cdk-local 0.137.0 → 0.138.0

package/dist/{local-studio-DxzjQZJu.js → local-studio-Cr0YdvCb.js}

@@ -19486,6 +19486,33 @@ async function resolveInboundAuthorization(resolved, options) {
 	return header;
 }
 /**
+* Resolve the boot-time SigV4 signing context (`{ credentials, region }`) when
+* `--sigv4` is requested, or `undefined` when it is not applicable (`--sigv4`
+* off, or a `customJwtAuthorizer` is declared — the JWT path wins, warns).
+* Throws a {@link CdkLocalError} on a `--bearer-token` conflict, an unresolved
+* region, or no resolvable credentials.
+*
+* Extracted from {@link buildSigV4HeadersIfRequested} so both the single-shot
+* `cdkl invoke-agentcore` (signs ONE body) and the warm `cdkl start-agentcore`
+* serve (signs each forwarded body per request — issue #454) resolve the
+* credentials + region the SAME way. Exported so the serve boot + a unit test
+* can reuse it.
+*/
+async function resolveAgentCoreSigV4Context(options, resolved, loaded, stateProvider) {
+	if (!options.sigv4) return void 0;
+	if (options.bearerToken) throw new CdkLocalError(`--sigv4 and --bearer-token are mutually exclusive: pick one inbound auth.`, "LOCAL_INVOKE_AGENTCORE_AUTH_CONFLICT");
+	if (resolved.jwtAuthorizer) {
+		getLogger().warn(`Runtime '${resolved.logicalId}' declares a customJwtAuthorizer; --sigv4 ignored (JWT path takes precedence).`);
+		return;
+	}
+	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
+	if (!region) throw new CdkLocalError("--sigv4: no region resolved for the AgentCore signing scope. Pass --region <region>, set AWS_REGION, or use --from-cfn-stack with a region-bound stack.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_REGION");
+	return {
+		credentials: await resolveHostCredentialsForSigV4(options, resolved, loaded, region, stateProvider),
+		region
+	};
+}
+/**
 * Compute the SigV4 headers for the `/invocations` POST when `--sigv4` is
 * requested. Returns `undefined` (no header overlay) when:
 *
@@ -19498,17 +19525,11 @@ async function resolveInboundAuthorization(resolved, options) {
 * Exported so a unit test can drive the gate without the full Docker pipeline.
 */
 async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, port, event, sessionId, stateProvider) {
-	if (!options.sigv4) return void 0;
-	if (options.bearerToken) throw new CdkLocalError(`--sigv4 and --bearer-token are mutually exclusive: pick one inbound auth.`, "LOCAL_INVOKE_AGENTCORE_AUTH_CONFLICT");
-	if (resolved.jwtAuthorizer) {
-		getLogger().warn(`Runtime '${resolved.logicalId}' declares a customJwtAuthorizer; --sigv4 ignored (JWT path takes precedence).`);
-		return;
-	}
-	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
-	if (!region) throw new CdkLocalError("--sigv4: no region resolved for the AgentCore signing scope. Pass --region <region>, set AWS_REGION, or use --from-cfn-stack with a region-bound stack.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_REGION");
+	const ctx = await resolveAgentCoreSigV4Context(options, resolved, loaded, stateProvider);
+	if (!ctx) return void 0;
 	const signed = await signAgentCoreInvocation({
-		credentials: await resolveHostCredentialsForSigV4(options, resolved, loaded, region, stateProvider),
-		region,
+		credentials: ctx.credentials,
+		region: ctx.region,
 		host,
 		port,
 		path: "/invocations",
@@ -19521,7 +19542,7 @@ async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, por
 		"X-Amz-Content-Sha256": signed.amzContentSha256
 	};
 	if (signed.amzSecurityToken) headers["X-Amz-Security-Token"] = signed.amzSecurityToken;
-	getLogger().info(`Signed /invocations with SigV4 (region=${region}).`);
+	getLogger().info(`Signed /invocations with SigV4 (region=${ctx.region}).`);
 	return headers;
 }
 /**
@@ -31065,23 +31086,13 @@ const DEFAULT_ROUTES = [{
 	path: "/ping"
 }];
 /**
-* Proxy one inbound HTTP request to the warm container, injecting the
-* session-id + Authorization (+ any extra) headers, and stream the response
-* back. Used for both `GET /ping` and `POST /invocations`; piping the response
-* preserves an SSE (`text/event-stream`) stream.
+* Wire an upstream (container-leg) request's response back to the inbound
+* client, piping the body so an SSE (`text/event-stream`) stream stays
+* incremental, and mapping an upstream error to a `502`. Shared by the
+* streaming and buffered (`--sigv4`) proxy paths.
 */
-function proxyToContainer(clientReq, clientRes, config, upstreamPath) {
-	const headers = { ...clientReq.headers };
-	delete headers["host"];
-	headers[AGENTCORE_SESSION_ID_HEADER] = config.sessionId ?? randomUUID();
-	if (config.authorization) headers["authorization"] = config.authorization;
-	const upstream = request({
-		host: config.containerHost,
-		port: config.containerPort,
-		path: upstreamPath,
-		method: clientReq.method,
-		headers
-	}, (upRes) => {
+function wireUpstreamResponse(upstream, clientRes) {
+	upstream.on("response", (upRes) => {
 		clientRes.writeHead(upRes.statusCode ?? 502, upRes.headers);
 		upRes.on("error", () => clientRes.destroy());
 		upRes.pipe(clientRes);
@@ -31091,6 +31102,79 @@ function proxyToContainer(clientReq, clientRes, config, upstreamPath) {
 		if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
 		clientRes.end(JSON.stringify({ error: `upstream error: ${err.message}` }));
 	});
+}
+/**
+* Proxy one inbound HTTP request to the warm container, injecting the
+* session-id + Authorization (+ any per-request / signed) headers, and stream
+* the response back. Used for both `GET /ping` and `POST /invocations`; piping
+* the response preserves an SSE (`text/event-stream`) stream.
+*
+* `perRequest.authorization` overrides {@link AgentCoreHttpServerConfig.authorization}
+* with the value the per-request inbound-JWT gate verified / injected (issue
+* #454). When {@link AgentCoreHttpServerConfig.signRequest} is set and this is a
+* `POST`, the body is buffered, signed (SigV4), and forwarded — signing needs
+* the whole body, so the streaming fast-path is bypassed for that case only.
+*/
+function proxyToContainer(clientReq, clientRes, config, upstreamPath, perRequest) {
+	const sessionId = config.sessionId ?? randomUUID();
+	const headers = { ...clientReq.headers };
+	delete headers["host"];
+	headers[AGENTCORE_SESSION_ID_HEADER] = sessionId;
+	const authorization = perRequest?.authorization ?? config.authorization;
+	if (authorization) headers["authorization"] = authorization;
+	if (config.signRequest && clientReq.method === "POST") {
+		const signRequest = config.signRequest;
+		const chunks = [];
+		clientReq.on("data", (c) => chunks.push(c));
+		clientReq.on("error", (err) => {
+			getLogger().debug(`agentcore http serve client error: ${err.message}`);
+			if (!clientRes.headersSent) {
+				clientRes.writeHead(400, { "content-type": "application/json" });
+				clientRes.end(JSON.stringify({ error: `client error: ${err.message}` }));
+			}
+		});
+		clientReq.on("end", () => {
+			const body = Buffer.concat(chunks);
+			signRequest({
+				method: "POST",
+				path: upstreamPath,
+				body,
+				sessionId
+			}).then((signed) => {
+				const signedHeaders = {
+					...headers,
+					...signed
+				};
+				delete signedHeaders["transfer-encoding"];
+				signedHeaders["content-length"] = String(body.length);
+				const upstream = request({
+					host: config.containerHost,
+					port: config.containerPort,
+					path: upstreamPath,
+					method: "POST",
+					headers: signedHeaders
+				});
+				wireUpstreamResponse(upstream, clientRes);
+				upstream.end(body);
+			}).catch((err) => {
+				const msg = err instanceof Error ? err.message : String(err);
+				getLogger().debug(`agentcore http serve sigv4 sign error: ${msg}`);
+				if (!clientRes.headersSent) {
+					clientRes.writeHead(500, { "content-type": "application/json" });
+					clientRes.end(JSON.stringify({ error: `sigv4 signing failed: ${msg}` }));
+				}
+			});
+		});
+		return;
+	}
+	const upstream = request({
+		host: config.containerHost,
+		port: config.containerPort,
+		path: upstreamPath,
+		method: clientReq.method,
+		headers
+	});
+	wireUpstreamResponse(upstream, clientRes);
 	clientReq.on("error", (err) => {
 		getLogger().debug(`agentcore http serve client error: ${err.message}`);
 		upstream.destroy();
@@ -31110,12 +31194,36 @@ function startAgentCoreHttpServer(config) {
 	const httpServer = createServer$1((req, res) => {
 		const path = (req.url ?? "/").split("?")[0];
 		const match = routes.find((r) => r.method === req.method && r.path === path);
-		if (match) return proxyToContainer(req, res, config, match.path);
-		res.writeHead(404, { "content-type": "application/json" });
-		res.end(JSON.stringify({
-			error: "not found",
-			hint: notFoundHint
-		}));
+		if (!match) {
+			res.writeHead(404, { "content-type": "application/json" });
+			res.end(JSON.stringify({
+				error: "not found",
+				hint: notFoundHint
+			}));
+			return;
+		}
+		if (config.authCheck && req.method === "POST") {
+			req.on("error", (err) => getLogger().debug(`agentcore http serve client error (auth gate): ${err.message}`));
+			config.authCheck(req.headers).then((result) => {
+				if (!result.allow) {
+					req.resume();
+					res.writeHead(result.status ?? 403, { "content-type": "application/json" });
+					res.end(JSON.stringify({ error: result.message ?? "forbidden" }));
+					return;
+				}
+				proxyToContainer(req, res, config, match.path, { ...result.authorization && { authorization: result.authorization } });
+			}).catch((err) => {
+				const msg = err instanceof Error ? err.message : String(err);
+				getLogger().debug(`agentcore http serve auth-check error: ${msg}`);
+				req.resume();
+				if (!res.headersSent) {
+					res.writeHead(500, { "content-type": "application/json" });
+					res.end(JSON.stringify({ error: `auth check failed: ${msg}` }));
+				}
+			});
+			return;
+		}
+		proxyToContainer(req, res, config, match.path);
 	});
 	const bridge = attachWs ? attachAgentCoreWsBridge(httpServer, {
 		containerHost: config.containerHost,
@@ -31152,6 +31260,90 @@ function buildNotFoundHint(routes, attachWs) {
 	return attachWs ? `${base} (WebSocket: connect to /ws)` : base;
 }
 
+//#endregion
+//#region src/local/agentcore-serve-auth.ts
+/**
+* Build the per-request inbound-JWT gate for `cdkl start-agentcore`. The cloud
+* AgentCore Runtime verifies the CALLER's token against the
+* `customJwtAuthorizer` on every `InvokeAgentRuntime`; the warm local serve
+* mirrors that here — unlike the single-shot `cdkl invoke-agentcore`, which
+* verifies the `--bearer-token` ONCE at boot. This is the serve counterpart of
+* `front-door-auth`'s `buildAuthCheck` for the ALB (issue #454).
+*
+* Semantics (matching the cloud + `resolveInboundAuthorization`):
+*  - `--no-verify-auth` → always allow; forward `--bearer-token` if given.
+*  - inbound `Authorization` present → verify it; absent → fall back to the
+*    injected `--bearer-token`; neither → 401.
+*  - verify failure → 403. An unreachable / malformed discovery URL falls back
+*    to pass-through accept (offline-dev fallback in {@link verifyJwtViaDiscovery}).
+*
+* Exported so a unit test can drive the gate (and a host CLI can reuse it)
+* without the Docker pipeline.
+*/
+function buildAgentCoreServeAuthCheck(authorizer, opts = {}) {
+	const injectedBearer = opts.bearerToken ? `Bearer ${opts.bearerToken}` : void 0;
+	if (opts.noVerifyAuth === true) return async () => ({
+		allow: true,
+		...injectedBearer && { authorization: injectedBearer }
+	});
+	const jwksCache = opts.jwksCache ?? createJwksCache();
+	const warnedAt = opts.warnedAt ?? /* @__PURE__ */ new Map();
+	return async (headers) => {
+		const header = readAuthorizationHeader(headers) ?? injectedBearer;
+		if (!header) return {
+			allow: false,
+			status: 401,
+			message: "Missing Authorization: this runtime declares a customJwtAuthorizer. Send a Bearer JWT, or start the serve with --bearer-token / --no-verify-auth."
+		};
+		if (!(await verifyJwtViaDiscovery({
+			discoveryUrl: authorizer.discoveryUrl,
+			...authorizer.allowedAudience && { allowedAudience: authorizer.allowedAudience },
+			...authorizer.allowedClients && { allowedClients: authorizer.allowedClients },
+			...authorizer.allowedScopes && { allowedScopes: authorizer.allowedScopes },
+			...authorizer.customClaims && { customClaims: authorizer.customClaims }
+		}, header, jwksCache, { warnedAt })).allow) return {
+			allow: false,
+			status: 403,
+			message: `Forbidden: the inbound JWT was rejected by the runtime's customJwtAuthorizer (signature / issuer / expiry / audience / scope check failed against ${authorizer.discoveryUrl}).`
+		};
+		return {
+			allow: true,
+			authorization: header
+		};
+	};
+}
+/**
+* Pick the warm serve's inbound-auth wiring for a runtime shape (issue #454).
+* Pure (no Docker / network) so the boot's mutually-exclusive selection —
+* per-request JWT gate vs `--sigv4` signing vs static `--bearer-token`
+* pass-through — is unit-testable. `sigv4Active` is whether
+* `resolveAgentCoreSigV4Context` resolved a signing context (it returns
+* undefined when `--sigv4` is off OR a customJwtAuthorizer is declared, so the
+* authorizer arm always wins). `buildAuthCheck` is injectable for tests.
+*/
+function selectServeInboundAuth(resolved, options, sigv4Active, buildAuthCheck = buildAgentCoreServeAuthCheck) {
+	const bearerHeader = options.bearerToken ? `Bearer ${options.bearerToken}` : void 0;
+	if (resolved.jwtAuthorizer) return {
+		authCheck: buildAuthCheck(resolved.jwtAuthorizer, {
+			...options.verifyAuth === false && { noVerifyAuth: true },
+			...options.bearerToken && { bearerToken: options.bearerToken }
+		}),
+		...bearerHeader && { bridgeAuthorization: bearerHeader },
+		sign: false
+	};
+	if (sigv4Active) return { sign: true };
+	return {
+		...bearerHeader && { bridgeAuthorization: bearerHeader },
+		sign: false
+	};
+}
+/** Read a single `Authorization` header value (first when duplicated, undefined when empty). */
+function readAuthorizationHeader(headers) {
+	const raw = headers["authorization"];
+	const v = Array.isArray(raw) ? raw[0] : raw;
+	return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+
 //#endregion
 //#region src/cli/commands/local-start-agentcore.ts
 /**
@@ -31295,7 +31487,9 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 	const resolved = resolveAgentCoreTarget(resolvedTarget, stacks, imageContext);
 	logger.info(`Target: ${resolved.stack.stackName}/${resolved.logicalId} (${resolved.protocol})`);
 	const plan = resolveAgentCoreServePlan(resolved.protocol);
-	const authorization = await resolveInboundAuthorization(resolved, options);
+	const sigv4Context = await resolveAgentCoreSigV4Context(options, resolved, loadedState, stateProvider);
+	const authPlan = selectServeInboundAuth(resolved, options, sigv4Context !== void 0);
+	if (authPlan.authCheck && resolved.jwtAuthorizer) logger.info(`Inbound JWT: each request verified per-request against ${resolved.jwtAuthorizer.discoveryUrl}${options.verifyAuth === false ? " (verification DISABLED via --no-verify-auth)" : ""}.`);
 	await resolveFromS3BucketIntrinsic(resolved, stateProvider, loadedState, imageContext);
 	const image = await resolveAgentCoreImage(resolved, options, loadedState, stateProvider);
 	const { env: dockerEnv, sensitiveEnvKeys } = await buildContainerEnv(resolved, options, profileCredentials, profileCredsFile, stateProvider, loadedState, imageContext);
@@ -31328,6 +31522,25 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 	try {
 		if (plan.readyPath === void 0) await waitForAgentCorePing(containerHost, containerHostPort, options.timeout);
 		else await waitForAgentCoreHttpReady(containerHost, containerHostPort, plan.readyPath, options.timeout);
+		const signRequest = authPlan.sign && sigv4Context ? async ({ method, path, body, sessionId }) => {
+			const signed = await signAgentCoreInvocation({
+				credentials: sigv4Context.credentials,
+				region: sigv4Context.region,
+				host: containerHost,
+				port: containerHostPort,
+				path,
+				body,
+				sessionId,
+				method
+			});
+			const h = {
+				Authorization: signed.authorization,
+				"X-Amz-Date": signed.amzDate,
+				"X-Amz-Content-Sha256": signed.amzContentSha256
+			};
+			if (signed.amzSecurityToken) h["X-Amz-Security-Token"] = signed.amzSecurityToken;
+			return h;
+		} : void 0;
 		server = await startAgentCoreHttpServer({
 			containerHost,
 			containerPort: containerHostPort,
@@ -31335,7 +31548,9 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 			port: options.port,
 			routes: plan.routes,
 			attachWs: plan.attachWs,
-			...authorization && { authorization },
+			...authPlan.bridgeAuthorization && { authorization: authPlan.bridgeAuthorization },
+			...authPlan.authCheck && { authCheck: authPlan.authCheck },
+			...signRequest && { signRequest },
 			...options.sessionId && { sessionId: options.sessionId }
 		});
 	} catch (err) {
@@ -31385,7 +31600,7 @@ function createLocalStartAgentCoreCommand(opts = {}) {
 * `.addOption(...)` blocks. Chainable: returns `cmd`.
 */
 function addStartAgentCoreSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
 //#endregion
@@ -36964,5 +37179,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { edgeHeadersToHttp as $, verifyJwtAuthorizer as $n, resolveSingleTarget as $r, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as $t, startAgentCoreWsBridge as A, addStartApiSpecificOptions as An, buildDisconnectEvent as Ar, addCommonEcsServiceOptions as At, resolveDeployedKvsArnByName as B, availableApiIdentifiers as Bn, substituteEnvVarsFromState as Br, ImageOverrideError as Bt, addListSpecificOptions as C, LocalInvokeBuildError as Ci, buildAgentCoreCodeImage as Cn, probeHostGatewaySupport as Cr, resolveAlbFrontDoor as Ct, createLocalStartAgentCoreCommand as D, classifySourceChange as Dn, handleConnectionsRequest as Dr, addRunTaskSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, toCmdArgv as En, buildMgmtEndpointEnvUrl as Er, serviceStrategy as Et, parseOriginOverrides as F, createFileWatcher as Fn, resolveRuntimeFileExtension as Fr, parseMaxTasks as Ft, startCloudFrontServer as G, startApiServer as Gn, rejectExplicitCfnStackWithMultipleStacks as Gr, resolveImageOverrides as Gt, classifyS3Error as H, filterRoutesByApiIdentifiers as Hn, LocalStateSourceError as Hr, enforceImageOverrideOrphans as Ht, resolveCloudFrontTarget as I, attachStageContext as In, resolveRuntimeImage as Ir, parseRestartPolicy as It, serveLambdaUrlOrigin as J, defaultCredentialsLoader as Jn, resolveCfnStackName as Jr, isLocalCdkAssetImage as Jt, resolveErrorResponseCandidates as K, resolveSelectionExpression as Kn, resolveCfnFallbackRegion as Kr, runImageOverrideBuilds as Kt, idFromArn as L, buildStageMap as Ln, EcsTaskResolutionError as Lr, resolveEcsAssumeRoleOption as Lt, addStartCloudFrontSpecificOptions as M, createWatchPredicates as Mn, architectureToPlatform as Mr, addImageOverrideOptions as Mt, createLocalStartCloudFrontCommand as N, resolveApiTargetSubset as Nn, buildContainerImage as Nr, buildEcsImageResolutionContext$1 as Nt, startAgentCoreHttpServer as O, addInvokeSpecificOptions as On, parseConnectionsPath as Or, createLocalRunTaskCommand as Ot, parseKvsFileOverrides as P, createAuthorizerCache as Pn, resolveRuntimeCodeMountPath as Pr, ecsClusterOption as Pt, buildEdgeResponseEvent as Q, verifyCognitoJwt as Qn, resolveWatchConfig as Qr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Qt, resolveKvsModulesForDistribution as R, materializeLayerFromArn as Rn, substituteAgainstState as Rr, resolveSharedSidecarCredentials as Rt, StudioEventBus as S, tryResolveImageFnJoin as Si, SUPPORTED_CODE_RUNTIMES as Sn, HOST_GATEWAY_MIN_VERSION as Sr, isApplicationLoadBalancer as St, formatTargetListing as T, resolveProfileCredentials as Ti, renderCodeDockerfile as Tn, ConnectionRegistry as Tr, createLocalStartServiceCommand as Tt, createS3OriginReader as U, groupRoutesByServer as Un, createLocalStateProvider as Ur, mergeForService as Ut, resolveDeployedOriginBucket as V, filterRoutesByApiIdentifier as Vn, substituteEnvVarsFromStateAsync as Vr, buildImageOverrideTag as Vt, matchBehavior as W, readMtlsMaterialsFromDisk as Wn, isCfnFlagPresent as Wr, parseImageOverrideFlags as Wt, applyEdgeResponseResult as X, buildJwksUrlFromIssuer as Xn, collectSsmParameterRefs as Xr, buildCloudMapIndex as Xt, applyEdgeRequestResult as Y, buildCognitoJwksUrl as Yn, CfnLocalStateProvider as Yr, listPinnedTargets as Yt, buildEdgeRequestEvent as Z, createJwksCache as Zn, resolveSsmParameters as Zr, CloudMapRegistry as Zt, filterStudioTargetGroups as _, pickAgentCoreCandidateStack as _i, AGENTCORE_SESSION_ID_HEADER as _n, evaluateResponseParameters as _r, addAlbSpecificOptions as _t, createLocalStudioCommand as a, filterWebSocketApisByIdentifiers as ai, bridgeAgentCoreWs as an, invokeTokenAuthorizer as ar, pickFunctionUrlLogicalIdFromOrigin as at, renderStudioHtml as b, formatStateRemedy as bi, waitForAgentCorePing as bn, tryParseStatus as br, parseLbPortOverrides as bt, startStudioProxy as c, discoverRoutes as ci, A2A_PATH as cn, buildCorsConfigByApiId as cr, pickTargetFunctionLogicalId as ct, createStudioDispatcher as d, AGENTCORE_A2A_PROTOCOL as di, MCP_PATH as dn, matchPreflight as dr, runViewerRequest as dt, countTargets as ei, setShadowReadyTimeoutMs as en, verifyJwtViaDiscovery as er, httpHeadersToEdge as et, filterStudioCustomResources as f, AGENTCORE_AGUI_PROTOCOL as fi, MCP_PROTOCOL_VERSION as fn, matchRoute as fr, runViewerResponse as ft, annotatePinnedEcsTargets as g, AgentCoreResolutionError as gi, signAgentCoreInvocation as gn, buildRestV1Event as gr, createUnboundCloudFrontModule as gt, annotateEcsTaskPinnedTargets as h, AGENTCORE_RUNTIME_TYPE as hi, AGENTCORE_SIGV4_SERVICE as hn, buildHttpApiV2Event as hr, createLocalFileKvsDataSource as ht, coerceStopRequest as i, discoverWebSocketApisOrThrow as ii, createLocalInvokeAgentCoreCommand as in, invokeRequestAuthorizer as ir, isCloudFrontDistribution as it, LocalStartCloudFrontError as j, createLocalStartApiCommand as jn, buildMessageEvent as jr, addEcsAssumeRoleOptions as jt, attachAgentCoreWsBridge as k, createLocalInvokeCommand as kn, buildConnectEvent as kr, MAX_TASKS_SUBNET_RANGE_CAP as kt, relayServeRequest as l, pickRefLogicalId as li, a2aInvokeOnce as ln, buildCorsConfigFromCloudFrontChain as lr, resolveCloudFrontDistribution as lt, annotateAlbPinnedBackingServices as m, AGENTCORE_MCP_PROTOCOL as mi, parseSseForJsonRpc as mn, applyAuthorizerOverlay as mr, createCloudFrontModule as mt, coerceRunRequest as n, availableWebSocketApiIdentifiers as ni, attachContainerLogStreamer as nn, computeRequestIdentityHash as nr, describeS3OriginDomain as nt, resolveServeBaseUrl as o, parseSelectionExpressionPath as oi, invokeAgentCoreWs as on, attachAuthorizers as or, pickKvsLogicalIdFromArn as ot, isCustomResourceLambdaTarget as p, AGENTCORE_HTTP_PROTOCOL as pi, mcpInvokeOnce as pn, translateLambdaResponse as pr, stripCloudFrontImport as pt, serveFromStaticOrigin as q, resolveServiceIntegrationParameters as qn, resolveCfnRegion as qr, describePinnedImageUri as qt, coerceServeRequest as r, discoverWebSocketApis as ri, addInvokeAgentCoreSpecificOptions as rn, evaluateCachedLambdaPolicy as rr, extractKvsAssociations as rt, createStudioServeManager as s, webSocketApiMatchesIdentifier as si, A2A_CONTAINER_PORT as sn, applyCorsResponseHeaders as sr, pickLambdaEdgeFunctionLogicalId as st, addStudioSpecificOptions as t, listTargets as ti, getContainerNetworkIp as tn, buildMethodArn as tr, CLOUDFRONT_DISTRIBUTION_TYPE as tt, reinvoke as u, resolveLambdaArnIntrinsic as ui, MCP_CONTAINER_PORT as un, isFunctionUrlOacFronted as ur, compileCloudFrontFunction as ut, startStudioServer as v, resolveAgentCoreTarget as vi, invokeAgentCore as vn, pickResponseTemplate as vr, albStrategy as vt, createLocalListCommand as w, buildStsClientConfig as wi, computeCodeImageTag as wn, bufferToBody as wr, addStartServiceSpecificOptions as wt, createStudioStore as x, substituteImagePlaceholders as xi, downloadAndExtractS3Bundle as xn, VtlEvaluationError as xr, resolveAlbTarget as xt, toStudioTargetGroups as y, derivePseudoParametersFromRegion as yi, waitForAgentCoreHttpReady as yn, selectIntegrationResponse as yr, createLocalStartAlbCommand as yt, createDeployedKvsDataSource as z, resolveEnvVars$1 as zn, substituteAgainstStateAsync as zr, runEcsServiceEmulator as zt };
-//# sourceMappingURL=local-studio-DxzjQZJu.js.map
+export { buildEdgeRequestEvent as $, createJwksCache as $n, resolveSsmParameters as $r, CloudMapRegistry as $t, startAgentCoreHttpServer as A, addInvokeSpecificOptions as An, parseConnectionsPath as Ar, createLocalRunTaskCommand as At, resolveKvsModulesForDistribution as B, materializeLayerFromArn as Bn, substituteAgainstState as Br, resolveSharedSidecarCredentials as Bt, addListSpecificOptions as C, substituteImagePlaceholders as Ci, downloadAndExtractS3Bundle as Cn, VtlEvaluationError as Cr, resolveAlbTarget as Ct, createLocalStartAgentCoreCommand as D, resolveProfileCredentials as Di, renderCodeDockerfile as Dn, ConnectionRegistry as Dr, createLocalStartServiceCommand as Dt, addStartAgentCoreSpecificOptions as E, buildStsClientConfig as Ei, computeCodeImageTag as En, bufferToBody as Er, addStartServiceSpecificOptions as Et, createLocalStartCloudFrontCommand as F, resolveApiTargetSubset as Fn, buildContainerImage as Fr, buildEcsImageResolutionContext$1 as Ft, createS3OriginReader as G, groupRoutesByServer as Gn, createLocalStateProvider as Gr, mergeForService as Gt, resolveDeployedKvsArnByName as H, availableApiIdentifiers as Hn, substituteEnvVarsFromState as Hr, ImageOverrideError as Ht, parseKvsFileOverrides as I, createAuthorizerCache as In, resolveRuntimeCodeMountPath as Ir, ecsClusterOption as It, resolveErrorResponseCandidates as J, resolveSelectionExpression as Jn, resolveCfnFallbackRegion as Jr, runImageOverrideBuilds as Jt, matchBehavior as K, readMtlsMaterialsFromDisk as Kn, isCfnFlagPresent as Kr, parseImageOverrideFlags as Kt, parseOriginOverrides as L, createFileWatcher as Ln, resolveRuntimeFileExtension as Lr, parseMaxTasks as Lt, startAgentCoreWsBridge as M, addStartApiSpecificOptions as Mn, buildDisconnectEvent as Mr, addCommonEcsServiceOptions as Mt, LocalStartCloudFrontError as N, createLocalStartApiCommand as Nn, buildMessageEvent as Nr, addEcsAssumeRoleOptions as Nt, buildAgentCoreServeAuthCheck as O, toCmdArgv as On, buildMgmtEndpointEnvUrl as Or, serviceStrategy as Ot, addStartCloudFrontSpecificOptions as P, createWatchPredicates as Pn, architectureToPlatform as Pr, addImageOverrideOptions as Pt, applyEdgeResponseResult as Q, buildJwksUrlFromIssuer as Qn, collectSsmParameterRefs as Qr, buildCloudMapIndex as Qt, resolveCloudFrontTarget as R, attachStageContext as Rn, resolveRuntimeImage as Rr, parseRestartPolicy as Rt, StudioEventBus as S, formatStateRemedy as Si, waitForAgentCorePing as Sn, tryParseStatus as Sr, parseLbPortOverrides as St, formatTargetListing as T, LocalInvokeBuildError as Ti, buildAgentCoreCodeImage as Tn, probeHostGatewaySupport as Tr, resolveAlbFrontDoor as Tt, resolveDeployedOriginBucket as U, filterRoutesByApiIdentifier as Un, substituteEnvVarsFromStateAsync as Ur, buildImageOverrideTag as Ut, createDeployedKvsDataSource as V, resolveEnvVars$1 as Vn, substituteAgainstStateAsync as Vr, runEcsServiceEmulator as Vt, classifyS3Error as W, filterRoutesByApiIdentifiers as Wn, LocalStateSourceError as Wr, enforceImageOverrideOrphans as Wt, serveLambdaUrlOrigin as X, defaultCredentialsLoader as Xn, resolveCfnStackName as Xr, isLocalCdkAssetImage as Xt, serveFromStaticOrigin as Y, resolveServiceIntegrationParameters as Yn, resolveCfnRegion as Yr, describePinnedImageUri as Yt, applyEdgeRequestResult as Z, buildCognitoJwksUrl as Zn, CfnLocalStateProvider as Zr, listPinnedTargets as Zt, filterStudioTargetGroups as _, AGENTCORE_RUNTIME_TYPE as _i, AGENTCORE_SIGV4_SERVICE as _n, buildHttpApiV2Event as _r, createLocalFileKvsDataSource as _t, createLocalStudioCommand as a, discoverWebSocketApis as ai, addInvokeAgentCoreSpecificOptions as an, evaluateCachedLambdaPolicy as ar, extractKvsAssociations as at, renderStudioHtml as b, resolveAgentCoreTarget as bi, invokeAgentCore as bn, pickResponseTemplate as br, albStrategy as bt, startStudioProxy as c, parseSelectionExpressionPath as ci, invokeAgentCoreWs as cn, attachAuthorizers as cr, pickKvsLogicalIdFromArn as ct, createStudioDispatcher as d, pickRefLogicalId as di, a2aInvokeOnce as dn, buildCorsConfigFromCloudFrontChain as dr, resolveCloudFrontDistribution as dt, resolveWatchConfig as ei, DEFAULT_SHADOW_READY_TIMEOUT_MS as en, verifyCognitoJwt as er, buildEdgeResponseEvent as et, filterStudioCustomResources as f, resolveLambdaArnIntrinsic as fi, MCP_CONTAINER_PORT as fn, isFunctionUrlOacFronted as fr, compileCloudFrontFunction as ft, annotatePinnedEcsTargets as g, AGENTCORE_MCP_PROTOCOL as gi, parseSseForJsonRpc as gn, applyAuthorizerOverlay as gr, createCloudFrontModule as gt, annotateEcsTaskPinnedTargets as h, AGENTCORE_HTTP_PROTOCOL as hi, mcpInvokeOnce as hn, translateLambdaResponse as hr, stripCloudFrontImport as ht, coerceStopRequest as i, availableWebSocketApiIdentifiers as ii, attachContainerLogStreamer as in, computeRequestIdentityHash as ir, describeS3OriginDomain as it, attachAgentCoreWsBridge as j, createLocalInvokeCommand as jn, buildConnectEvent as jr, MAX_TASKS_SUBNET_RANGE_CAP as jt, selectServeInboundAuth as k, classifySourceChange as kn, handleConnectionsRequest as kr, addRunTaskSpecificOptions as kt, relayServeRequest as l, webSocketApiMatchesIdentifier as li, A2A_CONTAINER_PORT as ln, applyCorsResponseHeaders as lr, pickLambdaEdgeFunctionLogicalId as lt, annotateAlbPinnedBackingServices as m, AGENTCORE_AGUI_PROTOCOL as mi, MCP_PROTOCOL_VERSION as mn, matchRoute as mr, runViewerResponse as mt, coerceRunRequest as n, countTargets as ni, setShadowReadyTimeoutMs as nn, verifyJwtViaDiscovery as nr, httpHeadersToEdge as nt, resolveServeBaseUrl as o, discoverWebSocketApisOrThrow as oi, createLocalInvokeAgentCoreCommand as on, invokeRequestAuthorizer as or, isCloudFrontDistribution as ot, isCustomResourceLambdaTarget as p, AGENTCORE_A2A_PROTOCOL as pi, MCP_PATH as pn, matchPreflight as pr, runViewerRequest as pt, startCloudFrontServer as q, startApiServer as qn, rejectExplicitCfnStackWithMultipleStacks as qr, resolveImageOverrides as qt, coerceServeRequest as r, listTargets as ri, getContainerNetworkIp as rn, buildMethodArn as rr, CLOUDFRONT_DISTRIBUTION_TYPE as rt, createStudioServeManager as s, filterWebSocketApisByIdentifiers as si, bridgeAgentCoreWs as sn, invokeTokenAuthorizer as sr, pickFunctionUrlLogicalIdFromOrigin as st, addStudioSpecificOptions as t, resolveSingleTarget as ti, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as tn, verifyJwtAuthorizer as tr, edgeHeadersToHttp as tt, reinvoke as u, discoverRoutes as ui, A2A_PATH as un, buildCorsConfigByApiId as ur, pickTargetFunctionLogicalId as ut, startStudioServer as v, AgentCoreResolutionError as vi, signAgentCoreInvocation as vn, buildRestV1Event as vr, createUnboundCloudFrontModule as vt, createLocalListCommand as w, tryResolveImageFnJoin as wi, SUPPORTED_CODE_RUNTIMES as wn, HOST_GATEWAY_MIN_VERSION as wr, isApplicationLoadBalancer as wt, createStudioStore as x, derivePseudoParametersFromRegion as xi, waitForAgentCoreHttpReady as xn, selectIntegrationResponse as xr, createLocalStartAlbCommand as xt, toStudioTargetGroups as y, pickAgentCoreCandidateStack as yi, AGENTCORE_SESSION_ID_HEADER as yn, evaluateResponseParameters as yr, addAlbSpecificOptions as yt, idFromArn as z, buildStageMap as zn, EcsTaskResolutionError as zr, resolveEcsAssumeRoleOption as zt };
+//# sourceMappingURL=local-studio-Cr0YdvCb.js.map