cdk-local 0.118.1 → 0.120.0

package/dist/{local-studio-Downi4pd.js → local-studio--ndMb9dM.js}

@@ -34,6 +34,9 @@ import { SignatureV4 } from "@smithy/signature-v4";
 import graphlib from "graphlib";
 import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 import * as vm from "node:vm";
+import "@aws-sdk/signature-v4a";
+import { CloudFrontClient, paginateListKeyValueStores } from "@aws-sdk/client-cloudfront";
+import { CloudFrontKeyValueStoreClient, GetKeyCommand, ResourceNotFoundException } from "@aws-sdk/client-cloudfront-keyvaluestore";
 import { EventEmitter } from "node:events";
 
 //#region src/cli/options.ts
@@ -23887,7 +23890,7 @@ function writeRawHttpError(socket, statusCode, message) {
 	if (socket.destroyed) return;
 	const body = `${message}\n`;
 	const lines = [
-		`HTTP/1.1 ${statusCode} ${STATUS_TEXT[statusCode] ?? "Error"}`,
+		`HTTP/1.1 ${statusCode} ${STATUS_TEXT$1[statusCode] ?? "Error"}`,
 		"content-type: text/plain; charset=utf-8",
 		`content-length: ${Buffer.byteLength(body)}`,
 		"connection: close",
@@ -23940,7 +23943,7 @@ function writeRawHttpRedirect(socket, action, req, listenerPort, scheme) {
 function writeRawHttpFixedResponse(socket, action) {
 	if (socket.destroyed) return;
 	const body = action.messageBody ?? "";
-	const statusText = STATUS_TEXT[action.statusCode] ?? "";
+	const statusText = STATUS_TEXT$1[action.statusCode] ?? "";
 	const contentType = sanitizeRawHeaderValue(action.contentType ?? "text/plain; charset=utf-8");
 	const lines = [
 		`HTTP/1.1 ${action.statusCode} ${statusText}`,
@@ -23960,7 +23963,7 @@ function sanitizeRawHeaderValue(value) {
 	return value.replace(/[\r\n]/g, " ");
 }
 /** Minimal HTTP/1.1 status text map for the codes the raw writers emit. */
-const STATUS_TEXT = {
+const STATUS_TEXT$1 = {
 	301: "Moved Permanently",
 	302: "Found",
 	401: "Unauthorized",
@@ -28095,6 +28098,92 @@ function addAlbSpecificOptions(cmd) {
 	return cmd.addOption(new Option("--lb-port <listenerPort=hostPort...>", "Bind the local front-door on a specific host port (e.g. 80=8080); repeatable. Default: host port == ALB listener port. Use this on macOS to remap a privileged listener port (< 1024) to a non-privileged host port.")).addOption(new Option("--tls", "Terminate TLS locally for cloud-HTTPS listeners. Default: a cloud-HTTPS listener is served over plain HTTP locally (X-Forwarded-Proto: https is preserved so the upstream app still sees the deployed listener protocol). Implied by --tls-cert / --tls-key. Use this when local-dev cookies need Secure / SameSite=None, when the upstream app inspects TLS metadata, or for mTLS / SNI testing — otherwise plain HTTP is friendlier (no self-signed cert warnings in curl / browser).")).addOption(new Option("--tls-cert <path>", "PEM-encoded server certificate for HTTPS front-door listeners. Implies --tls. Must be set together with --tls-key. Pass --tls alone (without --tls-cert / --tls-key) to auto-generate a self-signed cert (cached under $XDG_CACHE_HOME/cdk-local/alb-https/, default ~/.cache/cdk-local/alb-https/); requires openssl on PATH. The deployed Listener Certificates[] are NOT fetched (ACM private keys are not retrievable by design). The auto-generated cert lists DNS:localhost,IP:127.0.0.1 as SubjectAltName, so a client validating a non-loopback --container-host will fail the SAN check — pass --tls-cert / --tls-key with a SAN covering that host instead.")).addOption(new Option("--tls-key <path>", "PEM-encoded server private key matching --tls-cert. Implies --tls. Must be set together with --tls-cert.")).addOption(new Option("--no-verify-auth", "Disable local enforcement of authenticate-cognito / authenticate-oidc actions. Every request is served as if the auth check passed. Useful for local dev where you do not want to mint a Bearer token at all.")).addOption(new Option("--bearer-token <jwt>", "Default Bearer JWT this command INJECTS only when an inbound request has none (the default-when-missing role) — `cdkl start-alb` is the local ALB front-door RECEIVING outside-in requests, so this token is the fallback the front-door slots in as Authorization: Bearer <jwt> if the caller did not already supply one. Verified against the same JWKS / OIDC discovery URL the deployed ALB would (signature + iss + aud + exp). Cookie pass-through (AWSELBAuthSessionCookie-*) also bypasses the guard. Contrast with `cdkl invoke-agentcore --bearer-token`, where the role is reversed — that command is the outbound client and ALWAYS presents this token (the supplier).")).addOption(new Option("--watch", "Hot-reload: re-synth + per-replica reload of every ECS service behind the ALB when the CDK source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). A per-firing classifier picks the per-replica primitive: source-only edits on interpreted-language handlers (Node/Python/Ruby/shell) take a bind-mount FAST PATH (`docker cp` the new source into each replica + `docker restart`; no rebuild, front-door pool entry unchanged since the IP/port are preserved). Dockerfile / dependency manifest / compiled-language source / ambiguous edits fall through to the rebuild rolling primitive — boot a shadow under a bumped generation suffix, wait for its container port to accept a TCP connection, atomically register it in the front-door pool, then drop the old entry and retire the old container. Either path rolls one replica at a time, so a continuous external request stream against the listener port sees zero connection refusals across the reload. The host front-door (TLS, JWKS cache, Lambda-target containers, listener sockets) stays up across the reload. Lambda target groups behind the ALB are a no-op on reload (the warm RIE container keeps its boot-time image). Off by default; existing replica(s) keep serving when synth fails mid-reload.").default(false));
 }
 
+//#endregion
+//#region src/local/cloudfront-kvs.ts
+/** Build a `cf` module backed by the resolved data sources for one function. */
+function createCloudFrontModule(sources) {
+	return { kvs(kvsId) {
+		return makeHandle(pickSource(sources, kvsId));
+	} };
+}
+/**
+* The `cf` module bound when a function calls `cf.kvs()` but no KeyValueStore
+* binding was resolved (no `--from-cfn-stack`, no covering `--kvs-file`). The
+* handle is returned successfully so a top-level `cf.kvs()` call does not throw
+* at module-eval; the actionable error surfaces when the function actually
+* reads a key.
+*/
+function createUnboundCloudFrontModule(functionLogicalId) {
+	const fail = () => Promise.reject(/* @__PURE__ */ new Error(`CloudFront Function '${functionLogicalId}' reads from a KeyValueStore (cf.kvs()), but no KeyValueStore binding is available locally. Pass --from-cfn-stack to read the deployed store, or --kvs-file <id>=<file.json> to back it with a local JSON map.`));
+	const handle = {
+		get: () => fail(),
+		exists: () => fail(),
+		meta: () => fail(),
+		count: () => fail()
+	};
+	return { kvs: () => handle };
+}
+function pickSource(sources, kvsId) {
+	if (sources.length === 0) throw new Error("cf.kvs(): no KeyValueStore is associated with this function.");
+	if (kvsId === void 0) return sources[0];
+	const byId = sources.find((s) => s.kvsId === kvsId);
+	if (byId) return byId;
+	if (sources.length === 1) return sources[0];
+	throw new Error(`cf.kvs('${kvsId}'): no associated KeyValueStore matches this id locally (associated: ${sources.map((s) => s.kvsId ?? s.label).join(", ")}).`);
+}
+function makeHandle(source) {
+	return {
+		async get(key, options) {
+			const value = await source.getValue(key);
+			if (value === void 0) throw new Error(`cf.kvs().get('${key}'): key not found in ${source.label}.`);
+			if (options?.format === "json") try {
+				return JSON.parse(value);
+			} catch (err) {
+				throw new Error(`cf.kvs().get('${key}', { format: 'json' }): value is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			return value;
+		},
+		async exists(key) {
+			return await source.getValue(key) !== void 0;
+		},
+		meta() {
+			return Promise.reject(/* @__PURE__ */ new Error("cf.kvs().meta() is not reproduced locally by cdkl start-cloudfront (only get / exists are supported)."));
+		},
+		count() {
+			return Promise.reject(/* @__PURE__ */ new Error("cf.kvs().count() is not reproduced locally by cdkl start-cloudfront (only get / exists are supported)."));
+		}
+	};
+}
+/**
+* Build a {@link KvsDataSource} from a local JSON file (the `--kvs-file
+* <id>=<file.json>` escape hatch). The file is a flat `{ "key": "value" }`
+* object; non-string values are JSON-stringified (KVS values are always
+* strings). Read once at construction (boot time); a `--watch` reload rebuilds
+* it.
+*/
+function createLocalFileKvsDataSource(args) {
+	let raw;
+	try {
+		raw = readFileSync(args.filePath, "utf-8");
+	} catch (err) {
+		throw new Error(`--kvs-file '${args.id}=${args.filePath}': could not read the file: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		throw new Error(`--kvs-file '${args.id}=${args.filePath}': not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`--kvs-file '${args.id}=${args.filePath}': expected a JSON object of key -> value entries.`);
+	const map = /* @__PURE__ */ new Map();
+	for (const [key, value] of Object.entries(parsed)) map.set(key, typeof value === "string" ? value : JSON.stringify(value));
+	return {
+		label: `file:${args.filePath}`,
+		kvsId: args.id,
+		getValue: (key) => Promise.resolve(map.get(key))
+	};
+}
+
 //#endregion
 //#region src/local/cloudfront-function-runtime.ts
 /**
@@ -28109,21 +28198,49 @@ function addAlbSpecificOptions(cmd) {
 const FUNCTION_TIMEOUT_MS = 5e3;
 const EVENT_GLOBAL = "__cfEvent";
 /**
+* Regex matching the canonical CloudFront-Functions 2.0 KeyValueStore import
+* line (`import cf from 'cloudfront';`). The module is default-imported under a
+* single binding name; this is the only `cloudfront` import form the runtime
+* supports. Anchored per-line (`m` flag) so only the import statement is
+* matched, not a substring elsewhere.
+*/
+const CLOUDFRONT_IMPORT_RE = /^[ \t]*import\s+(\w+)\s+from\s+['"]cloudfront['"]\s*;?[ \t]*$/m;
+/**
+* Strip the `import cf from 'cloudfront'` statement from a 2.0 function's code
+* and return the binding name, so the code compiles as a plain `vm.Script`
+* (an `import` statement is invalid outside an ES module) and the `cloudfront`
+* module can be injected as the binding-named sandbox global instead. Returns
+* the code unchanged with no binding name when the function does not import
+* `cloudfront`. The matched line is blanked (not deleted) so error line numbers
+* still line up with the source.
+*/
+function stripCloudFrontImport(code) {
+	const match = CLOUDFRONT_IMPORT_RE.exec(code);
+	if (!match) return { code };
+	return {
+		code: code.replace(CLOUDFRONT_IMPORT_RE, ""),
+		bindingName: match[1]
+	};
+}
+/**
 * Compile a CloudFront Function's inline code once. Throws a clear error when
 * the code has a syntax error or declares no `handler` (surfaced at boot so a
 * malformed function never silently no-ops at request time).
 */
 function compileCloudFrontFunction(logicalId, code, runtime) {
+	const { code: source, bindingName } = stripCloudFrontImport(code);
 	let script;
 	try {
-		script = new vm.Script(`${code}\n;handler(${EVENT_GLOBAL})`, { filename: `cloudfront-function-${logicalId}.js` });
+		script = new vm.Script(`${source}\n;handler(${EVENT_GLOBAL})`, { filename: `cloudfront-function-${logicalId}.js` });
 	} catch (err) {
 		throw new Error(`CloudFront Function '${logicalId}' failed to compile: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	let hasHandler;
 	try {
-		const probeContext = vm.createContext({ console });
-		hasHandler = new vm.Script(`${code}\n;typeof handler === 'function'`).runInContext(probeContext, { timeout: FUNCTION_TIMEOUT_MS });
+		const probeGlobals = { console };
+		if (bindingName) probeGlobals[bindingName] = createUnboundCloudFrontModule(logicalId);
+		const probeContext = vm.createContext(probeGlobals);
+		hasHandler = new vm.Script(`${source}\n;typeof handler === 'function'`).runInContext(probeContext, { timeout: FUNCTION_TIMEOUT_MS });
 	} catch (err) {
 		throw new Error(`CloudFront Function '${logicalId}' failed to compile: ${err instanceof Error ? err.message : String(err)}`);
 	}
@@ -28131,7 +28248,8 @@ function compileCloudFrontFunction(logicalId, code, runtime) {
 	return {
 		logicalId,
 		runtime,
-		script
+		script,
+		...bindingName !== void 0 && { cloudfrontBindingName: bindingName }
 	};
 }
 /**
@@ -28142,10 +28260,12 @@ function compileCloudFrontFunction(logicalId, code, runtime) {
 * thrown by the handler is wrapped with the function's logical id.
 */
 async function invokeCloudFrontFunction(fn, event) {
-	const context = vm.createContext({
+	const sandbox = {
 		console,
 		[EVENT_GLOBAL]: event
-	});
+	};
+	if (fn.cloudfrontBindingName) sandbox[fn.cloudfrontBindingName] = fn.cloudfrontModule ?? createUnboundCloudFrontModule(fn.logicalId);
+	const context = vm.createContext(sandbox);
 	let result;
 	try {
 		result = fn.script.runInContext(context, { timeout: FUNCTION_TIMEOUT_MS });
@@ -28282,6 +28402,15 @@ function buildViewerResponseEvent(requestEvent, response) {
 		}
 	};
 }
+/** Serialize a CloudFront request's `querystring` object back to a raw string. */
+function serializeCfQueryString(qs) {
+	const parts = [];
+	for (const [key, val] of Object.entries(qs)) {
+		const values = val.multiValue && val.multiValue.length > 0 ? val.multiValue : [{ value: val.value }];
+		for (const v of values) parts.push(v.value === "" ? encodeURIComponent(key) : `${encodeURIComponent(key)}=${encodeURIComponent(v.value)}`);
+	}
+	return parts.join("&");
+}
 function parseQueryStringToCf(raw) {
 	const out = {};
 	if (!raw) return out;
@@ -28340,6 +28469,7 @@ const CLOUDFRONT_FUNCTION_TYPE = "AWS::CloudFront::Function";
 const S3_BUCKET_TYPE = "AWS::S3::Bucket";
 const LAMBDA_URL_TYPE = "AWS::Lambda::Url";
 const LAMBDA_FUNCTION_TYPE = "AWS::Lambda::Function";
+const LAMBDA_VERSION_TYPE = "AWS::Lambda::Version";
 /**
 * Resolve a distribution logical id within a stack into its routing model.
 * `originOverrides` maps an origin id to a local directory (the `--origin`
@@ -28379,11 +28509,55 @@ function compileDistributionFunctions(template) {
 			continue;
 		}
 		const config = props["FunctionConfig"];
-		const runtime = config && typeof config === "object" && typeof config["Runtime"] === "string" ? config["Runtime"] : "cloudfront-js-1.0";
-		out.set(logicalId, compileCloudFrontFunction(logicalId, code, runtime));
+		const configObj = config && typeof config === "object" ? config : {};
+		const compiled = compileCloudFrontFunction(logicalId, code, typeof configObj["Runtime"] === "string" ? configObj["Runtime"] : "cloudfront-js-1.0");
+		const kvsAssociations = extractKvsAssociations(configObj);
+		if (kvsAssociations.length > 0) compiled.kvsAssociations = kvsAssociations;
+		out.set(logicalId, compiled);
+	}
+	return out;
+}
+/**
+* Extract a function's `FunctionConfig.KeyValueStoreAssociations[]` into the
+* compiled-function carrier, pre-resolving each association's KVS resource
+* logical id from the `KeyValueStoreARN` intrinsic so the command layer can
+* bind it (deployed store under `--from-cfn-stack`, or a `--kvs-file` map).
+*/
+function extractKvsAssociations(functionConfig) {
+	const raw = Array.isArray(functionConfig["KeyValueStoreAssociations"]) ? functionConfig["KeyValueStoreAssociations"] : [];
+	const out = [];
+	for (const entry of raw) {
+		if (!entry || typeof entry !== "object") continue;
+		const arnValue = entry["KeyValueStoreARN"];
+		if (arnValue === void 0) continue;
+		const kvsLogicalId = pickKvsLogicalIdFromArn(arnValue);
+		out.push({
+			arnValue,
+			...kvsLogicalId !== void 0 && { kvsLogicalId }
+		});
 	}
 	return out;
 }
+/**
+* Unwrap a `KeyValueStoreARN` value to the `AWS::CloudFront::KeyValueStore`
+* logical id when it is an intrinsic reference to a same-template store. CDK /
+* CloudFormation synthesize it as `Fn::GetAtt[<Kvs>, 'Arn']`, a `Ref`, or
+* `Fn::Sub: '${<Kvs>.Arn}'`. Returns `undefined` for a literal ARN string (an
+* imported / out-of-stack store).
+*/
+function pickKvsLogicalIdFromArn(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const obj = value;
+	const getAtt = obj["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && getAtt.length === 2 && typeof getAtt[0] === "string") return getAtt[0];
+	if (typeof obj["Ref"] === "string") return obj["Ref"];
+	const sub = obj["Fn::Sub"];
+	const subTemplate = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+	if (typeof subTemplate === "string") {
+		const match = /^\$\{([A-Za-z0-9]+)(?:\.[A-Za-z0-9]+)?\}$/.exec(subTemplate.trim());
+		if (match) return match[1];
+	}
+}
 function resolveBehaviors(dc, functions, distLogicalId, template) {
 	const behaviors = [];
 	const def = dc["DefaultCacheBehavior"];
@@ -28401,10 +28575,9 @@ function resolveBehaviors(dc, functions, distLogicalId, template) {
 	return behaviors;
 }
 function resolveBehavior(behavior, pathPattern, functions, distLogicalId, template) {
-	const resolved = {
-		targetOriginId: typeof behavior["TargetOriginId"] === "string" ? behavior["TargetOriginId"] : "",
-		hasLambdaEdge: Array.isArray(behavior["LambdaFunctionAssociations"]) ? behavior["LambdaFunctionAssociations"].length > 0 : false
-	};
+	const resolved = { targetOriginId: typeof behavior["TargetOriginId"] === "string" ? behavior["TargetOriginId"] : "" };
+	const lambdaEdge = resolveLambdaEdgeAssociations(behavior, template, distLogicalId);
+	if (lambdaEdge) resolved.lambdaEdge = lambdaEdge;
 	if (pathPattern !== void 0) resolved.pathPattern = pathPattern;
 	const cors = resolveResponseHeadersPolicyCors(template, behavior["ResponseHeadersPolicyId"]);
 	if (cors) resolved.cors = cors;
@@ -28436,6 +28609,55 @@ function pickFunctionLogicalIdFromArn(value) {
 	const getAtt = value["Fn::GetAtt"];
 	if (Array.isArray(getAtt) && getAtt.length === 2 && typeof getAtt[0] === "string") return getAtt[0];
 }
+/**
+* Resolve a behavior's `LambdaFunctionAssociations[]` into the per-event-type
+* backing-function map (issue #400). Each association names a
+* `LambdaFunctionARN` (a versioned ARN) + an `EventType` + `IncludeBody`.
+*/
+function resolveLambdaEdgeAssociations(behavior, template, distLogicalId) {
+	const assocs = Array.isArray(behavior["LambdaFunctionAssociations"]) ? behavior["LambdaFunctionAssociations"] : [];
+	const out = {};
+	for (const a of assocs) {
+		if (!a || typeof a !== "object") continue;
+		const assoc = a;
+		const eventType = assoc["EventType"];
+		const functionLogicalId = pickLambdaEdgeFunctionLogicalId(assoc["LambdaFunctionARN"], template);
+		if (!functionLogicalId) {
+			getLogger().warn(`Distribution '${distLogicalId}': a Lambda@Edge association references a LambdaFunctionARN cdk-local could not resolve to a local AWS::Lambda::Function; it will not run.`);
+			continue;
+		}
+		const entry = {
+			functionLogicalId,
+			includeBody: assoc["IncludeBody"] === true
+		};
+		if (eventType === "viewer-request") out.viewerRequest = entry;
+		else if (eventType === "origin-request") out.originRequest = entry;
+		else if (eventType === "origin-response") out.originResponse = entry;
+		else if (eventType === "viewer-response") out.viewerResponse = entry;
+	}
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+/**
+* Resolve a `LambdaFunctionARN` (a versioned function ARN) to the backing
+* `AWS::Lambda::Function` logical id. CDK wires the association to a
+* `lambda.Version` (`{Ref: <Version>}` returns the qualified ARN), whose
+* `FunctionName` references the function. A direct (unqualified) function ref
+* is also accepted. Returns `undefined` when it cannot reach an
+* `AWS::Lambda::Function` (e.g. an imported cross-region EdgeFunction ARN).
+*/
+function pickLambdaEdgeFunctionLogicalId(value, template) {
+	const candidate = refLogicalId(value) ?? getAttLogicalId(value);
+	if (!candidate) return void 0;
+	const resources = template.Resources ?? {};
+	const resource = resources[candidate];
+	if (!resource) return void 0;
+	if (resource.Type === LAMBDA_FUNCTION_TYPE) return candidate;
+	if (resource.Type === LAMBDA_VERSION_TYPE) {
+		const fnName = (resource.Properties ?? {})["FunctionName"];
+		const fnId = refLogicalId(fnName) ?? getAttLogicalId(fnName);
+		if (fnId && resources[fnId]?.Type === LAMBDA_FUNCTION_TYPE) return fnId;
+	}
+}
 function resolveOrigins(dc, template, stack, overrides) {
 	const out = /* @__PURE__ */ new Map();
 	const origins = Array.isArray(dc["Origins"]) ? dc["Origins"] : [];
@@ -28635,6 +28857,261 @@ function isCloudFrontDistribution(resource) {
 	return resource.Type === CLOUDFRONT_DISTRIBUTION_TYPE;
 }
 
+//#endregion
+//#region src/local/cloudfront-edge-event.ts
+/** Convert a normalized HTTP header map into the Lambda@Edge multi-map. */
+function httpHeadersToEdge(headers) {
+	const out = {};
+	for (const [name, values] of Object.entries(headers)) {
+		const lower = name.toLowerCase();
+		out[lower] = values.map((value) => ({
+			key: name,
+			value
+		}));
+	}
+	return out;
+}
+/**
+* Flatten a Lambda@Edge header multi-map into a single-valued `{ name: value }`
+* map (comma-joining duplicates), EXCEPT `set-cookie`, whose values are returned
+* separately so multiple cookies survive. Pseudo / read-only headers CloudFront
+* forbids a function from setting are dropped.
+*/
+function edgeHeadersToHttp(headers) {
+	const out = {};
+	const setCookies = [];
+	for (const [name, entries] of Object.entries(headers)) {
+		if (!Array.isArray(entries)) continue;
+		const lower = name.toLowerCase();
+		if (READ_ONLY_RESPONSE_HEADERS.has(lower)) continue;
+		if (lower === "set-cookie") {
+			for (const e of entries) if (e && typeof e.value === "string") setCookies.push(e.value);
+			continue;
+		}
+		const values = entries.filter((e) => e && typeof e.value === "string").map((e) => e.value);
+		if (values.length > 0) out[lower] = values.join(", ");
+	}
+	return {
+		headers: out,
+		setCookies
+	};
+}
+/**
+* Headers a Lambda@Edge function is not allowed to add/modify on a response (a
+* subset CloudFront blackholes). We drop them rather than fail the response.
+*/
+const READ_ONLY_RESPONSE_HEADERS = new Set([
+	"connection",
+	"content-length",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+/** Build the request-stage event (`viewer-request` / `origin-request`). */
+function buildEdgeRequestEvent(args) {
+	return { Records: [{ cf: {
+		config: {
+			...args.config,
+			eventType: args.eventType
+		},
+		request: toEdgeRequest(args.request, args.includeBody)
+	} }] };
+}
+/** Build the response-stage event (`origin-response` / `viewer-response`). */
+function buildEdgeResponseEvent(args) {
+	return { Records: [{ cf: {
+		config: {
+			...args.config,
+			eventType: args.eventType
+		},
+		request: toEdgeRequest(args.request, false),
+		response: {
+			status: String(args.response.statusCode),
+			statusDescription: statusText(args.response.statusCode),
+			headers: httpHeadersToEdge(toMultiMap(args.response.headers))
+		}
+	} }] };
+}
+function toEdgeRequest(input, includeBody) {
+	const request = {
+		clientIp: input.clientIp,
+		method: input.method,
+		uri: input.uri,
+		querystring: input.querystring,
+		headers: httpHeadersToEdge(input.headers)
+	};
+	if (includeBody) request.body = {
+		action: "read-only",
+		data: (input.body ?? Buffer.alloc(0)).toString("base64"),
+		encoding: "base64",
+		inputTruncated: false
+	};
+	return request;
+}
+function interpretEdgeRequestResult(result, fallback) {
+	if (!result || typeof result !== "object") return {
+		kind: "continue",
+		request: fallback
+	};
+	const obj = result;
+	if ("status" in obj) return {
+		kind: "response",
+		response: coerceEdgeResponse(obj)
+	};
+	return {
+		kind: "continue",
+		request: coerceEdgeRequest(obj, fallback)
+	};
+}
+/** Interpret a response-stage handler's return value as the (modified) response. */
+function interpretEdgeResponseResult(result, fallback) {
+	if (!result || typeof result !== "object") return fallback;
+	return coerceEdgeResponse(result, fallback);
+}
+/** Collapse an {@link EdgeResponse} into the server's status / headers / body. */
+function edgeResponseToResult(response, fallbackBody) {
+	const statusCode = Number.parseInt(response.status, 10);
+	const { headers, setCookies } = edgeHeadersToHttp(response.headers ?? {});
+	let body;
+	if (response.body !== void 0) body = response.bodyEncoding === "base64" ? Buffer.from(response.body, "base64") : Buffer.from(response.body);
+	else body = fallbackBody ?? Buffer.alloc(0);
+	return {
+		statusCode: Number.isFinite(statusCode) ? statusCode : 500,
+		headers,
+		setCookies,
+		body
+	};
+}
+/**
+* Server-facing request-stage orchestration: given a handler's raw return value
+* and the current request input, produce either the (modified) request to
+* continue with, or the generated response to short-circuit.
+*/
+function applyEdgeRequestResult(result, base) {
+	const outcome = interpretEdgeRequestResult(result, toEdgeRequest(base, false));
+	if (outcome.kind === "response") return {
+		kind: "response",
+		response: edgeResponseToResult(outcome.response)
+	};
+	return {
+		kind: "continue",
+		request: applyEdgeRequest(base, outcome.request)
+	};
+}
+/**
+* Server-facing response-stage orchestration: apply a handler's modified
+* response over the current status / headers, keeping the origin body unless the
+* function replaced it.
+*/
+function applyEdgeResponseResult(result, base, originBody) {
+	return edgeResponseToResult(interpretEdgeResponseResult(result, {
+		status: String(base.statusCode),
+		headers: httpHeadersToEdge(toMultiMap(base.headers))
+	}), originBody);
+}
+/** Apply a request-stage function's modified request back onto the server's request input. */
+function applyEdgeRequest(base, request) {
+	const out = {
+		clientIp: base.clientIp,
+		method: typeof request.method === "string" ? request.method : base.method,
+		uri: typeof request.uri === "string" ? request.uri : base.uri,
+		querystring: typeof request.querystring === "string" ? request.querystring : base.querystring,
+		headers: edgeHeadersToRawMap(request.headers) ?? base.headers
+	};
+	if (request.body && request.body.action === "replace" && typeof request.body.data === "string") out.body = request.body.encoding === "base64" ? Buffer.from(request.body.data, "base64") : Buffer.from(request.body.data);
+	else if (base.body !== void 0) out.body = base.body;
+	return out;
+}
+function edgeHeadersToRawMap(headers) {
+	if (!headers || typeof headers !== "object") return void 0;
+	const out = {};
+	for (const [name, entries] of Object.entries(headers)) {
+		if (!Array.isArray(entries)) continue;
+		out[name.toLowerCase()] = entries.filter((e) => e && typeof e.value === "string").map((e) => e.value);
+	}
+	return out;
+}
+function coerceEdgeRequest(obj, fallback) {
+	const out = {
+		clientIp: typeof obj["clientIp"] === "string" ? obj["clientIp"] : fallback.clientIp,
+		method: typeof obj["method"] === "string" ? obj["method"] : fallback.method,
+		uri: typeof obj["uri"] === "string" ? obj["uri"] : fallback.uri,
+		querystring: typeof obj["querystring"] === "string" ? obj["querystring"] : fallback.querystring,
+		headers: coerceEdgeHeaders(obj["headers"]) ?? fallback.headers
+	};
+	const body = obj["body"];
+	if (body && typeof body === "object") {
+		const b = body;
+		out.body = {
+			action: b["action"] === "replace" ? "replace" : "read-only",
+			data: typeof b["data"] === "string" ? b["data"] : "",
+			encoding: b["encoding"] === "text" ? "text" : "base64",
+			inputTruncated: b["inputTruncated"] === true
+		};
+	}
+	return out;
+}
+function coerceEdgeResponse(obj, fallback) {
+	const out = {
+		status: typeof obj["status"] === "string" ? obj["status"] : typeof obj["status"] === "number" ? String(obj["status"]) : fallback?.status ?? "200",
+		headers: coerceEdgeHeaders(obj["headers"]) ?? fallback?.headers ?? {}
+	};
+	if (typeof obj["statusDescription"] === "string") out.statusDescription = obj["statusDescription"];
+	else if (fallback?.statusDescription !== void 0) out.statusDescription = fallback.statusDescription;
+	if (typeof obj["body"] === "string") {
+		out.body = obj["body"];
+		if (obj["bodyEncoding"] === "base64" || obj["bodyEncoding"] === "text") out.bodyEncoding = obj["bodyEncoding"];
+	}
+	return out;
+}
+/** Coerce an arbitrary value into the EdgeHeaders shape, tolerating a bare `{name: 'value'}` map. */
+function coerceEdgeHeaders(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const out = {};
+	for (const [name, raw] of Object.entries(value)) {
+		const lower = name.toLowerCase();
+		if (Array.isArray(raw)) out[lower] = raw.filter((e) => !!e && typeof e === "object").map((e) => ({
+			key: typeof e["key"] === "string" ? e["key"] : name,
+			value: typeof e["value"] === "string" ? e["value"] : String(e["value"] ?? "")
+		}));
+		else if (typeof raw === "string") out[lower] = [{
+			key: name,
+			value: raw
+		}];
+	}
+	return out;
+}
+function toMultiMap(headers) {
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) out[name] = [value];
+	return out;
+}
+function statusText(code) {
+	return STATUS_TEXT[code] ?? "";
+}
+const STATUS_TEXT = {
+	200: "OK",
+	201: "Created",
+	204: "No Content",
+	301: "Moved Permanently",
+	302: "Found",
+	303: "See Other",
+	304: "Not Modified",
+	307: "Temporary Redirect",
+	308: "Permanent Redirect",
+	400: "Bad Request",
+	401: "Unauthorized",
+	403: "Forbidden",
+	404: "Not Found",
+	500: "Internal Server Error",
+	502: "Bad Gateway",
+	503: "Service Unavailable"
+};
+
 //#endregion
 //#region src/local/cloudfront-lambda-origin.ts
 /**
@@ -28819,9 +29296,10 @@ function contentTypeForKey(key) {
 async function startCloudFrontServer(options) {
 	const logger = getLogger().child("cloudfront");
 	const lambdaInvokers = options.lambdaInvokers ?? /* @__PURE__ */ new Map();
+	const edgeInvokers = options.edgeInvokers ?? /* @__PURE__ */ new Map();
 	const state = { distribution: options.distribution };
 	const handler = (req, res) => {
-		handleRequest$1(req, res, state, lambdaInvokers, logger).catch((err) => {
+		handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, logger).catch((err) => {
 			logger.warn(`Request handling failed: ${err instanceof Error ? err.message : String(err)}`);
 			if (!res.headersSent) {
 				res.statusCode = 500;
@@ -28851,7 +29329,7 @@ async function startCloudFrontServer(options) {
 	};
 }
 /** The per-request pipeline: behavior match -> viewer-request -> origin -> viewer-response. */
-async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
+async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, logger) {
 	const distribution = state.distribution;
 	const rawUrl = req.url ?? "/";
 	const queryIdx = rawUrl.indexOf("?");
@@ -28874,37 +29352,72 @@ async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 			return;
 		}
 	}
+	const config = {
+		distributionDomainName: req.headers.host ?? "localhost",
+		distributionId: distribution.logicalId,
+		requestId: `cdkl-${Date.now().toString(36)}-${Math.floor(performance.now()).toString(36)}`
+	};
+	const clientIp = req.socket.remoteAddress ?? "127.0.0.1";
 	let requestEvent = buildViewerRequestEvent({
 		method: req.method ?? "GET",
 		uri,
 		querystring,
 		headers: req.headers,
-		ip: req.socket.remoteAddress ?? "127.0.0.1",
+		ip: clientIp,
 		distributionId: distribution.logicalId,
 		domainName: req.headers.host ?? "localhost",
-		requestId: `cdkl-${Date.now().toString(36)}-${Math.floor(performance.now()).toString(36)}`
+		requestId: config.requestId
 	});
-	let effectiveUri = uri;
 	if (behavior.viewerRequest) {
 		const outcome = await runViewerRequest(behavior.viewerRequest, requestEvent);
 		if (outcome.kind === "response") {
 			writeCfResponse(res, outcome.response, logger);
 			return;
 		}
-		effectiveUri = outcome.request.uri;
 		requestEvent = {
 			...requestEvent,
 			request: outcome.request
 		};
 	}
+	let edgeInput = {
+		clientIp,
+		method: requestEvent.request.method,
+		uri: requestEvent.request.uri,
+		querystring: serializeCfQueryString(requestEvent.request.querystring),
+		headers: cfHeadersToRawMap(requestEvent.request.headers)
+	};
+	for (const eventType of ["viewer-request", "origin-request"]) {
+		const assoc = eventType === "viewer-request" ? behavior.lambdaEdge?.viewerRequest : behavior.lambdaEdge?.originRequest;
+		if (!assoc) continue;
+		const invoke = edgeInvokers.get(assoc.functionLogicalId);
+		if (!invoke) {
+			logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (added after start-up); skipping. Restart start-cloudfront.`);
+			continue;
+		}
+		if (assoc.includeBody && edgeInput.body === void 0) edgeInput = {
+			...edgeInput,
+			body: await readRequestBody(req)
+		};
+		const outcome = applyEdgeRequestResult(await invoke(buildEdgeRequestEvent({
+			eventType,
+			config,
+			request: edgeInput,
+			includeBody: assoc.includeBody
+		})), edgeInput);
+		if (outcome.kind === "response") {
+			writeEdgeResponse(res, outcome.response, behavior, req, logger);
+			return;
+		}
+		edgeInput = outcome.request;
+	}
 	const origin = distribution.origins.get(behavior.targetOriginId);
-	const originResult = await serveFromOrigin(origin, behavior, {
-		uri: effectiveUri,
-		querystring,
-		method: req.method ?? "GET",
-		headers: req.headers,
-		readBody: () => readRequestBody(req),
-		sourceIp: req.socket.remoteAddress ?? "127.0.0.1",
+	const originResult = await serveFromOrigin(origin, {
+		uri: edgeInput.uri,
+		querystring: edgeInput.querystring,
+		method: edgeInput.method,
+		headers: rawMapToIncomingHeaders(edgeInput.headers),
+		readBody: () => edgeInput.body !== void 0 ? Promise.resolve(edgeInput.body) : readRequestBody(req),
+		sourceIp: clientIp,
 		distribution,
 		lambdaInvokers,
 		logger
@@ -28912,16 +29425,47 @@ async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 	if (!originResult) return writePlain(res, 502, originUnavailableMessage(origin, behavior));
 	let finalStatus = originResult.statusCode;
 	let finalHeaders = originResult.headers;
+	let finalBody = originResult.body;
+	const setCookies = [...originResult.setCookies ?? []];
+	if (behavior.lambdaEdge?.originResponse) {
+		const r = await runEdgeResponseStage(behavior.lambdaEdge.originResponse, "origin-response", {
+			config,
+			request: edgeInput,
+			statusCode: finalStatus,
+			headers: finalHeaders,
+			body: finalBody
+		}, edgeInvokers, logger);
+		if (r) {
+			finalStatus = r.statusCode;
+			finalHeaders = r.headers;
+			finalBody = r.body;
+			setCookies.push(...r.setCookies);
+		}
+	}
 	if (behavior.viewerResponse) {
 		const responseEvent = buildViewerResponseEvent(requestEvent, {
-			statusCode: originResult.statusCode,
-			headers: originResult.headers
+			statusCode: finalStatus,
+			headers: finalHeaders
 		});
 		const mutated = await runViewerResponse(behavior.viewerResponse, responseEvent);
 		finalStatus = mutated.statusCode;
-		finalHeaders = cfHeadersToPlain(mutated.headers, originResult.headers);
+		finalHeaders = cfHeadersToPlain(mutated.headers, finalHeaders);
+	}
+	if (behavior.lambdaEdge?.viewerResponse) {
+		const r = await runEdgeResponseStage(behavior.lambdaEdge.viewerResponse, "viewer-response", {
+			config,
+			request: edgeInput,
+			statusCode: finalStatus,
+			headers: finalHeaders,
+			body: finalBody
+		}, edgeInvokers, logger);
+		if (r) {
+			finalStatus = r.statusCode;
+			finalHeaders = r.headers;
+			finalBody = r.body;
+			setCookies.push(...r.setCookies);
+		}
 	}
-	const setCookies = [...originResult.setCookies ?? []];
 	for (const name of Object.keys(finalHeaders)) if (name.toLowerCase() === "set-cookie") {
 		setCookies.push(finalHeaders[name]);
 		delete finalHeaders[name];
@@ -28937,7 +29481,54 @@ async function handleRequest$1(req, res, state, lambdaInvokers, logger) {
 		const origin = req.headers.origin;
 		applyCorsResponseHeadersFromConfig(res, behavior.cors, typeof origin === "string" ? origin : void 0);
 	}
-	res.end(originResult.body);
+	res.end(finalBody);
+}
+/** Run a Lambda@Edge response-stage function, returning the modified response (or undefined when no invoker). */
+async function runEdgeResponseStage(assoc, eventType, ctx, edgeInvokers, logger) {
+	const invoke = edgeInvokers.get(assoc.functionLogicalId);
+	if (!invoke) {
+		logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (added after start-up); skipping. Restart start-cloudfront.`);
+		return;
+	}
+	return applyEdgeResponseResult(await invoke(buildEdgeResponseEvent({
+		eventType,
+		config: ctx.config,
+		request: ctx.request,
+		response: {
+			statusCode: ctx.statusCode,
+			headers: ctx.headers
+		}
+	})), {
+		statusCode: ctx.statusCode,
+		headers: ctx.headers
+	}, ctx.body);
+}
+/** Write a Lambda@Edge generated response (request-stage short-circuit), incl. CORS. */
+function writeEdgeResponse(res, result, behavior, req, logger) {
+	if (!req.readableEnded) req.resume();
+	res.statusCode = result.statusCode;
+	setHeadersSafely(res, result.headers, logger);
+	if (result.setCookies.length > 0) try {
+		res.setHeader("set-cookie", result.setCookies);
+	} catch {}
+	if (behavior.cors) {
+		const origin = req.headers.origin;
+		applyCorsResponseHeadersFromConfig(res, behavior.cors, typeof origin === "string" ? origin : void 0);
+	}
+	res.end(result.body);
+}
+/** Convert a CloudFront-Function header map (`{name: CfValue}`) into the raw `{name: string[]}` form. */
+function cfHeadersToRawMap(cf) {
+	const out = {};
+	for (const [name, val] of Object.entries(cf)) if (val.multiValue && val.multiValue.length > 0) out[name] = val.multiValue.map((m) => m.value);
+	else out[name] = [val.value];
+	return out;
+}
+/** Convert a raw `{name: string[]}` header map into Node's `IncomingHttpHeaders` shape. */
+function rawMapToIncomingHeaders(headers) {
+	const out = {};
+	for (const [name, values] of Object.entries(headers)) out[name] = values.length === 1 ? values[0] : values;
+	return out;
 }
 /**
 * Convert Node's `IncomingMessage.headers` (`Record<string, string | string[]>`)
@@ -28974,9 +29565,8 @@ function setHeadersSafely(res, headers, logger) {
 		logger.warn(`Skipping invalid response header '${name}': ${err instanceof Error ? err.message : String(err)}`);
 	}
 }
-async function serveFromOrigin(origin, behavior, args) {
-	const { distribution, logger } = args;
-	if (behavior.hasLambdaEdge) logger.warn(`Behavior ${behavior.pathPattern ?? "(default)"} carries a Lambda@Edge association; cdk-local does not run Lambda@Edge — serving the origin only.`);
+async function serveFromOrigin(origin, args) {
+	const { distribution } = args;
 	if (!origin) return void 0;
 	if (origin.kind === "lambda-url") {
 		const invoke = args.lambdaInvokers.get(origin.functionLogicalId);
@@ -29073,6 +29663,130 @@ function listen(server, host, port) {
 	});
 }
 
+//#endregion
+//#region src/local/cloudfront-kvs-client.ts
+/**
+* Build a {@link KvsDataSource} backed by the deployed store's `GetKey` API.
+* A missing key resolves to `undefined` (the `ResourceNotFoundException` is
+* caught) so the `cf` shim can surface a clean "key not found" — any other
+* error (access denied, throttling) propagates so the user sees the real cause.
+*/
+function createDeployedKvsDataSource(options) {
+	const client = new CloudFrontKeyValueStoreClient({
+		region: options.region ?? "us-east-1",
+		...options.credentials !== void 0 && { credentials: options.credentials }
+	});
+	return {
+		label: `deployed:${options.kvsArn}`,
+		...options.kvsId !== void 0 && { kvsId: options.kvsId },
+		async getValue(key) {
+			try {
+				return (await client.send(new GetKeyCommand({
+					KvsARN: options.kvsArn,
+					Key: key
+				}))).Value;
+			} catch (err) {
+				if (isKeyNotFound(err)) return void 0;
+				throw new Error(`cf.kvs().get('${key}') against ${options.kvsArn} failed: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}
+	};
+}
+/**
+* Resolve a deployed KeyValueStore's ARN (+ Id) from its NAME via the
+* CloudFront control-plane `ListKeyValueStores` API. Needed because
+* `--from-cfn-stack` reads the store's physical id from `ListStackResources`,
+* and for `AWS::CloudFront::KeyValueStore` that physical id is the store NAME
+* (the `Ref` value) — NOT the ARN. The data-plane `GetKey` needs the ARN (which
+* embeds the store's UUID Id), so we look the name up against the account's
+* stores. CloudFront is global, so the client defaults to `us-east-1`. Returns
+* `undefined` on any miss (no match, access denied) so the caller falls back to
+* the unbound-KVS warning.
+*/
+async function resolveDeployedKvsArnByName(name, options = {}) {
+	const client = new CloudFrontClient({
+		region: options.region ?? "us-east-1",
+		...options.credentials !== void 0 && { credentials: options.credentials }
+	});
+	try {
+		for await (const page of paginateListKeyValueStores({ client }, {})) for (const item of page.KeyValueStoreList?.Items ?? []) if (item.Name === name && item.ARN) return {
+			arn: item.ARN,
+			...item.Id !== void 0 && { id: item.Id }
+		};
+	} catch (err) {
+		getLogger().debug(`ListKeyValueStores lookup for '${name}' failed: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+/** True when a GetKey error means the key (or store) was not found, not a real failure. */
+function isKeyNotFound(err) {
+	if (err instanceof ResourceNotFoundException) return true;
+	if (err && typeof err === "object") {
+		if (err.name === "ResourceNotFoundException") return true;
+		if (err.$metadata?.httpStatusCode === 404) return true;
+	}
+	return false;
+}
+
+//#endregion
+//#region src/local/cloudfront-kvs-binding.ts
+/**
+* Build + attach the `cf` module to every KVS-reading function in the
+* distribution. Returns boot warnings for associations that resolved to no
+* binding (the runtime then injects an unbound module so the read fails with a
+* clear actionable error). Idempotent per call — overwrites
+* `cloudfrontModule` so a `--watch` reload rebinds.
+*/
+async function resolveKvsModulesForDistribution(distribution, options) {
+	const warnings = [];
+	for (const fn of collectKvsFunctions(distribution)) {
+		const sources = [];
+		for (const assoc of fn.kvsAssociations ?? []) {
+			const source = await buildSourceForAssociation(assoc, options);
+			if (source) sources.push(source);
+			else {
+				const ref = assoc.kvsLogicalId ?? "<store>";
+				warnings.push(`CloudFront Function '${fn.logicalId}' reads KeyValueStore '${ref}', but no binding resolved it — cf.kvs() reads will fail. Pass --from-cfn-stack to read the deployed store, or --kvs-file ${ref}=<file.json> for a local map.`);
+			}
+		}
+		if (sources.length > 0) fn.cloudfrontModule = createCloudFrontModule(sources);
+		else delete fn.cloudfrontModule;
+	}
+	return { warnings };
+}
+/** Collect the unique compiled functions in the distribution that read a KVS. */
+function collectKvsFunctions(distribution) {
+	const byLogicalId = /* @__PURE__ */ new Map();
+	for (const behavior of distribution.behaviors) for (const fn of [behavior.viewerRequest, behavior.viewerResponse]) if (fn && fn.kvsAssociations && fn.kvsAssociations.length > 0) byLogicalId.set(fn.logicalId, fn);
+	return [...byLogicalId.values()];
+}
+async function buildSourceForAssociation(assoc, options) {
+	if (assoc.kvsLogicalId !== void 0) {
+		const filePath = options.kvsFiles?.get(assoc.kvsLogicalId);
+		if (filePath !== void 0) return createLocalFileKvsDataSource({
+			id: assoc.kvsLogicalId,
+			filePath
+		});
+	}
+	if (typeof assoc.arnValue === "string" && assoc.arnValue.startsWith("arn:")) return makeDeployedSource(assoc.arnValue, idFromArn(assoc.arnValue), options);
+	if (assoc.kvsLogicalId !== void 0 && options.resolveDeployedKvs) {
+		const ref = await options.resolveDeployedKvs(assoc.kvsLogicalId);
+		if (ref) return makeDeployedSource(ref.arn, ref.id, options);
+	}
+}
+function makeDeployedSource(arn, id, options) {
+	return createDeployedKvsDataSource({
+		kvsArn: arn,
+		...id !== void 0 && { kvsId: id },
+		...options.region !== void 0 && { region: options.region },
+		...options.credentials !== void 0 && { credentials: options.credentials }
+	});
+}
+/** The KeyValueStore Id is the ARN's last `/`-segment. */
+function idFromArn(arn) {
+	const slash = arn.lastIndexOf("/");
+	return slash >= 0 && slash < arn.length - 1 ? arn.slice(slash + 1) : void 0;
+}
+
 //#endregion
 //#region src/cli/commands/local-start-cloudfront.ts
 /** Error thrown by `cdkl start-cloudfront` for target / option problems. */
@@ -29097,6 +29811,55 @@ function parseOriginOverrides(values) {
 	return out;
 }
 /**
+* Parse the repeatable `--kvs-file <kvsLogicalId>=<file.json>` overrides into a
+* map. Each entry backs a CloudFront Function's `cf.kvs()` reads with a local
+* JSON map instead of the deployed store — the AWS-free escape hatch for KVS,
+* symmetric with `--origin <id>=<dir>`. The key is the
+* `AWS::CloudFront::KeyValueStore` resource logical id (surfaced in the
+* unbound-KVS boot warning when missing).
+*/
+function parseKvsFileOverrides(values) {
+	const out = /* @__PURE__ */ new Map();
+	for (const raw of values ?? []) {
+		const eq = raw.indexOf("=");
+		if (eq <= 0 || eq === raw.length - 1) throw new LocalStartCloudFrontError(`Invalid --kvs-file '${raw}'. Expected <kvsLogicalId>=<file.json> (e.g. MyKvsStore=./kvs.json).`);
+		out.set(raw.slice(0, eq).trim(), raw.slice(eq + 1).trim());
+	}
+	return out;
+}
+/**
+* Resolve + attach the `cf` KeyValueStore module to every KVS-reading
+* CloudFront Function in the distribution (run after each synth, initial +
+* `--watch` reload). A `--kvs-file` map wins; otherwise `--from-cfn-stack`
+* resolves the deployed store's ARN from state and `cf.kvs().get()` reads it
+* via the `GetKey` API. Unresolved associations log an actionable WARN (the
+* runtime then fails the read with the same guidance).
+*/
+async function attachKvsModules(distribution, stacks, options, profileCredentials, logger) {
+	const kvsFiles = parseKvsFileOverrides(options.kvsFile);
+	const synthRegion = stacks.find((s) => s.stackName === distribution.stackName)?.region;
+	const resolveDeployedKvs = isCfnFlagPresent(options) ? async (kvsLogicalId) => {
+		const provider = createLocalStateProvider(options, distribution.stackName, synthRegion);
+		if (!provider) return void 0;
+		const physicalId = (await provider.load(distribution.stackName, synthRegion))?.resources[kvsLogicalId]?.physicalId;
+		if (!physicalId) return void 0;
+		if (physicalId.startsWith("arn:")) {
+			const id = idFromArn(physicalId);
+			return {
+				arn: physicalId,
+				...id !== void 0 && { id }
+			};
+		}
+		return resolveDeployedKvsArnByName(physicalId, { ...profileCredentials !== void 0 && { credentials: profileCredentials } });
+	} : void 0;
+	const { warnings } = await resolveKvsModulesForDistribution(distribution, {
+		...kvsFiles.size > 0 && { kvsFiles },
+		...resolveDeployedKvs !== void 0 && { resolveDeployedKvs },
+		...profileCredentials !== void 0 && { credentials: profileCredentials }
+	});
+	for (const warning of warnings) logger.warn(warning);
+}
+/**
 * Resolve a CloudFront target string (`Stack/Path` display path or
 * `Stack:LogicalId`) to its stack + `AWS::CloudFront::Distribution` logical id.
 * Mirrors the ALB / ECS resolver target grammar.
@@ -29181,12 +29944,58 @@ async function bootLambdaUrlOrigins(distribution, stacks, opts) {
 		runners
 	};
 }
+/**
+* Boot one warm RIE container per unique Lambda@Edge function across the
+* distribution's behaviors (issue #400), returning the runners + an invoker map
+* keyed by backing-function logical id for {@link startCloudFrontServer}. Each
+* function gets the SAME container env as a direct `cdkl invoke` (declared env
+* vars + `--from-cfn-stack` substitution + `--assume-role` creds) via the shared
+* {@link resolveLambdaContainerEnv}. A function that cannot be booted is
+* warn-and-skipped (its edge stage will not run); booted once at start-up, NOT
+* rebuilt on a `--watch` reload.
+*/
+async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
+	const logger = getLogger();
+	const invokers = /* @__PURE__ */ new Map();
+	const runners = [];
+	const functionLogicalIds = /* @__PURE__ */ new Set();
+	for (const behavior of distribution.behaviors) {
+		const edge = behavior.lambdaEdge;
+		if (!edge) continue;
+		for (const assoc of [
+			edge.viewerRequest,
+			edge.originRequest,
+			edge.originResponse,
+			edge.viewerResponse
+		]) if (assoc) functionLogicalIds.add(assoc.functionLogicalId);
+	}
+	for (const functionLogicalId of functionLogicalIds) try {
+		const lambda = resolveLambdaTarget(functionLogicalId, stacks);
+		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials);
+		const runner = createFrontDoorLambdaRunner(lambda, {
+			containerHost: opts.containerHost,
+			skipPull: opts.skipPull,
+			...opts.envOptions.region !== void 0 && { region: opts.envOptions.region },
+			containerEnv: containerEnv.env,
+			...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
+		});
+		logger.info(`Booting Lambda@Edge container for ${functionLogicalId} (the function runs locally via RIE)...`);
+		await runner.start();
+		runners.push(runner);
+		invokers.set(functionLogicalId, (event) => runner.invoke(event));
+	} catch (err) {
+		logger.warn(`Could not boot Lambda@Edge function '${functionLogicalId}'; its stage will be skipped: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	return {
+		invokers,
+		runners
+	};
+}
 /** Emit boot-time WARNs for parts of the distribution cdk-local does not serve. */
 function warnUnsupported(distribution) {
 	const logger = getLogger();
 	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin '${origin.originId}' is a custom (non-S3, non-Lambda-Function-URL) origin (${origin.domainName}); ${getEmbedConfig().cliName} start-cloudfront serves S3 origins and Lambda Function URL origins only. Requests routed to it return 502.`);
 	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Point it at a directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
-	if (distribution.behaviors.some((b) => b.hasLambdaEdge)) logger.warn("One or more cache behaviors carry a Lambda@Edge association; cdk-local does not run Lambda@Edge functions — only CloudFront Functions + the S3 origin are served.");
 }
 async function localStartCloudFrontCommand(target, options) {
 	const logger = getLogger();
@@ -29241,24 +30050,34 @@ async function localStartCloudFrontCommand(target, options) {
 		...options.profile !== void 0 && { profile: options.profile },
 		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
 	};
-	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, {
+	await attachKvsModules(initial.distribution, initial.stacks, options, profileCredentials, logger);
+	const bootOpts = {
 		containerHost: options.host,
 		skipPull: options.pull === false,
 		envOptions,
 		...profileCredentials !== void 0 && { profileCredentials }
-	});
-	let tls;
-	if (tlsRequested) tls = await resolveFrontDoorTlsMaterials({
-		certPath: options.tlsCert,
-		keyPath: options.tlsKey
-	});
-	const server = await startCloudFrontServer({
-		distribution: initial.distribution,
-		host: options.host,
-		port: basePort,
-		...tls && { tls },
-		...lambdaInvokers.size > 0 && { lambdaInvokers }
-	});
+	};
+	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, bootOpts);
+	const { invokers: edgeInvokers, runners: edgeRunners } = await bootLambdaEdgeFunctions(initial.distribution, initial.stacks, bootOpts);
+	let server;
+	try {
+		let tls;
+		if (tlsRequested) tls = await resolveFrontDoorTlsMaterials({
+			certPath: options.tlsCert,
+			keyPath: options.tlsKey
+		});
+		server = await startCloudFrontServer({
+			distribution: initial.distribution,
+			host: options.host,
+			port: basePort,
+			...tls && { tls },
+			...lambdaInvokers.size > 0 && { lambdaInvokers },
+			...edgeInvokers.size > 0 && { edgeInvokers }
+		});
+	} catch (err) {
+		await Promise.all([...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch(() => void 0)));
+		throw err;
+	}
 	process.stdout.write(`CloudFront distribution serving on ${server.url}  (${initial.distribution.logicalId})\n`);
 	process.stdout.write("^C to stop.\n");
 	let watcher;
@@ -29280,6 +30099,7 @@ async function localStartCloudFrontCommand(target, options) {
 					try {
 						const reloaded = await synthAndResolve();
 						warnUnsupported(reloaded.distribution);
+						await attachKvsModules(reloaded.distribution, reloaded.stacks, options, profileCredentials, logger);
 						server.update(reloaded.distribution);
 						logger.info("Reload complete.");
 					} catch (err) {
@@ -29301,8 +30121,8 @@ async function localStartCloudFrontCommand(target, options) {
 		try {
 			await server.close();
 		} catch {}
-		await Promise.all(lambdaRunners.map((r) => r.stop().catch((err) => {
-			logger.debug(`Lambda origin runner stop failed: ${err instanceof Error ? err.message : String(err)}`);
+		await Promise.all([...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch((err) => {
+			logger.debug(`Lambda runner stop failed: ${err instanceof Error ? err.message : String(err)}`);
 		})));
 		process.exit(exitCode);
 	};
@@ -29333,7 +30153,7 @@ function createLocalStartCloudFrontCommand(opts = {}) {
 * `cmd`.
 */
 function addStartCloudFrontSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind a Lambda Function URL origin's backing Lambda to a deployed CloudFormation stack so its env vars resolve to the deployed physical IDs / exports (ListStackResources). Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs. No effect on a pure-S3 distribution.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's deployed execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
+	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <kvsLogicalId=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is the AWS::CloudFront::KeyValueStore resource logical id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind a Lambda Function URL origin's backing Lambda to a deployed CloudFormation stack so its env vars resolve to the deployed physical IDs / exports (ListStackResources). Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs. No effect on a pure-S3 distribution.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's deployed execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
@@ -34368,5 +35188,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { addRunTaskSpecificOptions as $, buildConnectEvent as $n, createLocalInvokeCommand as $t, resolveCloudFrontTarget as A, attachAuthorizers as An, parseSelectionExpressionPath as Ar, createLocalInvokeAgentCoreCommand as At, compileCloudFrontFunction as B, buildRestV1Event as Bn, AgentCoreResolutionError as Br, AGENTCORE_SIGV4_SERVICE as Bt, addListSpecificOptions as C, verifyJwtAuthorizer as Cn, resolveSingleTarget as Cr, CloudMapRegistry as Ct, addStartCloudFrontSpecificOptions as D, evaluateCachedLambdaPolicy as Dn, discoverWebSocketApis as Dr, getContainerNetworkIp as Dt, LocalStartCloudFrontError as E, computeRequestIdentityHash as En, availableWebSocketApiIdentifiers as Er, setShadowReadyTimeoutMs as Et, CLOUDFRONT_DISTRIBUTION_TYPE as F, matchPreflight as Fn, AGENTCORE_A2A_PROTOCOL as Fr, MCP_CONTAINER_PORT as Ft, createLocalStartAlbCommand as G, VtlEvaluationError as Gn, substituteImagePlaceholders as Gr, downloadAndExtractS3Bundle as Gt, runViewerResponse as H, pickResponseTemplate as Hn, resolveAgentCoreTarget as Hr, AGENTCORE_SESSION_ID_HEADER as Ht, isCloudFrontDistribution as I, matchRoute as In, AGENTCORE_AGUI_PROTOCOL as Ir, MCP_PATH as It, isApplicationLoadBalancer as J, bufferToBody as Jn, buildStsClientConfig as Jr, computeCodeImageTag as Jt, parseLbPortOverrides as K, HOST_GATEWAY_MIN_VERSION as Kn, tryResolveImageFnJoin as Kr, SUPPORTED_CODE_RUNTIMES as Kt, pickFunctionUrlLogicalIdFromOrigin as L, translateLambdaResponse as Ln, AGENTCORE_HTTP_PROTOCOL as Lr, MCP_PROTOCOL_VERSION as Lt, startCloudFrontServer as M, buildCorsConfigByApiId as Mn, discoverRoutes as Mr, A2A_CONTAINER_PORT as Mt, serveFromStaticOrigin as N, buildCorsConfigFromCloudFrontChain as Nn, pickRefLogicalId as Nr, A2A_PATH as Nt, createLocalStartCloudFrontCommand as O, invokeRequestAuthorizer as On, discoverWebSocketApisOrThrow as Or, attachContainerLogStreamer as Ot, serveLambdaUrlOrigin as P, isFunctionUrlOacFronted as Pn, resolveLambdaArnIntrinsic as Pr, a2aInvokeOnce as Pt, serviceStrategy as Q, parseConnectionsPath as Qn, addInvokeSpecificOptions as Qt, pickTargetFunctionLogicalId as R, applyAuthorizerOverlay as Rn, AGENTCORE_MCP_PROTOCOL as Rr, mcpInvokeOnce as Rt, StudioEventBus as S, verifyCognitoJwt as Sn, resolveWatchConfig as Sr, buildCloudMapIndex as St, formatTargetListing as T, buildMethodArn as Tn, listTargets as Tr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Tt, addAlbSpecificOptions as U, selectIntegrationResponse as Un, derivePseudoParametersFromRegion as Ur, invokeAgentCore as Ut, runViewerRequest as V, evaluateResponseParameters as Vn, pickAgentCoreCandidateStack as Vr, signAgentCoreInvocation as Vt, albStrategy as W, tryParseStatus as Wn, formatStateRemedy as Wr, waitForAgentCorePing as Wt, addStartServiceSpecificOptions as X, buildMgmtEndpointEnvUrl as Xn, toCmdArgv as Xt, resolveAlbFrontDoor as Y, ConnectionRegistry as Yn, resolveProfileCredentials as Yr, renderCodeDockerfile as Yt, createLocalStartServiceCommand as Z, handleConnectionsRequest as Zn, classifySourceChange as Zt, filterStudioTargetGroups as _, resolveServiceIntegrationParameters as _n, resolveCfnRegion as _r, resolveImageOverrides as _t, createLocalStudioCommand as a, createFileWatcher as an, resolveRuntimeFileExtension as ar, buildEcsImageResolutionContext$1 as at, renderStudioHtml as b, buildJwksUrlFromIssuer as bn, collectSsmParameterRefs as br, isLocalCdkAssetImage as bt, startStudioProxy as c, materializeLayerFromArn as cn, substituteAgainstState as cr, parseRestartPolicy as ct, createStudioDispatcher as d, filterRoutesByApiIdentifier as dn, substituteEnvVarsFromStateAsync as dr, runEcsServiceEmulator as dt, addStartApiSpecificOptions as en, buildDisconnectEvent as er, createLocalRunTaskCommand as et, filterStudioCustomResources as f, filterRoutesByApiIdentifiers as fn, LocalStateSourceError as fr, ImageOverrideError as ft, annotatePinnedEcsTargets as g, resolveSelectionExpression as gn, resolveCfnFallbackRegion as gr, parseImageOverrideFlags as gt, annotateEcsTaskPinnedTargets as h, startApiServer as hn, rejectExplicitCfnStackWithMultipleStacks as hr, mergeForService as ht, coerceStopRequest as i, createAuthorizerCache as in, resolveRuntimeCodeMountPath as ir, addImageOverrideOptions as it, matchBehavior as j, applyCorsResponseHeaders as jn, webSocketApiMatchesIdentifier as jr, invokeAgentCoreWs as jt, parseOriginOverrides as k, invokeTokenAuthorizer as kn, filterWebSocketApisByIdentifiers as kr, addInvokeAgentCoreSpecificOptions as kt, relayServeRequest as l, resolveEnvVars$1 as ln, substituteAgainstStateAsync as lr, resolveEcsAssumeRoleOption as lt, annotateAlbPinnedBackingServices as m, readMtlsMaterialsFromDisk as mn, isCfnFlagPresent as mr, enforceImageOverrideOrphans as mt, coerceRunRequest as n, createWatchPredicates as nn, architectureToPlatform as nr, addCommonEcsServiceOptions as nt, resolveServeBaseUrl as o, attachStageContext as on, resolveRuntimeImage as or, ecsClusterOption as ot, isCustomResourceLambdaTarget as p, groupRoutesByServer as pn, createLocalStateProvider as pr, buildImageOverrideTag as pt, resolveAlbTarget as q, probeHostGatewaySupport as qn, LocalInvokeBuildError as qr, buildAgentCoreCodeImage as qt, coerceServeRequest as r, resolveApiTargetSubset as rn, buildContainerImage as rr, addEcsAssumeRoleOptions as rt, createStudioServeManager as s, buildStageMap as sn, EcsTaskResolutionError as sr, parseMaxTasks as st, addStudioSpecificOptions as t, createLocalStartApiCommand as tn, buildMessageEvent as tr, MAX_TASKS_SUBNET_RANGE_CAP as tt, reinvoke as u, availableApiIdentifiers as un, substituteEnvVarsFromState as ur, resolveSharedSidecarCredentials as ut, startStudioServer as v, defaultCredentialsLoader as vn, resolveCfnStackName as vr, runImageOverrideBuilds as vt, createLocalListCommand as w, verifyJwtViaDiscovery as wn, countTargets as wr, DEFAULT_SHADOW_READY_TIMEOUT_MS as wt, createStudioStore as x, createJwksCache as xn, resolveSsmParameters as xr, listPinnedTargets as xt, toStudioTargetGroups as y, buildCognitoJwksUrl as yn, CfnLocalStateProvider as yr, describePinnedImageUri as yt, resolveCloudFrontDistribution as z, buildHttpApiV2Event as zn, AGENTCORE_RUNTIME_TYPE as zr, parseSseForJsonRpc as zt };
-//# sourceMappingURL=local-studio-Downi4pd.js.map
+export { resolveCloudFrontDistribution as $, matchPreflight as $n, AGENTCORE_A2A_PROTOCOL as $r, MCP_CONTAINER_PORT as $t, parseOriginOverrides as A, filterRoutesByApiIdentifiers as An, LocalStateSourceError as Ar, ImageOverrideError as At, applyEdgeRequestResult as B, verifyCognitoJwt as Bn, resolveWatchConfig as Br, buildCloudMapIndex as Bt, addListSpecificOptions as C, createFileWatcher as Cn, resolveRuntimeFileExtension as Cr, buildEcsImageResolutionContext$1 as Ct, addStartCloudFrontSpecificOptions as D, resolveEnvVars$1 as Dn, substituteAgainstStateAsync as Dr, resolveEcsAssumeRoleOption as Dt, LocalStartCloudFrontError as E, materializeLayerFromArn as En, substituteAgainstState as Er, parseRestartPolicy as Et, resolveDeployedKvsArnByName as F, resolveServiceIntegrationParameters as Fn, resolveCfnRegion as Fr, resolveImageOverrides as Ft, httpHeadersToEdge as G, evaluateCachedLambdaPolicy as Gn, discoverWebSocketApis as Gr, getContainerNetworkIp as Gt, buildEdgeRequestEvent as H, verifyJwtViaDiscovery as Hn, countTargets as Hr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Ht, matchBehavior as I, defaultCredentialsLoader as In, resolveCfnStackName as Ir, runImageOverrideBuilds as It, isCloudFrontDistribution as J, attachAuthorizers as Jn, parseSelectionExpressionPath as Jr, createLocalInvokeAgentCoreCommand as Jt, CLOUDFRONT_DISTRIBUTION_TYPE as K, invokeRequestAuthorizer as Kn, discoverWebSocketApisOrThrow as Kr, attachContainerLogStreamer as Kt, startCloudFrontServer as L, buildCognitoJwksUrl as Ln, CfnLocalStateProvider as Lr, describePinnedImageUri as Lt, idFromArn as M, readMtlsMaterialsFromDisk as Mn, isCfnFlagPresent as Mr, enforceImageOverrideOrphans as Mt, resolveKvsModulesForDistribution as N, startApiServer as Nn, rejectExplicitCfnStackWithMultipleStacks as Nr, mergeForService as Nt, createLocalStartCloudFrontCommand as O, availableApiIdentifiers as On, substituteEnvVarsFromState as Or, resolveSharedSidecarCredentials as Ot, createDeployedKvsDataSource as P, resolveSelectionExpression as Pn, resolveCfnFallbackRegion as Pr, parseImageOverrideFlags as Pt, pickTargetFunctionLogicalId as Q, isFunctionUrlOacFronted as Qn, resolveLambdaArnIntrinsic as Qr, a2aInvokeOnce as Qt, serveFromStaticOrigin as R, buildJwksUrlFromIssuer as Rn, collectSsmParameterRefs as Rr, isLocalCdkAssetImage as Rt, StudioEventBus as S, createAuthorizerCache as Sn, resolveRuntimeCodeMountPath as Sr, addImageOverrideOptions as St, formatTargetListing as T, buildStageMap as Tn, EcsTaskResolutionError as Tr, parseMaxTasks as Tt, buildEdgeResponseEvent as U, buildMethodArn as Un, listTargets as Ur, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Ut, applyEdgeResponseResult as V, verifyJwtAuthorizer as Vn, resolveSingleTarget as Vr, CloudMapRegistry as Vt, edgeHeadersToHttp as W, computeRequestIdentityHash as Wn, availableWebSocketApiIdentifiers as Wr, setShadowReadyTimeoutMs as Wt, pickKvsLogicalIdFromArn as X, buildCorsConfigByApiId as Xn, discoverRoutes as Xr, A2A_CONTAINER_PORT as Xt, pickFunctionUrlLogicalIdFromOrigin as Y, applyCorsResponseHeaders as Yn, webSocketApiMatchesIdentifier as Yr, invokeAgentCoreWs as Yt, pickLambdaEdgeFunctionLogicalId as Z, buildCorsConfigFromCloudFrontChain as Zn, pickRefLogicalId as Zr, A2A_PATH as Zt, filterStudioTargetGroups as _, createLocalInvokeCommand as _n, buildConnectEvent as _r, addRunTaskSpecificOptions as _t, createLocalStudioCommand as a, pickAgentCoreCandidateStack as ai, signAgentCoreInvocation as an, evaluateResponseParameters as ar, createLocalFileKvsDataSource as at, renderStudioHtml as b, createWatchPredicates as bn, architectureToPlatform as br, addCommonEcsServiceOptions as bt, startStudioProxy as c, formatStateRemedy as ci, waitForAgentCorePing as cn, tryParseStatus as cr, albStrategy as ct, createStudioDispatcher as d, LocalInvokeBuildError as di, buildAgentCoreCodeImage as dn, probeHostGatewaySupport as dr, resolveAlbTarget as dt, AGENTCORE_AGUI_PROTOCOL as ei, MCP_PATH as en, matchRoute as er, compileCloudFrontFunction as et, filterStudioCustomResources as f, buildStsClientConfig as fi, computeCodeImageTag as fn, bufferToBody as fr, isApplicationLoadBalancer as ft, annotatePinnedEcsTargets as g, addInvokeSpecificOptions as gn, parseConnectionsPath as gr, serviceStrategy as gt, annotateEcsTaskPinnedTargets as h, classifySourceChange as hn, handleConnectionsRequest as hr, createLocalStartServiceCommand as ht, coerceStopRequest as i, AgentCoreResolutionError as ii, AGENTCORE_SIGV4_SERVICE as in, buildRestV1Event as ir, createCloudFrontModule as it, resolveCloudFrontTarget as j, groupRoutesByServer as jn, createLocalStateProvider as jr, buildImageOverrideTag as jt, parseKvsFileOverrides as k, filterRoutesByApiIdentifier as kn, substituteEnvVarsFromStateAsync as kr, runEcsServiceEmulator as kt, relayServeRequest as l, substituteImagePlaceholders as li, downloadAndExtractS3Bundle as ln, VtlEvaluationError as lr, createLocalStartAlbCommand as lt, annotateAlbPinnedBackingServices as m, toCmdArgv as mn, buildMgmtEndpointEnvUrl as mr, addStartServiceSpecificOptions as mt, coerceRunRequest as n, AGENTCORE_MCP_PROTOCOL as ni, mcpInvokeOnce as nn, applyAuthorizerOverlay as nr, runViewerResponse as nt, resolveServeBaseUrl as o, resolveAgentCoreTarget as oi, AGENTCORE_SESSION_ID_HEADER as on, pickResponseTemplate as or, createUnboundCloudFrontModule as ot, isCustomResourceLambdaTarget as p, resolveProfileCredentials as pi, renderCodeDockerfile as pn, ConnectionRegistry as pr, resolveAlbFrontDoor as pt, extractKvsAssociations as q, invokeTokenAuthorizer as qn, filterWebSocketApisByIdentifiers as qr, addInvokeAgentCoreSpecificOptions as qt, coerceServeRequest as r, AGENTCORE_RUNTIME_TYPE as ri, parseSseForJsonRpc as rn, buildHttpApiV2Event as rr, stripCloudFrontImport as rt, createStudioServeManager as s, derivePseudoParametersFromRegion as si, invokeAgentCore as sn, selectIntegrationResponse as sr, addAlbSpecificOptions as st, addStudioSpecificOptions as t, AGENTCORE_HTTP_PROTOCOL as ti, MCP_PROTOCOL_VERSION as tn, translateLambdaResponse as tr, runViewerRequest as tt, reinvoke as u, tryResolveImageFnJoin as ui, SUPPORTED_CODE_RUNTIMES as un, HOST_GATEWAY_MIN_VERSION as ur, parseLbPortOverrides as ut, startStudioServer as v, addStartApiSpecificOptions as vn, buildDisconnectEvent as vr, createLocalRunTaskCommand as vt, createLocalListCommand as w, attachStageContext as wn, resolveRuntimeImage as wr, ecsClusterOption as wt, createStudioStore as x, resolveApiTargetSubset as xn, buildContainerImage as xr, addEcsAssumeRoleOptions as xt, toStudioTargetGroups as y, createLocalStartApiCommand as yn, buildMessageEvent as yr, MAX_TASKS_SUBNET_RANGE_CAP as yt, serveLambdaUrlOrigin as z, createJwksCache as zn, resolveSsmParameters as zr, listPinnedTargets as zt };
+//# sourceMappingURL=local-studio--ndMb9dM.js.map