cdk-local 0.148.0 → 0.148.2

package/dist/{local-studio-DoyRYZf6.js → local-studio-BVxRUfQV.js}

@@ -6,7 +6,8 @@ import path, { dirname, isAbsolute, join, normalize, relative, resolve, sep } fr
 import { Command, Option } from "commander";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { Agent, createServer, request } from "node:http";
-import { Agent as Agent$1, createServer as createServer$1 } from "node:https";
+import { Agent as Agent$1, createServer as createServer$1, request as request$1 } from "node:https";
+import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
 import { NodeHttpHandler } from "@smithy/node-http-handler";
 import { Agent as Agent$2 } from "agent-base";
 import { HttpProxyAgent } from "http-proxy-agent";
@@ -195,6 +196,13 @@ function hostFromAuthority(authority) {
 * via `buildStsClientConfig` for the STS sites);
 * `tests/unit/utils/aws-proxy-client-audit.test.ts` fences the sweep so a new
 * construction site cannot silently skip it.
+*
+* Not every AWS-bound request is an SDK call, though — and the global
+* `fetch` (undici) reads no proxy variable either (issue #647). The layer
+* ZIP download and the Cognito JWKS / OIDC discovery reads are plain GETs,
+* so `proxyAwareFetch()` is the second seam: same `NO_PROXY` decision, same
+* "empty when unconfigured" contract, fenced by
+* `tests/unit/utils/aws-proxy-fetch-audit.test.ts`.
 */
 /**
 * The SDK applies these defaults only when it builds its OWN agents from a
@@ -312,23 +320,305 @@ function buildProxyRequestHandler() {
 function buildProxyClientConfig(opts = {}) {
 	if (!isProxyEnvConfigured()) return {};
 	const profile = opts.profile;
-	const chainHandler = buildProxyRequestHandler();
 	let chain;
 	const credentials = async (identityProperties) => {
-		if (!chain) {
+		chain ??= (async () => {
 			const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
-			chain = defaultProvider({
+			return defaultProvider({
 				...profile ? { profile } : {},
-				clientConfig: { requestHandler: chainHandler }
+				clientConfig: { requestHandler: buildProxyRequestHandler() }
 			});
-		}
-		return chain(identityProperties);
+		})().catch((err) => {
+			chain = void 0;
+			throw err;
+		});
+		return (await chain)(identityProperties);
 	};
 	return {
 		requestHandler: buildProxyRequestHandler(),
 		credentials
 	};
 }
+/**
+* The fetch spec's redirect budget. Reached only by a redirect loop, which
+* neither call site's endpoint produces — the bound exists so a
+* misconfigured origin cannot spin forever.
+*/
+const MAX_FETCH_REDIRECTS = 20;
+/** Statuses whose response carries a null body per the fetch spec. */
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
+	204,
+	205,
+	304
+]);
+/**
+* Socket-inactivity bound for a proxied request, matching undici's
+* `headersTimeout` / `bodyTimeout` defaults — because `node:http` has NO
+* default timeout at all, and without one a proxy that accepts the
+* connection and never answers hangs `cdkl` forever. That is strictly worse
+* than the pre-#647 direct connection it replaced, and it would hang exactly
+* the fallback (`docs/cli-reference.md`, "JWKS / OIDC discovery
+* unreachable") that exists to keep local dev moving.
+*
+* Undici's separate 10 s CONNECT timeout is not reproduced: a black-holed
+* proxy fails here in 300 s rather than 10. Bounded is the property that
+* matters; the exempt path keeps undici's own timers (see the short-circuit
+* in {@link proxyAwareFetch}). Enforced by a timer `getThroughAgent` re-arms
+* on every byte — INACTIVITY, like undici's, not a wall-clock TOTAL, which
+* would abort a slow-but-progressing transfer that `fetch` would have
+* completed (a Lambda layer ZIP is up to 250 MB, and the whole point is that
+* it is crossing a corporate proxy). See `getThroughAgent` for why a
+* socket-level timer cannot bound the CONNECT tunnel.
+*/
+const REQUEST_STALL_TIMEOUT_MS = 3e5;
+function isRedirectStatus(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+/**
+* Whether `hostname` names THIS machine. `proxy-from-env` implements the
+* standard `NO_PROXY` semantics faithfully, and the standard exempts nothing
+* by default — so with `HTTP_PROXY` exported and no matching `NO_PROXY`
+* entry, a request to `127.0.0.1` is sent to the corporate proxy, which
+* cannot reach the caller's own loopback and refuses it.
+*
+* For an AWS SDK client that is unreachable in practice (every endpoint is a
+* public AWS host), which is why {@link EnvRoutingProxyAgent} does not carry
+* this rule. For `proxyAwareFetch` it is not: a JWT authorizer's issuer is
+* routinely a loopback IdP in local dev — this repo's own
+* `local-start-api-cognito-jwt` fixture is exactly that shape — and an
+* unreachable JWKS does not fail the request, it degrades the verifier to
+* ACCEPT EVERY TOKEN with a warn. So proxying loopback here converts a
+* working local setup into a silent auth downgrade, and it cannot buy
+* anything in exchange: a forward proxy has no route to the client's
+* loopback. Every other loopback request in cdk-local (the RIE and AgentCore
+* container clients) is unproxied for the same reason.
+*
+* Deliberately NOT extended to RFC 1918 / private ranges: a corporate proxy
+* plausibly does reach those, so exempting them would be a guess rather
+* than an impossibility. `NO_PROXY` remains the control for that case.
+*/
+/**
+* Whether `proxyUrl` names a proxy these agents can actually SPEAK to.
+*
+* `getProxyForUrl` honours `ALL_PROXY`, and `ALL_PROXY=socks5://...` is an
+* ordinary spelling — but `http-proxy-agent` / `https-proxy-agent` speak HTTP
+* `CONNECT`, not SOCKS. Measured: `new HttpsProxyAgent('socks5://127.0.0.1:1080')`
+* constructs happily and then talks HTTP at a SOCKS port, so every request
+* through it fails.
+*
+* Falling back to a DIRECT request is the right answer rather than a
+* best-effort attempt, for a reason specific to this seam: before issue #647
+* these reads went direct through undici and WORKED for a SOCKS user, and an
+* unreachable JWKS does not deny requests — it caches `passThrough` and
+* accepts every token for the failure TTL. Trying and failing would turn a
+* working setup into a silent auth downgrade, which is the outcome the
+* loopback rule below exists to prevent.
+*
+* The SDK-client half of this — `EnvRoutingProxyAgent`, which PR 646 built
+* with the same blind spot, and whose failures are at least loud — is tracked
+* in https://github.com/go-to-k/cdk-local/issues/663.
+*/
+function isSpeakableProxy(proxyUrl) {
+	return /^https?:\/\//i.test(proxyUrl);
+}
+function isLoopbackHost(hostname) {
+	const host = hostname.trim().replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
+	if (host === "localhost" || host.endsWith(".localhost")) return true;
+	if (host === "::1" || host === "0:0:0:0:0:0:0:1") return true;
+	if (host === "0.0.0.0" || host === "::" || host === "0:0:0:0:0:0:0:0" || host === "::ffff:0.0.0.0" || host === "::ffff:0:0") return true;
+	const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(host);
+	if (mapped) return parseInt(mapped[1], 16) >> 8 === 127;
+	const dotted = /^(?:::ffff:)?(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+	if (!dotted) return false;
+	const octets = dotted.slice(1).map(Number);
+	if (octets.some((o) => o > 255)) return false;
+	return octets[0] === 127;
+}
+/**
+* `http:` / `https:` only. The rejection names the PROTOCOL and never the
+* URL: the presigned layer `Content.Location` carries an `X-Amz-Signature`
+* in its query string, so a URL in an error message is a credential in a log
+* line (the same reasoning `downloadPresignedZip`'s own HTTP-status throw
+* applies).
+*/
+function parseHttpUrl(href) {
+	const parsed = new URL(href);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new TypeError(`Unsupported protocol for a proxied request: "${parsed.protocol}"`);
+	return parsed;
+}
+/**
+* One GET through `agent`, with the whole body buffered. Buffering is what
+* lets the result become a real `Response` (and is what both call sites do
+* with the body anyway: `text()` for JWKS / discovery, `arrayBuffer()` for
+* the layer ZIP).
+*/
+function getThroughAgent(url, agent, timeoutMs = REQUEST_STALL_TIMEOUT_MS) {
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		let timer;
+		let rearm = () => void 0;
+		const succeed = (value) => {
+			if (settled) return;
+			settled = true;
+			if (timer) clearTimeout(timer);
+			resolve(value);
+		};
+		const fail = (err) => {
+			if (settled) return;
+			settled = true;
+			if (timer) clearTimeout(timer);
+			reject(err);
+		};
+		const req = (url.protocol === "https:" ? request$1 : request)(url, {
+			agent,
+			headers: {
+				accept: "*/*",
+				"accept-encoding": "identity"
+			}
+		}, (res) => {
+			rearm();
+			const chunks = [];
+			res.on("data", (chunk) => {
+				rearm();
+				chunks.push(chunk);
+			});
+			res.on("error", fail);
+			res.on("end", () => {
+				if (res.statusCode === void 0) {
+					fail(/* @__PURE__ */ new Error("Malformed HTTP response: no status code"));
+					return;
+				}
+				succeed({
+					status: res.statusCode,
+					statusText: res.statusMessage ?? "",
+					headers: res.headers,
+					body: Buffer.concat(chunks)
+				});
+			});
+		});
+		req.on("error", fail);
+		rearm = () => {
+			if (settled) return;
+			if (timer) clearTimeout(timer);
+			timer = setTimeout(() => {
+				req.destroy();
+				fail(/* @__PURE__ */ new Error(`Proxied request stalled for ${timeoutMs} ms with no progress`));
+			}, timeoutMs);
+			timer.unref?.();
+		};
+		rearm();
+		req.end();
+	});
+}
+/**
+* `fetch` decodes a `Content-Encoding` body before handing it to the caller;
+* `node:http` does not. Node sends no `Accept-Encoding` of its own, so a
+* compliant origin answers identity — but S3 replays an object's STORED
+* `Content-Encoding`, so the case is reachable and a silently-still-
+* compressed body would be a corrupt layer ZIP rather than an error.
+*
+* An encoding this cannot decode (or one that fails to decode) leaves the
+* body and the header untouched, so the caller sees exactly what the origin
+* sent instead of a truncated one.
+*/
+function decodeContentEncoding(raw) {
+	const header = raw.headers["content-encoding"];
+	const encoding = (Array.isArray(header) ? header.join(",") : header ?? "").trim().toLowerCase();
+	if (encoding === "" || encoding === "identity") return {
+		body: raw.body,
+		decoded: false
+	};
+	try {
+		if (encoding === "gzip" || encoding === "x-gzip") return {
+			body: gunzipSync(raw.body),
+			decoded: true
+		};
+		if (encoding === "deflate" || encoding === "x-deflate") return {
+			body: inflateSync(raw.body),
+			decoded: true
+		};
+		if (encoding === "br") return {
+			body: brotliDecompressSync(raw.body),
+			decoded: true
+		};
+	} catch {
+		return {
+			body: raw.body,
+			decoded: false
+		};
+	}
+	return {
+		body: raw.body,
+		decoded: false
+	};
+}
+function toWebResponse(raw) {
+	if (raw.status < 200 || raw.status > 599) throw new Error(`Unsupported HTTP status in response: ${raw.status}`);
+	const { body, decoded } = decodeContentEncoding(raw);
+	const headers = new Headers();
+	for (const [name, value] of Object.entries(raw.headers)) {
+		if (value === void 0) continue;
+		if (decoded && (name === "content-encoding" || name === "content-length")) continue;
+		if (Array.isArray(value)) for (const one of value) headers.append(name, one);
+		else headers.append(name, value);
+	}
+	return new Response(NULL_BODY_STATUSES.has(raw.status) ? null : body, {
+		status: raw.status,
+		statusText: raw.statusText.replace(/[^\t\x20-\x7e\x80-\xff]/g, ""),
+		headers
+	});
+}
+/**
+* GET a URL, honoring the standard proxy environment (issue #647).
+*
+* The global `fetch` (undici) reads no proxy variable, so cdk-local's
+* non-SDK AWS-bound reads — the Lambda layer ZIP download from its
+* presigned `Content.Location`, and the Cognito JWKS / OIDC discovery
+* documents — connected DIRECT even where every SDK call was tunneled. On a
+* machine whose only egress is a forward proxy that is a hang or a
+* self-signed-certificate failure one step after `GetLayerVersion`
+* succeeded.
+*
+* Contract mirrors {@link buildProxyClientConfig}: with no proxy variable
+* set this IS `globalThis.fetch` (zero behavior change), and with one set
+* the request goes through {@link EnvRoutingProxyAgent} — the same
+* `NO_PROXY` decision, evaluated per request against the target host, that
+* the SDK clients get. A target that `NO_PROXY` exempts is ALSO handed back
+* to `globalThis.fetch`, so the hand-rolled path is entered only when it
+* has something to add, and every direct request keeps undici's semantics
+* (its timers included) exactly as before. A fresh agent per proxied
+* request, destroyed the moment that request's body is in hand — see the
+* loop below for why that is a correctness requirement and not only
+* tidiness.
+*
+* `opts.timeoutMs` is a TEST SEAM only — production callers pass one
+* argument and get {@link REQUEST_STALL_TIMEOUT_MS}, which no test can
+* afford to wait out.
+*
+* GET-only by construction: both call sites are GETs, and a method with a
+* request body needs redirect-replay semantics this deliberately does not
+* guess at. A future POST caller extends this (with its tests) rather than
+* falling back to a bare `fetch` —
+* `tests/unit/utils/aws-proxy-fetch-audit.test.ts` refuses the fallback.
+*/
+async function proxyAwareFetch(url, opts = {}) {
+	if (!isProxyEnvConfigured()) return globalThis.fetch(url);
+	let target = parseHttpUrl(url);
+	for (let hop = 0;; hop++) {
+		if (isLoopbackHost(target.hostname) || !isSpeakableProxy(getProxyForUrl(target.href))) return globalThis.fetch(target.href);
+		const agent = new EnvRoutingProxyAgent();
+		let raw;
+		try {
+			raw = await getThroughAgent(target, agent, opts.timeoutMs);
+		} finally {
+			agent.destroy();
+		}
+		const location = raw.headers["location"];
+		if (!isRedirectStatus(raw.status) || typeof location !== "string" || location === "") return toWebResponse(raw);
+		if (hop >= MAX_FETCH_REDIRECTS) throw new Error(`Too many redirects (more than ${MAX_FETCH_REDIRECTS})`);
+		target = parseHttpUrl(new URL(location, target).href);
+	}
+}
 
 //#endregion
 //#region src/utils/profile-resolver.ts
@@ -14066,8 +14356,26 @@ const DEFAULT_JWKS_TTL_MS = 3600 * 1e3;
 * suppressing the per-request fetch storm a 0s TTL would cause.
 */
 const FAILURE_JWKS_TTL_MS = 60 * 1e3;
+/**
+* Stall bound for the JWKS / discovery reads specifically, well under
+* `proxyAwareFetch`'s 300 s default.
+*
+* Those reads are small documents, and — unlike the layer ZIP, which is up to
+* 250 MB and wants the long default — one of them sits on a PER-REQUEST path:
+* `agentcore-serve-auth`'s `buildAgentCoreServeAuthCheck` calls
+* `verifyJwtViaDiscovery` for every inbound request, and that function holds
+* no discovery cache. Behind a black-holed proxy each in-flight request would
+* otherwise hold a socket for 300 s where the pre-#647 direct read gave up in
+* about undici's 10 s connect timeout.
+*
+* Failing FAST is also the right bias here in a way it is not for a download:
+* an unreachable JWKS lands in the documented pass-through fallback
+* (`docs/cli-reference.md`), so a long hold buys nothing and costs a stuck
+* request.
+*/
+const JWKS_FETCH_TIMEOUT_MS = 1e4;
 function createJwksCache(opts = {}) {
-	const fetchImpl = opts.fetchImpl ?? (async (url) => globalThis.fetch(url));
+	const fetchImpl = opts.fetchImpl ?? ((url) => proxyAwareFetch(url, { timeoutMs: JWKS_FETCH_TIMEOUT_MS }));
 	const now = opts.now ?? (() => Date.now());
 	const ttlMs = opts.ttlMs ?? DEFAULT_JWKS_TTL_MS;
 	const failureTtlMs = opts.failureTtlMs ?? FAILURE_JWKS_TTL_MS;
@@ -14104,7 +14412,7 @@ function createJwksCache(opts = {}) {
 				map.set(jwksUrl, entry);
 				return entry;
 			} catch (err) {
-				logger.warn(`JWKS unreachable at ${jwksUrl}: ${err instanceof Error ? err.message : String(err)}. JWT validation will allow all tokens — local dev fallback. Configure network access to the JWKS URL to enable real signature verification.`);
+				logger.warn(`JWKS unreachable at ${jwksUrl}: ${sanitizeServiceExceptionMessage(err instanceof Error ? err.message : String(err))}. JWT validation will allow all tokens — local dev fallback. Configure network access to the JWKS URL to enable real signature verification.`);
 				const entry = {
 					byKid: /* @__PURE__ */ new Map(),
 					expiresAt: now() + failureTtlMs,
@@ -14241,7 +14549,7 @@ async function verifyJwtViaDiscovery(authorizer, authorizationHeader, jwksCache,
 		identityHash: void 0,
 		ttlSeconds: 0
 	};
-	const fetchImpl = opts.fetchImpl ?? (async (url) => globalThis.fetch(url));
+	const fetchImpl = opts.fetchImpl ?? ((url) => proxyAwareFetch(url, { timeoutMs: JWKS_FETCH_TIMEOUT_MS }));
 	let issuer;
 	let jwksUri;
 	try {
@@ -14252,7 +14560,7 @@ async function verifyJwtViaDiscovery(authorizer, authorizationHeader, jwksCache,
 		issuer = doc.issuer;
 		jwksUri = doc.jwks_uri;
 	} catch (err) {
-		if (shouldWarn(authorizer.discoveryUrl, opts.warnedAt, now)) getLogger().child("cognito-jwt").warn(`OIDC discovery unreachable at ${authorizer.discoveryUrl}: ${err instanceof Error ? err.message : String(err)}. Token accepted without verification — local dev fallback.`);
+		if (shouldWarn(authorizer.discoveryUrl, opts.warnedAt, now)) getLogger().child("cognito-jwt").warn(`OIDC discovery unreachable at ${authorizer.discoveryUrl}: ${sanitizeServiceExceptionMessage(err instanceof Error ? err.message : String(err))}. Token accepted without verification — local dev fallback.`);
 		const identityHash = buildIdentityHash([token]);
 		const parsed = parseJwt(token);
 		if (parsed) return shapeAllowResult(parsed, identityHash, now);
@@ -16645,7 +16953,7 @@ async function materializeLayerFromArn(layer, options = {}) {
 	try {
 		zipBytes = await downloadPresignedZip(presignedUrl, options);
 	} catch (err) {
-		throw new LayerMaterializationError(`Layer ${layer.arn}: failed to download layer ZIP from the presigned URL: ${errMsg(err)}.`);
+		throw new LayerMaterializationError(`Layer ${layer.arn}: failed to download layer ZIP from the presigned URL: ${sanitizeServiceExceptionMessage(errMsg(err))}.`);
 	}
 	const dir = await mkdtemp(join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-arn-layer-${layer.name}-${layer.version}-`));
 	try {
@@ -16727,7 +17035,7 @@ async function buildAssumeRoleCommand(roleArn) {
 }
 async function downloadPresignedZip(presignedUrl, options) {
 	if (options.fetchZip) return options.fetchZip(presignedUrl);
-	const response = await fetch(presignedUrl);
+	const response = await proxyAwareFetch(presignedUrl);
 	if (!response.ok) throw new Error(`HTTP ${response.status} ${flattenToOneLine(response.statusText)} from layer Content.Location URL`);
 	const buf = await response.arrayBuffer();
 	return new Uint8Array(buf);
@@ -16819,9 +17127,16 @@ async function inflateRaw(data) {
 * The download `catch` DOES see wire-derived text — `downloadPresignedZip`
 * raises `HTTP <status> <statusText> ...`, and the reason phrase is whatever
 * the presigned host sent. Nothing there needs WITHHOLDING (no credential
-* chain, no secret), but it does need FLATTENING, which is applied at that
-* throw rather than here, because `errMsg` is also used by the unzip `catch`
-* whose input is a local `fflate` error.
+* chain, no secret), but it does need FLATTENING.
+*
+* CORRECTED AGAIN in issue #647: that flattening used to be applied at the
+* `HTTP <status>` throw alone, which was sufficient only while `fetch` was the
+* transport and its every failure was the fixed string `fetch failed`. The
+* download now goes through `proxyAwareFetch`, so the same `catch` also sees
+* `node:net` / OpenSSL / proxy-agent messages of arbitrary shape and length.
+* The download SITE therefore applies `sanitizeServiceExceptionMessage` to
+* whatever `errMsg` returns; `errMsg` itself stays bare because its other
+* caller is the unzip `catch`, whose input is a local `fflate` error.
 */
 function errMsg(err) {
 	return err instanceof Error ? err.message : String(err);
@@ -37739,7 +38054,8 @@ function runChild(spawnFn, nodeBin, argv, cwd, invocationId, target, bus, clock)
 				cwd,
 				env: {
 					...process.env,
-					CDKL_LOG_LEVEL: "warn"
+					CDKL_LOG_LEVEL: "warn",
+					CDKL_LOG_STREAM: "stderr"
 				}
 			});
 		} catch (err) {
@@ -39826,4 +40142,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, describeCredentialLoadFailure as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, resolveProfileCredentials as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, buildProxyClientConfig as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, isProxyEnvConfigured as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildStsClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, describeAwsFailureForWarn as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-DoyRYZf6.js.map
+//# sourceMappingURL=local-studio-BVxRUfQV.js.map