cdk-local 0.52.0 → 0.54.0

package/README.md

@@ -4,7 +4,8 @@
 [![CI](https://github.com/go-to-k/cdk-local/actions/workflows/ci.yml/badge.svg)](https://github.com/go-to-k/cdk-local/actions/workflows/ci.yml)
 [![License: Apache-2.0](https://img.shields.io/npm/l/cdk-local.svg)](./LICENSE)
 
-Run your CDK app's Lambda functions, API Gateway APIs, ECS tasks / services / ALB-fronted services, and Bedrock AgentCore agents on your own machine — with **no AWS account**, or bound to your **deployed stack to hit real AWS resources and data**. A native, CDK-first alternative to `sam local`.
+**Run your CDK app locally — no SAM template, no AWS account. Or bind to your deployed stack and hit its real data.**
+A CDK-native alternative to `sam local`, covering Lambda, API Gateway, ECS, ALB-fronted services, and Bedrock AgentCore.
 
 ![cdkl start-api serving a local CDK app's HTTP API; curl in the right pane reaches the local Lambda](assets/cdkl-start-api.gif)
 
@@ -31,8 +32,10 @@ cdkl invoke MyStack/Fn --from-cfn-stack    # one Lambda against real DynamoDB /
 
 - **Zero-friction local execution** — no AWS account, no IAM access, no deploy; just Docker and your CDK app. Onboard new engineers, review a PR by actually running its code, or work on an OSS CDK sample without owning the maintainer's account.
 - **Iterate against your real deployed stack — including its data.** `--from-cfn-stack` keeps you on the real DynamoDB rows, S3 objects, Cognito users, and Secret values your IAM credentials reach, instead of paying to seed and anonymize a local emulator.
-
-It also picks up where `sam local` leaves off: **CDK-native** (point at `cdk.json`, no SAM templates), **wider coverage** (Lambda, API Gateway, ECS run-task / service / ALB front-door, Bedrock AgentCore), and **real container images** (the Lambda RIE base image; ECS as real Docker — the only dependency is Docker).
+- **Picks up where `sam local` leaves off:**
+  - **CDK-native** — point at `cdk.json`; no SAM template to maintain.
+  - **Wider coverage** — Lambda, API Gateway, ECS run-task / service / ALB front-door, and Bedrock AgentCore.
+  - **Real container images** — the Lambda RIE base image; ECS as real Docker. The only dependency is Docker itself.
 
 ## What runs locally
 
@@ -58,54 +61,27 @@ cdkl list                                      # every runnable target, grouped
 
 - **`start-api`** serves one HTTP server per API; a bare `start-api` in a multi-stack app needs `--all-stacks` or `--stack <name>`. Add **`--watch`** to re-synth and hot-reload on CDK source changes ([details](docs/local-emulation.md#hot-reload---watch)).
 - **`run-task`** / single-replica **`start-service`** publish declared container ports on the host and log `Reach it at 127.0.0.1:<port>` (`--host-port <container>=<host>` remaps; handy for privileged ports on macOS).
-- **`invoke-agentcore`** runs the agent (a container, or a `fromCodeAsset` / `fromS3` managed-runtime bundle — Python 3.10-3.14 / Node 22 — built from source), waits for `GET /ping`, POSTs your `--event` to `POST /invocations`, and streams an SSE response live. `--ws` streams over the agent's bidirectional `/ws` WebSocket endpoint instead. A `customJwtAuthorizer` is enforced locally — pass `--bearer-token <jwt>` (verified against the runtime's OIDC discovery URL). MCP-protocol runtimes (`ProtocolConfiguration = MCP`) are also served — the `POST /mcp` Streamable-HTTP contract on 8000, with one JSON-RPC request (`tools/list` by default, or `--event`'s `{"method":...,"params":...}`).
+- **`start-alb`** stands up the ECS service(s) behind an ALB plus a host-side front-door on each listener port, honoring all six listener-rule conditions, weighted forwards, redirect / fixed-response actions, and mixed ECS + Lambda targets ([details](docs/cli-reference.md#cdkl-start-alb-run-an-alb-fronted-service-locally)).
+- **`invoke-agentcore`** invokes a Bedrock AgentCore Runtime agent locally — container or `fromCodeAsset` / `fromS3` managed runtime, HTTP / SSE / WebSocket / MCP protocols, with `customJwtAuthorizer` and `--sigv4` enforcement ([details](docs/cli-reference.md#cdkl-invoke-agentcore-run-bedrock-agentcore-runtime-agents-locally)).
 - Non-TTY (CI / pipes): every command except a bare `start-api` needs an explicit target.
 
 Full flags, precedence, and `--from-cfn-stack` resolution: [docs/cli-reference.md](docs/cli-reference.md) and [docs/local-emulation.md](docs/local-emulation.md).
 
-## start-service vs start-alb — which one?
-
-`start-service` and `start-alb` mirror `run-task` / `invoke` (the compute alone) vs `start-api` (the routed entry in front of the compute):
-
-| Command | You name | What runs | Use when |
-| --- | --- | --- | --- |
-| `cdkl start-service <Service>` | the ECS **service** | just the service's replicas (no load balancer) | workers / queue consumers / Service-Connect-only services, or to hit the containers directly |
-| `cdkl start-alb <Alb>` | the **ALB** | the ECS service(s) behind it **plus** a local **front-door** on each listener port | an `ApplicationLoadBalancedFargateService`-style service you want to reach the way external traffic does |
-
-`start-alb` discovers the ECS service(s) behind the ALB's HTTP listeners, boots their replicas, and stands up a host-side front-door on each listener port that round-robins across the replicas — one stable host endpoint, like behind a real load balancer. It honors **every ALB listener-rule condition** — `path-pattern`, `host-header`, `http-header`, `http-request-method`, `query-string`, and `source-ip` — plus **weighted** forwards and **`redirect` / `fixed-response`** actions, so a listener routing `/api/*` (or `api.example.com`, or `X-Tenant: acme`, or `POST` writes, or `?version=2`, or `10.0.0.0/8`) to one service and everything else to another — or returning a redirect / canned response — is reproduced locally. A **`TargetType: lambda`** target group is served by invoking the backing Lambda locally (the request is translated to the ALB `requestContext.elb` event and run through the Lambda RIE), so a forward can mix ECS and Lambda targets.
-
-```bash
-cdkl start-alb MyStack/WebAlb --lb-port 80=8080   # remap the privileged listener port 80 (macOS)
-curl http://127.0.0.1:8080/        # default action -> the default service (round-robin)
-curl http://127.0.0.1:8080/api/x   # path-pattern rule /api/* -> the api service
-```
-
-Resolution model + scope (HTTP listeners, all six ALB rule-condition fields, weighted forwards, `redirect` / `fixed-response`, ECS **and** Lambda targets): [docs/cli-reference.md](docs/cli-reference.md#cdkl-start-alb-run-an-alb-fronted-service-locally).
-
-## Override env vars without a state source
-
-When env-var values in your template are CloudFormation intrinsics (`Ref`, `Fn::GetAtt`, `Fn::ImportValue`) and you have no state source, inject literals with `--env-vars <file>` (the SAM-compatible `sam local invoke --env-vars` shape, so an existing file works unchanged). It composes with `--from-cfn-stack` — the state source resolves first, then `--env-vars` overrides only the keys you list.
-
-```bash
-cdkl invoke MyStack/Fn --event ./event.json --env-vars ./env.json
-```
+### start-service vs start-alb — which one?
 
-Format + full precedence: [docs/cli-reference.md](docs/cli-reference.md).
+`start-service` runs just the ECS service's replicas (workers, queue consumers, Service-Connect-only). `start-alb` boots the ECS service(s) behind an ALB **plus** a host-side front-door on each listener port, so external traffic reaches them the way it does in the cloud. Full resolution model: [docs/cli-reference.md](docs/cli-reference.md#cdkl-start-alb-run-an-alb-fronted-service-locally).
 
 ## Supported resources
 
-| Resource | Local execution support |
-|----------|------------------------|
-| `AWS::Lambda::Function` (ZIP) | ✓ |
-| `AWS::Lambda::Function` (container image) | ✓ |
-| `AWS::Lambda::Url` | ✓ |
-| `AWS::ApiGateway::*` (REST v1) | ✓ |
-| `AWS::ApiGatewayV2::*` (HTTP API + WebSocket) | ✓ |
-| `AWS::ECS::TaskDefinition` (run-task) | ✓ |
-| `AWS::ECS::Service` (start-service) | ✓ |
-| `AWS::ServiceDiscovery::*` (Cloud Map / Service Connect) | ✓ |
-| `AWS::ElasticLoadBalancingV2::*` (start-alb: ALB front-door; all six listener-rule condition fields, weighted forward, redirect / fixed-response; ECS + Lambda targets) | ✓ |
-| `AWS::BedrockAgentCore::Runtime` (invoke-agentcore, container + fromCodeAsset/fromS3 artifacts, HTTP + MCP) | ✓ |
+| Resource | Local execution |
+|----------|-----------------|
+| Lambda functions (ZIP, container image, Function URLs) | `invoke` — every current Lambda runtime |
+| API Gateway (REST v1, HTTP v2, WebSocket) + Lambda Function URLs | `start-api` |
+| ECS task definitions | `run-task` |
+| ECS services | `start-service` |
+| Cloud Map / Service Connect registry | service discovery between local replicas |
+| ALB-fronted ECS / Lambda services | `start-alb` — all six listener-rule conditions, weighted forwards, redirect / fixed-response, mixed ECS + Lambda targets |
+| Bedrock AgentCore Runtime agents | `invoke-agentcore` — container + `fromCodeAsset` / `fromS3` artifacts, HTTP + MCP |
 
 Lambda runs on every current AWS Lambda runtime — Node.js (18/20/22/24), Python (3.11–3.14), Ruby (3.2/3.3), Java (8.al2/11/17/21), .NET (6/8), and the OS-only `provided.al2` / `provided.al2023`. The retired `go1.x` runtime is rejected with a pointer to migrate to `provided.al2023`.
 

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { a as createLocalStartApiCommand } from "./cloud-map-resolver-D0OCnW6R.js";
-import { a as createLocalRunTaskCommand, i as createLocalStartServiceCommand, o as createLocalInvokeAgentCoreCommand, r as createLocalStartAlbCommand, s as createLocalInvokeCommand, t as createLocalListCommand } from "./local-list-v8D51s5a.js";
+import { a as createLocalStartApiCommand } from "./cloud-map-resolver-CbSdXQjx.js";
+import { a as createLocalRunTaskCommand, i as createLocalStartServiceCommand, o as createLocalInvokeAgentCoreCommand, r as createLocalStartAlbCommand, s as createLocalInvokeCommand, t as createLocalListCommand } from "./local-list-e7cz-0OZ.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.52.0");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.54.0");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalInvokeAgentCoreCommand());
 program.addCommand(createLocalStartApiCommand());

package/dist/{cloud-map-resolver-D0OCnW6R.js → cloud-map-resolver-CbSdXQjx.js}

@@ -24,6 +24,8 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { readFile } from "fs/promises";
 import { join as join$1 } from "path";
 import { unzipSync } from "fflate";
+import { Sha256 } from "@aws-crypto/sha256-js";
+import { SignatureV4 } from "@smithy/signature-v4";
 import { WebSocket, WebSocketServer } from "ws";
 import { createServer as createServer$1 } from "node:http";
 import { createServer as createServer$2 } from "node:https";
@@ -8030,7 +8032,8 @@ async function invokeAgentCore(host, port, event, options) {
 				"Content-Type": "application/json",
 				Accept: "application/json, text/event-stream",
 				[AGENTCORE_SESSION_ID_HEADER]: options.sessionId,
-				...options.authorization && { Authorization: options.authorization }
+				...options.authorization && { Authorization: options.authorization },
+				...options.additionalHeaders ?? {}
 			},
 			body,
 			signal: controller.signal
@@ -8084,6 +8087,71 @@ async function streamBody(body, onChunk) {
 	}
 }
 
+//#endregion
+//#region src/local/agentcore-sigv4-sign.ts
+/**
+* Client-side SigV4 signing for `cdkl invoke-agentcore --sigv4`.
+*
+* AgentCore's `InvokeAgentRuntime` API authenticates inbound `/invocations`
+* requests with IAM SigV4 when the runtime declares no
+* `customJwtAuthorizer`. The deployed cloud verifies the signature; a locally
+* running agent never does (no AWS public-key infra inside the container),
+* but an agent that introspects the `Authorization` header (e.g. via the
+* `bedrock-agentcore` SDK's request context) sees the same shape it would in
+* the cloud — header parity for debugging and local-dev of IAM-aware agents.
+*
+* Signing is OPT-IN via `--sigv4` on the command. Default behavior is
+* unchanged: no Authorization header on an unauthenticated invoke.
+*/
+/** AWS service name for AgentCore InvokeAgentRuntime SigV4 signing. */
+const AGENTCORE_SIGV4_SERVICE = "bedrock-agentcore";
+/**
+* Build a SigV4 signature for a `POST /invocations` request to the local
+* AgentCore container. Returns the headers that must be forwarded.
+*/
+async function signAgentCoreInvocation(opts) {
+	const signer = new SignatureV4({
+		credentials: {
+			accessKeyId: opts.credentials.accessKeyId,
+			secretAccessKey: opts.credentials.secretAccessKey,
+			...opts.credentials.sessionToken && { sessionToken: opts.credentials.sessionToken }
+		},
+		region: opts.region,
+		service: AGENTCORE_SIGV4_SERVICE,
+		sha256: Sha256
+	});
+	const request = {
+		method: opts.method ?? "POST",
+		protocol: "http:",
+		hostname: opts.host,
+		port: opts.port,
+		path: opts.path,
+		headers: {
+			"Content-Type": "application/json",
+			Host: `${opts.host}:${opts.port}`,
+			[AGENTCORE_SESSION_ID_HEADER]: opts.sessionId
+		},
+		body: opts.body
+	};
+	const signed = await signer.sign(request, { ...opts.now && { signingDate: new Date(opts.now()) } });
+	const get = (name) => {
+		const lower = name.toLowerCase();
+		for (const [k, v] of Object.entries(signed.headers)) if (k.toLowerCase() === lower) return v;
+	};
+	const authorization = get("authorization");
+	const amzDate = get("x-amz-date");
+	const amzContentSha256 = get("x-amz-content-sha256");
+	if (!authorization || !amzDate) throw new Error("SigV4 signing produced no Authorization / X-Amz-Date header — internal error");
+	const out = {
+		authorization,
+		amzDate,
+		amzContentSha256: amzContentSha256 ?? ""
+	};
+	const amzSecurityToken = get("x-amz-security-token");
+	if (amzSecurityToken) out.amzSecurityToken = amzSecurityToken;
+	return out;
+}
+
 //#endregion
 //#region src/local/agentcore-mcp-client.ts
 /**
@@ -17721,5 +17789,5 @@ function extractDnsRecords(serviceProps) {
 }
 
 //#endregion
-export { attachAuthorizers as $, substituteAgainstState as $t, buildHttpApiV2Event as A, AGENTCORE_RUNTIME_TYPE as An, buildDockerImage as At, ConnectionRegistry as B, readCdkPathOrUndefined as Bn, streamLogs as Bt, computeRequestIdentityHash as C, discoverWebSocketApisOrThrow as Cn, getDockerImageBySourceHash as Ct, matchRoute as D, resolveLambdaArnIntrinsic as Dn, buildContainerImage as Dt, invokeTokenAuthorizer as E, pickRefLogicalId as En, architectureToPlatform as Et, tryParseStatus as F, derivePseudoParametersFromRegion as Fn, execEnvForSecrets as Ft, buildDisconnectEvent as G, withErrorHandling as Gn, TASK_ROLE_ACCOUNT_PLACEHOLDER as Gt, handleConnectionsRequest as H, CdkLocalError as Hn, resolveRuntimeFileExtension as Ht, VtlEvaluationError as I, substituteImagePlaceholders as In, pickFreePort as It, buildJwksUrlFromIssuer as J, commonOptions as Jn, derivePartitionAndUrlSuffix as Jt, buildMessageEvent as K, applyRoleArnIfSet as Kn, applyCrossStackResolverToTask as Kt, HOST_GATEWAY_MIN_VERSION as L, tryResolveImageFnJoin as Ln, pullImage as Lt, evaluateResponseParameters as M, pickAgentCoreCandidateStack as Mn, SENSITIVE_ENV_KEYS as Mt, pickResponseTemplate as N, resolveAgentCoreTarget as Nn, appendEnvFlags as Nt, translateLambdaResponse as O, AGENTCORE_HTTP_PROTOCOL as On, parseEcrUri as Ot, selectIntegrationResponse as P, resolveLambdaTarget as Pn, ensureDockerAvailable as Pt, verifyJwtViaDiscovery as Q, warnIfDeprecatedRegion as Qn, applyDeployedEnvFallback as Qt, probeHostGatewaySupport as R, matchStacks as Rn, removeContainer as Rt, buildMethodArn as S, discoverWebSocketApis as Sn, AssetManifestLoader as St, invokeRequestAuthorizer as T, discoverRoutes as Tn, waitForRieReady as Tt, parseConnectionsPath as U, LocalInvokeBuildError as Un, resolveRuntimeImage as Ut, buildMgmtEndpointEnvUrl as V, resolveCdkPathToLogicalIds as Vn, resolveRuntimeCodeMountPath as Vt, buildConnectEvent as W, LocalStartServiceError as Wn, EcsTaskResolutionError as Wt, verifyCognitoJwt as X, deprecatedRegionOption as Xn, parseEcsTarget as Xt, createJwksCache as Y, contextOptions as Yn, detectEcsImageResolutionNeeds as Yt, verifyJwtAuthorizer as Z, parseContextOptions as Zn, resolveEcsTaskTarget as Zt, readMtlsMaterialsFromDisk as _, Synthesizer as _n, computeCodeImageTag as _t, createLocalStartApiCommand as a, LocalStateSourceError as an, invokeAgentCoreWs as at, resolveServiceIntegrationParameters as b, countTargets as bn, writeProfileCredentialsFile as bt, resolveProfileCredentials as c, rejectExplicitCfnStackWithMultipleStacks as cn, MCP_PROTOCOL_VERSION as ct, attachStageContext as d, resolveCfnStackName as dn, AGENTCORE_SESSION_ID_HEADER as dt, substituteAgainstStateAsync as en, applyCorsResponseHeaders as et, buildStageMap as f, CfnLocalStateProvider as fn, invokeAgentCore as ft, groupRoutesByServer as g, resolveWatchConfig as gn, buildAgentCoreCodeImage as gt, filterRoutesByApiIdentifiers as h, resolveApp as hn, SUPPORTED_CODE_RUNTIMES as ht, getPublishedHostPort as i, materializeLayerFromArn as in, matchPreflight as it, buildRestV1Event as j, AgentCoreResolutionError as jn, DockerRunnerError as jt, applyAuthorizerOverlay as k, AGENTCORE_MCP_PROTOCOL as kn, pullEcrImage as kt, createAuthorizerCache as l, resolveCfnFallbackRegion as ln, mcpInvokeOnce as lt, filterRoutesByApiIdentifier as m, resolveSsmParameters as mn, downloadAndExtractS3Bundle as mt, CloudMapRegistry as n, substituteEnvVarsFromStateAsync as nn, buildCorsConfigFromCloudFrontChain as nt, createWatchPredicates as o, createLocalStateProvider as on, MCP_CONTAINER_PORT as ot, availableApiIdentifiers as p, collectSsmParameterRefs as pn, waitForAgentCorePing as pt, buildCognitoJwksUrl as q, appOptions as qn, checkVolumeHostPath as qt, getContainerNetworkIp as r, resolveEnvVars as rn, isFunctionUrlOacFronted as rt, resolveApiTargetSubset as s, isCfnFlagPresent as sn, MCP_PATH as st, buildCloudMapIndex as t, substituteEnvVarsFromState as tn, buildCorsConfigByApiId as tt, createFileWatcher as u, resolveCfnRegion as un, parseSseForJsonRpc as ut, startApiServer as v, resolveMultiTarget as vn, renderCodeDockerfile as vt, evaluateCachedLambdaPolicy as w, parseSelectionExpressionPath as wn, invokeRie as wt, defaultCredentialsLoader as x, listTargets as xn, singleFlight as xt, resolveSelectionExpression as y, resolveSingleTarget as yn, toCmdArgv as yt, bufferToBody as z, buildCdkPathIndex as zn, runDetached as zt };
-//# sourceMappingURL=cloud-map-resolver-D0OCnW6R.js.map
+export { attachAuthorizers as $, parseContextOptions as $n, resolveEcsTaskTarget as $t, buildHttpApiV2Event as A, AGENTCORE_HTTP_PROTOCOL as An, parseEcrUri as At, ConnectionRegistry as B, matchStacks as Bn, removeContainer as Bt, computeRequestIdentityHash as C, listTargets as Cn, singleFlight as Ct, matchRoute as D, discoverRoutes as Dn, waitForRieReady as Dt, invokeTokenAuthorizer as E, parseSelectionExpressionPath as En, invokeRie as Et, tryParseStatus as F, resolveAgentCoreTarget as Fn, appendEnvFlags as Ft, buildDisconnectEvent as G, LocalInvokeBuildError as Gn, resolveRuntimeImage as Gt, handleConnectionsRequest as H, readCdkPathOrUndefined as Hn, streamLogs as Ht, VtlEvaluationError as I, resolveLambdaTarget as In, ensureDockerAvailable as It, buildJwksUrlFromIssuer as J, applyRoleArnIfSet as Jn, applyCrossStackResolverToTask as Jt, buildMessageEvent as K, LocalStartServiceError as Kn, EcsTaskResolutionError as Kt, HOST_GATEWAY_MIN_VERSION as L, derivePseudoParametersFromRegion as Ln, execEnvForSecrets as Lt, evaluateResponseParameters as M, AGENTCORE_RUNTIME_TYPE as Mn, buildDockerImage as Mt, pickResponseTemplate as N, AgentCoreResolutionError as Nn, DockerRunnerError as Nt, translateLambdaResponse as O, pickRefLogicalId as On, architectureToPlatform as Ot, selectIntegrationResponse as P, pickAgentCoreCandidateStack as Pn, SENSITIVE_ENV_KEYS as Pt, verifyJwtViaDiscovery as Q, deprecatedRegionOption as Qn, parseEcsTarget as Qt, probeHostGatewaySupport as R, substituteImagePlaceholders as Rn, pickFreePort as Rt, buildMethodArn as S, countTargets as Sn, writeProfileCredentialsFile as St, invokeRequestAuthorizer as T, discoverWebSocketApisOrThrow as Tn, getDockerImageBySourceHash as Tt, parseConnectionsPath as U, resolveCdkPathToLogicalIds as Un, resolveRuntimeCodeMountPath as Ut, buildMgmtEndpointEnvUrl as V, buildCdkPathIndex as Vn, runDetached as Vt, buildConnectEvent as W, CdkLocalError as Wn, resolveRuntimeFileExtension as Wt, verifyCognitoJwt as X, commonOptions as Xn, derivePartitionAndUrlSuffix as Xt, createJwksCache as Y, appOptions as Yn, checkVolumeHostPath as Yt, verifyJwtAuthorizer as Z, contextOptions as Zn, detectEcsImageResolutionNeeds as Zt, readMtlsMaterialsFromDisk as _, resolveApp as _n, SUPPORTED_CODE_RUNTIMES as _t, createLocalStartApiCommand as a, resolveEnvVars as an, invokeAgentCoreWs as at, resolveServiceIntegrationParameters as b, resolveMultiTarget as bn, renderCodeDockerfile as bt, resolveProfileCredentials as c, createLocalStateProvider as cn, MCP_PROTOCOL_VERSION as ct, attachStageContext as d, resolveCfnFallbackRegion as dn, AGENTCORE_SIGV4_SERVICE as dt, applyDeployedEnvFallback as en, warnIfDeprecatedRegion as er, applyCorsResponseHeaders as et, buildStageMap as f, resolveCfnRegion as fn, signAgentCoreInvocation as ft, groupRoutesByServer as g, resolveSsmParameters as gn, downloadAndExtractS3Bundle as gt, filterRoutesByApiIdentifiers as h, collectSsmParameterRefs as hn, waitForAgentCorePing as ht, getPublishedHostPort as i, substituteEnvVarsFromStateAsync as in, matchPreflight as it, buildRestV1Event as j, AGENTCORE_MCP_PROTOCOL as jn, pullEcrImage as jt, applyAuthorizerOverlay as k, resolveLambdaArnIntrinsic as kn, buildContainerImage as kt, createAuthorizerCache as l, isCfnFlagPresent as ln, mcpInvokeOnce as lt, filterRoutesByApiIdentifier as m, CfnLocalStateProvider as mn, invokeAgentCore as mt, CloudMapRegistry as n, substituteAgainstStateAsync as nn, buildCorsConfigFromCloudFrontChain as nt, createWatchPredicates as o, materializeLayerFromArn as on, MCP_CONTAINER_PORT as ot, availableApiIdentifiers as p, resolveCfnStackName as pn, AGENTCORE_SESSION_ID_HEADER as pt, buildCognitoJwksUrl as q, withErrorHandling as qn, TASK_ROLE_ACCOUNT_PLACEHOLDER as qt, getContainerNetworkIp as r, substituteEnvVarsFromState as rn, isFunctionUrlOacFronted as rt, resolveApiTargetSubset as s, LocalStateSourceError as sn, MCP_PATH as st, buildCloudMapIndex as t, substituteAgainstState as tn, buildCorsConfigByApiId as tt, createFileWatcher as u, rejectExplicitCfnStackWithMultipleStacks as un, parseSseForJsonRpc as ut, startApiServer as v, resolveWatchConfig as vn, buildAgentCoreCodeImage as vt, evaluateCachedLambdaPolicy as w, discoverWebSocketApis as wn, AssetManifestLoader as wt, defaultCredentialsLoader as x, resolveSingleTarget as xn, toCmdArgv as xt, resolveSelectionExpression as y, Synthesizer as yn, computeCodeImageTag as yt, bufferToBody as z, tryResolveImageFnJoin as zn, pullImage as zt };
+//# sourceMappingURL=cloud-map-resolver-CbSdXQjx.js.map