDBClient?.destroy();\n    this.cloudFormationClient?.destroy();\n    this.apiGatewayClient?.destroy();\n    this.eventBridgeClient?.destroy();\n    this.secretsManagerClient?.destroy();\n    this.ssmClient?.destroy();\n    this.cloudFrontClient?.destroy();\n    this.cloudWatchClient?.destroy();\n    this.cloudWatchLogsClient?.destroy();\n    this.bedrockAgentCoreControlClient?.destroy();\n  }\n}\n\n/**\n * Global AWS clients instance\n */\nlet globalClients: AwsClients | null = null;\n\n/**\n * Get or create global AWS clients\n */\nexport function getAwsClients(config?: AwsClientConfig): AwsClients {\n  if (!globalClients) {\n    globalClients = new AwsClients(config);\n  }\n  return globalClients;\n}\n\n/**\n * Set global AWS clients instance\n */\nexport function setAwsClients(clients: AwsClients): void {\n  globalClients = clients;\n}\n\n/**\n * Reset global AWS clients (useful for testing)\n */\nexport function resetAwsClients(): void {\n  globalClients?.destroy();\n  globalClients = null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAa,aAAb,MAAwB;CACtB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAY,SAA0B,EAAE,EAAE;AACxC,OAAK,SAAS;;;;;;;;;;CAWhB,cAAwB;AACtB,MAAI,CAAC,KAAK,SACR,MAAK,WAAW,IAAI,SAAS;GAC3B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GAEvE,QAAQ;IAAE,aAAa;IAAI,YAAY;IAAI,YAAY;IAAI,aAAa;IAAI;GAC7E,CAAC;AAEJ,SAAO,KAAK;;;;;;;;;;CAWd,wBAA4C;AAC1C,MAAI,CAAC,KAAK,mBACR,MAAK,qBAAqB,IAAI,mBAAmB;GAC/C,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;;;;CASd,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,QAAQ,KAAK,OAAO,UAAU;GAC9B,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,KAAe;AACjB,SAAO,KAAK,aAAa;;;;;CAM3B,IAAI,eAAmC;AACrC,SAAO,KAAK,uBAAuB;;;;;CAMrC,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,kBAAgC;AAC9B,MAAI,CAAC,KAAK,aACR,MAAK,eAAe,IAAI,aAAa;GACnC,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,SAAuB;AACzB,SAAO,KAAK,iBAAiB;;;;;CAM/B,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,oBAAoC;AAClC,MAAI,CAAC,KAAK,eACR,MAAK,iBAAiB,IAAI,eAAe;GACvC,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,WAA2B;AAC7B,SAAO,KAAK,mBAAmB;;;;;CAMjC,0BAAgD;AAC9C,MAAI,CAAC,KAAK,qBACR,MAAK,uBAAuB,IAAI,qBAAqB;GACnD,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,iBAAuC;AACzC,SAAO,KAAK,yBAAyB;;;;;CAMvC,sBAAwC;AACtC,MAAI,CAAC,KAAK,iBACR,MAAK,mBAAmB,IAAI,iBAAiB;GAC3C,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,aAA+B;AACjC,SAAO,KAAK,qBAAqB;;;;;CAMnC,uBAA0C;AACxC,MAAI,CAAC,KAAK,kBACR,MAAK,oBAAoB,IAAI,kBAAkB;GAC7C,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,cAAiC;AACnC,SAAO,KAAK,sBAAsB;;;;;CAMpC,0BAAgD;AAC9C,MAAI,CAAC,KAAK,qBACR,MAAK,uBAAuB,IAAI,qBAAqB;GACnD,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,iBAAuC;AACzC,SAAO,KAAK,yBAAyB;;;;;CAMvC,eAA0B;AACxB,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,IAAI,UAAU;GAC7B,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,MAAiB;AACnB,SAAO,KAAK,cAAc;;;;;CAM5B,sBAAwC;AACtC,MAAI,CAAC,KAAK,iBACR,MAAK,mBAAmB,IAAI,iBAAiB;GAC3C,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,aAA+B;AACjC,SAAO,KAAK,qBAAqB;;;;;CAMnC,sBAAwC;AACtC,MAAI,CAAC,KAAK,iBACR,MAAK,mBAAmB,IAAI,iBAAiB;GAC3C,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,aAA+B;AACjC,SAAO,KAAK,qBAAqB;;;;;CAMnC,0BAAgD;AAC9C,MAAI,CAAC,KAAK,qBACR,MAAK,uBAAuB,IAAI,qBAAqB;GACnD,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,iBAAuC;AACzC,SAAO,KAAK,yBAAyB;;;;;CAMvC,mCAAkE;AAChE,MAAI,CAAC,KAAK,8BACR,MAAK,gCAAgC,IAAI,8BAA8B;GACrE,GAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,QAAQ;GACxD,GAAI,KAAK,OAAO,eAAe,EAAE,aAAa,KAAK,OAAO,aAAa;GACxE,CAAC;AAEJ,SAAO,KAAK;;;;;CAMd,IAAI,0BAAyD;AAC3D,SAAO,KAAK,kCAAkC;;;;;CAMhD,UAAgB;AACd,OAAK,UAAU,SAAS;AACxB,OAAK,oBAAoB,SAAS;AAClC,OAAK,WAAW,SAAS;AACzB,OAAK,WAAW,SAAS;AACzB,OAAK,WAAW,SAAS;AACzB,OAAK,cAAc,SAAS;AAC5B,OAAK,WAAW,SAAS;AACzB,OAAK,WAAW,SAAS;AACzB,OAAK,gBAAgB,SAAS;AAC9B,OAAK,sBAAsB,SAAS;AACpC,OAAK,kBAAkB,SAAS;AAChC,OAAK,mBAAmB,SAAS;AACjC,OAAK,sBAAsB,SAAS;AACpC,OAAK,WAAW,SAAS;AACzB,OAAK,kBAAkB,SAAS;AAChC,OAAK,kBAAkB,SAAS;AAChC,OAAK,sBAAsB,SAAS;AACpC,OAAK,+BAA+B,SAAS;;;;;;AAOjD,IAAI,gBAAmC;;;;AAKvC,SAAgB,cAAc,QAAsC;AAClE,KAAI,CAAC,cACH,iBAAgB,IAAI,WAAW,OAAO;AAExC,QAAO;;;;;AAMT,SAAgB,cAAc,SAA2B;AACvD,iBAAgB;;;;;AAMlB,SAAgB,kBAAwB;AACtC,gBAAe,SAAS;AACxB,iBAAgB"}