cdk-local 0.147.8 → 0.147.9

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, St as createLocalStartAlbCommand, a as createLocalStudioCommand, jt as createLocalRunTaskCommand, sn as createLocalInvokeAgentCoreCommand, w as createLocalListCommand } from "./local-studio-PCB6DpBn.js";
+import { D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, St as createLocalStartAlbCommand, a as createLocalStudioCommand, jt as createLocalRunTaskCommand, sn as createLocalInvokeAgentCoreCommand, w as createLocalListCommand } from "./local-studio-xigfWo5b.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.147.8");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.147.9");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalInvokeAgentCoreCommand());
 program.addCommand(createLocalStartApiCommand());

package/dist/index.js

@@ -1,4 +1,4 @@
 import { d as setEmbedConfig, l as getEmbedConfig, u as resetEmbedConfig } from "./docker-cmd-DLX1TqVw.js";
-import { $r as resolveCfnStackName, D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Gr as substituteEnvVarsFromState, Jr as createLocalStateProvider, Kr as substituteEnvVarsFromStateAsync, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, Qr as resolveCfnRegion, St as createLocalStartAlbCommand, T as formatTargetListing, Ur as substituteAgainstState, Wr as substituteAgainstStateAsync, Xr as rejectExplicitCfnStackWithMultipleStacks, Yr as isCfnFlagPresent, Zr as resolveCfnFallbackRegion, a as createLocalStudioCommand, ai as countTargets, ei as CfnLocalStateProvider, jt as createLocalRunTaskCommand, ni as resolveSsmParameters, oi as listTargets, qr as LocalStateSourceError, sn as createLocalInvokeAgentCoreCommand, ti as collectSsmParameterRefs, w as createLocalListCommand } from "./local-studio-PCB6DpBn.js";
+import { $r as resolveCfnStackName, D as createLocalStartAgentCoreCommand, F as createLocalStartCloudFrontCommand, Gr as substituteEnvVarsFromState, Jr as createLocalStateProvider, Kr as substituteEnvVarsFromStateAsync, Mn as createLocalInvokeCommand, Ot as createLocalStartServiceCommand, Pn as createLocalStartApiCommand, Qr as resolveCfnRegion, St as createLocalStartAlbCommand, T as formatTargetListing, Ur as substituteAgainstState, Wr as substituteAgainstStateAsync, Xr as rejectExplicitCfnStackWithMultipleStacks, Yr as isCfnFlagPresent, Zr as resolveCfnFallbackRegion, a as createLocalStudioCommand, ai as countTargets, ei as CfnLocalStateProvider, jt as createLocalRunTaskCommand, ni as resolveSsmParameters, oi as listTargets, qr as LocalStateSourceError, sn as createLocalInvokeAgentCoreCommand, ti as collectSsmParameterRefs, w as createLocalListCommand } from "./local-studio-xigfWo5b.js";
 
 export { CfnLocalStateProvider, LocalStateSourceError, collectSsmParameterRefs, countTargets, createLocalInvokeAgentCoreCommand, createLocalInvokeCommand, createLocalListCommand, createLocalRunTaskCommand, createLocalStartAgentCoreCommand, createLocalStartAlbCommand, createLocalStartApiCommand, createLocalStartCloudFrontCommand, createLocalStartServiceCommand, createLocalStateProvider, createLocalStudioCommand, formatTargetListing, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resetEmbedConfig, resolveCfnFallbackRegion, resolveCfnRegion, resolveCfnStackName, resolveSsmParameters, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync };

package/dist/internal.js

@@ -1,3 +1,3 @@
-import { $ as applyEdgeResponseResult, $n as buildJwksUrlFromIssuer, $t as buildCloudMapIndex, A as startAgentCoreHttpServer, Ai as resolveProfileCredentials, An as classifySourceChange, Ar as ConnectionRegistry, At as addRunTaskSpecificOptions, B as idFromArn, Bn as buildStageMap, Br as resolveRuntimeFileExtension, Bt as resolveEcsAssumeRoleOption, C as addListSpecificOptions, Ci as resolveAgentCoreTarget, Cn as waitForAgentCorePing, Cr as tryParseStatus, Ct as parseLbPortOverrides, Di as tryResolveImageFnJoin, Dn as computeCodeImageTag, Dr as probeHostGatewaySupport, Dt as addStartServiceSpecificOptions, E as addStartAgentCoreSpecificOptions, Ei as substituteImagePlaceholders, En as buildAgentCoreCodeImage, Er as HOST_GATEWAY_MIN_VERSION, Et as resolveAlbFrontDoor, Fn as createWatchPredicates, Fr as buildDisconnectEvent, Ft as addImageOverrideOptions, G as classifyS3Error, Gn as filterRoutesByApiIdentifiers, Gt as enforceImageOverrideOrphans, H as createDeployedKvsDataSource, Hn as resolveEnvVars, Hr as EcsTaskResolutionError, Ht as runEcsServiceEmulator, I as normalizeKvsFileKeys, In as resolveApiTargetSubset, Ir as buildMessageEvent, It as buildEcsImageResolutionContext, J as startCloudFrontServer, Jn as startApiServer, Jt as resolveImageOverrides, K as createS3OriginReader, Kn as groupRoutesByServer, Kt as mergeForService, L as parseKvsFileOverrides, Ln as createAuthorizerCache, Lr as architectureToPlatform, Lt as ecsClusterOption, M as startAgentCoreWsBridge, Mr as handleConnectionsRequest, Mt as MAX_TASKS_SUBNET_RANGE_CAP, N as LocalStartCloudFrontError, Nn as addStartApiSpecificOptions, Nr as parseConnectionsPath, Nt as addCommonEcsServiceOptions, O as buildAgentCoreServeAuthCheck, Oi as LocalInvokeBuildError, On as renderCodeDockerfile, Or as resolveHostGatewayExtraHosts, P as addStartCloudFrontSpecificOptions, Pr as buildConnectEvent, Pt as addEcsAssumeRoleOptions, Q as applyEdgeRequestResult, Qn as buildCognitoJwksUrl, Qt as listPinnedTargets, R as parseOriginOverrides, Rn as createFileWatcher, Rr as buildContainerImage, Rt as parseMaxTasks, S as StudioEventBus, Si as pickAgentCoreCandidateStack, Sn as waitForAgentCoreHttpReady, Sr as selectIntegrationResponse, Ti as formatStateRemedy, Tn as SUPPORTED_CODE_RUNTIMES, Tr as HOST_DOCKER_INTERNAL_GATEWAY, Tt as isApplicationLoadBalancer, U as resolveDeployedKvsArnByName, Un as availableApiIdentifiers, Ut as ImageOverrideError, V as resolveKvsModulesForDistribution, Vn as materializeLayerFromArn, Vr as resolveRuntimeImage, Vt as resolveSharedSidecarCredentials, W as resolveDeployedOriginBucket, Wn as filterRoutesByApiIdentifier, Wt as buildImageOverrideTag, X as serveFromStaticOrigin, Xn as resolveServiceIntegrationParameters, Xt as describePinnedImageUri, Y as resolveErrorResponseCandidates, Yn as resolveSelectionExpression, Yt as runImageOverrideBuilds, Z as serveLambdaUrlOrigin, Zn as defaultCredentialsLoader, Zt as isLocalCdkAssetImage, _ as filterStudioTargetGroups, _i as AGENTCORE_AGUI_PROTOCOL, _n as parseSseForJsonRpc, _r as applyAuthorizerOverlay, _t as createCloudFrontModule, an as attachContainerLogStreamer, ar as computeRequestIdentityHash, at as describeS3OriginDomain, b as renderStudioHtml, bi as AGENTCORE_RUNTIME_TYPE, bn as AGENTCORE_SESSION_ID_HEADER, br as evaluateResponseParameters, bt as addAlbSpecificOptions, c as startStudioProxy, ci as discoverWebSocketApis, cn as bridgeAgentCoreWs, cr as invokeTokenAuthorizer, ct as pickFunctionUrlLogicalIdFromOrigin, d as createStudioDispatcher, di as parseSelectionExpressionPath, dn as A2A_PATH, dr as buildCorsConfigByApiId, dt as pickTargetFunctionLogicalId, en as CloudMapRegistry, er as createJwksCache, et as buildEdgeRequestEvent, f as filterStudioCustomResources, fi as webSocketApiMatchesIdentifier, fn as a2aInvokeOnce, fr as buildCorsConfigFromCloudFrontChain, ft as resolveCloudFrontDistribution, g as annotatePinnedEcsTargets, gi as AGENTCORE_A2A_PROTOCOL, gn as mcpInvokeOnce, gr as translateLambdaResponse, gt as stripCloudFrontImport, h as annotateEcsTaskPinnedTargets, hi as resolveLambdaArnIntrinsic, hn as MCP_PROTOCOL_VERSION, hr as matchRoute, ht as runViewerResponse, i as coerceStopRequest, ii as resolveSingleTarget, in as getContainerNetworkIp, ir as buildMethodArn, it as CLOUDFRONT_DISTRIBUTION_TYPE, j as attachAgentCoreWsBridge, jn as addInvokeSpecificOptions, jr as buildMgmtEndpointEnvUrl, k as selectServeInboundAuth, ki as buildStsClientConfig, kn as toCmdArgv, kr as bufferToBody, kt as serviceStrategy, l as relayServeRequest, li as discoverWebSocketApisOrThrow, ln as invokeAgentCoreWs, lr as attachAuthorizers, lt as pickKvsLogicalIdFromArn, m as annotateAlbPinnedBackingServices, mi as pickRefLogicalId, mn as MCP_PATH, mr as matchPreflight, mt as runViewerRequest, n as coerceRunRequest, nn as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, nr as verifyJwtAuthorizer, nt as edgeHeadersToHttp, o as resolveServeBaseUrl, on as addInvokeAgentCoreSpecificOptions, or as evaluateCachedLambdaPolicy, ot as extractKvsAssociations, p as isCustomResourceLambdaTarget, pi as discoverRoutes, pn as MCP_CONTAINER_PORT, pr as isFunctionUrlOacFronted, pt as compileCloudFrontFunction, q as matchBehavior, qn as readMtlsMaterialsFromDisk, qt as parseImageOverrideFlags, r as coerceServeRequest, ri as resolveWatchConfig, rn as setShadowReadyTimeoutMs, rr as verifyJwtViaDiscovery, rt as httpHeadersToEdge, s as createStudioServeManager, si as availableWebSocketApiIdentifiers, sr as invokeRequestAuthorizer, st as isCloudFrontDistribution, t as addStudioSpecificOptions, tn as DEFAULT_SHADOW_READY_TIMEOUT_MS, tr as verifyCognitoJwt, tt as buildEdgeResponseEvent, u as reinvoke, ui as filterWebSocketApisByIdentifiers, un as A2A_CONTAINER_PORT, ur as applyCorsResponseHeaders, ut as pickLambdaEdgeFunctionLogicalId, v as startStudioServer, vi as AGENTCORE_HTTP_PROTOCOL, vn as AGENTCORE_SIGV4_SERVICE, vr as buildHttpApiV2Event, vt as createLocalFileKvsDataSource, wi as derivePseudoParametersFromRegion, wn as downloadAndExtractS3Bundle, wr as VtlEvaluationError, wt as resolveAlbTarget, x as createStudioStore, xi as AgentCoreResolutionError, xn as invokeAgentCore, xr as pickResponseTemplate, xt as albStrategy, y as toStudioTargetGroups, yi as AGENTCORE_MCP_PROTOCOL, yn as signAgentCoreInvocation, yr as buildRestV1Event, yt as createUnboundCloudFrontModule, z as resolveCloudFrontTarget, zn as attachStageContext, zr as resolveRuntimeCodeMountPath, zt as parseRestartPolicy } from "./local-studio-PCB6DpBn.js";
+import { $ as applyEdgeResponseResult, $n as buildJwksUrlFromIssuer, $t as buildCloudMapIndex, A as startAgentCoreHttpServer, Ai as resolveProfileCredentials, An as classifySourceChange, Ar as ConnectionRegistry, At as addRunTaskSpecificOptions, B as idFromArn, Bn as buildStageMap, Br as resolveRuntimeFileExtension, Bt as resolveEcsAssumeRoleOption, C as addListSpecificOptions, Ci as resolveAgentCoreTarget, Cn as waitForAgentCorePing, Cr as tryParseStatus, Ct as parseLbPortOverrides, Di as tryResolveImageFnJoin, Dn as computeCodeImageTag, Dr as probeHostGatewaySupport, Dt as addStartServiceSpecificOptions, E as addStartAgentCoreSpecificOptions, Ei as substituteImagePlaceholders, En as buildAgentCoreCodeImage, Er as HOST_GATEWAY_MIN_VERSION, Et as resolveAlbFrontDoor, Fn as createWatchPredicates, Fr as buildDisconnectEvent, Ft as addImageOverrideOptions, G as classifyS3Error, Gn as filterRoutesByApiIdentifiers, Gt as enforceImageOverrideOrphans, H as createDeployedKvsDataSource, Hn as resolveEnvVars, Hr as EcsTaskResolutionError, Ht as runEcsServiceEmulator, I as normalizeKvsFileKeys, In as resolveApiTargetSubset, Ir as buildMessageEvent, It as buildEcsImageResolutionContext, J as startCloudFrontServer, Jn as startApiServer, Jt as resolveImageOverrides, K as createS3OriginReader, Kn as groupRoutesByServer, Kt as mergeForService, L as parseKvsFileOverrides, Ln as createAuthorizerCache, Lr as architectureToPlatform, Lt as ecsClusterOption, M as startAgentCoreWsBridge, Mr as handleConnectionsRequest, Mt as MAX_TASKS_SUBNET_RANGE_CAP, N as LocalStartCloudFrontError, Nn as addStartApiSpecificOptions, Nr as parseConnectionsPath, Nt as addCommonEcsServiceOptions, O as buildAgentCoreServeAuthCheck, Oi as LocalInvokeBuildError, On as renderCodeDockerfile, Or as resolveHostGatewayExtraHosts, P as addStartCloudFrontSpecificOptions, Pr as buildConnectEvent, Pt as addEcsAssumeRoleOptions, Q as applyEdgeRequestResult, Qn as buildCognitoJwksUrl, Qt as listPinnedTargets, R as parseOriginOverrides, Rn as createFileWatcher, Rr as buildContainerImage, Rt as parseMaxTasks, S as StudioEventBus, Si as pickAgentCoreCandidateStack, Sn as waitForAgentCoreHttpReady, Sr as selectIntegrationResponse, Ti as formatStateRemedy, Tn as SUPPORTED_CODE_RUNTIMES, Tr as HOST_DOCKER_INTERNAL_GATEWAY, Tt as isApplicationLoadBalancer, U as resolveDeployedKvsArnByName, Un as availableApiIdentifiers, Ut as ImageOverrideError, V as resolveKvsModulesForDistribution, Vn as materializeLayerFromArn, Vr as resolveRuntimeImage, Vt as resolveSharedSidecarCredentials, W as resolveDeployedOriginBucket, Wn as filterRoutesByApiIdentifier, Wt as buildImageOverrideTag, X as serveFromStaticOrigin, Xn as resolveServiceIntegrationParameters, Xt as describePinnedImageUri, Y as resolveErrorResponseCandidates, Yn as resolveSelectionExpression, Yt as runImageOverrideBuilds, Z as serveLambdaUrlOrigin, Zn as defaultCredentialsLoader, Zt as isLocalCdkAssetImage, _ as filterStudioTargetGroups, _i as AGENTCORE_AGUI_PROTOCOL, _n as parseSseForJsonRpc, _r as applyAuthorizerOverlay, _t as createCloudFrontModule, an as attachContainerLogStreamer, ar as computeRequestIdentityHash, at as describeS3OriginDomain, b as renderStudioHtml, bi as AGENTCORE_RUNTIME_TYPE, bn as AGENTCORE_SESSION_ID_HEADER, br as evaluateResponseParameters, bt as addAlbSpecificOptions, c as startStudioProxy, ci as discoverWebSocketApis, cn as bridgeAgentCoreWs, cr as invokeTokenAuthorizer, ct as pickFunctionUrlLogicalIdFromOrigin, d as createStudioDispatcher, di as parseSelectionExpressionPath, dn as A2A_PATH, dr as buildCorsConfigByApiId, dt as pickTargetFunctionLogicalId, en as CloudMapRegistry, er as createJwksCache, et as buildEdgeRequestEvent, f as filterStudioCustomResources, fi as webSocketApiMatchesIdentifier, fn as a2aInvokeOnce, fr as buildCorsConfigFromCloudFrontChain, ft as resolveCloudFrontDistribution, g as annotatePinnedEcsTargets, gi as AGENTCORE_A2A_PROTOCOL, gn as mcpInvokeOnce, gr as translateLambdaResponse, gt as stripCloudFrontImport, h as annotateEcsTaskPinnedTargets, hi as resolveLambdaArnIntrinsic, hn as MCP_PROTOCOL_VERSION, hr as matchRoute, ht as runViewerResponse, i as coerceStopRequest, ii as resolveSingleTarget, in as getContainerNetworkIp, ir as buildMethodArn, it as CLOUDFRONT_DISTRIBUTION_TYPE, j as attachAgentCoreWsBridge, jn as addInvokeSpecificOptions, jr as buildMgmtEndpointEnvUrl, k as selectServeInboundAuth, ki as buildStsClientConfig, kn as toCmdArgv, kr as bufferToBody, kt as serviceStrategy, l as relayServeRequest, li as discoverWebSocketApisOrThrow, ln as invokeAgentCoreWs, lr as attachAuthorizers, lt as pickKvsLogicalIdFromArn, m as annotateAlbPinnedBackingServices, mi as pickRefLogicalId, mn as MCP_PATH, mr as matchPreflight, mt as runViewerRequest, n as coerceRunRequest, nn as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, nr as verifyJwtAuthorizer, nt as edgeHeadersToHttp, o as resolveServeBaseUrl, on as addInvokeAgentCoreSpecificOptions, or as evaluateCachedLambdaPolicy, ot as extractKvsAssociations, p as isCustomResourceLambdaTarget, pi as discoverRoutes, pn as MCP_CONTAINER_PORT, pr as isFunctionUrlOacFronted, pt as compileCloudFrontFunction, q as matchBehavior, qn as readMtlsMaterialsFromDisk, qt as parseImageOverrideFlags, r as coerceServeRequest, ri as resolveWatchConfig, rn as setShadowReadyTimeoutMs, rr as verifyJwtViaDiscovery, rt as httpHeadersToEdge, s as createStudioServeManager, si as availableWebSocketApiIdentifiers, sr as invokeRequestAuthorizer, st as isCloudFrontDistribution, t as addStudioSpecificOptions, tn as DEFAULT_SHADOW_READY_TIMEOUT_MS, tr as verifyCognitoJwt, tt as buildEdgeResponseEvent, u as reinvoke, ui as filterWebSocketApisByIdentifiers, un as A2A_CONTAINER_PORT, ur as applyCorsResponseHeaders, ut as pickLambdaEdgeFunctionLogicalId, v as startStudioServer, vi as AGENTCORE_HTTP_PROTOCOL, vn as AGENTCORE_SIGV4_SERVICE, vr as buildHttpApiV2Event, vt as createLocalFileKvsDataSource, wi as derivePseudoParametersFromRegion, wn as downloadAndExtractS3Bundle, wr as VtlEvaluationError, wt as resolveAlbTarget, x as createStudioStore, xi as AgentCoreResolutionError, xn as invokeAgentCore, xr as pickResponseTemplate, xt as albStrategy, y as toStudioTargetGroups, yi as AGENTCORE_MCP_PROTOCOL, yn as signAgentCoreInvocation, yr as buildRestV1Event, yt as createUnboundCloudFrontModule, z as resolveCloudFrontTarget, zn as attachStageContext, zr as resolveRuntimeCodeMountPath, zt as parseRestartPolicy } from "./local-studio-xigfWo5b.js";
 
 export { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_HTTP_PROTOCOL, AGENTCORE_MCP_PROTOCOL, AGENTCORE_RUNTIME_TYPE, AGENTCORE_SESSION_ID_HEADER, AGENTCORE_SIGV4_SERVICE, AgentCoreResolutionError, CLOUDFRONT_DISTRIBUTION_TYPE, CloudMapRegistry, ConnectionRegistry, DEFAULT_SHADOW_READY_TIMEOUT_MS, EcsTaskResolutionError, HOST_DOCKER_INTERNAL_GATEWAY, HOST_GATEWAY_MIN_VERSION, ImageOverrideError, LocalInvokeBuildError, LocalStartCloudFrontError, MAX_TASKS_SUBNET_RANGE_CAP, MCP_CONTAINER_PORT, MCP_PATH, MCP_PROTOCOL_VERSION, SOFT_RELOAD_COMPLETION_LOG_SUFFIX, SUPPORTED_CODE_RUNTIMES, StudioEventBus, VtlEvaluationError, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addEcsAssumeRoleOptions, addImageOverrideOptions, addInvokeAgentCoreSpecificOptions, addInvokeSpecificOptions, addListSpecificOptions, addRunTaskSpecificOptions, addStartAgentCoreSpecificOptions, addStartApiSpecificOptions, addStartCloudFrontSpecificOptions, addStartServiceSpecificOptions, addStudioSpecificOptions, albStrategy, annotateAlbPinnedBackingServices, annotateEcsTaskPinnedTargets, annotatePinnedEcsTargets, applyAuthorizerOverlay, applyCorsResponseHeaders, applyEdgeRequestResult, applyEdgeResponseResult, architectureToPlatform, attachAgentCoreWsBridge, attachAuthorizers, attachContainerLogStreamer, attachStageContext, availableApiIdentifiers, availableWebSocketApiIdentifiers, bridgeAgentCoreWs, bufferToBody, buildAgentCoreCodeImage, buildAgentCoreServeAuthCheck, buildCloudMapIndex, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildEcsImageResolutionContext, buildEdgeRequestEvent, buildEdgeResponseEvent, buildHttpApiV2Event, buildImageOverrideTag, buildJwksUrlFromIssuer, buildMessageEvent, buildMethodArn, buildMgmtEndpointEnvUrl, buildRestV1Event, buildStageMap, buildStsClientConfig, classifyS3Error, classifySourceChange, coerceRunRequest, coerceServeRequest, coerceStopRequest, compileCloudFrontFunction, computeCodeImageTag, computeRequestIdentityHash, createAuthorizerCache, createCloudFrontModule, createDeployedKvsDataSource, createFileWatcher, createJwksCache, createLocalFileKvsDataSource, createS3OriginReader, createStudioDispatcher, createStudioServeManager, createStudioStore, createUnboundCloudFrontModule, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describePinnedImageUri, describeS3OriginDomain, discoverRoutes, discoverWebSocketApis, discoverWebSocketApisOrThrow, downloadAndExtractS3Bundle, ecsClusterOption, edgeHeadersToHttp, enforceImageOverrideOrphans, evaluateCachedLambdaPolicy, evaluateResponseParameters, extractKvsAssociations, filterRoutesByApiIdentifier, filterRoutesByApiIdentifiers, filterStudioCustomResources, filterStudioTargetGroups, filterWebSocketApisByIdentifiers, formatStateRemedy, getContainerNetworkIp, groupRoutesByServer, handleConnectionsRequest, httpHeadersToEdge, idFromArn, invokeAgentCore, invokeAgentCoreWs, invokeRequestAuthorizer, invokeTokenAuthorizer, isApplicationLoadBalancer, isCloudFrontDistribution, isCustomResourceLambdaTarget, isFunctionUrlOacFronted, isLocalCdkAssetImage, listPinnedTargets, matchBehavior, matchPreflight, matchRoute, materializeLayerFromArn, mcpInvokeOnce, mergeForService, normalizeKvsFileKeys, parseConnectionsPath, parseImageOverrideFlags, parseKvsFileOverrides, parseLbPortOverrides, parseMaxTasks, parseOriginOverrides, parseRestartPolicy, parseSelectionExpressionPath, parseSseForJsonRpc, pickAgentCoreCandidateStack, pickFunctionUrlLogicalIdFromOrigin, pickKvsLogicalIdFromArn, pickLambdaEdgeFunctionLogicalId, pickRefLogicalId, pickResponseTemplate, pickTargetFunctionLogicalId, probeHostGatewaySupport, readMtlsMaterialsFromDisk, reinvoke, relayServeRequest, renderCodeDockerfile, renderStudioHtml, resolveAgentCoreTarget, resolveAlbFrontDoor, resolveAlbTarget, resolveApiTargetSubset, resolveCloudFrontDistribution, resolveCloudFrontTarget, resolveDeployedKvsArnByName, resolveDeployedOriginBucket, resolveEcsAssumeRoleOption, resolveEnvVars, resolveErrorResponseCandidates, resolveHostGatewayExtraHosts, resolveImageOverrides, resolveKvsModulesForDistribution, resolveLambdaArnIntrinsic, resolveProfileCredentials, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSelectionExpression, resolveServeBaseUrl, resolveServiceIntegrationParameters, resolveSharedSidecarCredentials, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, runImageOverrideBuilds, runViewerRequest, runViewerResponse, selectIntegrationResponse, selectServeInboundAuth, serveFromStaticOrigin, serveLambdaUrlOrigin, serviceStrategy, setShadowReadyTimeoutMs, signAgentCoreInvocation, startAgentCoreHttpServer, startAgentCoreWsBridge, startApiServer, startCloudFrontServer, startStudioProxy, startStudioServer, stripCloudFrontImport, substituteImagePlaceholders, toCmdArgv, toStudioTargetGroups, translateLambdaResponse, tryParseStatus, tryResolveImageFnJoin, verifyCognitoJwt, verifyJwtAuthorizer, verifyJwtViaDiscovery, waitForAgentCoreHttpReady, waitForAgentCorePing, webSocketApiMatchesIdentifier };

package/dist/{local-studio-PCB6DpBn.js → local-studio-xigfWo5b.js}

@@ -13421,7 +13421,8 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 	try {
 		local = await loadCredentials();
 	} catch (err) {
-		const reason = err instanceof Error ? err.message : String(err);
+		logger.debug(`AWS_IAM authorizer: the AWS credential chain's own failure message was: ${stringifyCredentialLoadFailure(err)}`);
+		const reason = describeCredentialLoadFailure(err);
 		const { sigV4StrictByDefault, sigV4OptFlag: optFlag } = getEmbedConfig();
 		if (opts.strict && !opts.oacFronted) {
 			logger.warn(sigV4StrictByDefault ? `AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified. cdk-local denies unverifiable IAM requests by default; pass ${optFlag} to warn-and-pass, or configure AWS credentials cdk-local can read.` : `AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified. ${optFlag} is set, so cdk-local denies unverifiable IAM requests; remove ${optFlag} to warn-and-pass (the default), or configure AWS credentials cdk-local can read.`);
@@ -13439,12 +13440,12 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 	}
 	if (local.accessKeyId.toLowerCase() !== parsed.credentialAccessKeyId.toLowerCase()) {
 		const warned = opts.warnedForeignIds;
-		const dedupKey = parsed.credentialAccessKeyId.toLowerCase();
+		const dedupKey = createHash("sha256").update(parsed.credentialAccessKeyId.toLowerCase()).digest("hex");
 		const { sigV4StrictByDefault, sigV4OptFlag: optFlag } = getEmbedConfig();
 		if (opts.strict && !opts.oacFronted) {
 			if (!warned || !warned.has(dedupKey)) {
 				logger.warn(sigV4StrictByDefault ? `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', which differs from the AWS credentials cdk-local resolved locally — SigV4 (HMAC / shared-secret) can only be verified with the signer's own credentials, never a federated / Cognito Identity Pool / cross-account signer's. cdk-local denies it by default; pass ${optFlag} to warn-and-pass, or sign the request with the same credentials cdk-local resolves locally.` : `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', which differs from the AWS credentials cdk-local resolved locally — SigV4 (HMAC / shared-secret) can only be verified with the signer's own credentials, never a federated / Cognito Identity Pool / cross-account signer's. ${optFlag} is set, so cdk-local denies it; remove ${optFlag} to warn-and-pass (the default), or sign the request with the same credentials cdk-local resolves locally.`);
-				warned?.add(dedupKey);
+				rememberWarnedForeignId(warned, dedupKey);
 			}
 			return {
 				allow: false,
@@ -13453,7 +13454,7 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 		}
 		if (!warned || !warned.has(dedupKey)) {
 			logger.warn(opts.oacFronted ? `AWS_IAM authorizer: Function URL is fronted by CloudFront OAC — in production CloudFront re-signs the origin request, so the local client's signature (access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}') cannot be verified. Passing through with unverified principalId 'unverified-foreign-identity'. Do NOT trust event.requestContext.authorizer.principalId in handler code.` : sigV4StrictByDefault ? `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', a federated / Cognito Identity Pool / cross-account signer cdk-local cannot verify locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it because AWS holds the secret). ${optFlag} is set; passing through with unverified principalId 'unverified-foreign-identity'. Do NOT trust event.requestContext.authorizer.principalId in handler code.` : `AWS_IAM authorizer: request signed with access-key-id '${redactAuthorizationSegment(parsed.credentialAccessKeyId)}', a federated / Cognito Identity Pool / cross-account signer cdk-local cannot verify locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it because AWS holds the secret). Passing through with unverified principalId 'unverified-foreign-identity' — cdk-local's default for unverifiable IAM requests; pass ${optFlag} to deny instead. Do NOT trust event.requestContext.authorizer.principalId in handler code.`);
-			warned?.add(dedupKey);
+			rememberWarnedForeignId(warned, dedupKey);
 		}
 		return {
 			allow: true,
@@ -13579,6 +13580,111 @@ function redactSignature(signature) {
 	return signature;
 }
 /**
+* Describe a credential-chain failure for a default-level log line WITHOUT
+* relaying the chain's own message (issue #564).
+*
+* The message is withheld because of what a credential-chain error CAN
+* carry: `@aws-sdk/credential-provider-process` copies the rejection of
+* `promisify(child_process.exec)` — Node's
+* `Command failed: <command line>\n<stderr>` — into the error it throws, so
+* a passphrase on a `credential_process` command line is already inside a
+* chain error object. On the SDK versions this repo resolves today that
+* object does not actually reach the caller (the chain swallows it and ends
+* on a generic message), which makes this defense in depth rather than a
+* live disclosure. The measurement, and the full reasoning for withholding
+* at `warn` while keeping the text at `debug`, are at the call site in
+* {@link verifySigV4}.
+*
+* What is reported instead is input-INDEPENDENT: `err.name` is set by the
+* throwing class rather than derived from anything the loader read, which is
+* the property that makes quoting it safe, and is the same discriminator
+* `ecs-secrets-resolver.ts` reports for the JSON parse failure it must not
+* echo. `'unknown'` rather than a guessed class name for a non-`Error`
+* throw, so the field never names a class the throw was not -- and the same
+* `'unknown'` for a `name` that is not a bare identifier, so the guarantee
+* does not rest on every provider following the convention.
+*
+* The LENGTH is reported, unlike in `ecs-secrets-resolver.ts`, and the
+* difference is deliberate: there the user already knows which secret it is
+* and can read the value at its source, so a character count would be
+* disclosure buying nothing. Here the user cannot see the withheld message
+* at all, and the count is what separates a one-line
+* `Could not load credentials from any providers` from a multi-hundred-
+* character `Command failed:` dump — which is what tells them whether their
+* `credential_process` even ran. It is the same choice
+* {@link redactAuthorizationSegment} makes when it withholds.
+*
+* The count is a side channel, and a narrow one: against a KNOWN
+* `credential_process` template the number is `constant + len(passphrase)`,
+* so it yields the passphrase's LENGTH. That is accepted rather than
+* overlooked. It buys the one thing the user cannot otherwise see, the
+* `Command failed:` dump is not reachable today anyway (see the call site),
+* and bucketing the number would blur exactly the boilerplate-vs-dump
+* distinction the field exists for.
+*/
+function stringifyCredentialLoadFailure(err) {
+	try {
+		return err instanceof Error ? String(err.message) : String(err);
+	} catch {
+		return "[unstringifiable throw]";
+	}
+}
+function describeCredentialLoadFailure(err) {
+	const rawKind = err instanceof Error ? err.name : "unknown";
+	return `${/^[A-Za-z0-9_.-]{1,64}$/.test(rawKind) ? rawKind : "unknown"}; ${stringifyCredentialLoadFailure(err).length}-character message withheld, logged at debug level under --verbose`;
+}
+/**
+* How many distinct foreign access-key-ids {@link verifySigV4}'s warn-dedup
+* set retains (issue #561).
+*
+* The legitimate population is tiny — a session sees one federated / Cognito
+* Identity Pool / cross-account signer, occasionally a handful — so 256
+* leaves two orders of magnitude of headroom over any real use while holding
+* the set at 256 entries of exactly 64 hex characters whatever a caller
+* sends, because {@link verifySigV4} hashes the id before it becomes a key.
+*
+* `docs/local-emulation.md` states this number to users ("the 256 most
+* recently warned ids"); change both together.
+*/
+const FOREIGN_ID_DEDUP_MAX = 256;
+/**
+* Record that the foreign-access-key-id warning has been emitted for
+* `dedupKey`, evicting oldest-first so the set cannot grow without bound
+* (issue #561).
+*
+* # Why eviction, and not "stop warning past the cap"
+*
+* The set's only power is SUPPRESSION — an entry present means the warning
+* is skipped — so the two candidate policies differ in the DIRECTION they
+* fail. Evicting an entry can only ever cause a REPEAT warning, which is
+* precisely the un-deduped behaviour this code had before the dedup existed:
+* noisier, never quieter. Capping by refusing to warn once the set is full
+* would instead silence the (cap+1)-th distinct signer, and that signer is
+* every bit as likely to be the real federated identity the developer needs
+* told about as it is to be a prober's next value. A warning that never
+* arrives is a worse failure than a set that grows, so the bound is put
+* where it cannot suppress anything.
+*
+* `Set` iterates in insertion order, so `values().next()` is the oldest
+* entry and this is FIFO. It is a loop rather than a single `delete` so a
+* set handed in already over the cap is brought back under it.
+*
+* What this does NOT fix: a client looping over DISTINCT ids still draws one
+* warn line per probe. Distinct ids defeat the dedup whether or not the set
+* is bounded, and closing that half would need suppression — the direction
+* ruled out above. The bound here is on memory only.
+*/
+function rememberWarnedForeignId(warned, dedupKey) {
+	if (!warned) return;
+	if (warned.has(dedupKey)) return;
+	while (warned.size >= FOREIGN_ID_DEDUP_MAX) {
+		const oldest = warned.values().next();
+		if (oldest.done === true) break;
+		warned.delete(oldest.value);
+	}
+	warned.add(dedupKey);
+}
+/**
 * Parse `AWS4-HMAC-SHA256 Credential=..., SignedHeaders=..., Signature=...`.
 * Rejects every other shape (including legacy `AWS4-HMAC-SHA256-...`
 * variants and HTTP/1.0-style multi-line values).
@@ -37954,4 +38060,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, resolveProfileCredentials as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, buildStsClientConfig as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-PCB6DpBn.js.map
+//# sourceMappingURL=local-studio-xigfWo5b.js.map