cdk-local 0.103.7 → 0.103.9

package/README.md

@@ -80,7 +80,7 @@ cdkl invoke MyStack/Fn --from-cfn-stack --assume-role   # ...and run as its depl
 ```
 
 - **`start-api`** serves one HTTP server per API; a bare `start-api` in a multi-stack app needs `--all-stacks` or `--stack <name>`.
-- **`run-task`** / single-replica **`start-service`** publish declared container ports on the host (`--host-port <container>=<host>` remaps; handy for privileged ports on macOS). **`start-service`** / **`start-alb`** also list each host URL in a `Service endpoints:` banner after boot so the access URL stays visible.
+- **`run-task`** / single-replica **`start-service`** publish declared container ports on the host (a privileged port like 80 auto-remaps to a free high host port with a WARN; `--host-port <container>=<host>` pins a specific one). **`start-service`** / **`start-alb`** also list each host URL in a `Service endpoints:` banner after boot so the access URL stays visible.
 - **`start-alb`** stands up the ECS service(s) behind an ALB plus a host-side front-door on each listener port, honoring all six listener-rule conditions, weighted forwards, redirect / fixed-response actions, mixed ECS + Lambda targets, `authenticate-cognito` / `authenticate-oidc` actions (local Bearer-JWT enforcement), and WebSocket `Upgrade` proxying to ECS targets ([details](docs/cli-reference.md#cdkl-start-alb-run-an-alb-fronted-service-locally)).
 - **`invoke-agentcore`** invokes a Bedrock AgentCore Runtime agent locally — container or `fromCodeAsset` / `fromS3` managed runtime, all four runtime protocols (HTTP and AGUI on 8080, MCP on 8000, A2A on 9000; SSE and WebSocket are HTTP wire-shape variants on the same 8080 container), with `customJwtAuthorizer` and `--sigv4` enforcement ([details](docs/cli-reference.md#cdkl-invoke-agentcore-run-bedrock-agentcore-runtime-agents-locally)).
 - **`studio`** opens a local web console over the same synthesized targets — a point-and-click front over the same CLI runners. Takes no target (it lists them all). Flags + in-UI controls: [Web console — `cdkl studio`](#web-console--cdkl-studio).
@@ -200,7 +200,7 @@ Most CDK ECS apps boot multiple replicas behind an ALB. cdk-local exposes each l
 **Why the extra flags on the simple case?** The template's `DesiredCount` (typically 3 in production) is honored locally by default, but N replicas can't all bind the same host port — so `start-service` skips host publishing for multi-replica runs and the app is reachable only from inside the `cdkl-svc-` docker network. To get the simple `curl http://127.0.0.1:...` access path:
 
 - `--max-tasks 1` clamps the local replica count to 1 without touching your CDK code.
-- `--host-port <containerPort>=<hostPort>` remaps the container port to a non-privileged host port (macOS Docker Desktop needs `sudo` for ports < 1024).
+- A privileged declared host port (`< 1024`, e.g. 80) is auto-remapped to a free high host port — with a WARN naming the remap — because macOS Docker Desktop refuses to publish privileged ports and a `< 1024` host port needs root. `--host-port <containerPort>=<hostPort>` pins a specific host port instead.
 
 `start-alb` uses the symmetric `--lb-port <listenerPort>=<hostPort>` for privileged listener ports like 80 / 443, and `--tls` (or `--tls-cert` / `--tls-key`) to terminate TLS locally instead of serving the HTTPS listener over plain HTTP (the default). Full resolution model: [docs/cli-reference.md](docs/cli-reference.md#cdkl-start-alb-run-an-alb-fronted-service-locally).
 

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { E as createLocalStartAlbCommand, F as createLocalRunTaskCommand, It as createLocalStartApiCommand, M as createLocalStartServiceCommand, Pt as createLocalInvokeCommand, S as createLocalListCommand, a as createLocalStudioCommand, dt as createLocalInvokeAgentCoreCommand } from "./local-studio-CSMk0ikr.js";
+import { E as createLocalStartAlbCommand, F as createLocalRunTaskCommand, It as createLocalStartApiCommand, M as createLocalStartServiceCommand, Pt as createLocalInvokeCommand, S as createLocalListCommand, a as createLocalStudioCommand, dt as createLocalInvokeAgentCoreCommand } from "./local-studio-BEoOU1Y7.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.103.7");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.103.9");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalInvokeAgentCoreCommand());
 program.addCommand(createLocalStartApiCommand());

package/dist/index.js

@@ -1,4 +1,4 @@
 import { d as setEmbedConfig, l as getEmbedConfig, u as resetEmbedConfig } from "./docker-cmd-GcI_cqY5.js";
-import { $n as resolveCfnStackName, C as formatTargetListing, E as createLocalStartAlbCommand, F as createLocalRunTaskCommand, Gn as substituteEnvVarsFromState, It as createLocalStartApiCommand, Jn as createLocalStateProvider, Kn as substituteEnvVarsFromStateAsync, M as createLocalStartServiceCommand, Pt as createLocalInvokeCommand, Qn as resolveCfnRegion, S as createLocalListCommand, Un as substituteAgainstState, Wn as substituteAgainstStateAsync, Xn as rejectExplicitCfnStackWithMultipleStacks, Yn as isCfnFlagPresent, Zn as resolveCfnFallbackRegion, a as createLocalStudioCommand, ar as countTargets, dt as createLocalInvokeAgentCoreCommand, er as CfnLocalStateProvider, nr as resolveSsmParameters, or as listTargets, qn as LocalStateSourceError, tr as collectSsmParameterRefs } from "./local-studio-CSMk0ikr.js";
+import { $n as resolveCfnStackName, C as formatTargetListing, E as createLocalStartAlbCommand, F as createLocalRunTaskCommand, Gn as substituteEnvVarsFromState, It as createLocalStartApiCommand, Jn as createLocalStateProvider, Kn as substituteEnvVarsFromStateAsync, M as createLocalStartServiceCommand, Pt as createLocalInvokeCommand, Qn as resolveCfnRegion, S as createLocalListCommand, Un as substituteAgainstState, Wn as substituteAgainstStateAsync, Xn as rejectExplicitCfnStackWithMultipleStacks, Yn as isCfnFlagPresent, Zn as resolveCfnFallbackRegion, a as createLocalStudioCommand, ar as countTargets, dt as createLocalInvokeAgentCoreCommand, er as CfnLocalStateProvider, nr as resolveSsmParameters, or as listTargets, qn as LocalStateSourceError, tr as collectSsmParameterRefs } from "./local-studio-BEoOU1Y7.js";
 
 export { CfnLocalStateProvider, LocalStateSourceError, collectSsmParameterRefs, countTargets, createLocalInvokeAgentCoreCommand, createLocalInvokeCommand, createLocalListCommand, createLocalRunTaskCommand, createLocalStartAlbCommand, createLocalStartApiCommand, createLocalStartServiceCommand, createLocalStateProvider, createLocalStudioCommand, formatTargetListing, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resetEmbedConfig, resolveCfnFallbackRegion, resolveCfnRegion, resolveCfnStackName, resolveSsmParameters, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync };

package/dist/internal.js

@@ -1,3 +1,3 @@
-import { $ as runImageOverrideBuilds, $t as defaultCredentialsLoader, A as resolveAlbFrontDoor, An as ConnectionRegistry, Ar as resolveProfileCredentials, At as renderCodeDockerfile, B as buildEcsImageResolutionContext, Bn as resolveRuntimeFileExtension, Bt as createFileWatcher, Cn as pickResponseTemplate, Cr as resolveAgentCoreTarget, Ct as AGENTCORE_SESSION_ID_HEADER, D as parseLbPortOverrides, Dn as HOST_GATEWAY_MIN_VERSION, Dr as tryResolveImageFnJoin, Dt as SUPPORTED_CODE_RUNTIMES, En as VtlEvaluationError, Er as substituteImagePlaceholders, Et as downloadAndExtractS3Bundle, Fn as buildDisconnectEvent, Ft as addStartApiSpecificOptions, G as resolveSharedSidecarCredentials, Gt as availableApiIdentifiers, H as parseMaxTasks, Hn as EcsTaskResolutionError, Ht as buildStageMap, I as MAX_TASKS_SUBNET_RANGE_CAP, In as buildMessageEvent, J as buildImageOverrideTag, Jt as groupRoutesByServer, K as runEcsServiceEmulator, Kt as filterRoutesByApiIdentifier, L as addCommonEcsServiceOptions, Ln as architectureToPlatform, Lt as createWatchPredicates, Mn as handleConnectionsRequest, Mt as classifySourceChange, N as serviceStrategy, Nn as parseConnectionsPath, Nt as addInvokeSpecificOptions, O as resolveAlbTarget, On as probeHostGatewaySupport, Or as LocalInvokeBuildError, Ot as buildAgentCoreCodeImage, P as addRunTaskSpecificOptions, Pn as buildConnectEvent, Q as resolveImageOverrides, Qt as resolveServiceIntegrationParameters, R as addEcsAssumeRoleOptions, Rn as buildContainerImage, Rt as resolveApiTargetSubset, Sn as evaluateResponseParameters, Sr as pickAgentCoreCandidateStack, St as signAgentCoreInvocation, T as albStrategy, Tn as tryParseStatus, Tr as formatStateRemedy, Tt as waitForAgentCorePing, U as parseRestartPolicy, Ut as materializeLayerFromArn, V as ecsClusterOption, Vn as resolveRuntimeImage, Vt as attachStageContext, W as resolveEcsAssumeRoleOption, Wt as resolveEnvVars, X as mergeForService, Xt as startApiServer, Y as enforceImageOverrideOrphans, Yt as readMtlsMaterialsFromDisk, Z as parseImageOverrideFlags, Zt as resolveSelectionExpression, _ as toStudioTargetGroups, _n as matchRoute, _r as AGENTCORE_AGUI_PROTOCOL, _t as MCP_PATH, an as verifyJwtViaDiscovery, at as DEFAULT_SHADOW_READY_TIMEOUT_MS, b as StudioEventBus, bn as buildHttpApiV2Event, br as AGENTCORE_RUNTIME_TYPE, bt as parseSseForJsonRpc, c as startStudioProxy, cn as evaluateCachedLambdaPolicy, cr as discoverWebSocketApis, ct as getContainerNetworkIp, d as createStudioDispatcher, dn as attachAuthorizers, dr as parseSelectionExpressionPath, en as buildCognitoJwksUrl, et as describePinnedImageUri, f as filterStudioCustomResources, fn as applyCorsResponseHeaders, fr as webSocketApiMatchesIdentifier, ft as invokeAgentCoreWs, g as startStudioServer, gn as matchPreflight, gr as AGENTCORE_A2A_PROTOCOL, gt as MCP_CONTAINER_PORT, h as filterStudioTargetGroups, hn as isFunctionUrlOacFronted, hr as resolveLambdaArnIntrinsic, ht as a2aInvokeOnce, i as coerceStopRequest, in as verifyJwtAuthorizer, ir as resolveSingleTarget, it as CloudMapRegistry, j as addStartServiceSpecificOptions, jn as buildMgmtEndpointEnvUrl, jt as toCmdArgv, k as isApplicationLoadBalancer, kn as bufferToBody, kr as buildStsClientConfig, kt as computeCodeImageTag, l as relayServeRequest, ln as invokeRequestAuthorizer, lr as discoverWebSocketApisOrThrow, lt as attachContainerLogStreamer, m as annotatePinnedEcsTargets, mn as buildCorsConfigFromCloudFrontChain, mr as pickRefLogicalId, mt as A2A_PATH, n as coerceRunRequest, nn as createJwksCache, nt as listPinnedTargets, o as resolveServeBaseUrl, on as buildMethodArn, ot as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, p as isCustomResourceLambdaTarget, pn as buildCorsConfigByApiId, pr as discoverRoutes, pt as A2A_CONTAINER_PORT, q as ImageOverrideError, qt as filterRoutesByApiIdentifiers, r as coerceServeRequest, rn as verifyCognitoJwt, rr as resolveWatchConfig, rt as buildCloudMapIndex, s as createStudioServeManager, sn as computeRequestIdentityHash, sr as availableWebSocketApiIdentifiers, st as setShadowReadyTimeoutMs, t as addStudioSpecificOptions, tn as buildJwksUrlFromIssuer, tt as isLocalCdkAssetImage, u as reinvoke, un as invokeTokenAuthorizer, ur as filterWebSocketApisByIdentifiers, ut as addInvokeAgentCoreSpecificOptions, v as renderStudioHtml, vn as translateLambdaResponse, vr as AGENTCORE_HTTP_PROTOCOL, vt as MCP_PROTOCOL_VERSION, w as addAlbSpecificOptions, wn as selectIntegrationResponse, wr as derivePseudoParametersFromRegion, wt as invokeAgentCore, x as addListSpecificOptions, xn as buildRestV1Event, xr as AgentCoreResolutionError, xt as AGENTCORE_SIGV4_SERVICE, y as createStudioStore, yn as applyAuthorizerOverlay, yr as AGENTCORE_MCP_PROTOCOL, yt as mcpInvokeOnce, z as addImageOverrideOptions, zn as resolveRuntimeCodeMountPath, zt as createAuthorizerCache } from "./local-studio-CSMk0ikr.js";
+import { $ as runImageOverrideBuilds, $t as defaultCredentialsLoader, A as resolveAlbFrontDoor, An as ConnectionRegistry, Ar as resolveProfileCredentials, At as renderCodeDockerfile, B as buildEcsImageResolutionContext, Bn as resolveRuntimeFileExtension, Bt as createFileWatcher, Cn as pickResponseTemplate, Cr as resolveAgentCoreTarget, Ct as AGENTCORE_SESSION_ID_HEADER, D as parseLbPortOverrides, Dn as HOST_GATEWAY_MIN_VERSION, Dr as tryResolveImageFnJoin, Dt as SUPPORTED_CODE_RUNTIMES, En as VtlEvaluationError, Er as substituteImagePlaceholders, Et as downloadAndExtractS3Bundle, Fn as buildDisconnectEvent, Ft as addStartApiSpecificOptions, G as resolveSharedSidecarCredentials, Gt as availableApiIdentifiers, H as parseMaxTasks, Hn as EcsTaskResolutionError, Ht as buildStageMap, I as MAX_TASKS_SUBNET_RANGE_CAP, In as buildMessageEvent, J as buildImageOverrideTag, Jt as groupRoutesByServer, K as runEcsServiceEmulator, Kt as filterRoutesByApiIdentifier, L as addCommonEcsServiceOptions, Ln as architectureToPlatform, Lt as createWatchPredicates, Mn as handleConnectionsRequest, Mt as classifySourceChange, N as serviceStrategy, Nn as parseConnectionsPath, Nt as addInvokeSpecificOptions, O as resolveAlbTarget, On as probeHostGatewaySupport, Or as LocalInvokeBuildError, Ot as buildAgentCoreCodeImage, P as addRunTaskSpecificOptions, Pn as buildConnectEvent, Q as resolveImageOverrides, Qt as resolveServiceIntegrationParameters, R as addEcsAssumeRoleOptions, Rn as buildContainerImage, Rt as resolveApiTargetSubset, Sn as evaluateResponseParameters, Sr as pickAgentCoreCandidateStack, St as signAgentCoreInvocation, T as albStrategy, Tn as tryParseStatus, Tr as formatStateRemedy, Tt as waitForAgentCorePing, U as parseRestartPolicy, Ut as materializeLayerFromArn, V as ecsClusterOption, Vn as resolveRuntimeImage, Vt as attachStageContext, W as resolveEcsAssumeRoleOption, Wt as resolveEnvVars, X as mergeForService, Xt as startApiServer, Y as enforceImageOverrideOrphans, Yt as readMtlsMaterialsFromDisk, Z as parseImageOverrideFlags, Zt as resolveSelectionExpression, _ as toStudioTargetGroups, _n as matchRoute, _r as AGENTCORE_AGUI_PROTOCOL, _t as MCP_PATH, an as verifyJwtViaDiscovery, at as DEFAULT_SHADOW_READY_TIMEOUT_MS, b as StudioEventBus, bn as buildHttpApiV2Event, br as AGENTCORE_RUNTIME_TYPE, bt as parseSseForJsonRpc, c as startStudioProxy, cn as evaluateCachedLambdaPolicy, cr as discoverWebSocketApis, ct as getContainerNetworkIp, d as createStudioDispatcher, dn as attachAuthorizers, dr as parseSelectionExpressionPath, en as buildCognitoJwksUrl, et as describePinnedImageUri, f as filterStudioCustomResources, fn as applyCorsResponseHeaders, fr as webSocketApiMatchesIdentifier, ft as invokeAgentCoreWs, g as startStudioServer, gn as matchPreflight, gr as AGENTCORE_A2A_PROTOCOL, gt as MCP_CONTAINER_PORT, h as filterStudioTargetGroups, hn as isFunctionUrlOacFronted, hr as resolveLambdaArnIntrinsic, ht as a2aInvokeOnce, i as coerceStopRequest, in as verifyJwtAuthorizer, ir as resolveSingleTarget, it as CloudMapRegistry, j as addStartServiceSpecificOptions, jn as buildMgmtEndpointEnvUrl, jt as toCmdArgv, k as isApplicationLoadBalancer, kn as bufferToBody, kr as buildStsClientConfig, kt as computeCodeImageTag, l as relayServeRequest, ln as invokeRequestAuthorizer, lr as discoverWebSocketApisOrThrow, lt as attachContainerLogStreamer, m as annotatePinnedEcsTargets, mn as buildCorsConfigFromCloudFrontChain, mr as pickRefLogicalId, mt as A2A_PATH, n as coerceRunRequest, nn as createJwksCache, nt as listPinnedTargets, o as resolveServeBaseUrl, on as buildMethodArn, ot as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, p as isCustomResourceLambdaTarget, pn as buildCorsConfigByApiId, pr as discoverRoutes, pt as A2A_CONTAINER_PORT, q as ImageOverrideError, qt as filterRoutesByApiIdentifiers, r as coerceServeRequest, rn as verifyCognitoJwt, rr as resolveWatchConfig, rt as buildCloudMapIndex, s as createStudioServeManager, sn as computeRequestIdentityHash, sr as availableWebSocketApiIdentifiers, st as setShadowReadyTimeoutMs, t as addStudioSpecificOptions, tn as buildJwksUrlFromIssuer, tt as isLocalCdkAssetImage, u as reinvoke, un as invokeTokenAuthorizer, ur as filterWebSocketApisByIdentifiers, ut as addInvokeAgentCoreSpecificOptions, v as renderStudioHtml, vn as translateLambdaResponse, vr as AGENTCORE_HTTP_PROTOCOL, vt as MCP_PROTOCOL_VERSION, w as addAlbSpecificOptions, wn as selectIntegrationResponse, wr as derivePseudoParametersFromRegion, wt as invokeAgentCore, x as addListSpecificOptions, xn as buildRestV1Event, xr as AgentCoreResolutionError, xt as AGENTCORE_SIGV4_SERVICE, y as createStudioStore, yn as applyAuthorizerOverlay, yr as AGENTCORE_MCP_PROTOCOL, yt as mcpInvokeOnce, z as addImageOverrideOptions, zn as resolveRuntimeCodeMountPath, zt as createAuthorizerCache } from "./local-studio-BEoOU1Y7.js";
 
 export { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_HTTP_PROTOCOL, AGENTCORE_MCP_PROTOCOL, AGENTCORE_RUNTIME_TYPE, AGENTCORE_SESSION_ID_HEADER, AGENTCORE_SIGV4_SERVICE, AgentCoreResolutionError, CloudMapRegistry, ConnectionRegistry, DEFAULT_SHADOW_READY_TIMEOUT_MS, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, ImageOverrideError, LocalInvokeBuildError, MAX_TASKS_SUBNET_RANGE_CAP, MCP_CONTAINER_PORT, MCP_PATH, MCP_PROTOCOL_VERSION, SOFT_RELOAD_COMPLETION_LOG_SUFFIX, SUPPORTED_CODE_RUNTIMES, StudioEventBus, VtlEvaluationError, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addEcsAssumeRoleOptions, addImageOverrideOptions, addInvokeAgentCoreSpecificOptions, addInvokeSpecificOptions, addListSpecificOptions, addRunTaskSpecificOptions, addStartApiSpecificOptions, addStartServiceSpecificOptions, addStudioSpecificOptions, albStrategy, annotatePinnedEcsTargets, applyAuthorizerOverlay, applyCorsResponseHeaders, architectureToPlatform, attachAuthorizers, attachContainerLogStreamer, attachStageContext, availableApiIdentifiers, availableWebSocketApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCloudMapIndex, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildEcsImageResolutionContext, buildHttpApiV2Event, buildImageOverrideTag, buildJwksUrlFromIssuer, buildMessageEvent, buildMethodArn, buildMgmtEndpointEnvUrl, buildRestV1Event, buildStageMap, buildStsClientConfig, classifySourceChange, coerceRunRequest, coerceServeRequest, coerceStopRequest, computeCodeImageTag, computeRequestIdentityHash, createAuthorizerCache, createFileWatcher, createJwksCache, createStudioDispatcher, createStudioServeManager, createStudioStore, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describePinnedImageUri, discoverRoutes, discoverWebSocketApis, discoverWebSocketApisOrThrow, downloadAndExtractS3Bundle, ecsClusterOption, enforceImageOverrideOrphans, evaluateCachedLambdaPolicy, evaluateResponseParameters, filterRoutesByApiIdentifier, filterRoutesByApiIdentifiers, filterStudioCustomResources, filterStudioTargetGroups, filterWebSocketApisByIdentifiers, formatStateRemedy, getContainerNetworkIp, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, invokeRequestAuthorizer, invokeTokenAuthorizer, isApplicationLoadBalancer, isCustomResourceLambdaTarget, isFunctionUrlOacFronted, isLocalCdkAssetImage, listPinnedTargets, matchPreflight, matchRoute, materializeLayerFromArn, mcpInvokeOnce, mergeForService, parseConnectionsPath, parseImageOverrideFlags, parseLbPortOverrides, parseMaxTasks, parseRestartPolicy, parseSelectionExpressionPath, parseSseForJsonRpc, pickAgentCoreCandidateStack, pickRefLogicalId, pickResponseTemplate, probeHostGatewaySupport, readMtlsMaterialsFromDisk, reinvoke, relayServeRequest, renderCodeDockerfile, renderStudioHtml, resolveAgentCoreTarget, resolveAlbFrontDoor, resolveAlbTarget, resolveApiTargetSubset, resolveEcsAssumeRoleOption, resolveEnvVars, resolveImageOverrides, resolveLambdaArnIntrinsic, resolveProfileCredentials, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSelectionExpression, resolveServeBaseUrl, resolveServiceIntegrationParameters, resolveSharedSidecarCredentials, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, runImageOverrideBuilds, selectIntegrationResponse, serviceStrategy, setShadowReadyTimeoutMs, signAgentCoreInvocation, startApiServer, startStudioProxy, startStudioServer, substituteImagePlaceholders, toCmdArgv, toStudioTargetGroups, translateLambdaResponse, tryParseStatus, tryResolveImageFnJoin, verifyCognitoJwt, verifyJwtAuthorizer, verifyJwtViaDiscovery, waitForAgentCorePing, webSocketApiMatchesIdentifier };

package/dist/{local-studio-CSMk0ikr.js → local-studio-BEoOU1Y7.js}

@@ -20647,6 +20647,24 @@ async function runEcsTask(task, options, state) {
 		state.network = await createTaskNetwork(netCreateOpts);
 	}
 	const volumeByName = await realizeDockerVolumes(task.volumes, state);
+	let effectiveHostPortOverrides = options.hostPortOverrides;
+	let autoRemappedContainerPorts;
+	if (!options.skipHostPortPublish) {
+		const remaps = await resolvePrivilegedHostPortRemaps({
+			task,
+			userOverrides: options.hostPortOverrides,
+			ephemeralPorts: new Set(options.ephemeralPublishContainerPorts ?? []),
+			allocate: options.allocateHostPort ?? pickFreePort
+		});
+		const remapKeys = Object.keys(remaps);
+		if (remapKeys.length > 0) {
+			effectiveHostPortOverrides = {
+				...options.hostPortOverrides,
+				...remaps
+			};
+			autoRemappedContainerPorts = new Set(remapKeys.map(Number));
+		}
+	}
 	const dockerCmds = /* @__PURE__ */ new Map();
 	for (const container of task.containers) {
 		const image = imagePlan.get(container.name);
@@ -20665,7 +20683,8 @@ async function runEcsTask(task, options, state) {
 			region: options.region,
 			sidecarIp: state.network.sidecarIp,
 			...options.skipHostPortPublish ? { skipHostPortPublish: true } : {},
-			...options.hostPortOverrides ? { hostPortOverrides: options.hostPortOverrides } : {},
+			...effectiveHostPortOverrides ? { hostPortOverrides: effectiveHostPortOverrides } : {},
+			...autoRemappedContainerPorts ? { autoRemappedContainerPorts } : {},
 			...options.ephemeralPublishContainerPorts && options.ephemeralPublishContainerPorts.length > 0 ? { ephemeralPublishContainerPorts: options.ephemeralPublishContainerPorts } : {},
 			...options.addHostFlags && options.addHostFlags.length > 0 ? { addHostFlags: options.addHostFlags } : {},
 			...(options.networkAliasesByContainer?.get(container.name)?.length ?? 0) > 0 ? { networkAliases: options.networkAliasesByContainer.get(container.name) } : {},
@@ -20992,6 +21011,51 @@ function parseHostPortOverrides(values) {
 	return out;
 }
 /**
+* Issue #357 — auto-remap privileged declared host ports to free high host
+* ports so `docker run` never tries to publish e.g. `127.0.0.1:80:80`.
+*
+* For each container port whose DECLARED host port (`hostPort ?? containerPort`)
+* is privileged (`< 1024`), is NOT already pinned by a user `--host-port`
+* override, and is NOT an ephemeral front-door port, a free high host port is
+* allocated and recorded as an additional override. A loud WARN names the remap
+* and the `--host-port` escape hatch so the change is never silent. The
+* returned map is keyed by containerPort and meant to be merged OVER the user
+* overrides (which always win).
+*
+* Why: macOS Docker Desktop rejects publishing a privileged host port through
+* the `com.docker.vmnetd` helper, and a `< 1024` host port needs root on Linux
+* — so a single-replica `start-service` / `run-task` / `start-alb` publish of a
+* task definition that declares container port 80 used to fail at `docker run`.
+* Remapping makes it work out of the box; the user can still pin a specific
+* (even privileged) port with `--host-port`.
+*
+* Pure except for the injected `allocate` (a free-host-port finder). Callers
+* skip this entirely when host-port publishing is suppressed (multi-replica).
+* One remap per containerPort (the override map is flat / keyed by container
+* port), matching the existing `--host-port` semantics.
+*
+* Applied automatically by `runEcsTask`; exported (no leading underscore) so the
+* unit tests can assert the remap decisions directly with an injected allocator.
+*/
+async function resolvePrivilegedHostPortRemaps(opts) {
+	const { task, userOverrides, ephemeralPorts, allocate } = opts;
+	const remaps = {};
+	const seen = /* @__PURE__ */ new Set();
+	for (const container of task.containers) for (const pm of container.portMappings) {
+		const cp = pm.containerPort;
+		if (seen.has(cp)) continue;
+		if (ephemeralPorts.has(cp)) continue;
+		if (userOverrides && userOverrides[cp] !== void 0) continue;
+		const declaredHostPort = pm.hostPort ?? cp;
+		if (declaredHostPort >= 1024) continue;
+		seen.add(cp);
+		const freePort = await allocate();
+		remaps[cp] = freePort;
+		getLogger().child("ecs").warn(`Container '${container.name}' container port ${cp} declares a privileged host port ${declaredHostPort}, which cannot be published locally (macOS Docker Desktop rejects privileged-port publishing; a host port < 1024 needs root). Auto-remapped to host port ${freePort}. Pass --host-port ${cp}=<hostPort> to pin a specific host port.`);
+	}
+	return remaps;
+}
+/**
 * Build the full `docker run -d` argument list for one container.
 * Exported (no-leading-underscore) so the unit tests can assert against
 * the shape directly without spawning a process.
@@ -21019,7 +21083,7 @@ function buildDockerRunArgs(opts) {
 		const declaredHostPort = pm.hostPort ?? pm.containerPort;
 		const hostPort = opts.hostPortOverrides?.[pm.containerPort] ?? declaredHostPort;
 		const overridden = hostPort !== declaredHostPort;
-		const overrideNote = overridden ? " (--host-port override)" : "";
+		const overrideNote = opts.autoRemappedContainerPorts?.has(pm.containerPort) ?? false ? " (privileged-port auto-remap)" : overridden ? " (--host-port override)" : "";
 		getLogger().child("ecs").info(`Container '${container.name}' container port ${pm.containerPort} published on ${containerHost}:${hostPort}${overrideNote}. Reach it at ${containerHost}:${hostPort}.`);
 		args.push("-p", `${containerHost}:${hostPort}:${pm.containerPort}/${pm.protocol}`);
 		publishedEndpoints.push({
@@ -28249,6 +28313,15 @@ const OPTION_SPECS = {
 			flag: "--no-verify-auth",
 			kind: "boolean",
 			label: "Disable auth guard"
+		},
+		{
+			flag: "--env-vars",
+			kind: "env-kv",
+			label: "Env vars",
+			sep: "=",
+			leftPlaceholder: "KEY",
+			rightPlaceholder: "value",
+			help: "Overlay the backing ECS task container env vars — add KEY=VALUE rows or paste a JSON object."
 		}
 	],
 	agentcore: [
@@ -28288,20 +28361,32 @@ const OPTION_SPECS = {
 			help: "Overlay container env vars — add KEY=VALUE rows or paste a JSON object."
 		}
 	],
-	ecs: [{
-		flag: "--max-tasks",
-		kind: "scalar",
-		label: "Max replicas",
-		placeholder: "1",
-		inputType: "number"
-	}, {
-		flag: "--host-port",
-		kind: "repeat-pair",
-		label: "Container port publish",
-		sep: "=",
-		leftPlaceholder: "containerPort",
-		rightPlaceholder: "hostPort"
-	}]
+	ecs: [
+		{
+			flag: "--max-tasks",
+			kind: "scalar",
+			label: "Max replicas",
+			placeholder: "1",
+			inputType: "number"
+		},
+		{
+			flag: "--host-port",
+			kind: "repeat-pair",
+			label: "Container port publish",
+			sep: "=",
+			leftPlaceholder: "containerPort",
+			rightPlaceholder: "hostPort"
+		},
+		{
+			flag: "--env-vars",
+			kind: "env-kv",
+			label: "Env vars",
+			sep: "=",
+			leftPlaceholder: "KEY",
+			rightPlaceholder: "value",
+			help: "Overlay the task container env vars — add KEY=VALUE rows or paste a JSON object."
+		}
+	]
 };
 /** True when `value` is a non-empty trimmed string. */
 function nonEmptyStr(value) {
@@ -31438,10 +31523,24 @@ function createStudioServeManager(config) {
 	const proxyFactory = config.proxyFactory ?? startStudioProxy;
 	const captureRequests = config.captureRequests ?? true;
 	const entries = /* @__PURE__ */ new Map();
-	/** Close every capture proxy fronting `e` (best-effort; idempotent). */
+	/**
+	* Release every per-serve resource fronting `e` (best-effort; idempotent):
+	* its capture proxies (slice C2) and the `--env-vars` temp dir (issue #355).
+	* Called at every teardown path so neither a proxy socket nor the env file
+	* leaks when a serve stops / errors / times out.
+	*/
 	async function closeProxies(e) {
 		const proxies = e.proxies.splice(0);
 		await Promise.all(proxies.map((p) => p.close().catch(() => void 0)));
+		if (e.envDir) {
+			try {
+				rmSync(e.envDir, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+			delete e.envDir;
+		}
 	}
 	function publicState(e) {
 		const s = {
@@ -31468,7 +31567,7 @@ function createStudioServeManager(config) {
 		if (message !== void 0) ev.message = message;
 		config.bus.emit("serve", ev);
 	}
-	function buildArgs(req, spec) {
+	function buildArgs(req, spec, envFile) {
 		const preferAssembly = config.watch !== true;
 		return [
 			spec.command,
@@ -31476,6 +31575,7 @@ function createStudioServeManager(config) {
 			...spec.portArgs,
 			...buildSharedChildArgs(config, { preferAssembly }),
 			...buildPerRunArgs(req.kind, req.options),
+			...envFile ? ["--env-vars", envFile] : [],
 			...req.imageOverride && req.imageOverride.trim() !== "" ? ["--image-override", req.targetId + "=" + req.imageOverride.trim()] : [],
 			...config.watch === true ? ["--watch"] : [],
 			...tokenizeRawArgs(req.rawArgs)
@@ -31487,10 +31587,23 @@ function createStudioServeManager(config) {
 		const existing = entries.get(req.targetId);
 		if (existing && existing.status !== "stopped" && existing.status !== "error") throw new Error(`'${req.targetId}' is already running.`);
 		const startedAt = clock();
+		let envDir;
+		const envVars = resolveEnvVars(req.kind, req.options);
+		if (envVars) {
+			envDir = mkdtempSync(join(tmpdir(), "cdkl-studio-env-"));
+			writeFileSync(join(envDir, "env-vars.json"), JSON.stringify(envVars));
+		}
+		const envFile = envDir ? join(envDir, "env-vars.json") : void 0;
 		let child;
 		try {
-			child = spawnFn(nodeBin, [config.cliEntry, ...buildArgs(req, spec)], { cwd });
+			child = spawnFn(nodeBin, [config.cliEntry, ...buildArgs(req, spec, envFile)], { cwd });
 		} catch (err) {
+			if (envDir) try {
+				rmSync(envDir, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
 			throw err instanceof Error ? err : new Error(String(err));
 		}
 		const entry = {
@@ -31503,6 +31616,7 @@ function createStudioServeManager(config) {
 			proxies: []
 		};
 		if (child.pid !== void 0) entry.pid = child.pid;
+		if (envDir) entry.envDir = envDir;
 		if (req.kind === "ecs") {
 			const hp = req.options?.["--host-port"];
 			if (Array.isArray(hp)) {
@@ -32120,4 +32234,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { runImageOverrideBuilds as $, resolveCfnStackName as $n, defaultCredentialsLoader as $t, resolveAlbFrontDoor as A, ConnectionRegistry as An, resolveProfileCredentials as Ar, renderCodeDockerfile as At, buildEcsImageResolutionContext$1 as B, resolveRuntimeFileExtension as Bn, createFileWatcher as Bt, formatTargetListing as C, pickResponseTemplate as Cn, resolveAgentCoreTarget as Cr, AGENTCORE_SESSION_ID_HEADER as Ct, parseLbPortOverrides as D, HOST_GATEWAY_MIN_VERSION as Dn, tryResolveImageFnJoin as Dr, SUPPORTED_CODE_RUNTIMES as Dt, createLocalStartAlbCommand as E, VtlEvaluationError as En, substituteImagePlaceholders as Er, downloadAndExtractS3Bundle as Et, createLocalRunTaskCommand as F, buildDisconnectEvent as Fn, addStartApiSpecificOptions as Ft, resolveSharedSidecarCredentials as G, substituteEnvVarsFromState as Gn, availableApiIdentifiers as Gt, parseMaxTasks as H, EcsTaskResolutionError as Hn, buildStageMap as Ht, MAX_TASKS_SUBNET_RANGE_CAP as I, buildMessageEvent as In, createLocalStartApiCommand as It, buildImageOverrideTag as J, createLocalStateProvider as Jn, groupRoutesByServer as Jt, runEcsServiceEmulator as K, substituteEnvVarsFromStateAsync as Kn, filterRoutesByApiIdentifier as Kt, addCommonEcsServiceOptions as L, architectureToPlatform as Ln, createWatchPredicates as Lt, createLocalStartServiceCommand as M, handleConnectionsRequest as Mn, classifySourceChange as Mt, serviceStrategy as N, parseConnectionsPath as Nn, addInvokeSpecificOptions as Nt, resolveAlbTarget as O, probeHostGatewaySupport as On, LocalInvokeBuildError as Or, buildAgentCoreCodeImage as Ot, addRunTaskSpecificOptions as P, buildConnectEvent as Pn, createLocalInvokeCommand as Pt, resolveImageOverrides as Q, resolveCfnRegion as Qn, resolveServiceIntegrationParameters as Qt, addEcsAssumeRoleOptions as R, buildContainerImage as Rn, resolveApiTargetSubset as Rt, createLocalListCommand as S, evaluateResponseParameters as Sn, pickAgentCoreCandidateStack as Sr, signAgentCoreInvocation as St, albStrategy as T, tryParseStatus as Tn, formatStateRemedy as Tr, waitForAgentCorePing as Tt, parseRestartPolicy as U, substituteAgainstState as Un, materializeLayerFromArn as Ut, ecsClusterOption as V, resolveRuntimeImage as Vn, attachStageContext as Vt, resolveEcsAssumeRoleOption as W, substituteAgainstStateAsync as Wn, resolveEnvVars$1 as Wt, mergeForService as X, rejectExplicitCfnStackWithMultipleStacks as Xn, startApiServer as Xt, enforceImageOverrideOrphans as Y, isCfnFlagPresent as Yn, readMtlsMaterialsFromDisk as Yt, parseImageOverrideFlags as Z, resolveCfnFallbackRegion as Zn, resolveSelectionExpression as Zt, toStudioTargetGroups as _, matchRoute as _n, AGENTCORE_AGUI_PROTOCOL as _r, MCP_PATH as _t, createLocalStudioCommand as a, verifyJwtViaDiscovery as an, countTargets as ar, DEFAULT_SHADOW_READY_TIMEOUT_MS as at, StudioEventBus as b, buildHttpApiV2Event as bn, AGENTCORE_RUNTIME_TYPE as br, parseSseForJsonRpc as bt, startStudioProxy as c, evaluateCachedLambdaPolicy as cn, discoverWebSocketApis as cr, getContainerNetworkIp as ct, createStudioDispatcher as d, attachAuthorizers as dn, parseSelectionExpressionPath as dr, createLocalInvokeAgentCoreCommand as dt, buildCognitoJwksUrl as en, CfnLocalStateProvider as er, describePinnedImageUri as et, filterStudioCustomResources as f, applyCorsResponseHeaders as fn, webSocketApiMatchesIdentifier as fr, invokeAgentCoreWs as ft, startStudioServer as g, matchPreflight as gn, AGENTCORE_A2A_PROTOCOL as gr, MCP_CONTAINER_PORT as gt, filterStudioTargetGroups as h, isFunctionUrlOacFronted as hn, resolveLambdaArnIntrinsic as hr, a2aInvokeOnce as ht, coerceStopRequest as i, verifyJwtAuthorizer as in, resolveSingleTarget as ir, CloudMapRegistry as it, addStartServiceSpecificOptions as j, buildMgmtEndpointEnvUrl as jn, toCmdArgv as jt, isApplicationLoadBalancer as k, bufferToBody as kn, buildStsClientConfig as kr, computeCodeImageTag as kt, relayServeRequest as l, invokeRequestAuthorizer as ln, discoverWebSocketApisOrThrow as lr, attachContainerLogStreamer as lt, annotatePinnedEcsTargets as m, buildCorsConfigFromCloudFrontChain as mn, pickRefLogicalId as mr, A2A_PATH as mt, coerceRunRequest as n, createJwksCache as nn, resolveSsmParameters as nr, listPinnedTargets as nt, resolveServeBaseUrl as o, buildMethodArn as on, listTargets as or, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as ot, isCustomResourceLambdaTarget as p, buildCorsConfigByApiId as pn, discoverRoutes as pr, A2A_CONTAINER_PORT as pt, ImageOverrideError as q, LocalStateSourceError as qn, filterRoutesByApiIdentifiers as qt, coerceServeRequest as r, verifyCognitoJwt as rn, resolveWatchConfig as rr, buildCloudMapIndex as rt, createStudioServeManager as s, computeRequestIdentityHash as sn, availableWebSocketApiIdentifiers as sr, setShadowReadyTimeoutMs as st, addStudioSpecificOptions as t, buildJwksUrlFromIssuer as tn, collectSsmParameterRefs as tr, isLocalCdkAssetImage as tt, reinvoke as u, invokeTokenAuthorizer as un, filterWebSocketApisByIdentifiers as ur, addInvokeAgentCoreSpecificOptions as ut, renderStudioHtml as v, translateLambdaResponse as vn, AGENTCORE_HTTP_PROTOCOL as vr, MCP_PROTOCOL_VERSION as vt, addAlbSpecificOptions as w, selectIntegrationResponse as wn, derivePseudoParametersFromRegion as wr, invokeAgentCore as wt, addListSpecificOptions as x, buildRestV1Event as xn, AgentCoreResolutionError as xr, AGENTCORE_SIGV4_SERVICE as xt, createStudioStore as y, applyAuthorizerOverlay as yn, AGENTCORE_MCP_PROTOCOL as yr, mcpInvokeOnce as yt, addImageOverrideOptions as z, resolveRuntimeCodeMountPath as zn, createAuthorizerCache as zt };
-//# sourceMappingURL=local-studio-CSMk0ikr.js.map
+//# sourceMappingURL=local-studio-BEoOU1Y7.js.map