cdk-local 0.147.0 → 0.147.2

package/dist/internal.d.ts

@@ -1,6 +1,884 @@
-import { $i as signAgentCoreInvocation, $n as RegistrationHandle, $r as discoverWebSocketApisOrThrow, $t as CompiledCloudFrontFunction, A as annotateAlbPinnedBackingServices, Ai as A2A_PATH, An as PlannedLambdaForwardTarget, Ar as buildJwksUrlFromIssuer, At as CLOUDFRONT_DISTRIBUTION_TYPE, B as createStudioStore, Bi as McpJsonRpcRequest, Bn as resolveEcsAssumeRoleOption, Br as LambdaTokenAuthorizer, Bt as pickFunctionUrlLogicalIdFromOrigin, C as StudioRunRequest, Ci as AgentCoreWsBridgeHandle, Cn as MAX_TASKS_SUBNET_RANGE_CAP, Cr as CredentialsLoader, Ct as S3FetchResult, D as StudioServerOptions, Di as bridgeAgentCoreWs, Dn as PlannedForwardAction, Dr as JwtCustomClaim, Dt as S3OriginReaderOptions, E as RunningStudioServer, Ea as ResolvedArnLambdaLayer, Ei as InvokeAgentCoreWsOptions, En as PlannedFixedResponseAction, Er as JwksCache, Et as S3OriginReader, F as toStudioTargetGroups, Fi as MCP_CONTAINER_PORT, Fn as addImageOverrideOptions, Fr as AuthorizerCache, Ft as ResolvedLambdaEdgeAssoc, G as StudioTargetKind, Gi as InvokeAgentCoreOptions, Gn as isApplicationLoadBalancer, Gr as buildCorsConfigByApiId, Gt as ErrorResponseCandidate, H as StudioInvocationEvent, Hi as parseSseForJsonRpc, Hn as runEcsServiceEmulator, Hr as attachAuthorizers, Ht as pickLambdaEdgeFunctionLogicalId, I as StudioHistory, Ii as MCP_PATH, In as buildEcsImageResolutionContext, Ir as CachedAuthorizerResult, It as ResolvedOrigin, J as addListSpecificOptions, Ji as waitForAgentCorePing, Jn as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, Jr as matchPreflight, Jt as resolveErrorResponseCandidates, Ki as invokeAgentCore, Kn as resolveAlbFrontDoor, Kr as buildCorsConfigFromCloudFrontChain, Kt as ResolvedCustomErrorResponse, L as StudioLogSearchOptions, Li as MCP_PROTOCOL_VERSION, Ln as ecsClusterOption, Lr as createAuthorizerCache, Lt as describeS3OriginDomain, M as annotatePinnedEcsTargets, Mi as A2aInvokeResult, Mn as ServiceBoot, Mr as verifyCognitoJwt, Mt as ResolvedCloudFrontFunction, N as filterStudioTargetGroups, Ni as A2aJsonRpcRequest, Nn as addCommonEcsServiceOptions, Nr as verifyJwtAuthorizer, Nt as ResolvedDistribution, O as StudioTarget, Oi as invokeAgentCoreWs, On as PlannedForwardTarget, Or as WarnedAt, Ot as classifyS3Error, P as startStudioServer, Pi as a2aInvokeOnce, Pn as addEcsAssumeRoleOptions, Pr as verifyJwtViaDiscovery, Pt as ResolvedLambdaEdge, Q as addStartAgentCoreSpecificOptions, Qi as SignedAgentCoreHeaders, Qn as CloudMapRegistry, Qr as discoverWebSocketApis, Qt as CloudFrontKvsAssociation, R as StudioStore, Ri as McpInvokeOptions, Rn as parseMaxTasks, Rr as AuthorizerInfo, Rt as extractKvsAssociations, S as StudioDispatcher, Sa as createFileWatcher, Si as resolveEnvVars, Sn as FrontDoorPlan, Sr as startApiServer, St as startCloudFrontServer, T as createStudioDispatcher, Ti as BridgeAgentCoreWsOptions, Tn as PlannedEcsForwardTarget, Tr as DiscoveryJwtAuthorizer, Tt as S3OriginCredentials, U as StudioLogEvent, Ui as AGENTCORE_SESSION_ID_HEADER, Un as FrontDoorForwardTarget, Ur as CorsConfig, Ut as pickTargetFunctionLogicalId, V as StudioEventBus, Vi as mcpInvokeOnce, Vn as resolveSharedSidecarCredentials, Vr as RouteWithAuth, Vt as pickKvsLogicalIdFromArn, W as StudioServeEvent, Wi as AgentCoreInvokeResult, Wn as ResolvedListenerAction, Wr as applyCorsResponseHeaders, Wt as resolveCloudFrontDistribution, Xi as SigV4Credentials, Xn as CloudMapIndex, Xr as WebSocketRouteEntry, Xt as CfRequest, Yi as AGENTCORE_SIGV4_SERVICE, Yn as setShadowReadyTimeoutMs, Yr as DiscoveredWebSocketApi, Yt as serveFromStaticOrigin, Zi as SignAgentCoreInvocationOptions, Zn as buildCloudMapIndex, Zr as availableWebSocketApiIdentifiers, Zt as CfResponse, _ as startStudioProxy, _a as ReloadAssetContext, _n as addStartServiceSpecificOptions, _r as resolveApiTargetSubset, _t as parseOriginOverrides, a as coerceServeRequest, aa as AgentCoreCodeArtifact, ai as discoverRoutes, an as CloudFrontModule, ar as CdkLocalError, at as AgentCoreServeAuthCheck, b as relayServeRequest, ba as FileWatcher, bi as DockerImageAssetSource, bn as EcsServiceEmulatorOptions, br as StartedApiServer, bt as StartedCloudFrontServer, c as resolveServeBaseUrl, ca as AgentCoreResolutionError, ci as pickResponseTemplate, cn as createLocalFileKvsDataSource, cr as addRunTaskSpecificOptions, ct as ServeInboundAuthPlan, d as StudioServeRequest, da as resolveAgentCoreTarget, di as VtlEvaluationError, dn as addAlbSpecificOptions, dr as ApiTargetSubset, ea as AGENTCORE_A2A_PROTOCOL, ei as filterWebSocketApisByIdentifiers, en as compileCloudFrontFunction, er as ResolvedEcsService, et as AgentCoreHttpServerConfig, f as StudioServeState, fa as ImageResolutionContext, fi as ContainerPool, fn as albStrategy, ft as LocalStartCloudFrontError, g as StudioProxyConfig, ga as tryResolveImageFnJoin, gi as resolveProfileCredentials, gr as createWatchPredicates, gt as parseKvsFileOverrides, h as RunningStudioProxy, ha as substituteImagePlaceholders, hi as buildStsClientConfig, hn as resolveAlbTarget, ht as normalizeKvsFileKeys, i as coerceRunRequest, ia as AGENTCORE_RUNTIME_TYPE, ii as RestV1IntegrationConfig, in as CloudFrontKvsHandle, it as startAgentCoreHttpServer, j as annotateEcsTaskPinnedTargets, ji as A2aInvokeOptions, jn as PlannedRedirectAction, jr as createJwksCache, jt as ResolvedBehavior, k as StudioTargetGroup, ki as A2A_CONTAINER_PORT, kn as PlannedFrontDoorListener, kr as buildCognitoJwksUrl, kt as createS3OriginReader, l as StudioServeManager, la as ResolvedAgentCoreRuntime, li as selectIntegrationResponse, ln as createUnboundCloudFrontModule, lt as buildAgentCoreServeAuthCheck, m as createStudioServeManager, ma as formatStateRemedy, mi as resolveWatchConfig, mn as parseLbPortOverrides, mr as addStartApiSpecificOptions, n as StudioServeRequestPayload, na as AGENTCORE_HTTP_PROTOCOL, ni as webSocketApiMatchesIdentifier, nn as runViewerResponse, nt as AgentCoreServeSignRequest, o as coerceStopRequest, oa as AgentCoreCustomClaim, oi as IntegrationResponseEntry, on as KvsDataSource, or as LocalInvokeBuildError, ot as AgentCoreServeAuthResult, p as StudioStopRequest, pa as derivePseudoParametersFromRegion, pi as CdkWatchConfig, pr as WatchPredicates, pt as addStartCloudFrontSpecificOptions, qi as waitForAgentCoreHttpReady, qn as DEFAULT_SHADOW_READY_TIMEOUT_MS, qr as isFunctionUrlOacFronted, qt as StaticOriginResult, r as addStudioSpecificOptions, ra as AGENTCORE_MCP_PROTOCOL, ri as DiscoveredRoute, rn as stripCloudFrontImport, rt as RunningAgentCoreHttpServer, sa as AgentCoreJwtAuthorizer, si as evaluateResponseParameters, sn as createCloudFrontModule, st as BuildAgentCoreServeAuthCheckOptions, ta as AGENTCORE_AGUI_PROTOCOL, ti as parseSelectionExpressionPath, tn as runViewerRequest, to as CloudFormationTemplate, tr as TargetEntry, tt as AgentCoreServeRoute, u as StudioServeManagerConfig, ua as pickAgentCoreCandidateStack, ui as tryParseStatus, ur as EcsTaskResolutionError, ut as selectServeInboundAuth, v as ServeRequestInput, va as ReloadVerdict, vi as addInvokeAgentCoreSpecificOptions, vr as MtlsServerConfig, vt as resolveCloudFrontTarget, w as StudioRunResult, wa as addInvokeSpecificOptions, wi as AgentCoreWsResult, wn as PlannedAction, wr as defaultCredentialsLoader, wt as S3ObjectFetcher, x as StudioDispatchConfig, xa as FileWatcherOptions, xi as EnvOverrideFile, xn as EmulatorStrategy, xr as readMtlsMaterialsFromDisk, xt as matchBehavior, y as ServeRequestResult, ya as classifySourceChange, yn as serviceStrategy, yr as ServerState, yt as LambdaUrlInvokerMap, z as StudioStoreOptions, zi as McpInvokeResult, zn as parseRestartPolicy, zr as LambdaRequestAuthorizer, zt as isCloudFrontDistribution } from "./local-studio-DcBEEMJp.js";
+import { $ as serviceStrategy, $t as RouteWithAuth, A as addListSpecificOptions, An as formatStateRemedy, At as TargetEntry, B as normalizeKvsFileKeys, Bt as ResolvedEcsTask, C as StudioEventBus, Cn as AgentCoreWsResult, Ct as FrontDoorForwardTarget, D as StudioTargetKind, Dn as invokeAgentCoreWs, Dt as DEFAULT_SHADOW_READY_TIMEOUT_MS, E as StudioServeEvent, En as bridgeAgentCoreWs, Et as resolveAlbFrontDoor, Ft as LocalInvokeBuildError, G as addAlbSpecificOptions, H as parseOriginOverrides, In as ResolvedArnLambdaLayer, J as parseLbPortOverrides, Jt as AuthorizerInfo, K as albStrategy, Kt as createWatchPredicates, L as LocalStartCloudFrontError, Ln as StackInfo, Lt as addRunTaskSpecificOptions, Mn as tryResolveImageFnJoin, On as ImageResolutionContext, Ot as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, P as addStartAgentCoreSpecificOptions, Pn as addInvokeSpecificOptions, Pt as CdkLocalError, Qt as LambdaTokenAuthorizer, R as addStartCloudFrontSpecificOptions, S as createStudioDispatcher, Sn as AgentCoreWsBridgeHandle, St as runEcsServiceEmulator, T as StudioLogEvent, Tn as InvokeAgentCoreWsOptions, Tt as isApplicationLoadBalancer, U as resolveCloudFrontTarget, Ut as WatchPredicates, V as parseKvsFileOverrides, Vt as ApiTargetSubset, Wt as addStartApiSpecificOptions, Xt as JwtAuthorizer, Y as resolveAlbTarget, Yt as CognitoUserPoolAuthorizer, Z as addStartServiceSpecificOptions, Zt as LambdaRequestAuthorizer, _ as startStudioProxy, _n as CdkWatchConfig, _t as ecsClusterOption, a as coerceServeRequest, an as discoverWebSocketApisOrThrow, at as PlannedEcsForwardTarget, b as StudioRunRequest, bn as addInvokeAgentCoreSpecificOptions, bt as resolveEcsAssumeRoleOption, c as resolveServeBaseUrl, cn as webSocketApiMatchesIdentifier, ct as PlannedForwardTarget, d as StudioServeRequest, dn as discoverRoutes, dt as PlannedRedirectAction, en as attachAuthorizers, et as EcsServiceEmulatorOptions, f as StudioServeState, fn as IntegrationResponseEntry, fr as CloudFormationTemplate, ft as ServiceBoot, g as StudioProxyConfig, gn as tryParseStatus, gt as buildEcsImageResolutionContext, h as RunningStudioProxy, hn as selectIntegrationResponse, ht as addImageOverrideOptions, i as coerceRunRequest, in as discoverWebSocketApis, it as PlannedAction, jn as substituteImagePlaceholders, jt as TargetListing, kn as derivePseudoParametersFromRegion, kt as setShadowReadyTimeoutMs, l as StudioServeManager, ln as DiscoveredRoute, lt as PlannedFrontDoorListener, m as createStudioServeManager, mn as pickResponseTemplate, mt as addEcsAssumeRoleOptions, n as StudioServeRequestPayload, nn as WebSocketRouteEntry, nt as FrontDoorPlan, o as coerceStopRequest, on as filterWebSocketApisByIdentifiers, ot as PlannedFixedResponseAction, p as StudioStopRequest, pn as evaluateResponseParameters, pr as TemplateResource, pt as addCommonEcsServiceOptions, qt as resolveApiTargetSubset, r as addStudioSpecificOptions, rn as availableWebSocketApiIdentifiers, rt as MAX_TASKS_SUBNET_RANGE_CAP, sn as parseSelectionExpressionPath, st as PlannedForwardAction, tn as DiscoveredWebSocketApi, tt as EmulatorStrategy, u as StudioServeManagerConfig, un as RestV1IntegrationConfig, ut as PlannedLambdaForwardTarget, v as StudioDispatchConfig, vn as resolveWatchConfig, vt as parseMaxTasks, w as StudioInvocationEvent, wn as BridgeAgentCoreWsOptions, wt as ResolvedListenerAction, x as StudioRunResult, xt as resolveSharedSidecarCredentials, y as StudioDispatcher, yt as parseRestartPolicy, zt as EcsTaskResolutionError } from "./local-studio-BBA_8Xvk.js";
 import { WebSocket } from "ws";
 import { IncomingHttpHeaders, IncomingMessage, Server, ServerResponse } from "node:http";
+import * as vm from "node:vm";
+import "@aws-sdk/signature-v4a";
+//#region src/local/file-watcher.d.ts
+interface FileWatcher {
+  close(): Promise<void>;
+}
+interface FileWatcherOptions {
+  paths: readonly string[];
+  onChange: (changedPaths: readonly string[]) => void;
+  debounceMs?: number;
+  ignoreInitial?: boolean;
+  ignored?: (path: string) => boolean;
+  shouldTrigger?: (path: string) => boolean;
+}
+declare function createFileWatcher(options: FileWatcherOptions): FileWatcher;
+//#endregion
+//#region src/local/source-change-classifier.d.ts
+interface ReloadAssetContext {
+  oldAssetHash?: string;
+  newAssetHash: string;
+  newAssetSourceDir: string;
+  dockerFile: string;
+}
+type ReloadVerdict = {
+  kind: 'rebuild';
+  reason: string;
+} | {
+  kind: 'soft-reload';
+  reason: string;
+  newAssetSourceDir: string;
+};
+declare function classifySourceChange(changedPaths: readonly string[], ctx: ReloadAssetContext | undefined): ReloadVerdict;
+//#endregion
+//#region src/local/agentcore-resolver.d.ts
+declare const AGENTCORE_RUNTIME_TYPE = "AWS::BedrockAgentCore::Runtime";
+declare const AGENTCORE_HTTP_PROTOCOL = "HTTP";
+declare const AGENTCORE_MCP_PROTOCOL = "MCP";
+declare const AGENTCORE_A2A_PROTOCOL = "A2A";
+declare const AGENTCORE_AGUI_PROTOCOL = "AGUI";
+interface ResolvedAgentCoreRuntime {
+  stack: StackInfo;
+  logicalId: string;
+  resource: TemplateResource;
+  containerUri?: string;
+  codeArtifact?: AgentCoreCodeArtifact;
+  environmentVariables: Record<string, unknown>;
+  roleArn?: string;
+  protocol: string;
+  jwtAuthorizer?: AgentCoreJwtAuthorizer;
+}
+interface AgentCoreJwtAuthorizer {
+  discoveryUrl: string;
+  allowedAudience?: string[];
+  allowedClients?: string[];
+  allowedScopes?: string[];
+  customClaims?: AgentCoreCustomClaim[];
+}
+interface AgentCoreCustomClaim {
+  name: string;
+  valueType: 'STRING' | 'STRING_ARRAY';
+  operator: 'EQUALS' | 'CONTAINS' | 'CONTAINS_ANY';
+  value: string | string[];
+}
+interface AgentCoreCodeArtifact {
+  runtime: string;
+  entryPoint: string[];
+  codeAssetHash: string;
+  s3Source?: {
+    bucket?: string;
+    bucketIntrinsic?: unknown;
+    key: string;
+    versionId?: string;
+  };
+}
+declare class AgentCoreResolutionError extends Error {
+  constructor(message: string);
+}
+declare function resolveAgentCoreTarget(target: string, stacks: StackInfo[], imageContext?: ImageResolutionContext): ResolvedAgentCoreRuntime;
+declare function pickAgentCoreCandidateStack(target: string, stacks: StackInfo[]): StackInfo | undefined;
+//#endregion
+//#region src/local/agentcore-sigv4-sign.d.ts
+declare const AGENTCORE_SIGV4_SERVICE = "bedrock-agentcore";
+interface SigV4Credentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+}
+interface SignAgentCoreInvocationOptions {
+  credentials: SigV4Credentials;
+  region: string;
+  host: string;
+  port: number;
+  path: string;
+  body: string | Buffer;
+  sessionId: string;
+  method?: string;
+  now?: () => number;
+}
+interface SignedAgentCoreHeaders {
+  authorization: string;
+  amzDate: string;
+  amzContentSha256: string;
+  amzSecurityToken?: string;
+}
+declare function signAgentCoreInvocation(opts: SignAgentCoreInvocationOptions): Promise<SignedAgentCoreHeaders>;
+//#endregion
+//#region src/local/agentcore-client.d.ts
+declare const AGENTCORE_SESSION_ID_HEADER = "X-Amzn-Bedrock-AgentCore-Runtime-Session-Id";
+interface AgentCoreInvokeResult {
+  status: number;
+  contentType: string | null;
+  raw: string;
+  streamed: boolean;
+}
+declare function waitForAgentCorePing(host: string, port: number, timeoutMs?: number): Promise<void>;
+declare function waitForAgentCoreHttpReady(host: string, port: number, path: string, timeoutMs?: number): Promise<void>;
+interface InvokeAgentCoreOptions {
+  sessionId: string;
+  timeoutMs: number;
+  authorization?: string;
+  additionalHeaders?: Record<string, string>;
+  onChunk?: (text: string) => void;
+}
+declare function invokeAgentCore(host: string, port: number, event: unknown, options: InvokeAgentCoreOptions): Promise<AgentCoreInvokeResult>;
+//#endregion
+//#region src/local/agentcore-mcp-client.d.ts
+declare const MCP_CONTAINER_PORT = 8000;
+declare const MCP_PATH = "/mcp";
+declare const MCP_PROTOCOL_VERSION = "2025-06-18";
+interface McpJsonRpcRequest {
+  method: string;
+  params?: unknown;
+}
+interface McpInvokeResult {
+  ok: boolean;
+  raw: string;
+}
+interface McpInvokeOptions {
+  readyTimeoutMs?: number;
+  requestTimeoutMs?: number;
+  fetchImpl?: typeof fetch;
+}
+declare function mcpInvokeOnce(host: string, port: number, request: McpJsonRpcRequest, options?: McpInvokeOptions): Promise<McpInvokeResult>;
+declare function parseSseForJsonRpc(text: string, id: number): unknown;
+//#endregion
+//#region src/local/agentcore-a2a-client.d.ts
+declare const A2A_CONTAINER_PORT = 9000;
+declare const A2A_PATH = "/";
+interface A2aJsonRpcRequest {
+  method: string;
+  params?: unknown;
+}
+interface A2aInvokeResult {
+  ok: boolean;
+  raw: string;
+}
+interface A2aInvokeOptions {
+  readyTimeoutMs?: number;
+  requestTimeoutMs?: number;
+  fetchImpl?: typeof fetch;
+}
+declare function a2aInvokeOnce(host: string, port: number, request: A2aJsonRpcRequest, options?: A2aInvokeOptions): Promise<A2aInvokeResult>;
+//#endregion
+//#region src/local/env-resolver.d.ts
+interface EnvResolutionResult {
+  resolved: Record<string, string>;
+  unresolved: string[];
+}
+interface EnvOverrideFile {
+  Parameters?: Record<string, string | null>;
+  [logicalIdOrDisplayPath: string]: Record<string, string | null> | undefined;
+}
+declare function resolveEnvVars(logicalId: string, displayPath: string | undefined, templateEnv: Record<string, unknown> | undefined, overrides?: EnvOverrideFile): EnvResolutionResult;
+//#endregion
+//#region src/types/assets.d.ts
+interface DockerImageAssetSource {
+  directory?: string;
+  executable?: string[];
+  dockerFile?: string;
+  dockerBuildTarget?: string;
+  dockerBuildArgs?: Record<string, string>;
+  dockerBuildContexts?: Record<string, string>;
+  dockerBuildSsh?: string;
+  dockerBuildSecrets?: Record<string, string>;
+  networkMode?: string;
+  platform?: string;
+  dockerOutputs?: string[];
+  cacheFrom?: DockerCacheOption[];
+  cacheTo?: DockerCacheOption;
+  cacheDisabled?: boolean;
+}
+interface DockerCacheOption {
+  type: string;
+  params?: Record<string, string>;
+}
+//#endregion
+//#region src/utils/profile-resolver.d.ts
+declare function resolveProfileCredentials(profile: string): Promise<{
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+  region?: string;
+}>;
+declare function buildStsClientConfig(args: {
+  region?: string | undefined;
+  profile?: string | undefined;
+}): {
+  region?: string;
+  profile?: string;
+};
+//#endregion
+//#region src/local/container-pool.d.ts
+interface ContainerHandle {
+  logicalId: string;
+  containerId: string;
+  containerName: string;
+  hostPort: number;
+  containerHost: string;
+  stopLogStream: () => void;
+}
+interface ContainerPool {
+  acquire(logicalId: string): Promise<ContainerHandle>;
+  release(handle: ContainerHandle): void;
+  dispose(): Promise<void>;
+}
+//#endregion
+//#region src/local/vtl-engine.d.ts
+declare class VtlEvaluationError extends Error {
+  constructor(message: string);
+}
+//#endregion
+//#region src/local/cors-handler.d.ts
+interface CorsConfig {
+  AllowOrigins: string[];
+  AllowMethods: string[];
+  AllowHeaders: string[];
+  ExposeHeaders: string[];
+  MaxAge?: number;
+  AllowCredentials?: boolean;
+}
+declare function buildCorsConfigByApiId(template: CloudFormationTemplate): Map<string, CorsConfig>;
+declare function buildCorsConfigFromCloudFrontChain(template: CloudFormationTemplate): Map<string, CorsConfig>;
+declare function isFunctionUrlOacFronted(template: CloudFormationTemplate, fnUrlLogicalId: string): boolean;
+interface PreflightResponse {
+  statusCode: number;
+  headers: Record<string, string>;
+}
+declare function matchPreflight(req: {
+  method: string;
+  headers: Record<string, string[]>;
+}, config: CorsConfig): PreflightResponse | null;
+declare function applyCorsResponseHeaders(res: ServerResponse, apiLogicalId: string | undefined, corsConfigByApiId: Map<string, CorsConfig>, requestOrigin: string | undefined): void;
+//#endregion
+//#region src/local/authorizer-cache.d.ts
+interface CachedAuthorizerResult {
+  allow: boolean;
+  principalId?: string;
+  context?: Record<string, unknown>;
+  policy?: unknown;
+}
+interface AuthorizerCache {
+  get(authorizerLogicalId: string, identityHash: string): CachedAuthorizerResult | undefined;
+  set(authorizerLogicalId: string, identityHash: string, ttlSeconds: number, result: CachedAuthorizerResult): void;
+  clear(): void;
+  size(): number;
+}
+declare function createAuthorizerCache(opts?: {
+  now?: () => number;
+}): AuthorizerCache;
+//#endregion
+//#region src/local/cognito-jwt.d.ts
+interface JwksKey {
+  kid: string;
+  n: string;
+  e: string;
+  alg?: string;
+  kty: string;
+  use?: string;
+}
+interface JwksCacheEntry {
+  byKid: Map<string, JwksKey>;
+  expiresAt: number;
+  passThrough: boolean;
+}
+interface JwksCache {
+  fetchAndCache(jwksUrl: string): Promise<JwksCacheEntry>;
+  peek(jwksUrl: string): JwksCacheEntry | undefined;
+  clear(): void;
+}
+type WarnedAt = Map<string, number>;
+declare function createJwksCache(opts?: {
+  fetchImpl?: (url: string) => Promise<{
+    ok: boolean;
+    status: number;
+    text: () => Promise<string>;
+  }>;
+  now?: () => number;
+  ttlMs?: number;
+  failureTtlMs?: number;
+}): JwksCache;
+declare function buildCognitoJwksUrl(region: string, userPoolId: string): string;
+declare function buildJwksUrlFromIssuer(issuer: string): string;
+declare function verifyCognitoJwt(authorizer: CognitoUserPoolAuthorizer, authorizationHeader: string | undefined, jwksCache: JwksCache, opts?: {
+  now?: () => number;
+  warnedAt?: WarnedAt;
+}): Promise<CachedAuthorizerResult & {
+  identityHash: string | undefined;
+  ttlSeconds: number;
+}>;
+declare function verifyJwtAuthorizer(authorizer: JwtAuthorizer, authorizationHeader: string | undefined, jwksCache: JwksCache, opts?: {
+  now?: () => number;
+  warnedAt?: WarnedAt;
+}): Promise<CachedAuthorizerResult & {
+  identityHash: string | undefined;
+  ttlSeconds: number;
+}>;
+interface DiscoveryJwtAuthorizer {
+  discoveryUrl: string;
+  allowedAudience?: readonly string[];
+  allowedClients?: readonly string[];
+  allowedScopes?: readonly string[];
+  customClaims?: readonly JwtCustomClaim[];
+}
+interface JwtCustomClaim {
+  name: string;
+  valueType: 'STRING' | 'STRING_ARRAY';
+  operator: 'EQUALS' | 'CONTAINS' | 'CONTAINS_ANY';
+  value: string | string[];
+}
+declare function verifyJwtViaDiscovery(authorizer: DiscoveryJwtAuthorizer, authorizationHeader: string | undefined, jwksCache: JwksCache, opts?: {
+  now?: () => number;
+  warnedAt?: WarnedAt;
+  fetchImpl?: (url: string) => Promise<{
+    ok: boolean;
+    status: number;
+    text: () => Promise<string>;
+  }>;
+}): Promise<CachedAuthorizerResult & {
+  identityHash: string | undefined;
+  ttlSeconds: number;
+}>;
+//#endregion
+//#region src/local/sigv4-verify.d.ts
+interface ResolvedCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string | undefined;
+}
+type CredentialsLoader = () => Promise<ResolvedCredentials>;
+declare function defaultCredentialsLoader(): CredentialsLoader;
+//#endregion
+//#region src/local/http-server.d.ts
+interface ServerState {
+  routes: readonly RouteWithAuth[];
+  pool: ContainerPool;
+  corsConfigByApiId: Map<string, CorsConfig>;
+}
+interface StartApiServerOptions {
+  state: ServerState;
+  rieTimeoutMs: number;
+  host: string;
+  port: number;
+  authorizerCache?: AuthorizerCache;
+  jwksCache?: JwksCache;
+  jwksWarnedAt?: WarnedAt;
+  mtls?: MtlsServerConfig;
+  sigV4CredentialsLoader?: CredentialsLoader;
+  sigV4WarnedForeignIds?: Set<string>;
+  sigV4Strict?: boolean;
+  defaultRegion?: string;
+  preDispatch?: (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+}
+interface MtlsServerConfig {
+  caPem: Buffer;
+  certPem: Buffer;
+  keyPem: Buffer;
+}
+interface StartedApiServer {
+  port: number;
+  host: string;
+  scheme: 'http' | 'https';
+  server: Server;
+  close: () => Promise<void>;
+  setServerState: (next: ServerState) => ServerState;
+  getServerState: () => ServerState;
+}
+declare function startApiServer(opts: StartApiServerOptions): Promise<StartedApiServer>;
+declare function readMtlsMaterialsFromDisk(opts: {
+  truststorePath: string;
+  certPath: string;
+  keyPath: string;
+}): MtlsServerConfig;
+//#endregion
+//#region src/local/ecs-service-resolver.d.ts
+interface ResolvedServiceConnect {
+  namespaceName: string;
+  services: ReadonlyArray<{
+    portName: string;
+    containerPort: number;
+    discoveryName: string;
+    clientAliases: ReadonlyArray<{
+      dnsName?: string;
+      port: number;
+    }>;
+  }>;
+}
+interface ResolvedServiceRegistry {
+  cloudMapServiceLogicalId: string;
+  containerName?: string;
+  containerPort?: number;
+}
+interface ResolvedEcsService {
+  stack: StackInfo;
+  serviceLogicalId: string;
+  resource: TemplateResource;
+  serviceName: string;
+  serviceDisplayName: string;
+  desiredCount: number;
+  healthCheckGracePeriodSeconds: number;
+  task: ResolvedEcsTask;
+  serviceConnect?: ResolvedServiceConnect;
+  serviceRegistries: ReadonlyArray<ResolvedServiceRegistry>;
+  warnings: string[];
+}
+//#endregion
+//#region src/local/cloud-map-registry.d.ts
+interface RegisteredEndpoint {
+  ip: string;
+  port: number;
+  ownerKey: string;
+}
+interface RegistrationHandle {
+  readonly fqdn: string;
+  readonly ownerKey: string;
+}
+interface RegistryListing {
+  namespace: string;
+  discoveryName: string;
+  endpoints: ReadonlyArray<RegisteredEndpoint>;
+  isAlias: boolean;
+}
+declare class CloudMapRegistry {
+  private readonly byFqdn;
+  private readonly aliasIndex;
+  register(namespace: string, discoveryName: string, endpoint: RegisteredEndpoint): RegistrationHandle;
+  registerAlias(alias: string, targetFqdn: string): void;
+  unregister(handle: RegistrationHandle): boolean;
+  unregisterByOwner(ownerKeyPrefix: string): number;
+  lookup(namespace: string, discoveryName: string): ReadonlyArray<RegisteredEndpoint> | undefined;
+  lookupAlias(alias: string): ReadonlyArray<RegisteredEndpoint> | undefined;
+  buildAddHostFlags(excludeOwnerKeyPrefix?: string): string[];
+  list(): ReadonlyArray<RegistryListing>;
+  isEmpty(): boolean;
+}
+//#endregion
+//#region src/local/cloud-map-resolver.d.ts
+interface ResolvedCloudMapNamespace {
+  logicalId: string;
+  name: string;
+}
+interface ResolvedCloudMapService {
+  logicalId: string;
+  namespaceLogicalId: string;
+  namespaceName: string;
+  name: string;
+  dnsRecords: ReadonlyArray<{
+    type: 'A' | 'SRV';
+    ttlSeconds: number;
+  }>;
+}
+interface CloudMapIndex {
+  namespacesByLogicalId: Map<string, ResolvedCloudMapNamespace>;
+  namespacesByName: Map<string, ResolvedCloudMapNamespace>;
+  servicesByLogicalId: Map<string, ResolvedCloudMapService>;
+  warnings: string[];
+}
+declare function buildCloudMapIndex(stack: StackInfo): CloudMapIndex;
+//#endregion
+//#region src/local/cloudfront-kvs.d.ts
+interface KvsDataSource {
+  readonly label: string;
+  readonly kvsId?: string;
+  getValue(key: string): Promise<string | undefined>;
+}
+interface CloudFrontKvsHandle {
+  get(key: string, options?: {
+    format?: 'string' | 'json';
+  }): Promise<unknown>;
+  exists(key: string): Promise<boolean>;
+  meta(): Promise<never>;
+  count(): Promise<never>;
+}
+interface CloudFrontModule {
+  kvs(kvsId?: string): CloudFrontKvsHandle;
+}
+declare function createCloudFrontModule(sources: readonly KvsDataSource[]): CloudFrontModule;
+declare function createUnboundCloudFrontModule(functionLogicalId: string): CloudFrontModule;
+declare function createLocalFileKvsDataSource(args: {
+  id: string;
+  filePath: string;
+}): KvsDataSource;
+//#endregion
+//#region src/local/cloudfront-function-runtime.d.ts
+interface CfValue {
+  value: string;
+  multiValue?: Array<{
+    value: string;
+  }>;
+}
+interface CfRequest {
+  method: string;
+  uri: string;
+  querystring: Record<string, CfValue>;
+  headers: Record<string, CfValue>;
+  cookies: Record<string, CfValue>;
+}
+interface CfResponse {
+  statusCode: number;
+  statusDescription?: string;
+  headers: Record<string, CfValue>;
+  cookies?: Record<string, CfValue>;
+  body?: string | {
+    encoding?: 'text' | 'base64';
+    data?: string;
+  };
+}
+interface CfViewerRequestEvent {
+  version: '1.0';
+  context: {
+    distributionDomainName: string;
+    distributionId: string;
+    eventType: string;
+    requestId: string;
+  };
+  viewer: {
+    ip: string;
+  };
+  request: CfRequest;
+}
+interface CfViewerResponseEvent extends CfViewerRequestEvent {
+  response: CfResponse;
+}
+interface CloudFrontKvsAssociation {
+  arnValue: unknown;
+  kvsLogicalId?: string;
+}
+interface CompiledCloudFrontFunction {
+  logicalId: string;
+  runtime: string;
+  script: vm.Script;
+  cloudfrontBindingName?: string;
+  kvsAssociations?: CloudFrontKvsAssociation[];
+  cloudfrontModule?: CloudFrontModule;
+}
+declare function stripCloudFrontImport(code: string): {
+  code: string;
+  bindingName?: string;
+};
+declare function compileCloudFrontFunction(logicalId: string, code: string, runtime: string): CompiledCloudFrontFunction;
+type ViewerRequestOutcome = {
+  kind: 'continue';
+  request: CfRequest;
+} | {
+  kind: 'response';
+  response: CfResponse;
+};
+declare function runViewerRequest(fn: CompiledCloudFrontFunction, event: CfViewerRequestEvent): Promise<ViewerRequestOutcome>;
+declare function runViewerResponse(fn: CompiledCloudFrontFunction, event: CfViewerResponseEvent): Promise<CfResponse>;
+//#endregion
+//#region src/local/cloudfront-static-origin.d.ts
+interface ResolvedCustomErrorResponse {
+  errorCode: number;
+  responsePagePath?: string;
+  responseCode?: number;
+}
+interface StaticOriginResult {
+  statusCode: number;
+  headers: Record<string, string>;
+  body: Buffer;
+}
+declare function serveFromStaticOrigin(input: {
+  localDirs: readonly string[];
+  uri: string;
+  defaultRootObject?: string;
+  customErrorResponses?: readonly ResolvedCustomErrorResponse[];
+}): StaticOriginResult;
+interface ErrorResponseCandidate {
+  errorKey: string;
+  responseCode: number;
+}
+declare function resolveErrorResponseCandidates(customErrorResponses?: readonly ResolvedCustomErrorResponse[]): ErrorResponseCandidate[];
+//#endregion
+//#region src/local/cloudfront-resolver.d.ts
+interface ResolvedCloudFrontFunction extends CompiledCloudFrontFunction {}
+interface ResolvedLambdaEdgeAssoc {
+  functionLogicalId: string;
+  includeBody: boolean;
+}
+interface ResolvedLambdaEdge {
+  viewerRequest?: ResolvedLambdaEdgeAssoc;
+  originRequest?: ResolvedLambdaEdgeAssoc;
+  originResponse?: ResolvedLambdaEdgeAssoc;
+  viewerResponse?: ResolvedLambdaEdgeAssoc;
+}
+interface ResolvedBehavior {
+  pathPattern?: string;
+  targetOriginId: string;
+  viewerProtocolPolicy?: string;
+  viewerRequest?: ResolvedCloudFrontFunction;
+  viewerResponse?: ResolvedCloudFrontFunction;
+  lambdaEdge?: ResolvedLambdaEdge;
+  cors?: CorsConfig;
+}
+type ResolvedOrigin = {
+  kind: 's3';
+  originId: string;
+  localDirs: string[];
+} | {
+  kind: 's3-unresolved';
+  originId: string;
+  bucketLogicalId?: string;
+  bucketName?: string;
+  deployedConfigOnly?: boolean;
+} | {
+  kind: 's3-deployed';
+  originId: string;
+  bucketName: string;
+} | {
+  kind: 'lambda-url';
+  originId: string;
+  functionLogicalId: string;
+  functionUrlLogicalId: string;
+} | {
+  kind: 'custom';
+  originId: string;
+  domainName: string;
+};
+interface ResolvedDistribution {
+  logicalId: string;
+  stackName: string;
+  defaultRootObject?: string;
+  behaviors: ResolvedBehavior[];
+  origins: Map<string, ResolvedOrigin>;
+  customErrorResponses: ResolvedCustomErrorResponse[];
+}
+declare const CLOUDFRONT_DISTRIBUTION_TYPE = "AWS::CloudFront::Distribution";
+declare function resolveCloudFrontDistribution(args: {
+  stack: StackInfo;
+  logicalId: string;
+  originOverrides?: Map<string, string>;
+}): ResolvedDistribution;
+declare function extractKvsAssociations(functionConfig: Record<string, unknown>): CloudFrontKvsAssociation[];
+declare function pickKvsLogicalIdFromArn(value: unknown): string | undefined;
+declare function pickLambdaEdgeFunctionLogicalId(value: unknown, template: CloudFormationTemplate): string | undefined;
+declare function describeS3OriginDomain(value: unknown): {
+  isS3: boolean;
+  bucketName?: string;
+};
+declare function pickFunctionUrlLogicalIdFromOrigin(value: unknown): string | undefined;
+declare function pickTargetFunctionLogicalId(value: unknown): string | undefined;
+declare function isCloudFrontDistribution(resource: TemplateResource): boolean;
+//#endregion
+//#region src/local/cloudfront-s3-origin.d.ts
+interface S3OriginCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+}
+type S3FetchResult = {
+  kind: 'found';
+  body: Buffer;
+} | {
+  kind: 'not-found';
+} | {
+  kind: 'denied';
+} | {
+  kind: 'error';
+  message: string;
+};
+type S3ObjectFetcher = (key: string) => Promise<S3FetchResult>;
+interface S3OriginReaderOptions {
+  region?: string;
+  credentials?: S3OriginCredentials;
+  cache?: boolean;
+  fetchObject?: S3ObjectFetcher;
+}
+interface S3OriginReader {
+  (input: {
+    uri: string;
+    defaultRootObject?: string;
+    customErrorResponses?: readonly ResolvedCustomErrorResponse[];
+  }): Promise<StaticOriginResult>;
+  close(): Promise<void>;
+  clearCache(): void;
+}
+declare function createS3OriginReader(bucketName: string, options?: S3OriginReaderOptions): S3OriginReader;
+declare function classifyS3Error(err: unknown): S3FetchResult;
+//#endregion
+//#region src/local/front-door-tls.d.ts
+interface FrontDoorTlsMaterials {
+  certPem: Buffer;
+  keyPem: Buffer;
+}
+//#endregion
+//#region src/local/cloudfront-server.d.ts
+type LambdaUrlInvokerMap = Map<string, (event: Record<string, unknown>) => Promise<unknown>>;
+interface StartedCloudFrontServer {
+  url: string;
+  port: number;
+  scheme: 'http' | 'https';
+  update(distribution: ResolvedDistribution): void;
+  close(): Promise<void>;
+}
+interface StartCloudFrontServerOptions {
+  distribution: ResolvedDistribution;
+  host: string;
+  port: number;
+  tls?: FrontDoorTlsMaterials;
+  lambdaInvokers?: LambdaUrlInvokerMap;
+  edgeInvokers?: LambdaUrlInvokerMap;
+  s3OriginReaders?: Map<string, S3OriginReader>;
+}
+declare function startCloudFrontServer(options: StartCloudFrontServerOptions): Promise<StartedCloudFrontServer>;
+declare function matchBehavior(behaviors: readonly ResolvedBehavior[], uri: string): ResolvedBehavior | undefined;
+//#endregion
+//#region src/local/agentcore-serve-auth.d.ts
+interface AgentCoreServeAuthResult {
+  allow: boolean;
+  status?: number;
+  message?: string;
+  authorization?: string;
+}
+type AgentCoreServeAuthCheck = (headers: IncomingHttpHeaders) => Promise<AgentCoreServeAuthResult>;
+interface BuildAgentCoreServeAuthCheckOptions {
+  noVerifyAuth?: boolean;
+  bearerToken?: string;
+  jwksCache?: JwksCache;
+  warnedAt?: WarnedAt;
+}
+declare function buildAgentCoreServeAuthCheck(authorizer: AgentCoreJwtAuthorizer, opts?: BuildAgentCoreServeAuthCheckOptions): AgentCoreServeAuthCheck;
+interface ServeInboundAuthPlan {
+  authCheck?: AgentCoreServeAuthCheck;
+  bridgeAuthorization?: string;
+  sign: boolean;
+}
+declare function selectServeInboundAuth(resolved: Pick<ResolvedAgentCoreRuntime, 'jwtAuthorizer'>, options: {
+  bearerToken?: string;
+  verifyAuth?: boolean;
+}, sigv4Active: boolean, buildAuthCheck?: typeof buildAgentCoreServeAuthCheck): ServeInboundAuthPlan;
+//#endregion
+//#region src/local/agentcore-http-server.d.ts
+interface AgentCoreServeRoute {
+  method: string;
+  path: string;
+}
+type AgentCoreServeSignRequest = (opts: {
+  method: string;
+  path: string;
+  body: Buffer;
+  sessionId: string;
+}) => Promise<Record<string, string>>;
+interface AgentCoreHttpServerConfig {
+  containerHost: string;
+  containerPort: number;
+  host?: string;
+  port?: number;
+  sessionId?: string;
+  authorization?: string;
+  routes?: AgentCoreServeRoute[];
+  attachWs?: boolean;
+  authCheck?: AgentCoreServeAuthCheck;
+  signRequest?: AgentCoreServeSignRequest;
+}
+interface RunningAgentCoreHttpServer {
+  httpUrl: string;
+  wsUrl?: string;
+  port: number;
+  setContainerPort(port: number): void;
+  close(): Promise<void>;
+}
+declare function startAgentCoreHttpServer(config: AgentCoreHttpServerConfig): Promise<RunningAgentCoreHttpServer>;
+//#endregion
+//#region src/local/studio-store.d.ts
+interface StudioStoreOptions {
+  maxInvocations?: number;
+  maxLogs?: number;
+  bindGraceMs?: number;
+}
+interface StudioHistory {
+  invocations: StudioInvocationEvent[];
+  logs: StudioLogEvent[];
+}
+interface StudioLogSearchOptions {
+  target?: string;
+  limit?: number;
+}
+interface StudioStore {
+  history: () => StudioHistory;
+  searchLogs: (query: string, opts?: StudioLogSearchOptions) => StudioLogEvent[];
+  logsForInvocation: (id: string) => StudioLogEvent[];
+  invocation: (id: string) => StudioInvocationEvent | undefined;
+  dispose: () => void;
+}
+declare function createStudioStore(bus: StudioEventBus, options?: StudioStoreOptions): StudioStore;
+//#endregion
+//#region src/local/studio-server.d.ts
+interface StudioTarget {
+  id: string;
+  qualifiedId: string;
+  surface?: string;
+  servable?: boolean;
+  pinned?: boolean;
+  pinUnresolved?: boolean;
+  backingPinnedServices?: {
+    id: string;
+    label: string;
+  }[];
+  agentCoreHasWs?: boolean;
+  agentCoreContractPath?: string;
+}
+interface StudioTargetGroup {
+  kind: 'lambda' | 'api' | 'alb' | 'ecs' | 'ecs-task' | 'cloudfront' | 'agentcore' | 'agentcore-ws';
+  title: string;
+  entries: StudioTarget[];
+}
+declare function toStudioTargetGroups(listing: TargetListing): StudioTargetGroup[];
+declare function annotatePinnedEcsTargets(groups: StudioTargetGroup[], classify: (targetId: string) => boolean): boolean;
+declare function annotateEcsTaskPinnedTargets(groups: StudioTargetGroup[], classify: (targetId: string) => boolean): boolean;
+declare function annotateAlbPinnedBackingServices(groups: StudioTargetGroup[], resolveBackingPinned: (albEntry: StudioTarget) => {
+  id: string;
+  label: string;
+}[]): boolean;
+declare function filterStudioTargetGroups(groups: StudioTargetGroup[], globs: string[] | undefined): StudioTargetGroup[];
+interface StudioServerOptions {
+  port: number;
+  host?: string;
+  bus: StudioEventBus;
+  targetGroups: StudioTargetGroup[];
+  dockerfiles?: string[];
+  appLabel: string;
+  cliName: string;
+  maxPortBump?: number;
+  onRun?: (body: unknown) => Promise<unknown>;
+  onStop?: (body: unknown) => Promise<unknown>;
+  onServeRequest?: (body: unknown) => Promise<unknown>;
+  onReinvoke?: (body: unknown) => Promise<unknown>;
+  getRunning?: () => unknown;
+  store?: StudioStore;
+  getConfig?: () => unknown;
+  patchConfig?: (body: unknown) => Promise<unknown>;
+}
+interface RunningStudioServer {
+  url: string;
+  port: number;
+  close: () => Promise<void>;
+  setTargets: (groups: StudioTargetGroup[], dockerfiles?: string[]) => void;
+}
+declare function startStudioServer(options: StudioServerOptions): Promise<RunningStudioServer>;
+//#endregion
+//#region src/local/studio-request-relay.d.ts
+interface ServeRequestInput {
+  baseUrl: string;
+  method: string;
+  path?: string;
+  headers?: Record<string, string>;
+  body?: string;
+  timeoutMs?: number;
+  maxBodyChars?: number;
+}
+interface ServeRequestResult {
+  status: number;
+  headers: Record<string, string>;
+  body: string;
+  truncated: boolean;
+  durationMs: number;
+}
+declare function relayServeRequest(input: ServeRequestInput, fetchFn?: typeof fetch, clock?: () => number): Promise<ServeRequestResult>;
+//#endregion
 //#region src/local/intrinsic-utils.d.ts
 declare function pickRefLogicalId(value: unknown): string | null;
 //#endregion