cdk-local 0.109.0 → 0.110.0

package/README.md

@@ -83,7 +83,7 @@ cdkl invoke MyStack/Fn --from-cfn-stack --assume-role   # ...and run as its depl
 - **`start-api`** serves one HTTP server per API; a bare `start-api` in a multi-stack app needs `--all-stacks` or `--stack <name>`.
 - **`run-task`** / single-replica **`start-service`** publish declared container ports on the host (a privileged port like 80 auto-remaps to a free high host port with a WARN; `--host-port <container>=<host>` pins a specific one). **`start-service`** / **`start-alb`** also list each host URL in a `Service endpoints:` banner after boot so the access URL stays visible.
 - **`start-alb`** stands up the ECS service(s) behind an ALB plus a host-side front-door on each listener port, honoring all six listener-rule conditions, weighted forwards, redirect / fixed-response actions, mixed ECS + Lambda targets, `authenticate-cognito` / `authenticate-oidc` actions (local Bearer-JWT enforcement), and WebSocket `Upgrade` proxying to ECS targets ([details](docs/cli-reference.md#cdkl-start-alb-run-an-alb-fronted-service-locally)).
-- **`start-cloudfront`** serves a CloudFront distribution's `viewer-request` -> origin -> `viewer-response` pipeline locally — CloudFront Functions in-process over an **S3 origin** (BucketDeployment source) or a **Lambda Function URL origin** (the backing Lambda run locally), so a routing / rewrite / SPA-fallback / CDN-fronted-Lambda change is verifiable in seconds. `--origin`, `--tls`, `--watch` ([details](docs/cli-reference.md#cdkl-start-cloudfront-serve-a-cloudfront-distribution-locally)).
+- **`start-cloudfront`** serves a CloudFront distribution's `viewer-request` -> origin -> `viewer-response` pipeline locally — CloudFront Functions in-process over an **S3 origin** (BucketDeployment source) or a **Lambda Function URL origin** (the backing Lambda run locally), with the behavior's **`ResponseHeadersPolicy` CORS** (preflight + response headers) reproduced at the edge, so a routing / rewrite / SPA-fallback / CDN-fronted-Lambda / CORS change is verifiable in seconds. `--origin`, `--tls`, `--watch` ([details](docs/cli-reference.md#cdkl-start-cloudfront-serve-a-cloudfront-distribution-locally)).
 - **`invoke-agentcore`** invokes a Bedrock AgentCore Runtime agent locally — container or `fromCodeAsset` / `fromS3` managed runtime, all four runtime protocols (HTTP and AGUI on 8080, MCP on 8000, A2A on 9000; SSE and WebSocket are HTTP wire-shape variants on the same 8080 container), with `customJwtAuthorizer` and `--sigv4` enforcement ([details](docs/cli-reference.md#cdkl-invoke-agentcore-run-bedrock-agentcore-runtime-agents-locally)).
 - **`studio`** opens a local web console over the same synthesized targets — a point-and-click front over the same CLI runners. Takes no target (it lists them all). Flags + in-UI controls: [Web console — `cdkl studio`](#web-console--cdkl-studio).
 - Non-TTY (CI / pipes): every command except a bare `start-api` needs an explicit target.
@@ -216,7 +216,7 @@ Most CDK ECS apps boot multiple replicas behind an ALB. cdk-local exposes each l
 | ECS services | `start-service` |
 | Cloud Map / Service Connect registry | service discovery between local replicas |
 | ALB-fronted ECS / Lambda services | `start-alb` — HTTP / HTTPS listeners, all six listener-rule conditions, weighted forwards, redirect / fixed-response, mixed ECS + Lambda targets, authenticate-cognito / authenticate-oidc (local Bearer-JWT enforcement), WebSocket Upgrade |
-| CloudFront distributions (S3 + Lambda Function URL origins + CloudFront Functions) | `start-cloudfront` — viewer-request / viewer-response Functions over S3 origin routing (default root object, custom error responses / SPA fallback) and Lambda Function URL origins (backing Lambda run locally), `--tls`, `--watch` |
+| CloudFront distributions (S3 + Lambda Function URL origins + CloudFront Functions) | `start-cloudfront` — viewer-request / viewer-response Functions over S3 origin routing (default root object, custom error responses / SPA fallback) and Lambda Function URL origins (backing Lambda run locally), `ResponseHeadersPolicy` CORS (preflight + response headers), `--tls`, `--watch` |
 | Bedrock AgentCore Runtime agents | `invoke-agentcore` — container + `fromCodeAsset` / `fromS3` artifacts, HTTP / MCP / A2A / AGUI |
 
 Lambda runs on every current AWS Lambda runtime — Node.js (18/20/22/24), Python (3.11–3.14), Ruby (3.2/3.3), Java (8.al2/11/17/21), .NET (6/8), and the OS-only `provided.al2` / `provided.al2023`. The retired `go1.x` runtime is rejected with a pointer to migrate to `provided.al2023`.

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { $ as createLocalRunTaskCommand, C as createLocalListCommand, D as createLocalStartCloudFrontCommand, Qt as createLocalInvokeCommand, W as createLocalStartAlbCommand, X as createLocalStartServiceCommand, a as createLocalStudioCommand, en as createLocalStartApiCommand, kt as createLocalInvokeAgentCoreCommand } from "./local-studio-CxVVLdJw.js";
+import { $ as createLocalRunTaskCommand, C as createLocalListCommand, D as createLocalStartCloudFrontCommand, Qt as createLocalInvokeCommand, W as createLocalStartAlbCommand, X as createLocalStartServiceCommand, a as createLocalStudioCommand, en as createLocalStartApiCommand, kt as createLocalInvokeAgentCoreCommand } from "./local-studio-8hdH7a_R.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.109.0");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.110.0");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalInvokeAgentCoreCommand());
 program.addCommand(createLocalStartApiCommand());

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $t as TargetListing, Ai as LocalStateRecord, Bi as substituteAgainstStateAsync, Ci as createLocalStateProvider, Di as resolveCfnRegion, Ei as resolveCfnFallbackRegion, Fi as CrossStackResolver, Hi as substituteEnvVarsFromStateAsync, I as createLocalStartCloudFrontCommand, Ii as PseudoParameters, Li as StateEnvSubstitutionAudit, M as formatTargetListing, Mi as SsmParameterRef, N as CreateLocalStartCloudFrontCommandOptions, Ni as collectSsmParameterRefs, O as CreateLocalListCommandOptions, Oi as resolveCfnStackName, Pi as resolveSsmParameters, Qt as TargetEntry, Ri as SubstitutionContext, Si as LocalStateSourceOptions, Ti as rejectExplicitCfnStackWithMultipleStacks, Ui as CloudFormationTemplate, Vi as substituteEnvVarsFromState, _i as resetEmbedConfig, bi as LocalStateProviderFactory, di as CreateLocalInvokeCommandOptions, en as countTargets, fn as createLocalStartApiCommand, gi as getEmbedConfig, gr as createLocalInvokeAgentCoreCommand, hi as CdkLocalEmbedConfig, ht as createLocalStartServiceCommand, in as CreateLocalRunTaskCommandOptions, j as createLocalListCommand, ji as ResolvedSsmParameters, k as FormatTargetListingOptions, ki as LocalStateProvider, ln as CreateLocalStartApiCommandOptions, mr as CreateLocalInvokeAgentCoreCommandOptions, on as createLocalRunTaskCommand, pi as createLocalInvokeCommand, pt as CreateLocalStartServiceCommandOptions, s as createLocalStudioCommand, st as CreateLocalStartAlbCommandOptions, t as CreateLocalStudioCommandOptions, tn as listTargets, ut as createLocalStartAlbCommand, vi as setEmbedConfig, wi as isCfnFlagPresent, xi as LocalStateSourceError, yi as ExtraStateProviders, zi as substituteAgainstState } from "./local-studio-DWnKL8m1.js";
+import { $t as TargetListing, Ai as LocalStateRecord, Bi as substituteAgainstStateAsync, Ci as createLocalStateProvider, Di as resolveCfnRegion, Ei as resolveCfnFallbackRegion, Fi as CrossStackResolver, Hi as substituteEnvVarsFromStateAsync, I as createLocalStartCloudFrontCommand, Ii as PseudoParameters, Li as StateEnvSubstitutionAudit, M as formatTargetListing, Mi as SsmParameterRef, N as CreateLocalStartCloudFrontCommandOptions, Ni as collectSsmParameterRefs, O as CreateLocalListCommandOptions, Oi as resolveCfnStackName, Pi as resolveSsmParameters, Qt as TargetEntry, Ri as SubstitutionContext, Si as LocalStateSourceOptions, Ti as rejectExplicitCfnStackWithMultipleStacks, Ui as CloudFormationTemplate, Vi as substituteEnvVarsFromState, _i as resetEmbedConfig, bi as LocalStateProviderFactory, di as CreateLocalInvokeCommandOptions, en as countTargets, fn as createLocalStartApiCommand, gi as getEmbedConfig, gr as createLocalInvokeAgentCoreCommand, hi as CdkLocalEmbedConfig, ht as createLocalStartServiceCommand, in as CreateLocalRunTaskCommandOptions, j as createLocalListCommand, ji as ResolvedSsmParameters, k as FormatTargetListingOptions, ki as LocalStateProvider, ln as CreateLocalStartApiCommandOptions, mr as CreateLocalInvokeAgentCoreCommandOptions, on as createLocalRunTaskCommand, pi as createLocalInvokeCommand, pt as CreateLocalStartServiceCommandOptions, s as createLocalStudioCommand, st as CreateLocalStartAlbCommandOptions, t as CreateLocalStudioCommandOptions, tn as listTargets, ut as createLocalStartAlbCommand, vi as setEmbedConfig, wi as isCfnFlagPresent, xi as LocalStateSourceError, yi as ExtraStateProviders, zi as substituteAgainstState } from "./local-studio-CmriwG6o.js";
 import { CloudFormationClient } from "@aws-sdk/client-cloudformation";
 
 //#region src/local/cfn-local-state-provider.d.ts

package/dist/index.js

@@ -1,4 +1,4 @@
 import { d as setEmbedConfig, l as getEmbedConfig, u as resetEmbedConfig } from "./docker-cmd-GcI_cqY5.js";
-import { $ as createLocalRunTaskCommand, C as createLocalListCommand, Cr as countTargets, D as createLocalStartCloudFrontCommand, Qt as createLocalInvokeCommand, W as createLocalStartAlbCommand, X as createLocalStartServiceCommand, _r as resolveCfnStackName, a as createLocalStudioCommand, br as resolveSsmParameters, cr as substituteAgainstStateAsync, dr as LocalStateSourceError, en as createLocalStartApiCommand, fr as createLocalStateProvider, gr as resolveCfnRegion, hr as resolveCfnFallbackRegion, kt as createLocalInvokeAgentCoreCommand, lr as substituteEnvVarsFromState, mr as rejectExplicitCfnStackWithMultipleStacks, pr as isCfnFlagPresent, sr as substituteAgainstState, ur as substituteEnvVarsFromStateAsync, vr as CfnLocalStateProvider, w as formatTargetListing, wr as listTargets, yr as collectSsmParameterRefs } from "./local-studio-CxVVLdJw.js";
+import { $ as createLocalRunTaskCommand, C as createLocalListCommand, Cr as countTargets, D as createLocalStartCloudFrontCommand, Qt as createLocalInvokeCommand, W as createLocalStartAlbCommand, X as createLocalStartServiceCommand, _r as resolveCfnStackName, a as createLocalStudioCommand, br as resolveSsmParameters, cr as substituteAgainstStateAsync, dr as LocalStateSourceError, en as createLocalStartApiCommand, fr as createLocalStateProvider, gr as resolveCfnRegion, hr as resolveCfnFallbackRegion, kt as createLocalInvokeAgentCoreCommand, lr as substituteEnvVarsFromState, mr as rejectExplicitCfnStackWithMultipleStacks, pr as isCfnFlagPresent, sr as substituteAgainstState, ur as substituteEnvVarsFromStateAsync, vr as CfnLocalStateProvider, w as formatTargetListing, wr as listTargets, yr as collectSsmParameterRefs } from "./local-studio-8hdH7a_R.js";
 
 export { CfnLocalStateProvider, LocalStateSourceError, collectSsmParameterRefs, countTargets, createLocalInvokeAgentCoreCommand, createLocalInvokeCommand, createLocalListCommand, createLocalRunTaskCommand, createLocalStartAlbCommand, createLocalStartApiCommand, createLocalStartCloudFrontCommand, createLocalStartServiceCommand, createLocalStateProvider, createLocalStudioCommand, formatTargetListing, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resetEmbedConfig, resolveCfnFallbackRegion, resolveCfnRegion, resolveCfnStackName, resolveSsmParameters, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync };

package/dist/internal.d.ts

@@ -1,4 +1,4 @@
-import { $ as StaticOriginResult, $n as webSocketApiMatchesIdentifier, $r as resolveAgentCoreTarget, $t as TargetListing, A as addListSpecificOptions, An as verifyJwtAuthorizer, Ar as MCP_PATH, At as addCommonEcsServiceOptions, B as StartedCloudFrontServer, Bn as CorsConfig, Br as invokeAgentCore, Bt as FrontDoorForwardTarget, C as StudioEventBus, Cn as JwksCache, Cr as A2A_CONTAINER_PORT, Ct as PlannedFixedResponseAction, D as StudioTargetKind, Dn as buildJwksUrlFromIssuer, Dr as A2aJsonRpcRequest, Dt as PlannedLambdaForwardTarget, E as StudioServeEvent, En as buildCognitoJwksUrl, Er as A2aInvokeResult, Et as PlannedFrontDoorListener, F as addStartCloudFrontSpecificOptions, Fn as AuthorizerInfo, Fr as mcpInvokeOnce, Ft as parseMaxTasks, G as ResolvedCloudFrontFunction, Gn as matchPreflight, Gr as AGENTCORE_MCP_PROTOCOL, Gt as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, H as startCloudFrontServer, Hn as buildCorsConfigByApiId, Hr as AGENTCORE_A2A_PROTOCOL, Ht as isApplicationLoadBalancer, In as LambdaRequestAuthorizer, Ir as parseSseForJsonRpc, It as parseRestartPolicy, J as isCloudFrontDistribution, Jn as availableWebSocketApiIdentifiers, Jr as AgentCoreCustomClaim, Jt as buildCloudMapIndex, K as ResolvedDistribution, Kn as DiscoveredWebSocketApi, Kr as AGENTCORE_RUNTIME_TYPE, Kt as setShadowReadyTimeoutMs, L as parseOriginOverrides, Ln as LambdaTokenAuthorizer, Lr as AGENTCORE_SESSION_ID_HEADER, Lt as resolveEcsAssumeRoleOption, Mn as AuthorizerCache, Mr as McpInvokeOptions, Mt as addImageOverrideOptions, Nn as CachedAuthorizerResult, Nr as McpInvokeResult, Nt as buildEcsImageResolutionContext, On as createJwksCache, Or as a2aInvokeOnce, Ot as PlannedRedirectAction, P as LocalStartCloudFrontError, Pn as createAuthorizerCache, Pr as McpJsonRpcRequest, Pt as ecsClusterOption, Q as ResolvedCustomErrorResponse, Qn as parseSelectionExpressionPath, Qr as pickAgentCoreCandidateStack, Qt as TargetEntry, R as resolveCloudFrontTarget, Rn as RouteWithAuth, Rr as AgentCoreInvokeResult, Rt as resolveSharedSidecarCredentials, S as createStudioDispatcher, Sn as DiscoveryJwtAuthorizer, Sr as invokeAgentCoreWs, St as PlannedEcsForwardTarget, T as StudioLogEvent, Tn as WarnedAt, Tr as A2aInvokeOptions, Tt as PlannedForwardTarget, U as CLOUDFRONT_DISTRIBUTION_TYPE, Ui as CloudFormationTemplate, Un as buildCorsConfigFromCloudFrontChain, Ur as AGENTCORE_AGUI_PROTOCOL, Ut as resolveAlbFrontDoor, V as matchBehavior, Vn as applyCorsResponseHeaders, Vr as waitForAgentCorePing, Vt as ResolvedListenerAction, W as ResolvedBehavior, Wn as isFunctionUrlOacFronted, Wr as AGENTCORE_HTTP_PROTOCOL, Wt as DEFAULT_SHADOW_READY_TIMEOUT_MS, X as pickTargetFunctionLogicalId, Xn as discoverWebSocketApisOrThrow, Xr as AgentCoreResolutionError, Xt as RegistrationHandle, Y as pickFunctionUrlLogicalIdFromOrigin, Yn as discoverWebSocketApis, Yr as AgentCoreJwtAuthorizer, Yt as CloudMapRegistry, Z as resolveCloudFrontDistribution, Zn as filterWebSocketApisByIdentifiers, Zr as ResolvedAgentCoreRuntime, Zt as ResolvedEcsService, _ as startStudioProxy, _n as StartedApiServer, _r as DockerImageAssetSource, _t as EcsServiceEmulatorOptions, a as coerceServeRequest, ai as ReloadAssetContext, an as addRunTaskSpecificOptions, ar as pickResponseTemplate, at as runViewerRequest, b as StudioRunRequest, bn as CredentialsLoader, br as AgentCoreWsResult, bt as MAX_TASKS_SUBNET_RANGE_CAP, c as resolveServeBaseUrl, ci as FileWatcher, cn as ApiTargetSubset, cr as VtlEvaluationError, ct as addAlbSpecificOptions, d as StudioServeRequest, dn as addStartApiSpecificOptions, dr as resolveWatchConfig, dt as parseLbPortOverrides, ei as ImageResolutionContext, er as DiscoveredRoute, et as serveFromStaticOrigin, f as StudioServeState, fi as addInvokeSpecificOptions, fr as buildStsClientConfig, ft as resolveAlbTarget, g as StudioProxyConfig, gn as ServerState, gt as serviceStrategy, h as RunningStudioProxy, hn as MtlsServerConfig, hr as addInvokeAgentCoreSpecificOptions, i as coerceRunRequest, ii as tryResolveImageFnJoin, ir as evaluateResponseParameters, it as compileCloudFrontFunction, jn as verifyJwtViaDiscovery, jr as MCP_PROTOCOL_VERSION, jt as addEcsAssumeRoleOptions, kn as verifyCognitoJwt, kr as MCP_CONTAINER_PORT, kt as ServiceBoot, l as StudioServeManager, li as FileWatcherOptions, lr as ContainerPool, lt as albStrategy, m as createStudioServeManager, mi as ResolvedArnLambdaLayer, mn as resolveApiTargetSubset, mt as addStartServiceSpecificOptions, n as StudioServeRequestPayload, ni as formatStateRemedy, nn as CdkLocalError, nr as discoverRoutes, nt as CfResponse, o as coerceStopRequest, oi as ReloadVerdict, or as selectIntegrationResponse, ot as runViewerResponse, p as StudioStopRequest, pn as createWatchPredicates, pr as resolveProfileCredentials, q as ResolvedOrigin, qn as WebSocketRouteEntry, qr as AgentCoreCodeArtifact, qt as CloudMapIndex, r as addStudioSpecificOptions, ri as substituteImagePlaceholders, rn as LocalInvokeBuildError, rr as IntegrationResponseEntry, rt as CompiledCloudFrontFunction, si as classifySourceChange, sn as EcsTaskResolutionError, sr as tryParseStatus, ti as derivePseudoParametersFromRegion, tr as RestV1IntegrationConfig, tt as CfRequest, u as StudioServeManagerConfig, ui as createFileWatcher, un as WatchPredicates, ur as CdkWatchConfig, v as StudioDispatchConfig, vn as readMtlsMaterialsFromDisk, vr as EnvOverrideFile, vt as EmulatorStrategy, w as StudioInvocationEvent, wn as JwtCustomClaim, wr as A2A_PATH, wt as PlannedForwardAction, x as StudioRunResult, xn as defaultCredentialsLoader, xr as InvokeAgentCoreWsOptions, xt as PlannedAction, y as StudioDispatcher, yn as startApiServer, yr as resolveEnvVars, yt as FrontDoorPlan, z as LambdaUrlInvokerMap, zn as attachAuthorizers, zr as InvokeAgentCoreOptions, zt as runEcsServiceEmulator } from "./local-studio-DWnKL8m1.js";
+import { $ as StaticOriginResult, $n as webSocketApiMatchesIdentifier, $r as resolveAgentCoreTarget, $t as TargetListing, A as addListSpecificOptions, An as verifyJwtAuthorizer, Ar as MCP_PATH, At as addCommonEcsServiceOptions, B as StartedCloudFrontServer, Bn as CorsConfig, Br as invokeAgentCore, Bt as FrontDoorForwardTarget, C as StudioEventBus, Cn as JwksCache, Cr as A2A_CONTAINER_PORT, Ct as PlannedFixedResponseAction, D as StudioTargetKind, Dn as buildJwksUrlFromIssuer, Dr as A2aJsonRpcRequest, Dt as PlannedLambdaForwardTarget, E as StudioServeEvent, En as buildCognitoJwksUrl, Er as A2aInvokeResult, Et as PlannedFrontDoorListener, F as addStartCloudFrontSpecificOptions, Fn as AuthorizerInfo, Fr as mcpInvokeOnce, Ft as parseMaxTasks, G as ResolvedCloudFrontFunction, Gn as matchPreflight, Gr as AGENTCORE_MCP_PROTOCOL, Gt as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, H as startCloudFrontServer, Hn as buildCorsConfigByApiId, Hr as AGENTCORE_A2A_PROTOCOL, Ht as isApplicationLoadBalancer, In as LambdaRequestAuthorizer, Ir as parseSseForJsonRpc, It as parseRestartPolicy, J as isCloudFrontDistribution, Jn as availableWebSocketApiIdentifiers, Jr as AgentCoreCustomClaim, Jt as buildCloudMapIndex, K as ResolvedDistribution, Kn as DiscoveredWebSocketApi, Kr as AGENTCORE_RUNTIME_TYPE, Kt as setShadowReadyTimeoutMs, L as parseOriginOverrides, Ln as LambdaTokenAuthorizer, Lr as AGENTCORE_SESSION_ID_HEADER, Lt as resolveEcsAssumeRoleOption, Mn as AuthorizerCache, Mr as McpInvokeOptions, Mt as addImageOverrideOptions, Nn as CachedAuthorizerResult, Nr as McpInvokeResult, Nt as buildEcsImageResolutionContext, On as createJwksCache, Or as a2aInvokeOnce, Ot as PlannedRedirectAction, P as LocalStartCloudFrontError, Pn as createAuthorizerCache, Pr as McpJsonRpcRequest, Pt as ecsClusterOption, Q as ResolvedCustomErrorResponse, Qn as parseSelectionExpressionPath, Qr as pickAgentCoreCandidateStack, Qt as TargetEntry, R as resolveCloudFrontTarget, Rn as RouteWithAuth, Rr as AgentCoreInvokeResult, Rt as resolveSharedSidecarCredentials, S as createStudioDispatcher, Sn as DiscoveryJwtAuthorizer, Sr as invokeAgentCoreWs, St as PlannedEcsForwardTarget, T as StudioLogEvent, Tn as WarnedAt, Tr as A2aInvokeOptions, Tt as PlannedForwardTarget, U as CLOUDFRONT_DISTRIBUTION_TYPE, Ui as CloudFormationTemplate, Un as buildCorsConfigFromCloudFrontChain, Ur as AGENTCORE_AGUI_PROTOCOL, Ut as resolveAlbFrontDoor, V as matchBehavior, Vn as applyCorsResponseHeaders, Vr as waitForAgentCorePing, Vt as ResolvedListenerAction, W as ResolvedBehavior, Wn as isFunctionUrlOacFronted, Wr as AGENTCORE_HTTP_PROTOCOL, Wt as DEFAULT_SHADOW_READY_TIMEOUT_MS, X as pickTargetFunctionLogicalId, Xn as discoverWebSocketApisOrThrow, Xr as AgentCoreResolutionError, Xt as RegistrationHandle, Y as pickFunctionUrlLogicalIdFromOrigin, Yn as discoverWebSocketApis, Yr as AgentCoreJwtAuthorizer, Yt as CloudMapRegistry, Z as resolveCloudFrontDistribution, Zn as filterWebSocketApisByIdentifiers, Zr as ResolvedAgentCoreRuntime, Zt as ResolvedEcsService, _ as startStudioProxy, _n as StartedApiServer, _r as DockerImageAssetSource, _t as EcsServiceEmulatorOptions, a as coerceServeRequest, ai as ReloadAssetContext, an as addRunTaskSpecificOptions, ar as pickResponseTemplate, at as runViewerRequest, b as StudioRunRequest, bn as CredentialsLoader, br as AgentCoreWsResult, bt as MAX_TASKS_SUBNET_RANGE_CAP, c as resolveServeBaseUrl, ci as FileWatcher, cn as ApiTargetSubset, cr as VtlEvaluationError, ct as addAlbSpecificOptions, d as StudioServeRequest, dn as addStartApiSpecificOptions, dr as resolveWatchConfig, dt as parseLbPortOverrides, ei as ImageResolutionContext, er as DiscoveredRoute, et as serveFromStaticOrigin, f as StudioServeState, fi as addInvokeSpecificOptions, fr as buildStsClientConfig, ft as resolveAlbTarget, g as StudioProxyConfig, gn as ServerState, gt as serviceStrategy, h as RunningStudioProxy, hn as MtlsServerConfig, hr as addInvokeAgentCoreSpecificOptions, i as coerceRunRequest, ii as tryResolveImageFnJoin, ir as evaluateResponseParameters, it as compileCloudFrontFunction, jn as verifyJwtViaDiscovery, jr as MCP_PROTOCOL_VERSION, jt as addEcsAssumeRoleOptions, kn as verifyCognitoJwt, kr as MCP_CONTAINER_PORT, kt as ServiceBoot, l as StudioServeManager, li as FileWatcherOptions, lr as ContainerPool, lt as albStrategy, m as createStudioServeManager, mi as ResolvedArnLambdaLayer, mn as resolveApiTargetSubset, mt as addStartServiceSpecificOptions, n as StudioServeRequestPayload, ni as formatStateRemedy, nn as CdkLocalError, nr as discoverRoutes, nt as CfResponse, o as coerceStopRequest, oi as ReloadVerdict, or as selectIntegrationResponse, ot as runViewerResponse, p as StudioStopRequest, pn as createWatchPredicates, pr as resolveProfileCredentials, q as ResolvedOrigin, qn as WebSocketRouteEntry, qr as AgentCoreCodeArtifact, qt as CloudMapIndex, r as addStudioSpecificOptions, ri as substituteImagePlaceholders, rn as LocalInvokeBuildError, rr as IntegrationResponseEntry, rt as CompiledCloudFrontFunction, si as classifySourceChange, sn as EcsTaskResolutionError, sr as tryParseStatus, ti as derivePseudoParametersFromRegion, tr as RestV1IntegrationConfig, tt as CfRequest, u as StudioServeManagerConfig, ui as createFileWatcher, un as WatchPredicates, ur as CdkWatchConfig, v as StudioDispatchConfig, vn as readMtlsMaterialsFromDisk, vr as EnvOverrideFile, vt as EmulatorStrategy, w as StudioInvocationEvent, wn as JwtCustomClaim, wr as A2A_PATH, wt as PlannedForwardAction, x as StudioRunResult, xn as defaultCredentialsLoader, xr as InvokeAgentCoreWsOptions, xt as PlannedAction, y as StudioDispatcher, yn as startApiServer, yr as resolveEnvVars, yt as FrontDoorPlan, z as LambdaUrlInvokerMap, zn as attachAuthorizers, zr as InvokeAgentCoreOptions, zt as runEcsServiceEmulator } from "./local-studio-CmriwG6o.js";
 import { WebSocket } from "ws";
 import { IncomingHttpHeaders, IncomingMessage, ServerResponse } from "node:http";
 

package/dist/internal.js

@@ -1,3 +1,3 @@
-import { $n as buildDisconnectEvent, $t as addStartApiSpecificOptions, A as matchBehavior, An as applyCorsResponseHeaders, Ar as webSocketApiMatchesIdentifier, At as invokeAgentCoreWs, B as runViewerRequest, Bn as evaluateResponseParameters, Br as pickAgentCoreCandidateStack, Bt as signAgentCoreInvocation, Cn as verifyJwtViaDiscovery, Ct as DEFAULT_SHADOW_READY_TIMEOUT_MS, Dn as invokeRequestAuthorizer, Dr as discoverWebSocketApisOrThrow, Dt as attachContainerLogStreamer, E as addStartCloudFrontSpecificOptions, En as evaluateCachedLambdaPolicy, Er as discoverWebSocketApis, Et as getContainerNetworkIp, F as isCloudFrontDistribution, Fn as matchRoute, Fr as AGENTCORE_AGUI_PROTOCOL, Ft as MCP_PATH, G as parseLbPortOverrides, Gn as HOST_GATEWAY_MIN_VERSION, Gr as tryResolveImageFnJoin, Gt as SUPPORTED_CODE_RUNTIMES, H as addAlbSpecificOptions, Hn as selectIntegrationResponse, Hr as derivePseudoParametersFromRegion, Ht as invokeAgentCore, I as pickFunctionUrlLogicalIdFromOrigin, In as translateLambdaResponse, Ir as AGENTCORE_HTTP_PROTOCOL, It as MCP_PROTOCOL_VERSION, J as resolveAlbFrontDoor, Jn as ConnectionRegistry, Jr as resolveProfileCredentials, Jt as renderCodeDockerfile, K as resolveAlbTarget, Kn as probeHostGatewaySupport, Kr as LocalInvokeBuildError, Kt as buildAgentCoreCodeImage, L as pickTargetFunctionLogicalId, Ln as applyAuthorizerOverlay, Lr as AGENTCORE_MCP_PROTOCOL, Lt as mcpInvokeOnce, M as serveFromStaticOrigin, Mn as buildCorsConfigFromCloudFrontChain, Mr as pickRefLogicalId, Mt as A2A_PATH, N as serveLambdaUrlOrigin, Nn as isFunctionUrlOacFronted, Nr as resolveLambdaArnIntrinsic, Nt as a2aInvokeOnce, O as parseOriginOverrides, On as invokeTokenAuthorizer, Or as filterWebSocketApisByIdentifiers, Ot as addInvokeAgentCoreSpecificOptions, P as CLOUDFRONT_DISTRIBUTION_TYPE, Pn as matchPreflight, Pr as AGENTCORE_A2A_PROTOCOL, Pt as MCP_CONTAINER_PORT, Q as addRunTaskSpecificOptions, Qn as buildConnectEvent, R as resolveCloudFrontDistribution, Rn as buildHttpApiV2Event, Rr as AGENTCORE_RUNTIME_TYPE, Rt as parseSseForJsonRpc, S as addListSpecificOptions, Sn as verifyJwtAuthorizer, Sr as resolveSingleTarget, St as CloudMapRegistry, T as LocalStartCloudFrontError, Tn as computeRequestIdentityHash, Tr as availableWebSocketApiIdentifiers, Tt as setShadowReadyTimeoutMs, U as albStrategy, Un as tryParseStatus, Ur as formatStateRemedy, Ut as waitForAgentCorePing, V as runViewerResponse, Vn as pickResponseTemplate, Vr as resolveAgentCoreTarget, Vt as AGENTCORE_SESSION_ID_HEADER, Wn as VtlEvaluationError, Wr as substituteImagePlaceholders, Wt as downloadAndExtractS3Bundle, Xn as handleConnectionsRequest, Xt as classifySourceChange, Y as addStartServiceSpecificOptions, Yn as buildMgmtEndpointEnvUrl, Yt as toCmdArgv, Z as serviceStrategy, Zn as parseConnectionsPath, Zt as addInvokeSpecificOptions, _ as startStudioServer, _n as defaultCredentialsLoader, _t as runImageOverrideBuilds, an as attachStageContext, ar as resolveRuntimeImage, at as ecsClusterOption, b as createStudioStore, bn as createJwksCache, bt as listPinnedTargets, c as startStudioProxy, cn as resolveEnvVars, ct as resolveEcsAssumeRoleOption, d as createStudioDispatcher, dn as filterRoutesByApiIdentifiers, dt as ImageOverrideError, er as buildMessageEvent, et as MAX_TASKS_SUBNET_RANGE_CAP, f as filterStudioCustomResources, fn as groupRoutesByServer, ft as buildImageOverrideTag, g as filterStudioTargetGroups, gn as resolveServiceIntegrationParameters, gt as resolveImageOverrides, h as annotatePinnedEcsTargets, hn as resolveSelectionExpression, ht as parseImageOverrideFlags, i as coerceStopRequest, in as createFileWatcher, ir as resolveRuntimeFileExtension, it as buildEcsImageResolutionContext, j as startCloudFrontServer, jn as buildCorsConfigByApiId, jr as discoverRoutes, jt as A2A_CONTAINER_PORT, k as resolveCloudFrontTarget, kn as attachAuthorizers, kr as parseSelectionExpressionPath, l as relayServeRequest, ln as availableApiIdentifiers, lt as resolveSharedSidecarCredentials, m as annotateAlbPinnedBackingServices, mn as startApiServer, mt as mergeForService, n as coerceRunRequest, nn as resolveApiTargetSubset, nr as buildContainerImage, nt as addEcsAssumeRoleOptions, o as resolveServeBaseUrl, on as buildStageMap, or as EcsTaskResolutionError, ot as parseMaxTasks, p as isCustomResourceLambdaTarget, pn as readMtlsMaterialsFromDisk, pt as enforceImageOverrideOrphans, q as isApplicationLoadBalancer, qn as bufferToBody, qr as buildStsClientConfig, qt as computeCodeImageTag, r as coerceServeRequest, rn as createAuthorizerCache, rr as resolveRuntimeCodeMountPath, rt as addImageOverrideOptions, s as createStudioServeManager, sn as materializeLayerFromArn, st as parseRestartPolicy, t as addStudioSpecificOptions, tn as createWatchPredicates, tr as architectureToPlatform, tt as addCommonEcsServiceOptions, u as reinvoke, un as filterRoutesByApiIdentifier, ut as runEcsServiceEmulator, v as toStudioTargetGroups, vn as buildCognitoJwksUrl, vt as describePinnedImageUri, wn as buildMethodArn, wt as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, x as StudioEventBus, xn as verifyCognitoJwt, xr as resolveWatchConfig, xt as buildCloudMapIndex, y as renderStudioHtml, yn as buildJwksUrlFromIssuer, yt as isLocalCdkAssetImage, z as compileCloudFrontFunction, zn as buildRestV1Event, zr as AgentCoreResolutionError, zt as AGENTCORE_SIGV4_SERVICE } from "./local-studio-CxVVLdJw.js";
+import { $n as buildDisconnectEvent, $t as addStartApiSpecificOptions, A as matchBehavior, An as applyCorsResponseHeaders, Ar as webSocketApiMatchesIdentifier, At as invokeAgentCoreWs, B as runViewerRequest, Bn as evaluateResponseParameters, Br as pickAgentCoreCandidateStack, Bt as signAgentCoreInvocation, Cn as verifyJwtViaDiscovery, Ct as DEFAULT_SHADOW_READY_TIMEOUT_MS, Dn as invokeRequestAuthorizer, Dr as discoverWebSocketApisOrThrow, Dt as attachContainerLogStreamer, E as addStartCloudFrontSpecificOptions, En as evaluateCachedLambdaPolicy, Er as discoverWebSocketApis, Et as getContainerNetworkIp, F as isCloudFrontDistribution, Fn as matchRoute, Fr as AGENTCORE_AGUI_PROTOCOL, Ft as MCP_PATH, G as parseLbPortOverrides, Gn as HOST_GATEWAY_MIN_VERSION, Gr as tryResolveImageFnJoin, Gt as SUPPORTED_CODE_RUNTIMES, H as addAlbSpecificOptions, Hn as selectIntegrationResponse, Hr as derivePseudoParametersFromRegion, Ht as invokeAgentCore, I as pickFunctionUrlLogicalIdFromOrigin, In as translateLambdaResponse, Ir as AGENTCORE_HTTP_PROTOCOL, It as MCP_PROTOCOL_VERSION, J as resolveAlbFrontDoor, Jn as ConnectionRegistry, Jr as resolveProfileCredentials, Jt as renderCodeDockerfile, K as resolveAlbTarget, Kn as probeHostGatewaySupport, Kr as LocalInvokeBuildError, Kt as buildAgentCoreCodeImage, L as pickTargetFunctionLogicalId, Ln as applyAuthorizerOverlay, Lr as AGENTCORE_MCP_PROTOCOL, Lt as mcpInvokeOnce, M as serveFromStaticOrigin, Mn as buildCorsConfigFromCloudFrontChain, Mr as pickRefLogicalId, Mt as A2A_PATH, N as serveLambdaUrlOrigin, Nn as isFunctionUrlOacFronted, Nr as resolveLambdaArnIntrinsic, Nt as a2aInvokeOnce, O as parseOriginOverrides, On as invokeTokenAuthorizer, Or as filterWebSocketApisByIdentifiers, Ot as addInvokeAgentCoreSpecificOptions, P as CLOUDFRONT_DISTRIBUTION_TYPE, Pn as matchPreflight, Pr as AGENTCORE_A2A_PROTOCOL, Pt as MCP_CONTAINER_PORT, Q as addRunTaskSpecificOptions, Qn as buildConnectEvent, R as resolveCloudFrontDistribution, Rn as buildHttpApiV2Event, Rr as AGENTCORE_RUNTIME_TYPE, Rt as parseSseForJsonRpc, S as addListSpecificOptions, Sn as verifyJwtAuthorizer, Sr as resolveSingleTarget, St as CloudMapRegistry, T as LocalStartCloudFrontError, Tn as computeRequestIdentityHash, Tr as availableWebSocketApiIdentifiers, Tt as setShadowReadyTimeoutMs, U as albStrategy, Un as tryParseStatus, Ur as formatStateRemedy, Ut as waitForAgentCorePing, V as runViewerResponse, Vn as pickResponseTemplate, Vr as resolveAgentCoreTarget, Vt as AGENTCORE_SESSION_ID_HEADER, Wn as VtlEvaluationError, Wr as substituteImagePlaceholders, Wt as downloadAndExtractS3Bundle, Xn as handleConnectionsRequest, Xt as classifySourceChange, Y as addStartServiceSpecificOptions, Yn as buildMgmtEndpointEnvUrl, Yt as toCmdArgv, Z as serviceStrategy, Zn as parseConnectionsPath, Zt as addInvokeSpecificOptions, _ as startStudioServer, _n as defaultCredentialsLoader, _t as runImageOverrideBuilds, an as attachStageContext, ar as resolveRuntimeImage, at as ecsClusterOption, b as createStudioStore, bn as createJwksCache, bt as listPinnedTargets, c as startStudioProxy, cn as resolveEnvVars, ct as resolveEcsAssumeRoleOption, d as createStudioDispatcher, dn as filterRoutesByApiIdentifiers, dt as ImageOverrideError, er as buildMessageEvent, et as MAX_TASKS_SUBNET_RANGE_CAP, f as filterStudioCustomResources, fn as groupRoutesByServer, ft as buildImageOverrideTag, g as filterStudioTargetGroups, gn as resolveServiceIntegrationParameters, gt as resolveImageOverrides, h as annotatePinnedEcsTargets, hn as resolveSelectionExpression, ht as parseImageOverrideFlags, i as coerceStopRequest, in as createFileWatcher, ir as resolveRuntimeFileExtension, it as buildEcsImageResolutionContext, j as startCloudFrontServer, jn as buildCorsConfigByApiId, jr as discoverRoutes, jt as A2A_CONTAINER_PORT, k as resolveCloudFrontTarget, kn as attachAuthorizers, kr as parseSelectionExpressionPath, l as relayServeRequest, ln as availableApiIdentifiers, lt as resolveSharedSidecarCredentials, m as annotateAlbPinnedBackingServices, mn as startApiServer, mt as mergeForService, n as coerceRunRequest, nn as resolveApiTargetSubset, nr as buildContainerImage, nt as addEcsAssumeRoleOptions, o as resolveServeBaseUrl, on as buildStageMap, or as EcsTaskResolutionError, ot as parseMaxTasks, p as isCustomResourceLambdaTarget, pn as readMtlsMaterialsFromDisk, pt as enforceImageOverrideOrphans, q as isApplicationLoadBalancer, qn as bufferToBody, qr as buildStsClientConfig, qt as computeCodeImageTag, r as coerceServeRequest, rn as createAuthorizerCache, rr as resolveRuntimeCodeMountPath, rt as addImageOverrideOptions, s as createStudioServeManager, sn as materializeLayerFromArn, st as parseRestartPolicy, t as addStudioSpecificOptions, tn as createWatchPredicates, tr as architectureToPlatform, tt as addCommonEcsServiceOptions, u as reinvoke, un as filterRoutesByApiIdentifier, ut as runEcsServiceEmulator, v as toStudioTargetGroups, vn as buildCognitoJwksUrl, vt as describePinnedImageUri, wn as buildMethodArn, wt as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, x as StudioEventBus, xn as verifyCognitoJwt, xr as resolveWatchConfig, xt as buildCloudMapIndex, y as renderStudioHtml, yn as buildJwksUrlFromIssuer, yt as isLocalCdkAssetImage, z as compileCloudFrontFunction, zn as buildRestV1Event, zr as AgentCoreResolutionError, zt as AGENTCORE_SIGV4_SERVICE } from "./local-studio-8hdH7a_R.js";
 
 export { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_HTTP_PROTOCOL, AGENTCORE_MCP_PROTOCOL, AGENTCORE_RUNTIME_TYPE, AGENTCORE_SESSION_ID_HEADER, AGENTCORE_SIGV4_SERVICE, AgentCoreResolutionError, CLOUDFRONT_DISTRIBUTION_TYPE, CloudMapRegistry, ConnectionRegistry, DEFAULT_SHADOW_READY_TIMEOUT_MS, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, ImageOverrideError, LocalInvokeBuildError, LocalStartCloudFrontError, MAX_TASKS_SUBNET_RANGE_CAP, MCP_CONTAINER_PORT, MCP_PATH, MCP_PROTOCOL_VERSION, SOFT_RELOAD_COMPLETION_LOG_SUFFIX, SUPPORTED_CODE_RUNTIMES, StudioEventBus, VtlEvaluationError, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addEcsAssumeRoleOptions, addImageOverrideOptions, addInvokeAgentCoreSpecificOptions, addInvokeSpecificOptions, addListSpecificOptions, addRunTaskSpecificOptions, addStartApiSpecificOptions, addStartCloudFrontSpecificOptions, addStartServiceSpecificOptions, addStudioSpecificOptions, albStrategy, annotateAlbPinnedBackingServices, annotatePinnedEcsTargets, applyAuthorizerOverlay, applyCorsResponseHeaders, architectureToPlatform, attachAuthorizers, attachContainerLogStreamer, attachStageContext, availableApiIdentifiers, availableWebSocketApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCloudMapIndex, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildEcsImageResolutionContext, buildHttpApiV2Event, buildImageOverrideTag, buildJwksUrlFromIssuer, buildMessageEvent, buildMethodArn, buildMgmtEndpointEnvUrl, buildRestV1Event, buildStageMap, buildStsClientConfig, classifySourceChange, coerceRunRequest, coerceServeRequest, coerceStopRequest, compileCloudFrontFunction, computeCodeImageTag, computeRequestIdentityHash, createAuthorizerCache, createFileWatcher, createJwksCache, createStudioDispatcher, createStudioServeManager, createStudioStore, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describePinnedImageUri, discoverRoutes, discoverWebSocketApis, discoverWebSocketApisOrThrow, downloadAndExtractS3Bundle, ecsClusterOption, enforceImageOverrideOrphans, evaluateCachedLambdaPolicy, evaluateResponseParameters, filterRoutesByApiIdentifier, filterRoutesByApiIdentifiers, filterStudioCustomResources, filterStudioTargetGroups, filterWebSocketApisByIdentifiers, formatStateRemedy, getContainerNetworkIp, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, invokeRequestAuthorizer, invokeTokenAuthorizer, isApplicationLoadBalancer, isCloudFrontDistribution, isCustomResourceLambdaTarget, isFunctionUrlOacFronted, isLocalCdkAssetImage, listPinnedTargets, matchBehavior, matchPreflight, matchRoute, materializeLayerFromArn, mcpInvokeOnce, mergeForService, parseConnectionsPath, parseImageOverrideFlags, parseLbPortOverrides, parseMaxTasks, parseOriginOverrides, parseRestartPolicy, parseSelectionExpressionPath, parseSseForJsonRpc, pickAgentCoreCandidateStack, pickFunctionUrlLogicalIdFromOrigin, pickRefLogicalId, pickResponseTemplate, pickTargetFunctionLogicalId, probeHostGatewaySupport, readMtlsMaterialsFromDisk, reinvoke, relayServeRequest, renderCodeDockerfile, renderStudioHtml, resolveAgentCoreTarget, resolveAlbFrontDoor, resolveAlbTarget, resolveApiTargetSubset, resolveCloudFrontDistribution, resolveCloudFrontTarget, resolveEcsAssumeRoleOption, resolveEnvVars, resolveImageOverrides, resolveLambdaArnIntrinsic, resolveProfileCredentials, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSelectionExpression, resolveServeBaseUrl, resolveServiceIntegrationParameters, resolveSharedSidecarCredentials, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, runImageOverrideBuilds, runViewerRequest, runViewerResponse, selectIntegrationResponse, serveFromStaticOrigin, serveLambdaUrlOrigin, serviceStrategy, setShadowReadyTimeoutMs, signAgentCoreInvocation, startApiServer, startCloudFrontServer, startStudioProxy, startStudioServer, substituteImagePlaceholders, toCmdArgv, toStudioTargetGroups, translateLambdaResponse, tryParseStatus, tryResolveImageFnJoin, verifyCognitoJwt, verifyJwtAuthorizer, verifyJwtViaDiscovery, waitForAgentCorePing, webSocketApiMatchesIdentifier };

package/dist/{local-studio-CxVVLdJw.js → local-studio-8hdH7a_R.js}

@@ -11359,6 +11359,34 @@ function buildCorsConfigFromCloudFrontChain(template) {
 	return out;
 }
 /**
+* Resolve one cache behavior's `ResponseHeadersPolicyId` to its CORS config.
+*
+* `start-cloudfront` (cloudfront-resolver) calls this per behavior so the
+* local CloudFront server reproduces the distribution's
+* `AWS::CloudFront::ResponseHeadersPolicy` CORS — answering an OPTIONS
+* preflight and adding `Access-Control-Allow-Origin` to actual responses, the
+* same way CloudFront does at the edge. (The `start-api` path uses
+* {@link buildCorsConfigFromCloudFrontChain}, which is keyed by the fronted
+* Function URL logical id; this is the direct per-behavior form, so a
+* distribution's `CacheBehaviors[]` can each carry their own policy.)
+*
+* Returns undefined unless the value is a `{ Ref: <logicalId> }` to a local
+* `AWS::CloudFront::ResponseHeadersPolicy` whose `CorsConfig` has at least one
+* value-bearing field (an AWS-managed-policy id literal, or a policy with only
+* `SecurityHeadersConfig` / `CustomHeadersConfig`, yields undefined).
+*/
+function resolveResponseHeadersPolicyCors(template, responseHeadersPolicyId) {
+	const rhpId = pickRhpRefLogicalId(responseHeadersPolicyId);
+	if (!rhpId) return void 0;
+	const rhpResource = (template.Resources ?? {})[rhpId];
+	if (!rhpResource || rhpResource.Type !== "AWS::CloudFront::ResponseHeadersPolicy") return;
+	const rhpConfig = (rhpResource.Properties ?? {})["ResponseHeadersPolicyConfig"];
+	if (!rhpConfig || typeof rhpConfig !== "object") return void 0;
+	const corsConfig = rhpConfig["CorsConfig"];
+	if (!corsConfig || typeof corsConfig !== "object" || Array.isArray(corsConfig)) return void 0;
+	return parseCloudFrontCorsConfig(corsConfig);
+}
+/**
 * Determine whether a Function URL (`AWS::Lambda::Url`, identified by its
 * logical id) is fronted by a CloudFront Distribution origin that uses
 * Origin Access Control (OAC) to SIGN origin requests.
@@ -11449,6 +11477,10 @@ function pickFnUrlLogicalIdFromOriginDomainName(value) {
 * ID. CDK 2.x synthesizes this as `{ Ref: <id> }`. Returns undefined
 * for the AWS-managed-policy ID form (literal UUID string) since
 * cdk-local can't fetch those — and for any non-Ref shape.
+*
+* Exported so `start-cloudfront`'s per-behavior resolver
+* (cloudfront-resolver) can resolve a behavior's `ResponseHeadersPolicyId`
+* to its CORS config via {@link resolveResponseHeadersPolicyCors}.
 */
 function pickRhpRefLogicalId(value) {
 	if (!value || typeof value !== "object") return void 0;
@@ -11463,6 +11495,10 @@ function pickRhpRefLogicalId(value) {
 * see `buildCorsConfigFromCloudFrontChain` JSDoc for the field mapping.
 *
 * Returns undefined when every value-bearing field is missing.
+*
+* Exported so `start-cloudfront`'s per-behavior resolver
+* (cloudfront-resolver) can parse a `ResponseHeadersPolicy`'s CORS block;
+* see {@link resolveResponseHeadersPolicyCors}.
 */
 function parseCloudFrontCorsConfig(raw) {
 	const allowOrigins = pickItemsStringArray(raw["AccessControlAllowOrigins"]);
@@ -11568,6 +11604,22 @@ function applyCorsResponseHeaders(res, apiLogicalId, corsConfigByApiId, requestO
 	if (!apiLogicalId) return;
 	const cors = corsConfigByApiId.get(apiLogicalId);
 	if (!cors) return;
+	applyCorsResponseHeadersFromConfig(res, cors, requestOrigin);
+}
+/**
+* Apply actual-response CORS headers from an already-resolved
+* {@link CorsConfig} (no map lookup). The map-keyed
+* {@link applyCorsResponseHeaders} delegates here so the two share one
+* implementation; `start-cloudfront`'s server (cloudfront-server) calls this
+* form directly with the matched behavior's
+* `AWS::CloudFront::ResponseHeadersPolicy` CORS config.
+*
+* No-op when the request has no `Origin` header or the Origin is not in
+* `AllowOrigins` (the browser would block the response anyway; we don't
+* smuggle an unauthorized origin through). See {@link applyCorsResponseHeaders}
+* for the header set + `Vary: Origin` / credentials rationale.
+*/
+function applyCorsResponseHeadersFromConfig(res, cors, requestOrigin) {
 	if (!requestOrigin) return;
 	const originMatch = matchOrigin(requestOrigin, cors.AllowOrigins);
 	if (!originMatch) return;
@@ -11575,8 +11627,9 @@ function applyCorsResponseHeaders(res, apiLogicalId, corsConfigByApiId, requestO
 	res.setHeader("Access-Control-Allow-Origin", allowOrigin);
 	if (allowOrigin !== "*") {
 		const existing = res.getHeader("Vary");
-		if (typeof existing === "string" && existing.length > 0) {
-			if (!existing.split(",").map((t) => t.trim()).some((t) => t.toLowerCase() === "origin")) res.setHeader("Vary", `${existing}, Origin`);
+		const existingStr = Array.isArray(existing) ? existing.join(", ") : typeof existing === "string" ? existing : "";
+		if (existingStr.length > 0) {
+			if (!existingStr.split(",").map((t) => t.trim()).some((t) => t.toLowerCase() === "origin")) res.setHeader("Vary", `${existingStr}, Origin`);
 		} else res.setHeader("Vary", "Origin");
 	}
 	if (cors.AllowCredentials === true) res.setHeader("Access-Control-Allow-Credentials", "true");
@@ -28212,7 +28265,7 @@ function resolveCloudFrontDistribution(args) {
 	const distConfig = (resource.Properties ?? {})["DistributionConfig"];
 	if (!distConfig || typeof distConfig !== "object") throw new Error(`Distribution '${logicalId}' has no DistributionConfig.`);
 	const dc = distConfig;
-	const behaviors = resolveBehaviors(dc, compileDistributionFunctions(template), logicalId);
+	const behaviors = resolveBehaviors(dc, compileDistributionFunctions(template), logicalId, template);
 	const origins = resolveOrigins(dc, template, stack, args.originOverrides ?? /* @__PURE__ */ new Map());
 	const customErrorResponses = resolveCustomErrorResponses(dc);
 	const result = {
@@ -28242,10 +28295,10 @@ function compileDistributionFunctions(template) {
 	}
 	return out;
 }
-function resolveBehaviors(dc, functions, distLogicalId) {
+function resolveBehaviors(dc, functions, distLogicalId, template) {
 	const behaviors = [];
 	const def = dc["DefaultCacheBehavior"];
-	if (def && typeof def === "object") behaviors.push(resolveBehavior(def, void 0, functions, distLogicalId));
+	if (def && typeof def === "object") behaviors.push(resolveBehavior(def, void 0, functions, distLogicalId, template));
 	const extra = Array.isArray(dc["CacheBehaviors"]) ? dc["CacheBehaviors"] : [];
 	for (const b of extra) {
 		if (!b || typeof b !== "object") continue;
@@ -28254,16 +28307,18 @@ function resolveBehaviors(dc, functions, distLogicalId) {
 			getLogger().warn(`Distribution '${distLogicalId}': a cache behavior has no literal PathPattern; cdk-local cannot route it and is skipping it.`);
 			continue;
 		}
-		behaviors.push(resolveBehavior(behavior, behavior["PathPattern"], functions, distLogicalId));
+		behaviors.push(resolveBehavior(behavior, behavior["PathPattern"], functions, distLogicalId, template));
 	}
 	return behaviors;
 }
-function resolveBehavior(behavior, pathPattern, functions, distLogicalId) {
+function resolveBehavior(behavior, pathPattern, functions, distLogicalId, template) {
 	const resolved = {
 		targetOriginId: typeof behavior["TargetOriginId"] === "string" ? behavior["TargetOriginId"] : "",
 		hasLambdaEdge: Array.isArray(behavior["LambdaFunctionAssociations"]) ? behavior["LambdaFunctionAssociations"].length > 0 : false
 	};
 	if (pathPattern !== void 0) resolved.pathPattern = pathPattern;
+	const cors = resolveResponseHeadersPolicyCors(template, behavior["ResponseHeadersPolicyId"]);
+	if (cors) resolved.cors = cors;
 	if (typeof behavior["ViewerProtocolPolicy"] === "string") resolved.viewerProtocolPolicy = behavior["ViewerProtocolPolicy"];
 	const assocs = Array.isArray(behavior["FunctionAssociations"]) ? behavior["FunctionAssociations"] : [];
 	for (const a of assocs) {
@@ -28718,6 +28773,18 @@ async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 		writePlain(res, 404, "No cache behavior matched.\n");
 		return;
 	}
+	if (behavior.cors) {
+		const preflight = matchPreflight({
+			method: req.method ?? "GET",
+			headers: nodeHeadersToRecord(req.headers)
+		}, behavior.cors);
+		if (preflight) {
+			res.statusCode = preflight.statusCode;
+			setHeadersSafely(res, preflight.headers, logger);
+			res.end();
+			return;
+		}
+	}
 	let requestEvent = buildViewerRequestEvent({
 		method: req.method ?? "GET",
 		uri,
@@ -28777,8 +28844,24 @@ async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 	} catch (err) {
 		logger.warn(`Skipping invalid Set-Cookie header(s): ${err instanceof Error ? err.message : String(err)}`);
 	}
+	if (behavior.cors) {
+		const origin = req.headers.origin;
+		applyCorsResponseHeadersFromConfig(res, behavior.cors, typeof origin === "string" ? origin : void 0);
+	}
 	res.end(originResult.body);
 }
+/**
+* Convert Node's `IncomingMessage.headers` (`Record<string, string | string[]>`)
+* to the lowercased `Record<string, string[]>` shape `matchPreflight` expects.
+*/
+function nodeHeadersToRecord(headers) {
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) {
+		if (value === void 0) continue;
+		out[name.toLowerCase()] = Array.isArray(value) ? value : [value];
+	}
+	return out;
+}
 /** Read the full request body into a Buffer. */
 function readRequestBody(req) {
 	return new Promise((resolveBody, rejectBody) => {
@@ -33896,4 +33979,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { createLocalRunTaskCommand as $, buildDisconnectEvent as $n, addStartApiSpecificOptions as $t, matchBehavior as A, applyCorsResponseHeaders as An, webSocketApiMatchesIdentifier as Ar, invokeAgentCoreWs as At, runViewerRequest as B, evaluateResponseParameters as Bn, pickAgentCoreCandidateStack as Br, signAgentCoreInvocation as Bt, createLocalListCommand as C, verifyJwtViaDiscovery as Cn, countTargets as Cr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Ct, createLocalStartCloudFrontCommand as D, invokeRequestAuthorizer as Dn, discoverWebSocketApisOrThrow as Dr, attachContainerLogStreamer as Dt, addStartCloudFrontSpecificOptions as E, evaluateCachedLambdaPolicy as En, discoverWebSocketApis as Er, getContainerNetworkIp as Et, isCloudFrontDistribution as F, matchRoute as Fn, AGENTCORE_AGUI_PROTOCOL as Fr, MCP_PATH as Ft, parseLbPortOverrides as G, HOST_GATEWAY_MIN_VERSION as Gn, tryResolveImageFnJoin as Gr, SUPPORTED_CODE_RUNTIMES as Gt, addAlbSpecificOptions as H, selectIntegrationResponse as Hn, derivePseudoParametersFromRegion as Hr, invokeAgentCore as Ht, pickFunctionUrlLogicalIdFromOrigin as I, translateLambdaResponse as In, AGENTCORE_HTTP_PROTOCOL as Ir, MCP_PROTOCOL_VERSION as It, resolveAlbFrontDoor as J, ConnectionRegistry as Jn, resolveProfileCredentials as Jr, renderCodeDockerfile as Jt, resolveAlbTarget as K, probeHostGatewaySupport as Kn, LocalInvokeBuildError as Kr, buildAgentCoreCodeImage as Kt, pickTargetFunctionLogicalId as L, applyAuthorizerOverlay as Ln, AGENTCORE_MCP_PROTOCOL as Lr, mcpInvokeOnce as Lt, serveFromStaticOrigin as M, buildCorsConfigFromCloudFrontChain as Mn, pickRefLogicalId as Mr, A2A_PATH as Mt, serveLambdaUrlOrigin as N, isFunctionUrlOacFronted as Nn, resolveLambdaArnIntrinsic as Nr, a2aInvokeOnce as Nt, parseOriginOverrides as O, invokeTokenAuthorizer as On, filterWebSocketApisByIdentifiers as Or, addInvokeAgentCoreSpecificOptions as Ot, CLOUDFRONT_DISTRIBUTION_TYPE as P, matchPreflight as Pn, AGENTCORE_A2A_PROTOCOL as Pr, MCP_CONTAINER_PORT as Pt, addRunTaskSpecificOptions as Q, buildConnectEvent as Qn, createLocalInvokeCommand as Qt, resolveCloudFrontDistribution as R, buildHttpApiV2Event as Rn, AGENTCORE_RUNTIME_TYPE as Rr, parseSseForJsonRpc as Rt, addListSpecificOptions as S, verifyJwtAuthorizer as Sn, resolveSingleTarget as Sr, CloudMapRegistry as St, LocalStartCloudFrontError as T, computeRequestIdentityHash as Tn, availableWebSocketApiIdentifiers as Tr, setShadowReadyTimeoutMs as Tt, albStrategy as U, tryParseStatus as Un, formatStateRemedy as Ur, waitForAgentCorePing as Ut, runViewerResponse as V, pickResponseTemplate as Vn, resolveAgentCoreTarget as Vr, AGENTCORE_SESSION_ID_HEADER as Vt, createLocalStartAlbCommand as W, VtlEvaluationError as Wn, substituteImagePlaceholders as Wr, downloadAndExtractS3Bundle as Wt, createLocalStartServiceCommand as X, handleConnectionsRequest as Xn, classifySourceChange as Xt, addStartServiceSpecificOptions as Y, buildMgmtEndpointEnvUrl as Yn, toCmdArgv as Yt, serviceStrategy as Z, parseConnectionsPath as Zn, addInvokeSpecificOptions as Zt, startStudioServer as _, defaultCredentialsLoader as _n, resolveCfnStackName as _r, runImageOverrideBuilds as _t, createLocalStudioCommand as a, attachStageContext as an, resolveRuntimeImage as ar, ecsClusterOption as at, createStudioStore as b, createJwksCache as bn, resolveSsmParameters as br, listPinnedTargets as bt, startStudioProxy as c, resolveEnvVars$1 as cn, substituteAgainstStateAsync as cr, resolveEcsAssumeRoleOption as ct, createStudioDispatcher as d, filterRoutesByApiIdentifiers as dn, LocalStateSourceError as dr, ImageOverrideError as dt, createLocalStartApiCommand as en, buildMessageEvent as er, MAX_TASKS_SUBNET_RANGE_CAP as et, filterStudioCustomResources as f, groupRoutesByServer as fn, createLocalStateProvider as fr, buildImageOverrideTag as ft, filterStudioTargetGroups as g, resolveServiceIntegrationParameters as gn, resolveCfnRegion as gr, resolveImageOverrides as gt, annotatePinnedEcsTargets as h, resolveSelectionExpression as hn, resolveCfnFallbackRegion as hr, parseImageOverrideFlags as ht, coerceStopRequest as i, createFileWatcher as in, resolveRuntimeFileExtension as ir, buildEcsImageResolutionContext$1 as it, startCloudFrontServer as j, buildCorsConfigByApiId as jn, discoverRoutes as jr, A2A_CONTAINER_PORT as jt, resolveCloudFrontTarget as k, attachAuthorizers as kn, parseSelectionExpressionPath as kr, createLocalInvokeAgentCoreCommand as kt, relayServeRequest as l, availableApiIdentifiers as ln, substituteEnvVarsFromState as lr, resolveSharedSidecarCredentials as lt, annotateAlbPinnedBackingServices as m, startApiServer as mn, rejectExplicitCfnStackWithMultipleStacks as mr, mergeForService as mt, coerceRunRequest as n, resolveApiTargetSubset as nn, buildContainerImage as nr, addEcsAssumeRoleOptions as nt, resolveServeBaseUrl as o, buildStageMap as on, EcsTaskResolutionError as or, parseMaxTasks as ot, isCustomResourceLambdaTarget as p, readMtlsMaterialsFromDisk as pn, isCfnFlagPresent as pr, enforceImageOverrideOrphans as pt, isApplicationLoadBalancer as q, bufferToBody as qn, buildStsClientConfig as qr, computeCodeImageTag as qt, coerceServeRequest as r, createAuthorizerCache as rn, resolveRuntimeCodeMountPath as rr, addImageOverrideOptions as rt, createStudioServeManager as s, materializeLayerFromArn as sn, substituteAgainstState as sr, parseRestartPolicy as st, addStudioSpecificOptions as t, createWatchPredicates as tn, architectureToPlatform as tr, addCommonEcsServiceOptions as tt, reinvoke as u, filterRoutesByApiIdentifier as un, substituteEnvVarsFromStateAsync as ur, runEcsServiceEmulator as ut, toStudioTargetGroups as v, buildCognitoJwksUrl as vn, CfnLocalStateProvider as vr, describePinnedImageUri as vt, formatTargetListing as w, buildMethodArn as wn, listTargets as wr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as wt, StudioEventBus as x, verifyCognitoJwt as xn, resolveWatchConfig as xr, buildCloudMapIndex as xt, renderStudioHtml as y, buildJwksUrlFromIssuer as yn, collectSsmParameterRefs as yr, isLocalCdkAssetImage as yt, compileCloudFrontFunction as z, buildRestV1Event as zn, AgentCoreResolutionError as zr, AGENTCORE_SIGV4_SERVICE as zt };
-//# sourceMappingURL=local-studio-CxVVLdJw.js.map
+//# sourceMappingURL=local-studio-8hdH7a_R.js.map