cdk-local 0.120.0 → 0.121.1

package/dist/{local-studio--ndMb9dM.js → local-studio-CFgAjIjT.js}

@@ -16,6 +16,7 @@ import { GetParameterCommand, GetParametersCommand, SSMClient } from "@aws-sdk/c
 import { execFile, spawn } from "node:child_process";
 import { connect, createServer } from "node:net";
 import { promisify } from "node:util";
+import * as nodeCrypto from "node:crypto";
 import { X509Certificate, createHash, createHmac, createPublicKey, createVerify, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { ECRClient, GetAuthorizationTokenCommand } from "@aws-sdk/client-ecr";
 import { readFile } from "fs/promises";
@@ -33,6 +34,8 @@ import { Sha256 } from "@aws-crypto/sha256-js";
 import { SignatureV4 } from "@smithy/signature-v4";
 import graphlib from "graphlib";
 import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import * as nodeBuffer from "node:buffer";
+import * as nodeQuerystring from "node:querystring";
 import * as vm from "node:vm";
 import "@aws-sdk/signature-v4a";
 import { CloudFrontClient, paginateListKeyValueStores } from "@aws-sdk/client-cloudfront";
@@ -18100,7 +18103,7 @@ function computeCodeImageTag(sourceDir, runtime, entryPoint, dockerfile) {
 async function downloadAndExtractS3Bundle(location, options = {}) {
 	const ref = formatRef(location);
 	getLogger().info(`Downloading fromS3 code bundle ${ref}...`);
-	const bytes = await (options.fetchObject ?? defaultFetchObject(options))(location);
+	const bytes = await (options.fetchObject ?? defaultFetchObject$1(options))(location);
 	let files;
 	try {
 		files = unzipSync(bytes);
@@ -18147,7 +18150,7 @@ function resolveSafeEntryPath(root, entry) {
 	if (dest !== root && !dest.startsWith(rootWithSep)) throw new CdkLocalError(`Refusing to extract a fromS3 bundle entry that escapes the target dir: '${entry}'.`, "LOCAL_INVOKE_AGENTCORE_S3_BUNDLE_ZIP_SLIP");
 	return dest;
 }
-function defaultFetchObject(options) {
+function defaultFetchObject$1(options) {
 	return async (location) => {
 		const { S3Client, GetObjectCommand } = await import("@aws-sdk/client-s3");
 		const client = new S3Client({
@@ -28187,6 +28190,44 @@ function createLocalFileKvsDataSource(args) {
 //#endregion
 //#region src/local/cloudfront-function-runtime.ts
 /**
+* The CloudFront Functions JS 2.0 runtime exposes a set of globals + `require`
+* modules that a bare `node:vm` context does NOT provide — code that uses any
+* of them works in production but fails locally with a `ReferenceError`
+* (issue #410). Reproduce them with their Node equivalents:
+*
+*   - globals: `Buffer`, `atob` / `btoa`, `TextEncoder` / `TextDecoder`
+*     (the 2.0 runtime's documented globals / built-in objects);
+*   - `require('crypto')` (`createHash` / `createHmac`, md5 / sha1 / sha256),
+*     `require('querystring')`, and `require('buffer')` — backed by the Node
+*     modules (a superset of the 2.0 runtime's documented subset, which is the
+*     right trade-off for a dev tool: a function using only the documented API
+*     behaves identically; an undocumented Node-only API would work locally but
+*     not deployed).
+*
+* `console` is added by the caller. A `require` of anything other than the
+* three modules above throws, and `fs` / `process` / timers / network / `eval`
+* are not provided as globals — matching the deployed runtime's restricted
+* features (a fidelity convenience, not a hard isolation guarantee; see the
+* module docstring).
+*/
+function cloudFrontRuntimeRequire(name) {
+	if (name === "crypto") return nodeCrypto;
+	if (name === "querystring") return nodeQuerystring;
+	if (name === "buffer") return nodeBuffer;
+	throw new Error(`Cannot find module '${name}'. CloudFront Functions only provides the 'crypto', 'querystring', and 'buffer' built-in modules.`);
+}
+/** The CloudFront-Functions-2.0 globals + `require` to merge into a sandbox. */
+function cloudFrontRuntimeGlobals() {
+	return {
+		Buffer,
+		atob,
+		btoa,
+		TextEncoder,
+		TextDecoder,
+		require: cloudFrontRuntimeRequire
+	};
+}
+/**
 * Hard cap on a single CloudFront Function's synchronous run. The deployed
 * runtime caps CPU at ~1ms; locally we are generous but still bound it so a
 * runaway `while (true) {}` in a function fails that one request with a clear
@@ -28237,7 +28278,10 @@ function compileCloudFrontFunction(logicalId, code, runtime) {
 	}
 	let hasHandler;
 	try {
-		const probeGlobals = { console };
+		const probeGlobals = {
+			console,
+			...cloudFrontRuntimeGlobals()
+		};
 		if (bindingName) probeGlobals[bindingName] = createUnboundCloudFrontModule(logicalId);
 		const probeContext = vm.createContext(probeGlobals);
 		hasHandler = new vm.Script(`${source}\n;typeof handler === 'function'`).runInContext(probeContext, { timeout: FUNCTION_TIMEOUT_MS });
@@ -28262,6 +28306,7 @@ function compileCloudFrontFunction(logicalId, code, runtime) {
 async function invokeCloudFrontFunction(fn, event) {
 	const sandbox = {
 		console,
+		...cloudFrontRuntimeGlobals(),
 		[EVENT_GLOBAL]: event
 	};
 	if (fn.cloudfrontBindingName) sandbox[fn.cloudfrontBindingName] = fn.cloudfrontModule ?? createUnboundCloudFrontModule(fn.logicalId);
@@ -29182,15 +29227,11 @@ function serveFromStaticOrigin(input) {
 		headers: { "content-type": contentTypeForKey(key) },
 		body: direct
 	};
-	const errorResponses = input.customErrorResponses ?? [];
-	for (const code of [403, 404]) {
-		const match = errorResponses.find((e) => e.errorCode === code);
-		if (!match || !match.responsePagePath) continue;
-		const errorKey = stripLeadingSlash(match.responsePagePath);
-		const body = readKey(input.localDirs, errorKey);
+	for (const candidate of resolveErrorResponseCandidates(input.customErrorResponses)) {
+		const body = readKey(input.localDirs, candidate.errorKey);
 		if (body) return {
-			statusCode: match.responseCode ?? code,
-			headers: { "content-type": contentTypeForKey(errorKey) },
+			statusCode: candidate.responseCode,
+			headers: { "content-type": contentTypeForKey(candidate.errorKey) },
 			body
 		};
 	}
@@ -29201,6 +29242,27 @@ function serveFromStaticOrigin(input) {
 	};
 }
 /**
+* Resolve the ordered list of custom-error-page candidates to try when an
+* origin object is missing/forbidden, shared by the local-dir static origin and
+* the deployed-S3 read-through origin so the 403-then-404 priority + the
+* `ResponseCode` mapping live in ONE place. We try 403 first then 404 because a
+* missing key on an OAC-fronted private bucket returns 403 AccessDenied (the
+* common static-site setup), but an app that mapped 404 instead is also honored.
+*/
+function resolveErrorResponseCandidates(customErrorResponses) {
+	const errorResponses = customErrorResponses ?? [];
+	const out = [];
+	for (const code of [403, 404]) {
+		const match = errorResponses.find((e) => e.errorCode === code);
+		if (!match || !match.responsePagePath) continue;
+		out.push({
+			errorKey: stripLeadingSlash(match.responsePagePath),
+			responseCode: match.responseCode ?? code
+		});
+	}
+	return out;
+}
+/**
 * Map a request URI to an S3 object key. The query string / fragment is
 * dropped, the leading slash is removed, and the root path (`/` or empty)
 * resolves to the default root object. A URI ending in `/` is NOT auto-indexed
@@ -29297,9 +29359,10 @@ async function startCloudFrontServer(options) {
 	const logger = getLogger().child("cloudfront");
 	const lambdaInvokers = options.lambdaInvokers ?? /* @__PURE__ */ new Map();
 	const edgeInvokers = options.edgeInvokers ?? /* @__PURE__ */ new Map();
+	const s3OriginReaders = options.s3OriginReaders ?? /* @__PURE__ */ new Map();
 	const state = { distribution: options.distribution };
 	const handler = (req, res) => {
-		handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, logger).catch((err) => {
+		handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger).catch((err) => {
 			logger.warn(`Request handling failed: ${err instanceof Error ? err.message : String(err)}`);
 			if (!res.headersSent) {
 				res.statusCode = 500;
@@ -29329,7 +29392,7 @@ async function startCloudFrontServer(options) {
 	};
 }
 /** The per-request pipeline: behavior match -> viewer-request -> origin -> viewer-response. */
-async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, logger) {
+async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger) {
 	const distribution = state.distribution;
 	const rawUrl = req.url ?? "/";
 	const queryIdx = rawUrl.indexOf("?");
@@ -29420,6 +29483,7 @@ async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, lo
 		sourceIp: clientIp,
 		distribution,
 		lambdaInvokers,
+		s3OriginReaders,
 		logger
 	});
 	if (!originResult) return writePlain(res, 502, originUnavailableMessage(origin, behavior));
@@ -29591,6 +29655,20 @@ async function serveFromOrigin(origin, args) {
 			...result.cookies.length > 0 && { setCookies: result.cookies }
 		};
 	}
+	if (origin.kind === "s3-deployed") {
+		const reader = args.s3OriginReaders.get(origin.originId);
+		if (!reader) return void 0;
+		const result = await reader({
+			uri: args.uri,
+			...distribution.defaultRootObject !== void 0 && { defaultRootObject: distribution.defaultRootObject },
+			customErrorResponses: distribution.customErrorResponses
+		});
+		return {
+			statusCode: result.statusCode,
+			headers: result.headers,
+			body: result.body
+		};
+	}
 	if (origin.kind !== "s3") return void 0;
 	const result = serveFromStaticOrigin({
 		localDirs: origin.localDirs,
@@ -29608,6 +29686,8 @@ function originUnavailableMessage(origin, behavior) {
 	if (!origin) return `Behavior ${behavior.pathPattern ?? "(default)"} targets unknown origin '${behavior.targetOriginId}'.\n`;
 	if (origin.kind === "lambda-url") return `Origin '${origin.originId}' is a Lambda Function URL origin whose backing function '${origin.functionLogicalId}' was not booted (it was added after start-up). Restart start-cloudfront.\n`;
 	if (origin.kind === "custom") return `Origin '${origin.originId}' is a custom (non-S3) origin (${origin.domainName}). cdkl start-cloudfront serves S3 origins and Lambda Function URL origins only.
+`;
+	if (origin.kind === "s3-deployed") return `Origin '${origin.originId}' is a deployed-S3 origin (bucket '${origin.bucketName}') whose reader was not booted (it was promoted after start-up). Restart start-cloudfront.
 `;
 	return `Origin '${origin.originId}' is an S3 origin with no resolvable local source. Point it at a directory with --origin ${origin.originId}=<dir>.\n`;
 }
@@ -29663,6 +29743,101 @@ function listen(server, host, port) {
 	});
 }
 
+//#endregion
+//#region src/local/cloudfront-s3-origin.ts
+/**
+* Build a reader that serves a deployed S3 bucket on demand. The S3 client is
+* created lazily on first read (and reused) so an all-local distribution never
+* touches the SDK. Boot-time bound to one `bucketName`; one reader per origin.
+*/
+function createS3OriginReader(bucketName, options = {}) {
+	const fetchObject = options.fetchObject ?? defaultFetchObject(bucketName, options);
+	let deniedWarned = false;
+	return async (input) => {
+		const key = uriToKey(input.uri, input.defaultRootObject);
+		if (key !== "") {
+			const direct = await fetchObject(key);
+			if (direct.kind === "found") return {
+				statusCode: 200,
+				headers: { "content-type": contentTypeForKey(key) },
+				body: direct.body
+			};
+			if (direct.kind === "denied" && !deniedWarned) {
+				deniedWarned = true;
+				getLogger().warn(`S3 denied reading '${key}' from bucket '${bucketName}'. If this is an OAC-locked / private bucket your credentials cannot read, point the origin at a local directory with --origin <originId>=<dir> (or use credentials with s3:GetObject on the bucket). ${getEmbedConfig().cliName} start-cloudfront reads the origin from real S3.`);
+			}
+			if (direct.kind === "error") getLogger().warn(`S3 read of '${key}' from bucket '${bucketName}' failed: ${direct.message}`);
+		}
+		for (const candidate of resolveErrorResponseCandidates(input.customErrorResponses)) {
+			const page = await fetchObject(candidate.errorKey);
+			if (page.kind === "found") return {
+				statusCode: candidate.responseCode,
+				headers: { "content-type": contentTypeForKey(candidate.errorKey) },
+				body: page.body
+			};
+		}
+		return {
+			statusCode: 404,
+			headers: { "content-type": "text/plain; charset=utf-8" },
+			body: Buffer.from(`Not found: ${input.uri}\n`)
+		};
+	};
+}
+/** The default fetcher: a real S3 `GetObject`, classifying the SDK error into the outcome union. */
+function defaultFetchObject(bucketName, options) {
+	let init = null;
+	const getAccess = () => {
+		if (!init) init = (async () => {
+			const { S3Client, GetObjectCommand } = await import("@aws-sdk/client-s3");
+			return {
+				client: new S3Client({
+					...options.region && { region: options.region },
+					...options.credentials && { credentials: {
+						accessKeyId: options.credentials.accessKeyId,
+						secretAccessKey: options.credentials.secretAccessKey,
+						...options.credentials.sessionToken && { sessionToken: options.credentials.sessionToken }
+					} }
+				}),
+				GetObjectCommand
+			};
+		})();
+		return init;
+	};
+	return async (key) => {
+		try {
+			const { client, GetObjectCommand } = await getAccess();
+			const res = await client.send(new GetObjectCommand({
+				Bucket: bucketName,
+				Key: key
+			}));
+			if (!res.Body) return { kind: "not-found" };
+			const bytes = await res.Body.transformToByteArray();
+			return {
+				kind: "found",
+				body: Buffer.from(bytes)
+			};
+		} catch (err) {
+			return classifyS3Error(err);
+		}
+	};
+}
+/**
+* Classify an S3 SDK error: a missing key (`NoSuchKey` / 404) is `not-found`
+* (try the SPA fallback), an `AccessDenied` / 403 is `denied` (a credential /
+* OAC config problem), anything else is `error`.
+*/
+function classifyS3Error(err) {
+	const e = err;
+	const status = e?.$metadata?.httpStatusCode;
+	const name = e?.name;
+	if (status === 404 || name === "NoSuchKey" || name === "NotFound") return { kind: "not-found" };
+	if (status === 403 || name === "AccessDenied" || name === "Forbidden") return { kind: "denied" };
+	return {
+		kind: "error",
+		message: err instanceof Error ? err.message : String(err)
+	};
+}
+
 //#endregion
 //#region src/local/cloudfront-kvs-client.ts
 /**
@@ -29995,7 +30170,72 @@ async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
 function warnUnsupported(distribution) {
 	const logger = getLogger();
 	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin '${origin.originId}' is a custom (non-S3, non-Lambda-Function-URL) origin (${origin.domainName}); ${getEmbedConfig().cliName} start-cloudfront serves S3 origins and Lambda Function URL origins only. Requests routed to it return 502.`);
-	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Point it at a directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
+	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass --from-cfn-stack to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
+}
+/**
+* Promote each S3 origin with no local BucketDeployment source (`s3-unresolved`)
+* to a deployed-S3 read-through origin (issue #405), building one
+* {@link S3OriginReader} per origin. This is the front/back-split path: the CDK
+* repo defines the distribution + bucket but the static files were uploaded out
+* of band, so there is nothing in the cloud assembly to serve locally. Under
+* `--from-cfn-stack`, the bucket's physical NAME is resolved from deployed state
+* (`ListStackResources`) and the reader serves it from real S3 on demand.
+*
+* Returns the readers (keyed by origin id, handed to the server) + the
+* origin-id -> bucket-name map (re-applied on each `--watch` reload via
+* {@link annotateDeployedS3Origins}, since the pure resolver re-emits the origin
+* as `s3-unresolved`). A no-op without `--from-cfn-stack` or when the bucket's
+* physical id is not in state (the origin stays `s3-unresolved` -> the existing
+* boot WARN + 502, with `--origin <id>=<dir>` as the escape hatch).
+*/
+async function resolveDeployedS3Origins(distribution, stacks, options, profileCredentials, logger) {
+	const readers = /* @__PURE__ */ new Map();
+	const buckets = /* @__PURE__ */ new Map();
+	if (!isCfnFlagPresent(options)) return {
+		readers,
+		buckets
+	};
+	const synthRegion = stacks.find((s) => s.stackName === distribution.stackName)?.region;
+	const region = options.stackRegion ?? options.region ?? synthRegion;
+	const provider = createLocalStateProvider(options, distribution.stackName, synthRegion);
+	const record = provider ? await provider.load(distribution.stackName, synthRegion) : void 0;
+	for (const origin of [...distribution.origins.values()]) {
+		if (origin.kind !== "s3-unresolved" || origin.bucketLogicalId === void 0) continue;
+		const bucketName = record?.resources[origin.bucketLogicalId]?.physicalId;
+		if (!bucketName) continue;
+		readers.set(origin.originId, createS3OriginReader(bucketName, {
+			...region !== void 0 && { region },
+			...profileCredentials !== void 0 && { credentials: profileCredentials }
+		}));
+		buckets.set(origin.originId, bucketName);
+		distribution.origins.set(origin.originId, {
+			kind: "s3-deployed",
+			originId: origin.originId,
+			bucketName
+		});
+		logger.info(`Origin '${origin.originId}': no local BucketDeployment source; serving from deployed S3 (bucket=${bucketName}) on demand under --from-cfn-stack.`);
+	}
+	return {
+		readers,
+		buckets
+	};
+}
+/**
+* Re-apply the boot-time deployed-S3 promotion to a freshly re-synthed
+* distribution on a `--watch` reload: the pure resolver re-emits the origin as
+* `s3-unresolved`, so rewrite it back to `s3-deployed` (same bucket name) so it
+* dispatches to the boot-time reader. The S3 readers themselves are boot-time
+* only (like the Function URL origin containers), so nothing is rebuilt here.
+*/
+function annotateDeployedS3Origins(distribution, buckets) {
+	for (const [originId, bucketName] of buckets) {
+		const origin = distribution.origins.get(originId);
+		if (origin && origin.kind === "s3-unresolved") distribution.origins.set(originId, {
+			kind: "s3-deployed",
+			originId,
+			bucketName
+		});
+	}
 }
 async function localStartCloudFrontCommand(target, options) {
 	const logger = getLogger();
@@ -30041,8 +30281,9 @@ async function localStartCloudFrontCommand(target, options) {
 		};
 	};
 	const initial = await synthAndResolve();
-	warnUnsupported(initial.distribution);
 	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
+	const deployedS3 = await resolveDeployedS3Origins(initial.distribution, initial.stacks, options, profileCredentials, logger);
+	warnUnsupported(initial.distribution);
 	const envOptions = {
 		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
 		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
@@ -30072,7 +30313,8 @@ async function localStartCloudFrontCommand(target, options) {
 			port: basePort,
 			...tls && { tls },
 			...lambdaInvokers.size > 0 && { lambdaInvokers },
-			...edgeInvokers.size > 0 && { edgeInvokers }
+			...edgeInvokers.size > 0 && { edgeInvokers },
+			...deployedS3.readers.size > 0 && { s3OriginReaders: deployedS3.readers }
 		});
 	} catch (err) {
 		await Promise.all([...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch(() => void 0)));
@@ -30098,6 +30340,7 @@ async function localStartCloudFrontCommand(target, options) {
 				reloadChain = reloadChain.then(async () => {
 					try {
 						const reloaded = await synthAndResolve();
+						annotateDeployedS3Origins(reloaded.distribution, deployedS3.buckets);
 						warnUnsupported(reloaded.distribution);
 						await attachKvsModules(reloaded.distribution, reloaded.stacks, options, profileCredentials, logger);
 						server.update(reloaded.distribution);
@@ -30153,7 +30396,7 @@ function createLocalStartCloudFrontCommand(opts = {}) {
 * `cmd`.
 */
 function addStartCloudFrontSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <kvsLogicalId=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is the AWS::CloudFront::KeyValueStore resource logical id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind a Lambda Function URL origin's backing Lambda to a deployed CloudFormation stack so its env vars resolve to the deployed physical IDs / exports (ListStackResources). Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs. No effect on a pure-S3 distribution.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's deployed execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
+	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <kvsLogicalId=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is the AWS::CloudFront::KeyValueStore resource logical id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind to a deployed CloudFormation stack (ListStackResources). Resolves an S3 origin that has no local BucketDeployment source to its deployed bucket and serves it from real S3 on demand (the front/back-split case: files uploaded out of band), and resolves a Lambda Function URL / Lambda@Edge function's env vars to the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's deployed execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
@@ -35188,5 +35431,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { resolveCloudFrontDistribution as $, matchPreflight as $n, AGENTCORE_A2A_PROTOCOL as $r, MCP_CONTAINER_PORT as $t, parseOriginOverrides as A, filterRoutesByApiIdentifiers as An, LocalStateSourceError as Ar, ImageOverrideError as At, applyEdgeRequestResult as B, verifyCognitoJwt as Bn, resolveWatchConfig as Br, buildCloudMapIndex as Bt, addListSpecificOptions as C, createFileWatcher as Cn, resolveRuntimeFileExtension as Cr, buildEcsImageResolutionContext$1 as Ct, addStartCloudFrontSpecificOptions as D, resolveEnvVars$1 as Dn, substituteAgainstStateAsync as Dr, resolveEcsAssumeRoleOption as Dt, LocalStartCloudFrontError as E, materializeLayerFromArn as En, substituteAgainstState as Er, parseRestartPolicy as Et, resolveDeployedKvsArnByName as F, resolveServiceIntegrationParameters as Fn, resolveCfnRegion as Fr, resolveImageOverrides as Ft, httpHeadersToEdge as G, evaluateCachedLambdaPolicy as Gn, discoverWebSocketApis as Gr, getContainerNetworkIp as Gt, buildEdgeRequestEvent as H, verifyJwtViaDiscovery as Hn, countTargets as Hr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Ht, matchBehavior as I, defaultCredentialsLoader as In, resolveCfnStackName as Ir, runImageOverrideBuilds as It, isCloudFrontDistribution as J, attachAuthorizers as Jn, parseSelectionExpressionPath as Jr, createLocalInvokeAgentCoreCommand as Jt, CLOUDFRONT_DISTRIBUTION_TYPE as K, invokeRequestAuthorizer as Kn, discoverWebSocketApisOrThrow as Kr, attachContainerLogStreamer as Kt, startCloudFrontServer as L, buildCognitoJwksUrl as Ln, CfnLocalStateProvider as Lr, describePinnedImageUri as Lt, idFromArn as M, readMtlsMaterialsFromDisk as Mn, isCfnFlagPresent as Mr, enforceImageOverrideOrphans as Mt, resolveKvsModulesForDistribution as N, startApiServer as Nn, rejectExplicitCfnStackWithMultipleStacks as Nr, mergeForService as Nt, createLocalStartCloudFrontCommand as O, availableApiIdentifiers as On, substituteEnvVarsFromState as Or, resolveSharedSidecarCredentials as Ot, createDeployedKvsDataSource as P, resolveSelectionExpression as Pn, resolveCfnFallbackRegion as Pr, parseImageOverrideFlags as Pt, pickTargetFunctionLogicalId as Q, isFunctionUrlOacFronted as Qn, resolveLambdaArnIntrinsic as Qr, a2aInvokeOnce as Qt, serveFromStaticOrigin as R, buildJwksUrlFromIssuer as Rn, collectSsmParameterRefs as Rr, isLocalCdkAssetImage as Rt, StudioEventBus as S, createAuthorizerCache as Sn, resolveRuntimeCodeMountPath as Sr, addImageOverrideOptions as St, formatTargetListing as T, buildStageMap as Tn, EcsTaskResolutionError as Tr, parseMaxTasks as Tt, buildEdgeResponseEvent as U, buildMethodArn as Un, listTargets as Ur, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Ut, applyEdgeResponseResult as V, verifyJwtAuthorizer as Vn, resolveSingleTarget as Vr, CloudMapRegistry as Vt, edgeHeadersToHttp as W, computeRequestIdentityHash as Wn, availableWebSocketApiIdentifiers as Wr, setShadowReadyTimeoutMs as Wt, pickKvsLogicalIdFromArn as X, buildCorsConfigByApiId as Xn, discoverRoutes as Xr, A2A_CONTAINER_PORT as Xt, pickFunctionUrlLogicalIdFromOrigin as Y, applyCorsResponseHeaders as Yn, webSocketApiMatchesIdentifier as Yr, invokeAgentCoreWs as Yt, pickLambdaEdgeFunctionLogicalId as Z, buildCorsConfigFromCloudFrontChain as Zn, pickRefLogicalId as Zr, A2A_PATH as Zt, filterStudioTargetGroups as _, createLocalInvokeCommand as _n, buildConnectEvent as _r, addRunTaskSpecificOptions as _t, createLocalStudioCommand as a, pickAgentCoreCandidateStack as ai, signAgentCoreInvocation as an, evaluateResponseParameters as ar, createLocalFileKvsDataSource as at, renderStudioHtml as b, createWatchPredicates as bn, architectureToPlatform as br, addCommonEcsServiceOptions as bt, startStudioProxy as c, formatStateRemedy as ci, waitForAgentCorePing as cn, tryParseStatus as cr, albStrategy as ct, createStudioDispatcher as d, LocalInvokeBuildError as di, buildAgentCoreCodeImage as dn, probeHostGatewaySupport as dr, resolveAlbTarget as dt, AGENTCORE_AGUI_PROTOCOL as ei, MCP_PATH as en, matchRoute as er, compileCloudFrontFunction as et, filterStudioCustomResources as f, buildStsClientConfig as fi, computeCodeImageTag as fn, bufferToBody as fr, isApplicationLoadBalancer as ft, annotatePinnedEcsTargets as g, addInvokeSpecificOptions as gn, parseConnectionsPath as gr, serviceStrategy as gt, annotateEcsTaskPinnedTargets as h, classifySourceChange as hn, handleConnectionsRequest as hr, createLocalStartServiceCommand as ht, coerceStopRequest as i, AgentCoreResolutionError as ii, AGENTCORE_SIGV4_SERVICE as in, buildRestV1Event as ir, createCloudFrontModule as it, resolveCloudFrontTarget as j, groupRoutesByServer as jn, createLocalStateProvider as jr, buildImageOverrideTag as jt, parseKvsFileOverrides as k, filterRoutesByApiIdentifier as kn, substituteEnvVarsFromStateAsync as kr, runEcsServiceEmulator as kt, relayServeRequest as l, substituteImagePlaceholders as li, downloadAndExtractS3Bundle as ln, VtlEvaluationError as lr, createLocalStartAlbCommand as lt, annotateAlbPinnedBackingServices as m, toCmdArgv as mn, buildMgmtEndpointEnvUrl as mr, addStartServiceSpecificOptions as mt, coerceRunRequest as n, AGENTCORE_MCP_PROTOCOL as ni, mcpInvokeOnce as nn, applyAuthorizerOverlay as nr, runViewerResponse as nt, resolveServeBaseUrl as o, resolveAgentCoreTarget as oi, AGENTCORE_SESSION_ID_HEADER as on, pickResponseTemplate as or, createUnboundCloudFrontModule as ot, isCustomResourceLambdaTarget as p, resolveProfileCredentials as pi, renderCodeDockerfile as pn, ConnectionRegistry as pr, resolveAlbFrontDoor as pt, extractKvsAssociations as q, invokeTokenAuthorizer as qn, filterWebSocketApisByIdentifiers as qr, addInvokeAgentCoreSpecificOptions as qt, coerceServeRequest as r, AGENTCORE_RUNTIME_TYPE as ri, parseSseForJsonRpc as rn, buildHttpApiV2Event as rr, stripCloudFrontImport as rt, createStudioServeManager as s, derivePseudoParametersFromRegion as si, invokeAgentCore as sn, selectIntegrationResponse as sr, addAlbSpecificOptions as st, addStudioSpecificOptions as t, AGENTCORE_HTTP_PROTOCOL as ti, MCP_PROTOCOL_VERSION as tn, translateLambdaResponse as tr, runViewerRequest as tt, reinvoke as u, tryResolveImageFnJoin as ui, SUPPORTED_CODE_RUNTIMES as un, HOST_GATEWAY_MIN_VERSION as ur, parseLbPortOverrides as ut, startStudioServer as v, addStartApiSpecificOptions as vn, buildDisconnectEvent as vr, createLocalRunTaskCommand as vt, createLocalListCommand as w, attachStageContext as wn, resolveRuntimeImage as wr, ecsClusterOption as wt, createStudioStore as x, resolveApiTargetSubset as xn, buildContainerImage as xr, addEcsAssumeRoleOptions as xt, toStudioTargetGroups as y, createLocalStartApiCommand as yn, buildMessageEvent as yr, MAX_TASKS_SUBNET_RANGE_CAP as yt, serveLambdaUrlOrigin as z, createJwksCache as zn, resolveSsmParameters as zr, listPinnedTargets as zt };
-//# sourceMappingURL=local-studio--ndMb9dM.js.map
+export { pickKvsLogicalIdFromArn as $, buildCorsConfigByApiId as $n, discoverRoutes as $r, A2A_CONTAINER_PORT as $t, parseOriginOverrides as A, resolveEnvVars$1 as An, substituteAgainstStateAsync as Ar, resolveEcsAssumeRoleOption as At, resolveErrorResponseCandidates as B, buildCognitoJwksUrl as Bn, CfnLocalStateProvider as Br, describePinnedImageUri as Bt, addListSpecificOptions as C, createWatchPredicates as Cn, architectureToPlatform as Cr, addCommonEcsServiceOptions as Ct, addStartCloudFrontSpecificOptions as D, attachStageContext as Dn, resolveRuntimeImage as Dr, ecsClusterOption as Dt, LocalStartCloudFrontError as E, createFileWatcher as En, resolveRuntimeFileExtension as Er, buildEcsImageResolutionContext$1 as Et, resolveDeployedKvsArnByName as F, readMtlsMaterialsFromDisk as Fn, isCfnFlagPresent as Fr, enforceImageOverrideOrphans as Ft, buildEdgeRequestEvent as G, verifyJwtViaDiscovery as Gn, countTargets as Gr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Gt, serveLambdaUrlOrigin as H, createJwksCache as Hn, resolveSsmParameters as Hr, listPinnedTargets as Ht, classifyS3Error as I, startApiServer as In, rejectExplicitCfnStackWithMultipleStacks as Ir, mergeForService as It, httpHeadersToEdge as J, evaluateCachedLambdaPolicy as Jn, discoverWebSocketApis as Jr, getContainerNetworkIp as Jt, buildEdgeResponseEvent as K, buildMethodArn as Kn, listTargets as Kr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Kt, createS3OriginReader as L, resolveSelectionExpression as Ln, resolveCfnFallbackRegion as Lr, parseImageOverrideFlags as Lt, idFromArn as M, filterRoutesByApiIdentifier as Mn, substituteEnvVarsFromStateAsync as Mr, runEcsServiceEmulator as Mt, resolveKvsModulesForDistribution as N, filterRoutesByApiIdentifiers as Nn, LocalStateSourceError as Nr, ImageOverrideError as Nt, createLocalStartCloudFrontCommand as O, buildStageMap as On, EcsTaskResolutionError as Or, parseMaxTasks as Ot, createDeployedKvsDataSource as P, groupRoutesByServer as Pn, createLocalStateProvider as Pr, buildImageOverrideTag as Pt, pickFunctionUrlLogicalIdFromOrigin as Q, applyCorsResponseHeaders as Qn, webSocketApiMatchesIdentifier as Qr, invokeAgentCoreWs as Qt, matchBehavior as R, resolveServiceIntegrationParameters as Rn, resolveCfnRegion as Rr, resolveImageOverrides as Rt, StudioEventBus as S, createLocalStartApiCommand as Sn, buildMessageEvent as Sr, MAX_TASKS_SUBNET_RANGE_CAP as St, formatTargetListing as T, createAuthorizerCache as Tn, resolveRuntimeCodeMountPath as Tr, addImageOverrideOptions as Tt, applyEdgeRequestResult as U, verifyCognitoJwt as Un, resolveWatchConfig as Ur, buildCloudMapIndex as Ut, serveFromStaticOrigin as V, buildJwksUrlFromIssuer as Vn, collectSsmParameterRefs as Vr, isLocalCdkAssetImage as Vt, applyEdgeResponseResult as W, verifyJwtAuthorizer as Wn, resolveSingleTarget as Wr, CloudMapRegistry as Wt, extractKvsAssociations as X, invokeTokenAuthorizer as Xn, filterWebSocketApisByIdentifiers as Xr, addInvokeAgentCoreSpecificOptions as Xt, CLOUDFRONT_DISTRIBUTION_TYPE as Y, invokeRequestAuthorizer as Yn, discoverWebSocketApisOrThrow as Yr, attachContainerLogStreamer as Yt, isCloudFrontDistribution as Z, attachAuthorizers as Zn, parseSelectionExpressionPath as Zr, createLocalInvokeAgentCoreCommand as Zt, filterStudioTargetGroups as _, toCmdArgv as _n, buildMgmtEndpointEnvUrl as _r, addStartServiceSpecificOptions as _t, createLocalStudioCommand as a, AGENTCORE_MCP_PROTOCOL as ai, mcpInvokeOnce as an, applyAuthorizerOverlay as ar, runViewerResponse as at, renderStudioHtml as b, createLocalInvokeCommand as bn, buildConnectEvent as br, addRunTaskSpecificOptions as bt, startStudioProxy as c, pickAgentCoreCandidateStack as ci, signAgentCoreInvocation as cn, evaluateResponseParameters as cr, createLocalFileKvsDataSource as ct, createStudioDispatcher as d, formatStateRemedy as di, waitForAgentCorePing as dn, tryParseStatus as dr, albStrategy as dt, pickRefLogicalId as ei, A2A_PATH as en, buildCorsConfigFromCloudFrontChain as er, pickLambdaEdgeFunctionLogicalId as et, filterStudioCustomResources as f, substituteImagePlaceholders as fi, downloadAndExtractS3Bundle as fn, VtlEvaluationError as fr, createLocalStartAlbCommand as ft, annotatePinnedEcsTargets as g, resolveProfileCredentials as gi, renderCodeDockerfile as gn, ConnectionRegistry as gr, resolveAlbFrontDoor as gt, annotateEcsTaskPinnedTargets as h, buildStsClientConfig as hi, computeCodeImageTag as hn, bufferToBody as hr, isApplicationLoadBalancer as ht, coerceStopRequest as i, AGENTCORE_HTTP_PROTOCOL as ii, MCP_PROTOCOL_VERSION as in, translateLambdaResponse as ir, runViewerRequest as it, resolveCloudFrontTarget as j, availableApiIdentifiers as jn, substituteEnvVarsFromState as jr, resolveSharedSidecarCredentials as jt, parseKvsFileOverrides as k, materializeLayerFromArn as kn, substituteAgainstState as kr, parseRestartPolicy as kt, relayServeRequest as l, resolveAgentCoreTarget as li, AGENTCORE_SESSION_ID_HEADER as ln, pickResponseTemplate as lr, createUnboundCloudFrontModule as lt, annotateAlbPinnedBackingServices as m, LocalInvokeBuildError as mi, buildAgentCoreCodeImage as mn, probeHostGatewaySupport as mr, resolveAlbTarget as mt, coerceRunRequest as n, AGENTCORE_A2A_PROTOCOL as ni, MCP_CONTAINER_PORT as nn, matchPreflight as nr, resolveCloudFrontDistribution as nt, resolveServeBaseUrl as o, AGENTCORE_RUNTIME_TYPE as oi, parseSseForJsonRpc as on, buildHttpApiV2Event as or, stripCloudFrontImport as ot, isCustomResourceLambdaTarget as p, tryResolveImageFnJoin as pi, SUPPORTED_CODE_RUNTIMES as pn, HOST_GATEWAY_MIN_VERSION as pr, parseLbPortOverrides as pt, edgeHeadersToHttp as q, computeRequestIdentityHash as qn, availableWebSocketApiIdentifiers as qr, setShadowReadyTimeoutMs as qt, coerceServeRequest as r, AGENTCORE_AGUI_PROTOCOL as ri, MCP_PATH as rn, matchRoute as rr, compileCloudFrontFunction as rt, createStudioServeManager as s, AgentCoreResolutionError as si, AGENTCORE_SIGV4_SERVICE as sn, buildRestV1Event as sr, createCloudFrontModule as st, addStudioSpecificOptions as t, resolveLambdaArnIntrinsic as ti, a2aInvokeOnce as tn, isFunctionUrlOacFronted as tr, pickTargetFunctionLogicalId as tt, reinvoke as u, derivePseudoParametersFromRegion as ui, invokeAgentCore as un, selectIntegrationResponse as ur, addAlbSpecificOptions as ut, startStudioServer as v, classifySourceChange as vn, handleConnectionsRequest as vr, createLocalStartServiceCommand as vt, createLocalListCommand as w, resolveApiTargetSubset as wn, buildContainerImage as wr, addEcsAssumeRoleOptions as wt, createStudioStore as x, addStartApiSpecificOptions as xn, buildDisconnectEvent as xr, createLocalRunTaskCommand as xt, toStudioTargetGroups as y, addInvokeSpecificOptions as yn, parseConnectionsPath as yr, serviceStrategy as yt, startCloudFrontServer as z, defaultCredentialsLoader as zn, resolveCfnStackName as zr, runImageOverrideBuilds as zt };
+//# sourceMappingURL=local-studio-CFgAjIjT.js.map