cdk-local 0.118.1 → 0.119.0

package/dist/{local-studio-Downi4pd.js → local-studio-DPEUB-rH.js}

@@ -34,6 +34,9 @@ import { SignatureV4 } from "@smithy/signature-v4";
 import graphlib from "graphlib";
 import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 import * as vm from "node:vm";
+import "@aws-sdk/signature-v4a";
+import { CloudFrontClient, paginateListKeyValueStores } from "@aws-sdk/client-cloudfront";
+import { CloudFrontKeyValueStoreClient, GetKeyCommand, ResourceNotFoundException } from "@aws-sdk/client-cloudfront-keyvaluestore";
 import { EventEmitter } from "node:events";
 
 //#region src/cli/options.ts
@@ -28095,6 +28098,92 @@ function addAlbSpecificOptions(cmd) {
 	return cmd.addOption(new Option("--lb-port <listenerPort=hostPort...>", "Bind the local front-door on a specific host port (e.g. 80=8080); repeatable. Default: host port == ALB listener port. Use this on macOS to remap a privileged listener port (< 1024) to a non-privileged host port.")).addOption(new Option("--tls", "Terminate TLS locally for cloud-HTTPS listeners. Default: a cloud-HTTPS listener is served over plain HTTP locally (X-Forwarded-Proto: https is preserved so the upstream app still sees the deployed listener protocol). Implied by --tls-cert / --tls-key. Use this when local-dev cookies need Secure / SameSite=None, when the upstream app inspects TLS metadata, or for mTLS / SNI testing — otherwise plain HTTP is friendlier (no self-signed cert warnings in curl / browser).")).addOption(new Option("--tls-cert <path>", "PEM-encoded server certificate for HTTPS front-door listeners. Implies --tls. Must be set together with --tls-key. Pass --tls alone (without --tls-cert / --tls-key) to auto-generate a self-signed cert (cached under $XDG_CACHE_HOME/cdk-local/alb-https/, default ~/.cache/cdk-local/alb-https/); requires openssl on PATH. The deployed Listener Certificates[] are NOT fetched (ACM private keys are not retrievable by design). The auto-generated cert lists DNS:localhost,IP:127.0.0.1 as SubjectAltName, so a client validating a non-loopback --container-host will fail the SAN check — pass --tls-cert / --tls-key with a SAN covering that host instead.")).addOption(new Option("--tls-key <path>", "PEM-encoded server private key matching --tls-cert. Implies --tls. Must be set together with --tls-cert.")).addOption(new Option("--no-verify-auth", "Disable local enforcement of authenticate-cognito / authenticate-oidc actions. Every request is served as if the auth check passed. Useful for local dev where you do not want to mint a Bearer token at all.")).addOption(new Option("--bearer-token <jwt>", "Default Bearer JWT this command INJECTS only when an inbound request has none (the default-when-missing role) — `cdkl start-alb` is the local ALB front-door RECEIVING outside-in requests, so this token is the fallback the front-door slots in as Authorization: Bearer <jwt> if the caller did not already supply one. Verified against the same JWKS / OIDC discovery URL the deployed ALB would (signature + iss + aud + exp). Cookie pass-through (AWSELBAuthSessionCookie-*) also bypasses the guard. Contrast with `cdkl invoke-agentcore --bearer-token`, where the role is reversed — that command is the outbound client and ALWAYS presents this token (the supplier).")).addOption(new Option("--watch", "Hot-reload: re-synth + per-replica reload of every ECS service behind the ALB when the CDK source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). A per-firing classifier picks the per-replica primitive: source-only edits on interpreted-language handlers (Node/Python/Ruby/shell) take a bind-mount FAST PATH (`docker cp` the new source into each replica + `docker restart`; no rebuild, front-door pool entry unchanged since the IP/port are preserved). Dockerfile / dependency manifest / compiled-language source / ambiguous edits fall through to the rebuild rolling primitive — boot a shadow under a bumped generation suffix, wait for its container port to accept a TCP connection, atomically register it in the front-door pool, then drop the old entry and retire the old container. Either path rolls one replica at a time, so a continuous external request stream against the listener port sees zero connection refusals across the reload. The host front-door (TLS, JWKS cache, Lambda-target containers, listener sockets) stays up across the reload. Lambda target groups behind the ALB are a no-op on reload (the warm RIE container keeps its boot-time image). Off by default; existing replica(s) keep serving when synth fails mid-reload.").default(false));
 }
 
+//#endregion
+//#region src/local/cloudfront-kvs.ts
+/** Build a `cf` module backed by the resolved data sources for one function. */
+function createCloudFrontModule(sources) {
+	return { kvs(kvsId) {
+		return makeHandle(pickSource(sources, kvsId));
+	} };
+}
+/**
+* The `cf` module bound when a function calls `cf.kvs()` but no KeyValueStore
+* binding was resolved (no `--from-cfn-stack`, no covering `--kvs-file`). The
+* handle is returned successfully so a top-level `cf.kvs()` call does not throw
+* at module-eval; the actionable error surfaces when the function actually
+* reads a key.
+*/
+function createUnboundCloudFrontModule(functionLogicalId) {
+	const fail = () => Promise.reject(/* @__PURE__ */ new Error(`CloudFront Function '${functionLogicalId}' reads from a KeyValueStore (cf.kvs()), but no KeyValueStore binding is available locally. Pass --from-cfn-stack to read the deployed store, or --kvs-file <id>=<file.json> to back it with a local JSON map.`));
+	const handle = {
+		get: () => fail(),
+		exists: () => fail(),
+		meta: () => fail(),
+		count: () => fail()
+	};
+	return { kvs: () => handle };
+}
+function pickSource(sources, kvsId) {
+	if (sources.length === 0) throw new Error("cf.kvs(): no KeyValueStore is associated with this function.");
+	if (kvsId === void 0) return sources[0];
+	const byId = sources.find((s) => s.kvsId === kvsId);
+	if (byId) return byId;
+	if (sources.length === 1) return sources[0];
+	throw new Error(`cf.kvs('${kvsId}'): no associated KeyValueStore matches this id locally (associated: ${sources.map((s) => s.kvsId ?? s.label).join(", ")}).`);
+}
+function makeHandle(source) {
+	return {
+		async get(key, options) {
+			const value = await source.getValue(key);
+			if (value === void 0) throw new Error(`cf.kvs().get('${key}'): key not found in ${source.label}.`);
+			if (options?.format === "json") try {
+				return JSON.parse(value);
+			} catch (err) {
+				throw new Error(`cf.kvs().get('${key}', { format: 'json' }): value is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			return value;
+		},
+		async exists(key) {
+			return await source.getValue(key) !== void 0;
+		},
+		meta() {
+			return Promise.reject(/* @__PURE__ */ new Error("cf.kvs().meta() is not reproduced locally by cdkl start-cloudfront (only get / exists are supported)."));
+		},
+		count() {
+			return Promise.reject(/* @__PURE__ */ new Error("cf.kvs().count() is not reproduced locally by cdkl start-cloudfront (only get / exists are supported)."));
+		}
+	};
+}
+/**
+* Build a {@link KvsDataSource} from a local JSON file (the `--kvs-file
+* <id>=<file.json>` escape hatch). The file is a flat `{ "key": "value" }`
+* object; non-string values are JSON-stringified (KVS values are always
+* strings). Read once at construction (boot time); a `--watch` reload rebuilds
+* it.
+*/
+function createLocalFileKvsDataSource(args) {
+	let raw;
+	try {
+		raw = readFileSync(args.filePath, "utf-8");
+	} catch (err) {
+		throw new Error(`--kvs-file '${args.id}=${args.filePath}': could not read the file: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		throw new Error(`--kvs-file '${args.id}=${args.filePath}': not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`--kvs-file '${args.id}=${args.filePath}': expected a JSON object of key -> value entries.`);
+	const map = /* @__PURE__ */ new Map();
+	for (const [key, value] of Object.entries(parsed)) map.set(key, typeof value === "string" ? value : JSON.stringify(value));
+	return {
+		label: `file:${args.filePath}`,
+		kvsId: args.id,
+		getValue: (key) => Promise.resolve(map.get(key))
+	};
+}
+
 //#endregion
 //#region src/local/cloudfront-function-runtime.ts
 /**
@@ -28109,21 +28198,49 @@ function addAlbSpecificOptions(cmd) {
 const FUNCTION_TIMEOUT_MS = 5e3;
 const EVENT_GLOBAL = "__cfEvent";
 /**
+* Regex matching the canonical CloudFront-Functions 2.0 KeyValueStore import
+* line (`import cf from 'cloudfront';`). The module is default-imported under a
+* single binding name; this is the only `cloudfront` import form the runtime
+* supports. Anchored per-line (`m` flag) so only the import statement is
+* matched, not a substring elsewhere.
+*/
+const CLOUDFRONT_IMPORT_RE = /^[ \t]*import\s+(\w+)\s+from\s+['"]cloudfront['"]\s*;?[ \t]*$/m;
+/**
+* Strip the `import cf from 'cloudfront'` statement from a 2.0 function's code
+* and return the binding name, so the code compiles as a plain `vm.Script`
+* (an `import` statement is invalid outside an ES module) and the `cloudfront`
+* module can be injected as the binding-named sandbox global instead. Returns
+* the code unchanged with no binding name when the function does not import
+* `cloudfront`. The matched line is blanked (not deleted) so error line numbers
+* still line up with the source.
+*/
+function stripCloudFrontImport(code) {
+	const match = CLOUDFRONT_IMPORT_RE.exec(code);
+	if (!match) return { code };
+	return {
+		code: code.replace(CLOUDFRONT_IMPORT_RE, ""),
+		bindingName: match[1]
+	};
+}
+/**
 * Compile a CloudFront Function's inline code once. Throws a clear error when
 * the code has a syntax error or declares no `handler` (surfaced at boot so a
 * malformed function never silently no-ops at request time).
 */
 function compileCloudFrontFunction(logicalId, code, runtime) {
+	const { code: source, bindingName } = stripCloudFrontImport(code);
 	let script;
 	try {
-		script = new vm.Script(`${code}\n;handler(${EVENT_GLOBAL})`, { filename: `cloudfront-function-${logicalId}.js` });
+		script = new vm.Script(`${source}\n;handler(${EVENT_GLOBAL})`, { filename: `cloudfront-function-${logicalId}.js` });
 	} catch (err) {
 		throw new Error(`CloudFront Function '${logicalId}' failed to compile: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	let hasHandler;
 	try {
-		const probeContext = vm.createContext({ console });
-		hasHandler = new vm.Script(`${code}\n;typeof handler === 'function'`).runInContext(probeContext, { timeout: FUNCTION_TIMEOUT_MS });
+		const probeGlobals = { console };
+		if (bindingName) probeGlobals[bindingName] = createUnboundCloudFrontModule(logicalId);
+		const probeContext = vm.createContext(probeGlobals);
+		hasHandler = new vm.Script(`${source}\n;typeof handler === 'function'`).runInContext(probeContext, { timeout: FUNCTION_TIMEOUT_MS });
 	} catch (err) {
 		throw new Error(`CloudFront Function '${logicalId}' failed to compile: ${err instanceof Error ? err.message : String(err)}`);
 	}
@@ -28131,7 +28248,8 @@ function compileCloudFrontFunction(logicalId, code, runtime) {
 	return {
 		logicalId,
 		runtime,
-		script
+		script,
+		...bindingName !== void 0 && { cloudfrontBindingName: bindingName }
 	};
 }
 /**
@@ -28142,10 +28260,12 @@ function compileCloudFrontFunction(logicalId, code, runtime) {
 * thrown by the handler is wrapped with the function's logical id.
 */
 async function invokeCloudFrontFunction(fn, event) {
-	const context = vm.createContext({
+	const sandbox = {
 		console,
 		[EVENT_GLOBAL]: event
-	});
+	};
+	if (fn.cloudfrontBindingName) sandbox[fn.cloudfrontBindingName] = fn.cloudfrontModule ?? createUnboundCloudFrontModule(fn.logicalId);
+	const context = vm.createContext(sandbox);
 	let result;
 	try {
 		result = fn.script.runInContext(context, { timeout: FUNCTION_TIMEOUT_MS });
@@ -28379,11 +28499,55 @@ function compileDistributionFunctions(template) {
 			continue;
 		}
 		const config = props["FunctionConfig"];
-		const runtime = config && typeof config === "object" && typeof config["Runtime"] === "string" ? config["Runtime"] : "cloudfront-js-1.0";
-		out.set(logicalId, compileCloudFrontFunction(logicalId, code, runtime));
+		const configObj = config && typeof config === "object" ? config : {};
+		const compiled = compileCloudFrontFunction(logicalId, code, typeof configObj["Runtime"] === "string" ? configObj["Runtime"] : "cloudfront-js-1.0");
+		const kvsAssociations = extractKvsAssociations(configObj);
+		if (kvsAssociations.length > 0) compiled.kvsAssociations = kvsAssociations;
+		out.set(logicalId, compiled);
 	}
 	return out;
 }
+/**
+* Extract a function's `FunctionConfig.KeyValueStoreAssociations[]` into the
+* compiled-function carrier, pre-resolving each association's KVS resource
+* logical id from the `KeyValueStoreARN` intrinsic so the command layer can
+* bind it (deployed store under `--from-cfn-stack`, or a `--kvs-file` map).
+*/
+function extractKvsAssociations(functionConfig) {
+	const raw = Array.isArray(functionConfig["KeyValueStoreAssociations"]) ? functionConfig["KeyValueStoreAssociations"] : [];
+	const out = [];
+	for (const entry of raw) {
+		if (!entry || typeof entry !== "object") continue;
+		const arnValue = entry["KeyValueStoreARN"];
+		if (arnValue === void 0) continue;
+		const kvsLogicalId = pickKvsLogicalIdFromArn(arnValue);
+		out.push({
+			arnValue,
+			...kvsLogicalId !== void 0 && { kvsLogicalId }
+		});
+	}
+	return out;
+}
+/**
+* Unwrap a `KeyValueStoreARN` value to the `AWS::CloudFront::KeyValueStore`
+* logical id when it is an intrinsic reference to a same-template store. CDK /
+* CloudFormation synthesize it as `Fn::GetAtt[<Kvs>, 'Arn']`, a `Ref`, or
+* `Fn::Sub: '${<Kvs>.Arn}'`. Returns `undefined` for a literal ARN string (an
+* imported / out-of-stack store).
+*/
+function pickKvsLogicalIdFromArn(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const obj = value;
+	const getAtt = obj["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && getAtt.length === 2 && typeof getAtt[0] === "string") return getAtt[0];
+	if (typeof obj["Ref"] === "string") return obj["Ref"];
+	const sub = obj["Fn::Sub"];
+	const subTemplate = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+	if (typeof subTemplate === "string") {
+		const match = /^\$\{([A-Za-z0-9]+)(?:\.[A-Za-z0-9]+)?\}$/.exec(subTemplate.trim());
+		if (match) return match[1];
+	}
+}
 function resolveBehaviors(dc, functions, distLogicalId, template) {
 	const behaviors = [];
 	const def = dc["DefaultCacheBehavior"];
@@ -29073,6 +29237,130 @@ function listen(server, host, port) {
 	});
 }
 
+//#endregion
+//#region src/local/cloudfront-kvs-client.ts
+/**
+* Build a {@link KvsDataSource} backed by the deployed store's `GetKey` API.
+* A missing key resolves to `undefined` (the `ResourceNotFoundException` is
+* caught) so the `cf` shim can surface a clean "key not found" — any other
+* error (access denied, throttling) propagates so the user sees the real cause.
+*/
+function createDeployedKvsDataSource(options) {
+	const client = new CloudFrontKeyValueStoreClient({
+		region: options.region ?? "us-east-1",
+		...options.credentials !== void 0 && { credentials: options.credentials }
+	});
+	return {
+		label: `deployed:${options.kvsArn}`,
+		...options.kvsId !== void 0 && { kvsId: options.kvsId },
+		async getValue(key) {
+			try {
+				return (await client.send(new GetKeyCommand({
+					KvsARN: options.kvsArn,
+					Key: key
+				}))).Value;
+			} catch (err) {
+				if (isKeyNotFound(err)) return void 0;
+				throw new Error(`cf.kvs().get('${key}') against ${options.kvsArn} failed: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}
+	};
+}
+/**
+* Resolve a deployed KeyValueStore's ARN (+ Id) from its NAME via the
+* CloudFront control-plane `ListKeyValueStores` API. Needed because
+* `--from-cfn-stack` reads the store's physical id from `ListStackResources`,
+* and for `AWS::CloudFront::KeyValueStore` that physical id is the store NAME
+* (the `Ref` value) — NOT the ARN. The data-plane `GetKey` needs the ARN (which
+* embeds the store's UUID Id), so we look the name up against the account's
+* stores. CloudFront is global, so the client defaults to `us-east-1`. Returns
+* `undefined` on any miss (no match, access denied) so the caller falls back to
+* the unbound-KVS warning.
+*/
+async function resolveDeployedKvsArnByName(name, options = {}) {
+	const client = new CloudFrontClient({
+		region: options.region ?? "us-east-1",
+		...options.credentials !== void 0 && { credentials: options.credentials }
+	});
+	try {
+		for await (const page of paginateListKeyValueStores({ client }, {})) for (const item of page.KeyValueStoreList?.Items ?? []) if (item.Name === name && item.ARN) return {
+			arn: item.ARN,
+			...item.Id !== void 0 && { id: item.Id }
+		};
+	} catch (err) {
+		getLogger().debug(`ListKeyValueStores lookup for '${name}' failed: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+/** True when a GetKey error means the key (or store) was not found, not a real failure. */
+function isKeyNotFound(err) {
+	if (err instanceof ResourceNotFoundException) return true;
+	if (err && typeof err === "object") {
+		if (err.name === "ResourceNotFoundException") return true;
+		if (err.$metadata?.httpStatusCode === 404) return true;
+	}
+	return false;
+}
+
+//#endregion
+//#region src/local/cloudfront-kvs-binding.ts
+/**
+* Build + attach the `cf` module to every KVS-reading function in the
+* distribution. Returns boot warnings for associations that resolved to no
+* binding (the runtime then injects an unbound module so the read fails with a
+* clear actionable error). Idempotent per call — overwrites
+* `cloudfrontModule` so a `--watch` reload rebinds.
+*/
+async function resolveKvsModulesForDistribution(distribution, options) {
+	const warnings = [];
+	for (const fn of collectKvsFunctions(distribution)) {
+		const sources = [];
+		for (const assoc of fn.kvsAssociations ?? []) {
+			const source = await buildSourceForAssociation(assoc, options);
+			if (source) sources.push(source);
+			else {
+				const ref = assoc.kvsLogicalId ?? "<store>";
+				warnings.push(`CloudFront Function '${fn.logicalId}' reads KeyValueStore '${ref}', but no binding resolved it — cf.kvs() reads will fail. Pass --from-cfn-stack to read the deployed store, or --kvs-file ${ref}=<file.json> for a local map.`);
+			}
+		}
+		if (sources.length > 0) fn.cloudfrontModule = createCloudFrontModule(sources);
+		else delete fn.cloudfrontModule;
+	}
+	return { warnings };
+}
+/** Collect the unique compiled functions in the distribution that read a KVS. */
+function collectKvsFunctions(distribution) {
+	const byLogicalId = /* @__PURE__ */ new Map();
+	for (const behavior of distribution.behaviors) for (const fn of [behavior.viewerRequest, behavior.viewerResponse]) if (fn && fn.kvsAssociations && fn.kvsAssociations.length > 0) byLogicalId.set(fn.logicalId, fn);
+	return [...byLogicalId.values()];
+}
+async function buildSourceForAssociation(assoc, options) {
+	if (assoc.kvsLogicalId !== void 0) {
+		const filePath = options.kvsFiles?.get(assoc.kvsLogicalId);
+		if (filePath !== void 0) return createLocalFileKvsDataSource({
+			id: assoc.kvsLogicalId,
+			filePath
+		});
+	}
+	if (typeof assoc.arnValue === "string" && assoc.arnValue.startsWith("arn:")) return makeDeployedSource(assoc.arnValue, idFromArn(assoc.arnValue), options);
+	if (assoc.kvsLogicalId !== void 0 && options.resolveDeployedKvs) {
+		const ref = await options.resolveDeployedKvs(assoc.kvsLogicalId);
+		if (ref) return makeDeployedSource(ref.arn, ref.id, options);
+	}
+}
+function makeDeployedSource(arn, id, options) {
+	return createDeployedKvsDataSource({
+		kvsArn: arn,
+		...id !== void 0 && { kvsId: id },
+		...options.region !== void 0 && { region: options.region },
+		...options.credentials !== void 0 && { credentials: options.credentials }
+	});
+}
+/** The KeyValueStore Id is the ARN's last `/`-segment. */
+function idFromArn(arn) {
+	const slash = arn.lastIndexOf("/");
+	return slash >= 0 && slash < arn.length - 1 ? arn.slice(slash + 1) : void 0;
+}
+
 //#endregion
 //#region src/cli/commands/local-start-cloudfront.ts
 /** Error thrown by `cdkl start-cloudfront` for target / option problems. */
@@ -29097,6 +29385,55 @@ function parseOriginOverrides(values) {
 	return out;
 }
 /**
+* Parse the repeatable `--kvs-file <kvsLogicalId>=<file.json>` overrides into a
+* map. Each entry backs a CloudFront Function's `cf.kvs()` reads with a local
+* JSON map instead of the deployed store — the AWS-free escape hatch for KVS,
+* symmetric with `--origin <id>=<dir>`. The key is the
+* `AWS::CloudFront::KeyValueStore` resource logical id (surfaced in the
+* unbound-KVS boot warning when missing).
+*/
+function parseKvsFileOverrides(values) {
+	const out = /* @__PURE__ */ new Map();
+	for (const raw of values ?? []) {
+		const eq = raw.indexOf("=");
+		if (eq <= 0 || eq === raw.length - 1) throw new LocalStartCloudFrontError(`Invalid --kvs-file '${raw}'. Expected <kvsLogicalId>=<file.json> (e.g. MyKvsStore=./kvs.json).`);
+		out.set(raw.slice(0, eq).trim(), raw.slice(eq + 1).trim());
+	}
+	return out;
+}
+/**
+* Resolve + attach the `cf` KeyValueStore module to every KVS-reading
+* CloudFront Function in the distribution (run after each synth, initial +
+* `--watch` reload). A `--kvs-file` map wins; otherwise `--from-cfn-stack`
+* resolves the deployed store's ARN from state and `cf.kvs().get()` reads it
+* via the `GetKey` API. Unresolved associations log an actionable WARN (the
+* runtime then fails the read with the same guidance).
+*/
+async function attachKvsModules(distribution, stacks, options, profileCredentials, logger) {
+	const kvsFiles = parseKvsFileOverrides(options.kvsFile);
+	const synthRegion = stacks.find((s) => s.stackName === distribution.stackName)?.region;
+	const resolveDeployedKvs = isCfnFlagPresent(options) ? async (kvsLogicalId) => {
+		const provider = createLocalStateProvider(options, distribution.stackName, synthRegion);
+		if (!provider) return void 0;
+		const physicalId = (await provider.load(distribution.stackName, synthRegion))?.resources[kvsLogicalId]?.physicalId;
+		if (!physicalId) return void 0;
+		if (physicalId.startsWith("arn:")) {
+			const id = idFromArn(physicalId);
+			return {
+				arn: physicalId,
+				...id !== void 0 && { id }
+			};
+		}
+		return resolveDeployedKvsArnByName(physicalId, { ...profileCredentials !== void 0 && { credentials: profileCredentials } });
+	} : void 0;
+	const { warnings } = await resolveKvsModulesForDistribution(distribution, {
+		...kvsFiles.size > 0 && { kvsFiles },
+		...resolveDeployedKvs !== void 0 && { resolveDeployedKvs },
+		...profileCredentials !== void 0 && { credentials: profileCredentials }
+	});
+	for (const warning of warnings) logger.warn(warning);
+}
+/**
 * Resolve a CloudFront target string (`Stack/Path` display path or
 * `Stack:LogicalId`) to its stack + `AWS::CloudFront::Distribution` logical id.
 * Mirrors the ALB / ECS resolver target grammar.
@@ -29241,6 +29578,7 @@ async function localStartCloudFrontCommand(target, options) {
 		...options.profile !== void 0 && { profile: options.profile },
 		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
 	};
+	await attachKvsModules(initial.distribution, initial.stacks, options, profileCredentials, logger);
 	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, {
 		containerHost: options.host,
 		skipPull: options.pull === false,
@@ -29280,6 +29618,7 @@ async function localStartCloudFrontCommand(target, options) {
 					try {
 						const reloaded = await synthAndResolve();
 						warnUnsupported(reloaded.distribution);
+						await attachKvsModules(reloaded.distribution, reloaded.stacks, options, profileCredentials, logger);
 						server.update(reloaded.distribution);
 						logger.info("Reload complete.");
 					} catch (err) {
@@ -29333,7 +29672,7 @@ function createLocalStartCloudFrontCommand(opts = {}) {
 * `cmd`.
 */
 function addStartCloudFrontSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind a Lambda Function URL origin's backing Lambda to a deployed CloudFormation stack so its env vars resolve to the deployed physical IDs / exports (ListStackResources). Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs. No effect on a pure-S3 distribution.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's deployed execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
+	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <kvsLogicalId=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is the AWS::CloudFront::KeyValueStore resource logical id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind a Lambda Function URL origin's backing Lambda to a deployed CloudFormation stack so its env vars resolve to the deployed physical IDs / exports (ListStackResources). Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs. No effect on a pure-S3 distribution.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's deployed execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
@@ -34368,5 +34707,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { addRunTaskSpecificOptions as $, buildConnectEvent as $n, createLocalInvokeCommand as $t, resolveCloudFrontTarget as A, attachAuthorizers as An, parseSelectionExpressionPath as Ar, createLocalInvokeAgentCoreCommand as At, compileCloudFrontFunction as B, buildRestV1Event as Bn, AgentCoreResolutionError as Br, AGENTCORE_SIGV4_SERVICE as Bt, addListSpecificOptions as C, verifyJwtAuthorizer as Cn, resolveSingleTarget as Cr, CloudMapRegistry as Ct, addStartCloudFrontSpecificOptions as D, evaluateCachedLambdaPolicy as Dn, discoverWebSocketApis as Dr, getContainerNetworkIp as Dt, LocalStartCloudFrontError as E, computeRequestIdentityHash as En, availableWebSocketApiIdentifiers as Er, setShadowReadyTimeoutMs as Et, CLOUDFRONT_DISTRIBUTION_TYPE as F, matchPreflight as Fn, AGENTCORE_A2A_PROTOCOL as Fr, MCP_CONTAINER_PORT as Ft, createLocalStartAlbCommand as G, VtlEvaluationError as Gn, substituteImagePlaceholders as Gr, downloadAndExtractS3Bundle as Gt, runViewerResponse as H, pickResponseTemplate as Hn, resolveAgentCoreTarget as Hr, AGENTCORE_SESSION_ID_HEADER as Ht, isCloudFrontDistribution as I, matchRoute as In, AGENTCORE_AGUI_PROTOCOL as Ir, MCP_PATH as It, isApplicationLoadBalancer as J, bufferToBody as Jn, buildStsClientConfig as Jr, computeCodeImageTag as Jt, parseLbPortOverrides as K, HOST_GATEWAY_MIN_VERSION as Kn, tryResolveImageFnJoin as Kr, SUPPORTED_CODE_RUNTIMES as Kt, pickFunctionUrlLogicalIdFromOrigin as L, translateLambdaResponse as Ln, AGENTCORE_HTTP_PROTOCOL as Lr, MCP_PROTOCOL_VERSION as Lt, startCloudFrontServer as M, buildCorsConfigByApiId as Mn, discoverRoutes as Mr, A2A_CONTAINER_PORT as Mt, serveFromStaticOrigin as N, buildCorsConfigFromCloudFrontChain as Nn, pickRefLogicalId as Nr, A2A_PATH as Nt, createLocalStartCloudFrontCommand as O, invokeRequestAuthorizer as On, discoverWebSocketApisOrThrow as Or, attachContainerLogStreamer as Ot, serveLambdaUrlOrigin as P, isFunctionUrlOacFronted as Pn, resolveLambdaArnIntrinsic as Pr, a2aInvokeOnce as Pt, serviceStrategy as Q, parseConnectionsPath as Qn, addInvokeSpecificOptions as Qt, pickTargetFunctionLogicalId as R, applyAuthorizerOverlay as Rn, AGENTCORE_MCP_PROTOCOL as Rr, mcpInvokeOnce as Rt, StudioEventBus as S, verifyCognitoJwt as Sn, resolveWatchConfig as Sr, buildCloudMapIndex as St, formatTargetListing as T, buildMethodArn as Tn, listTargets as Tr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Tt, addAlbSpecificOptions as U, selectIntegrationResponse as Un, derivePseudoParametersFromRegion as Ur, invokeAgentCore as Ut, runViewerRequest as V, evaluateResponseParameters as Vn, pickAgentCoreCandidateStack as Vr, signAgentCoreInvocation as Vt, albStrategy as W, tryParseStatus as Wn, formatStateRemedy as Wr, waitForAgentCorePing as Wt, addStartServiceSpecificOptions as X, buildMgmtEndpointEnvUrl as Xn, toCmdArgv as Xt, resolveAlbFrontDoor as Y, ConnectionRegistry as Yn, resolveProfileCredentials as Yr, renderCodeDockerfile as Yt, createLocalStartServiceCommand as Z, handleConnectionsRequest as Zn, classifySourceChange as Zt, filterStudioTargetGroups as _, resolveServiceIntegrationParameters as _n, resolveCfnRegion as _r, resolveImageOverrides as _t, createLocalStudioCommand as a, createFileWatcher as an, resolveRuntimeFileExtension as ar, buildEcsImageResolutionContext$1 as at, renderStudioHtml as b, buildJwksUrlFromIssuer as bn, collectSsmParameterRefs as br, isLocalCdkAssetImage as bt, startStudioProxy as c, materializeLayerFromArn as cn, substituteAgainstState as cr, parseRestartPolicy as ct, createStudioDispatcher as d, filterRoutesByApiIdentifier as dn, substituteEnvVarsFromStateAsync as dr, runEcsServiceEmulator as dt, addStartApiSpecificOptions as en, buildDisconnectEvent as er, createLocalRunTaskCommand as et, filterStudioCustomResources as f, filterRoutesByApiIdentifiers as fn, LocalStateSourceError as fr, ImageOverrideError as ft, annotatePinnedEcsTargets as g, resolveSelectionExpression as gn, resolveCfnFallbackRegion as gr, parseImageOverrideFlags as gt, annotateEcsTaskPinnedTargets as h, startApiServer as hn, rejectExplicitCfnStackWithMultipleStacks as hr, mergeForService as ht, coerceStopRequest as i, createAuthorizerCache as in, resolveRuntimeCodeMountPath as ir, addImageOverrideOptions as it, matchBehavior as j, applyCorsResponseHeaders as jn, webSocketApiMatchesIdentifier as jr, invokeAgentCoreWs as jt, parseOriginOverrides as k, invokeTokenAuthorizer as kn, filterWebSocketApisByIdentifiers as kr, addInvokeAgentCoreSpecificOptions as kt, relayServeRequest as l, resolveEnvVars$1 as ln, substituteAgainstStateAsync as lr, resolveEcsAssumeRoleOption as lt, annotateAlbPinnedBackingServices as m, readMtlsMaterialsFromDisk as mn, isCfnFlagPresent as mr, enforceImageOverrideOrphans as mt, coerceRunRequest as n, createWatchPredicates as nn, architectureToPlatform as nr, addCommonEcsServiceOptions as nt, resolveServeBaseUrl as o, attachStageContext as on, resolveRuntimeImage as or, ecsClusterOption as ot, isCustomResourceLambdaTarget as p, groupRoutesByServer as pn, createLocalStateProvider as pr, buildImageOverrideTag as pt, resolveAlbTarget as q, probeHostGatewaySupport as qn, LocalInvokeBuildError as qr, buildAgentCoreCodeImage as qt, coerceServeRequest as r, resolveApiTargetSubset as rn, buildContainerImage as rr, addEcsAssumeRoleOptions as rt, createStudioServeManager as s, buildStageMap as sn, EcsTaskResolutionError as sr, parseMaxTasks as st, addStudioSpecificOptions as t, createLocalStartApiCommand as tn, buildMessageEvent as tr, MAX_TASKS_SUBNET_RANGE_CAP as tt, reinvoke as u, availableApiIdentifiers as un, substituteEnvVarsFromState as ur, resolveSharedSidecarCredentials as ut, startStudioServer as v, defaultCredentialsLoader as vn, resolveCfnStackName as vr, runImageOverrideBuilds as vt, createLocalListCommand as w, verifyJwtViaDiscovery as wn, countTargets as wr, DEFAULT_SHADOW_READY_TIMEOUT_MS as wt, createStudioStore as x, createJwksCache as xn, resolveSsmParameters as xr, listPinnedTargets as xt, toStudioTargetGroups as y, buildCognitoJwksUrl as yn, CfnLocalStateProvider as yr, describePinnedImageUri as yt, resolveCloudFrontDistribution as z, buildHttpApiV2Event as zn, AGENTCORE_RUNTIME_TYPE as zr, parseSseForJsonRpc as zt };
-//# sourceMappingURL=local-studio-Downi4pd.js.map
+export { createUnboundCloudFrontModule as $, pickResponseTemplate as $n, resolveAgentCoreTarget as $r, AGENTCORE_SESSION_ID_HEADER as $t, parseOriginOverrides as A, buildCognitoJwksUrl as An, CfnLocalStateProvider as Ar, describePinnedImageUri as At, CLOUDFRONT_DISTRIBUTION_TYPE as B, invokeTokenAuthorizer as Bn, filterWebSocketApisByIdentifiers as Br, addInvokeAgentCoreSpecificOptions as Bt, addListSpecificOptions as C, filterRoutesByApiIdentifiers as Cn, LocalStateSourceError as Cr, ImageOverrideError as Ct, addStartCloudFrontSpecificOptions as D, resolveSelectionExpression as Dn, resolveCfnFallbackRegion as Dr, parseImageOverrideFlags as Dt, LocalStartCloudFrontError as E, startApiServer as En, rejectExplicitCfnStackWithMultipleStacks as Er, mergeForService as Et, resolveDeployedKvsArnByName as F, verifyJwtViaDiscovery as Fn, countTargets as Fr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Ft, pickTargetFunctionLogicalId as G, isFunctionUrlOacFronted as Gn, resolveLambdaArnIntrinsic as Gr, a2aInvokeOnce as Gt, isCloudFrontDistribution as H, applyCorsResponseHeaders as Hn, webSocketApiMatchesIdentifier as Hr, invokeAgentCoreWs as Ht, matchBehavior as I, buildMethodArn as In, listTargets as Ir, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as It, runViewerRequest as J, translateLambdaResponse as Jn, AGENTCORE_HTTP_PROTOCOL as Jr, MCP_PROTOCOL_VERSION as Jt, resolveCloudFrontDistribution as K, matchPreflight as Kn, AGENTCORE_A2A_PROTOCOL as Kr, MCP_CONTAINER_PORT as Kt, startCloudFrontServer as L, computeRequestIdentityHash as Ln, availableWebSocketApiIdentifiers as Lr, setShadowReadyTimeoutMs as Lt, idFromArn as M, createJwksCache as Mn, resolveSsmParameters as Mr, listPinnedTargets as Mt, resolveKvsModulesForDistribution as N, verifyCognitoJwt as Nn, resolveWatchConfig as Nr, buildCloudMapIndex as Nt, createLocalStartCloudFrontCommand as O, resolveServiceIntegrationParameters as On, resolveCfnRegion as Or, resolveImageOverrides as Ot, createDeployedKvsDataSource as P, verifyJwtAuthorizer as Pn, resolveSingleTarget as Pr, CloudMapRegistry as Pt, createLocalFileKvsDataSource as Q, evaluateResponseParameters as Qn, pickAgentCoreCandidateStack as Qr, signAgentCoreInvocation as Qt, serveFromStaticOrigin as R, evaluateCachedLambdaPolicy as Rn, discoverWebSocketApis as Rr, getContainerNetworkIp as Rt, StudioEventBus as S, filterRoutesByApiIdentifier as Sn, substituteEnvVarsFromStateAsync as Sr, runEcsServiceEmulator as St, formatTargetListing as T, readMtlsMaterialsFromDisk as Tn, isCfnFlagPresent as Tr, enforceImageOverrideOrphans as Tt, pickFunctionUrlLogicalIdFromOrigin as U, buildCorsConfigByApiId as Un, discoverRoutes as Ur, A2A_CONTAINER_PORT as Ut, extractKvsAssociations as V, attachAuthorizers as Vn, parseSelectionExpressionPath as Vr, createLocalInvokeAgentCoreCommand as Vt, pickKvsLogicalIdFromArn as W, buildCorsConfigFromCloudFrontChain as Wn, pickRefLogicalId as Wr, A2A_PATH as Wt, stripCloudFrontImport as X, buildHttpApiV2Event as Xn, AGENTCORE_RUNTIME_TYPE as Xr, parseSseForJsonRpc as Xt, runViewerResponse as Y, applyAuthorizerOverlay as Yn, AGENTCORE_MCP_PROTOCOL as Yr, mcpInvokeOnce as Yt, createCloudFrontModule as Z, buildRestV1Event as Zn, AgentCoreResolutionError as Zr, AGENTCORE_SIGV4_SERVICE as Zt, filterStudioTargetGroups as _, attachStageContext as _n, resolveRuntimeImage as _r, ecsClusterOption as _t, createLocalStudioCommand as a, buildStsClientConfig as ai, computeCodeImageTag as an, bufferToBody as ar, isApplicationLoadBalancer as at, renderStudioHtml as b, resolveEnvVars$1 as bn, substituteAgainstStateAsync as br, resolveEcsAssumeRoleOption as bt, startStudioProxy as c, classifySourceChange as cn, handleConnectionsRequest as cr, createLocalStartServiceCommand as ct, createStudioDispatcher as d, addStartApiSpecificOptions as dn, buildDisconnectEvent as dr, createLocalRunTaskCommand as dt, derivePseudoParametersFromRegion as ei, invokeAgentCore as en, selectIntegrationResponse as er, addAlbSpecificOptions as et, filterStudioCustomResources as f, createLocalStartApiCommand as fn, buildMessageEvent as fr, MAX_TASKS_SUBNET_RANGE_CAP as ft, annotatePinnedEcsTargets as g, createFileWatcher as gn, resolveRuntimeFileExtension as gr, buildEcsImageResolutionContext$1 as gt, annotateEcsTaskPinnedTargets as h, createAuthorizerCache as hn, resolveRuntimeCodeMountPath as hr, addImageOverrideOptions as ht, coerceStopRequest as i, LocalInvokeBuildError as ii, buildAgentCoreCodeImage as in, probeHostGatewaySupport as ir, resolveAlbTarget as it, resolveCloudFrontTarget as j, buildJwksUrlFromIssuer as jn, collectSsmParameterRefs as jr, isLocalCdkAssetImage as jt, parseKvsFileOverrides as k, defaultCredentialsLoader as kn, resolveCfnStackName as kr, runImageOverrideBuilds as kt, relayServeRequest as l, addInvokeSpecificOptions as ln, parseConnectionsPath as lr, serviceStrategy as lt, annotateAlbPinnedBackingServices as m, resolveApiTargetSubset as mn, buildContainerImage as mr, addEcsAssumeRoleOptions as mt, coerceRunRequest as n, substituteImagePlaceholders as ni, downloadAndExtractS3Bundle as nn, VtlEvaluationError as nr, createLocalStartAlbCommand as nt, resolveServeBaseUrl as o, resolveProfileCredentials as oi, renderCodeDockerfile as on, ConnectionRegistry as or, resolveAlbFrontDoor as ot, isCustomResourceLambdaTarget as p, createWatchPredicates as pn, architectureToPlatform as pr, addCommonEcsServiceOptions as pt, compileCloudFrontFunction as q, matchRoute as qn, AGENTCORE_AGUI_PROTOCOL as qr, MCP_PATH as qt, coerceServeRequest as r, tryResolveImageFnJoin as ri, SUPPORTED_CODE_RUNTIMES as rn, HOST_GATEWAY_MIN_VERSION as rr, parseLbPortOverrides as rt, createStudioServeManager as s, toCmdArgv as sn, buildMgmtEndpointEnvUrl as sr, addStartServiceSpecificOptions as st, addStudioSpecificOptions as t, formatStateRemedy as ti, waitForAgentCorePing as tn, tryParseStatus as tr, albStrategy as tt, reinvoke as u, createLocalInvokeCommand as un, buildConnectEvent as ur, addRunTaskSpecificOptions as ut, startStudioServer as v, buildStageMap as vn, EcsTaskResolutionError as vr, parseMaxTasks as vt, createLocalListCommand as w, groupRoutesByServer as wn, createLocalStateProvider as wr, buildImageOverrideTag as wt, createStudioStore as x, availableApiIdentifiers as xn, substituteEnvVarsFromState as xr, resolveSharedSidecarCredentials as xt, toStudioTargetGroups as y, materializeLayerFromArn as yn, substituteAgainstState as yr, parseRestartPolicy as yt, serveLambdaUrlOrigin as z, invokeRequestAuthorizer as zn, discoverWebSocketApisOrThrow as zr, attachContainerLogStreamer as zt };
+//# sourceMappingURL=local-studio-DPEUB-rH.js.map