cdk-local 0.57.0 → 0.59.0

package/README.md

@@ -61,7 +61,7 @@ cdkl list                                      # every runnable target, grouped
 
 - **`start-api`** serves one HTTP server per API; a bare `start-api` in a multi-stack app needs `--all-stacks` or `--stack <name>`. Add **`--watch`** to re-synth and hot-reload on CDK source changes ([details](docs/local-emulation.md#hot-reload---watch)).
 - **`run-task`** / single-replica **`start-service`** publish declared container ports on the host and log `Reach it at 127.0.0.1:<port>` (`--host-port <container>=<host>` remaps; handy for privileged ports on macOS).
-- **`start-alb`** stands up the ECS service(s) behind an ALB plus a host-side front-door on each listener port, honoring all six listener-rule conditions, weighted forwards, redirect / fixed-response actions, and mixed ECS + Lambda targets ([details](docs/cli-reference.md#cdkl-start-alb-run-an-alb-fronted-service-locally)).
+- **`start-alb`** stands up the ECS service(s) behind an ALB plus a host-side front-door on each listener port, honoring all six listener-rule conditions, weighted forwards, redirect / fixed-response actions, mixed ECS + Lambda targets, and `authenticate-cognito` / `authenticate-oidc` actions (local Bearer-JWT enforcement) ([details](docs/cli-reference.md#cdkl-start-alb-run-an-alb-fronted-service-locally)).
 - **`invoke-agentcore`** invokes a Bedrock AgentCore Runtime agent locally — container or `fromCodeAsset` / `fromS3` managed runtime, HTTP / SSE / WebSocket / MCP protocols, with `customJwtAuthorizer` and `--sigv4` enforcement ([details](docs/cli-reference.md#cdkl-invoke-agentcore-run-bedrock-agentcore-runtime-agents-locally)).
 - Non-TTY (CI / pipes): every command except a bare `start-api` needs an explicit target.
 
@@ -80,7 +80,7 @@ Full flags, precedence, and `--from-cfn-stack` resolution: [docs/cli-reference.m
 | ECS task definitions | `run-task` |
 | ECS services | `start-service` |
 | Cloud Map / Service Connect registry | service discovery between local replicas |
-| ALB-fronted ECS / Lambda services | `start-alb` — HTTP / HTTPS listeners, all six listener-rule conditions, weighted forwards, redirect / fixed-response, mixed ECS + Lambda targets |
+| ALB-fronted ECS / Lambda services | `start-alb` — HTTP / HTTPS listeners, all six listener-rule conditions, weighted forwards, redirect / fixed-response, mixed ECS + Lambda targets, authenticate-cognito / authenticate-oidc (local Bearer-JWT enforcement) |
 | Bedrock AgentCore Runtime agents | `invoke-agentcore` — container + `fromCodeAsset` / `fromS3` artifacts, HTTP + MCP |
 
 Lambda runs on every current AWS Lambda runtime — Node.js (18/20/22/24), Python (3.11–3.14), Ruby (3.2/3.3), Java (8.al2/11/17/21), .NET (6/8), and the OS-only `provided.al2` / `provided.al2023`. The retired `go1.x` runtime is rejected with a pointer to migrate to `provided.al2023`.

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { a as createLocalStartApiCommand } from "./cloud-map-resolver-BDAxtbvB.js";
-import { a as createLocalRunTaskCommand, i as createLocalStartServiceCommand, o as createLocalInvokeAgentCoreCommand, r as createLocalStartAlbCommand, s as createLocalInvokeCommand, t as createLocalListCommand } from "./local-list-DmEjNav4.js";
+import { a as createLocalStartApiCommand } from "./cloud-map-resolver-DjKCYyIq.js";
+import { a as createLocalRunTaskCommand, i as createLocalStartServiceCommand, o as createLocalInvokeAgentCoreCommand, r as createLocalStartAlbCommand, s as createLocalInvokeCommand, t as createLocalListCommand } from "./local-list-ChGfKSkV.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.57.0");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.59.0");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalInvokeAgentCoreCommand());
 program.addCommand(createLocalStartApiCommand());

package/dist/{cloud-map-resolver-BDAxtbvB.js → cloud-map-resolver-DjKCYyIq.js}

@@ -1201,13 +1201,22 @@ const AGENTCORE_RUNTIME_TYPE = "AWS::BedrockAgentCore::Runtime";
 *
 * - `HTTP` — the agent contract (`POST /invocations` + `GET /ping` on 8080).
 * - `MCP` — Model Context Protocol over Streamable HTTP (`POST /mcp` on 8000).
-*
-* `A2A` / `AGUI` declare yet other wire contracts and are not served yet.
+* - `A2A` — Agent2Agent JSON-RPC 2.0 over HTTP (`POST /` on 9000).
+* - `AGUI` — Agent-User Interaction event streams (SSE on `POST /invocations`,
+*   WebSocket on `/ws`); reuses the HTTP path's container port (8080) and its
+*   incremental SSE / WS streaming.
 */
 const AGENTCORE_HTTP_PROTOCOL = "HTTP";
 const AGENTCORE_MCP_PROTOCOL = "MCP";
+const AGENTCORE_A2A_PROTOCOL = "A2A";
+const AGENTCORE_AGUI_PROTOCOL = "AGUI";
 /** Protocols this CLI can run a container for. */
-const SUPPORTED_AGENTCORE_PROTOCOLS = [AGENTCORE_HTTP_PROTOCOL, "MCP"];
+const SUPPORTED_AGENTCORE_PROTOCOLS = [
+	AGENTCORE_HTTP_PROTOCOL,
+	"MCP",
+	"A2A",
+	AGENTCORE_AGUI_PROTOCOL
+];
 var AgentCoreResolutionError = class AgentCoreResolutionError extends Error {
 	constructor(message) {
 		super(message);
@@ -1409,14 +1418,14 @@ function extractCustomClaims(raw, logicalId) {
 	return out;
 }
 /**
-* Validate `ProtocolConfiguration`. Serves `HTTP` (the default when absent)
-* and `MCP`; `A2A` / `AGUI` speak other wire contracts and hard-error with a
-* pointer to the follow-up.
+* Validate `ProtocolConfiguration`. Serves the four AgentCore protocols
+* (HTTP / MCP / A2A / AGUI); an unrecognized value hard-errors with the
+* supported list so the command never starts something it can't run.
 */
 function extractProtocol(value, logicalId, stackName) {
 	if (value === void 0 || value === null) return AGENTCORE_HTTP_PROTOCOL;
 	if (typeof value !== "string") throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} has a non-string ProtocolConfiguration. ${getEmbedConfig().cliName} invoke-agentcore supports the ${SUPPORTED_AGENTCORE_PROTOCOLS.join(" / ")} protocols.`);
-	if (!SUPPORTED_AGENTCORE_PROTOCOLS.includes(value)) throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} uses the ${value} protocol. ${getEmbedConfig().cliName} invoke-agentcore supports the ${SUPPORTED_AGENTCORE_PROTOCOLS.join(" / ")} protocols (A2A / AGUI speak different wire contracts and are not served yet).`);
+	if (!SUPPORTED_AGENTCORE_PROTOCOLS.includes(value)) throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} uses the ${value} protocol. ${getEmbedConfig().cliName} invoke-agentcore supports the ${SUPPORTED_AGENTCORE_PROTOCOLS.join(" / ")} protocols.`);
 	return value;
 }
 /**
@@ -7192,7 +7201,7 @@ async function httpProbe(host, port, timeoutMs) {
 		})).text().catch(() => void 0);
 		return true;
 	} catch (err) {
-		if (isTransientNetworkError$2(err)) return false;
+		if (isTransientNetworkError$3(err)) return false;
 		throw err;
 	} finally {
 		clearTimeout(timer);
@@ -7206,7 +7215,7 @@ async function httpProbe(host, port, timeoutMs) {
 * between Docker's port forwarder accepting a TCP connection and the
 * container's RIE process being ready for HTTP.
 */
-function isTransientNetworkError$2(err) {
+function isTransientNetworkError$3(err) {
 	if (!(err instanceof Error)) return false;
 	if (err.name === "AbortError") return true;
 	if (err.name === "TypeError" && err.message === "fetch failed") return true;
@@ -7993,7 +8002,7 @@ async function pingProbe(host, port, timeoutMs) {
 		await response.text().catch(() => void 0);
 		return response.status;
 	} catch (err) {
-		if (isTransientNetworkError$1(err)) return void 0;
+		if (isTransientNetworkError$2(err)) return void 0;
 		throw err;
 	} finally {
 		clearTimeout(timer);
@@ -8005,7 +8014,7 @@ async function pingProbe(host, port, timeoutMs) {
 * `ECONNRESET` / `ECONNREFUSED` / `UND_ERR_SOCKET`. Treat all of those —
 * plus an `AbortError` from the per-probe timeout — as "not ready, retry".
 */
-function isTransientNetworkError$1(err) {
+function isTransientNetworkError$2(err) {
 	if (!(err instanceof Error)) return false;
 	if (err.name === "AbortError") return true;
 	if (err.name === "TypeError" && err.message === "fetch failed") return true;
@@ -8250,7 +8259,7 @@ async function initializeWithRetry(fetchImpl, url, readyTimeoutMs) {
 			lastDetail = `initialize returned HTTP ${response.status}`;
 			throw new Error(lastDetail);
 		} catch (err) {
-			if (!isTransientNetworkError(err)) {
+			if (!isTransientNetworkError$1(err)) {
 				if (lastDetail) throw new Error(`MCP initialize at ${url} failed: ${lastDetail}. Check 'docker logs' output.`);
 				throw err;
 			}
@@ -8285,7 +8294,7 @@ async function postMcp(fetchImpl, url, body, sessionId, timeoutMs) {
 		});
 		const text = await response.text();
 		if (body.id === void 0) return { status: response.status };
-		const message = (response.headers.get("content-type") ?? "").includes("text/event-stream") ? parseSseForJsonRpc(text, body.id) : text ? safeJsonParse$1(text) : void 0;
+		const message = (response.headers.get("content-type") ?? "").includes("text/event-stream") ? parseSseForJsonRpc(text, body.id) : text ? safeJsonParse$2(text) : void 0;
 		return {
 			status: response.status,
 			message
@@ -8308,14 +8317,14 @@ function parseSseForJsonRpc(text, id) {
 	for (const frame of text.split(/\r?\n\r?\n/)) {
 		const data = frame.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
 		if (!data) continue;
-		const parsed = safeJsonParse$1(data);
+		const parsed = safeJsonParse$2(data);
 		if (parsed === void 0) continue;
 		last = parsed;
 		if (parsed !== null && typeof parsed === "object" && parsed.id === id) return parsed;
 	}
 	return last;
 }
-function safeJsonParse$1(text) {
+function safeJsonParse$2(text) {
 	try {
 		return JSON.parse(text);
 	} catch {
@@ -8329,7 +8338,7 @@ function safeJsonParse$1(text) {
 * per-attempt timeout. Treat all of those — plus the synthetic non-2xx retry
 * — as "not ready, retry".
 */
-function isTransientNetworkError(err) {
+function isTransientNetworkError$1(err) {
 	if (!(err instanceof Error)) return false;
 	if (err.name === "AbortError") return true;
 	if (err.name === "TypeError" && err.message === "fetch failed") return true;
@@ -8341,6 +8350,111 @@ function isTransientNetworkError(err) {
 	return false;
 }
 
+//#endregion
+//#region src/local/agentcore-a2a-client.ts
+/**
+* Client for the Bedrock AgentCore Runtime A2A protocol contract.
+*
+* An A2A-protocol AgentCore Runtime container listens on `0.0.0.0:9000` and
+* serves the Agent2Agent JSON-RPC 2.0 contract at `POST /` (the root). Each
+* call is one JSON-RPC request and one JSON-RPC response. Unlike MCP there is
+* no session lifecycle to negotiate — the request is sent directly. `cdkl
+* invoke-agentcore` POSTs the method/params from `--event` (defaults to
+* `agent/getCard`, the agent's discovery card) and prints the response.
+*
+* Talking to the local container is **vanilla A2A**: the
+* `X-Amzn-Bedrock-AgentCore-Runtime-Session-Id` header and the inbound OAuth
+* bearer are AgentCore managed-plane concerns the front door layers on top,
+* so a direct local client does not send them.
+*/
+/** Container port an A2A-protocol AgentCore Runtime listens on. */
+const A2A_CONTAINER_PORT = 9e3;
+/** HTTP path of the A2A JSON-RPC endpoint. */
+const A2A_PATH = "/";
+/**
+* Send one JSON-RPC request to a local A2A container and return the parsed
+* response. The POST is retried while the container boots (there is no
+* separate readiness endpoint), so this also serves as the wait-for-ready step.
+*/
+async function a2aInvokeOnce(host, port, request, options = {}) {
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const url = `http://${host}:${port}${"/"}`;
+	const requestTimeoutMs = options.requestTimeoutMs ?? 12e4;
+	const readyTimeoutMs = options.readyTimeoutMs ?? 3e4;
+	const message = await postWithReadyRetry(fetchImpl, url, {
+		jsonrpc: "2.0",
+		id: 1,
+		method: request.method,
+		...request.params !== void 0 && { params: request.params }
+	}, requestTimeoutMs, readyTimeoutMs);
+	return {
+		ok: !(message !== null && typeof message === "object" && "error" in message),
+		raw: JSON.stringify(message ?? null, null, 2)
+	};
+}
+/**
+* POST a JSON-RPC message, retrying transient connect failures + reachable-
+* but-non-2xx responses until the container is up. The retry window is
+* `readyTimeoutMs`; each attempt is bounded by `requestTimeoutMs` (the
+* per-attempt abort), which protects the user's real (potentially slow)
+* agent call without misreporting it as "not ready". Connect failures
+* (ECONNREFUSED) propagate immediately regardless of the abort timer, so
+* the retry cadence keeps working during boot. The loop exits once a 2xx
+* arrives (returning the parsed body) or once `readyTimeoutMs` elapses
+* (throwing the final "did not become ready" error below).
+*/
+async function postWithReadyRetry(fetchImpl, url, body, requestTimeoutMs, readyTimeoutMs) {
+	const deadline = Date.now() + readyTimeoutMs;
+	let lastDetail = "";
+	while (Date.now() < deadline) {
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), requestTimeoutMs);
+		try {
+			const response = await fetchImpl(url, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Accept: "application/json"
+				},
+				body: JSON.stringify(body),
+				signal: controller.signal
+			});
+			const text = await response.text();
+			if (response.status >= 200 && response.status < 300) {
+				if (!text) return void 0;
+				const parsed = safeJsonParse$1(text);
+				if (parsed === void 0) throw new Error(`A2A POST at ${url} returned HTTP ${response.status} with a non-JSON body: ${text.slice(0, 200)}`);
+				return parsed;
+			}
+			lastDetail = `A2A POST returned HTTP ${response.status}`;
+		} catch (err) {
+			if (!isTransientNetworkError(err)) throw err;
+			lastDetail = err instanceof Error ? err.message : String(err);
+		} finally {
+			clearTimeout(timer);
+		}
+		await setTimeout$1(150);
+	}
+	throw new Error(`A2A server did not become ready on ${url} within ${readyTimeoutMs}ms${lastDetail ? `: ${lastDetail}` : ""}. The container may have exited early or may not serve POST ${"/"} — check 'docker logs'.`);
+}
+function safeJsonParse$1(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+}
+function isTransientNetworkError(err) {
+	if (!(err instanceof Error)) return false;
+	if (err.name === "AbortError") return true;
+	if (err.name === "TypeError" && err.message === "fetch failed") return true;
+	const cause = err.cause;
+	if (cause?.code === "ECONNRESET") return true;
+	if (cause?.code === "ECONNREFUSED") return true;
+	if (cause?.code === "UND_ERR_SOCKET") return true;
+	return false;
+}
+
 //#endregion
 //#region src/local/agentcore-ws-client.ts
 /**
@@ -17831,5 +17945,5 @@ function extractDnsRecords(serviceProps) {
 }
 
 //#endregion
-export { attachAuthorizers as $, parseContextOptions as $n, resolveEcsTaskTarget as $t, buildHttpApiV2Event as A, AGENTCORE_HTTP_PROTOCOL as An, parseEcrUri as At, ConnectionRegistry as B, matchStacks as Bn, removeContainer as Bt, computeRequestIdentityHash as C, listTargets as Cn, singleFlight as Ct, matchRoute as D, discoverRoutes as Dn, waitForRieReady as Dt, invokeTokenAuthorizer as E, parseSelectionExpressionPath as En, invokeRie as Et, tryParseStatus as F, resolveAgentCoreTarget as Fn, appendEnvFlags as Ft, buildDisconnectEvent as G, LocalInvokeBuildError as Gn, resolveRuntimeImage as Gt, handleConnectionsRequest as H, readCdkPathOrUndefined as Hn, streamLogs as Ht, VtlEvaluationError as I, resolveLambdaTarget as In, ensureDockerAvailable as It, buildJwksUrlFromIssuer as J, applyRoleArnIfSet as Jn, applyCrossStackResolverToTask as Jt, buildMessageEvent as K, LocalStartServiceError as Kn, EcsTaskResolutionError as Kt, HOST_GATEWAY_MIN_VERSION as L, derivePseudoParametersFromRegion as Ln, execEnvForSecrets as Lt, evaluateResponseParameters as M, AGENTCORE_RUNTIME_TYPE as Mn, buildDockerImage as Mt, pickResponseTemplate as N, AgentCoreResolutionError as Nn, DockerRunnerError as Nt, translateLambdaResponse as O, pickRefLogicalId as On, architectureToPlatform as Ot, selectIntegrationResponse as P, pickAgentCoreCandidateStack as Pn, SENSITIVE_ENV_KEYS as Pt, verifyJwtViaDiscovery as Q, deprecatedRegionOption as Qn, parseEcsTarget as Qt, probeHostGatewaySupport as R, substituteImagePlaceholders as Rn, pickFreePort as Rt, buildMethodArn as S, countTargets as Sn, writeProfileCredentialsFile as St, invokeRequestAuthorizer as T, discoverWebSocketApisOrThrow as Tn, getDockerImageBySourceHash as Tt, parseConnectionsPath as U, resolveCdkPathToLogicalIds as Un, resolveRuntimeCodeMountPath as Ut, buildMgmtEndpointEnvUrl as V, buildCdkPathIndex as Vn, runDetached as Vt, buildConnectEvent as W, CdkLocalError as Wn, resolveRuntimeFileExtension as Wt, verifyCognitoJwt as X, commonOptions as Xn, derivePartitionAndUrlSuffix as Xt, createJwksCache as Y, appOptions as Yn, checkVolumeHostPath as Yt, verifyJwtAuthorizer as Z, contextOptions as Zn, detectEcsImageResolutionNeeds as Zt, readMtlsMaterialsFromDisk as _, resolveApp as _n, SUPPORTED_CODE_RUNTIMES as _t, createLocalStartApiCommand as a, resolveEnvVars as an, invokeAgentCoreWs as at, resolveServiceIntegrationParameters as b, resolveMultiTarget as bn, renderCodeDockerfile as bt, resolveProfileCredentials as c, createLocalStateProvider as cn, MCP_PROTOCOL_VERSION as ct, attachStageContext as d, resolveCfnFallbackRegion as dn, AGENTCORE_SIGV4_SERVICE as dt, applyDeployedEnvFallback as en, warnIfDeprecatedRegion as er, applyCorsResponseHeaders as et, buildStageMap as f, resolveCfnRegion as fn, signAgentCoreInvocation as ft, groupRoutesByServer as g, resolveSsmParameters as gn, downloadAndExtractS3Bundle as gt, filterRoutesByApiIdentifiers as h, collectSsmParameterRefs as hn, waitForAgentCorePing as ht, getPublishedHostPort as i, substituteEnvVarsFromStateAsync as in, matchPreflight as it, buildRestV1Event as j, AGENTCORE_MCP_PROTOCOL as jn, pullEcrImage as jt, applyAuthorizerOverlay as k, resolveLambdaArnIntrinsic as kn, buildContainerImage as kt, createAuthorizerCache as l, isCfnFlagPresent as ln, mcpInvokeOnce as lt, filterRoutesByApiIdentifier as m, CfnLocalStateProvider as mn, invokeAgentCore as mt, CloudMapRegistry as n, substituteAgainstStateAsync as nn, buildCorsConfigFromCloudFrontChain as nt, createWatchPredicates as o, materializeLayerFromArn as on, MCP_CONTAINER_PORT as ot, availableApiIdentifiers as p, resolveCfnStackName as pn, AGENTCORE_SESSION_ID_HEADER as pt, buildCognitoJwksUrl as q, withErrorHandling as qn, TASK_ROLE_ACCOUNT_PLACEHOLDER as qt, getContainerNetworkIp as r, substituteEnvVarsFromState as rn, isFunctionUrlOacFronted as rt, resolveApiTargetSubset as s, LocalStateSourceError as sn, MCP_PATH as st, buildCloudMapIndex as t, substituteAgainstState as tn, buildCorsConfigByApiId as tt, createFileWatcher as u, rejectExplicitCfnStackWithMultipleStacks as un, parseSseForJsonRpc as ut, startApiServer as v, resolveWatchConfig as vn, buildAgentCoreCodeImage as vt, evaluateCachedLambdaPolicy as w, discoverWebSocketApis as wn, AssetManifestLoader as wt, defaultCredentialsLoader as x, resolveSingleTarget as xn, toCmdArgv as xt, resolveSelectionExpression as y, Synthesizer as yn, computeCodeImageTag as yt, bufferToBody as z, tryResolveImageFnJoin as zn, pullImage as zt };
-//# sourceMappingURL=cloud-map-resolver-BDAxtbvB.js.map
+export { attachAuthorizers as $, applyRoleArnIfSet as $n, derivePartitionAndUrlSuffix as $t, buildHttpApiV2Event as A, discoverRoutes as An, waitForRieReady as At, ConnectionRegistry as B, resolveAgentCoreTarget as Bn, execEnvForSecrets as Bt, computeRequestIdentityHash as C, resolveMultiTarget as Cn, renderCodeDockerfile as Ct, matchRoute as D, discoverWebSocketApis as Dn, AssetManifestLoader as Dt, invokeTokenAuthorizer as E, listTargets as En, singleFlight as Et, tryParseStatus as F, AGENTCORE_HTTP_PROTOCOL as Fn, buildDockerImage as Ft, buildDisconnectEvent as G, matchStacks as Gn, streamLogs as Gt, handleConnectionsRequest as H, derivePseudoParametersFromRegion as Hn, pullImage as Ht, VtlEvaluationError as I, AGENTCORE_MCP_PROTOCOL as In, DockerRunnerError as It, buildJwksUrlFromIssuer as J, resolveCdkPathToLogicalIds as Jn, resolveRuntimeImage as Jt, buildMessageEvent as K, buildCdkPathIndex as Kn, resolveRuntimeCodeMountPath as Kt, HOST_GATEWAY_MIN_VERSION as L, AGENTCORE_RUNTIME_TYPE as Ln, SENSITIVE_ENV_KEYS as Lt, evaluateResponseParameters as M, resolveLambdaArnIntrinsic as Mn, buildContainerImage as Mt, pickResponseTemplate as N, AGENTCORE_A2A_PROTOCOL as Nn, parseEcrUri as Nt, translateLambdaResponse as O, discoverWebSocketApisOrThrow as On, getDockerImageBySourceHash as Ot, selectIntegrationResponse as P, AGENTCORE_AGUI_PROTOCOL as Pn, pullEcrImage as Pt, verifyJwtViaDiscovery as Q, withErrorHandling as Qn, checkVolumeHostPath as Qt, probeHostGatewaySupport as R, AgentCoreResolutionError as Rn, appendEnvFlags as Rt, buildMethodArn as S, Synthesizer as Sn, computeCodeImageTag as St, invokeRequestAuthorizer as T, countTargets as Tn, writeProfileCredentialsFile as Tt, parseConnectionsPath as U, substituteImagePlaceholders as Un, removeContainer as Ut, buildMgmtEndpointEnvUrl as V, resolveLambdaTarget as Vn, pickFreePort as Vt, buildConnectEvent as W, tryResolveImageFnJoin as Wn, runDetached as Wt, verifyCognitoJwt as X, LocalInvokeBuildError as Xn, TASK_ROLE_ACCOUNT_PLACEHOLDER as Xt, createJwksCache as Y, CdkLocalError as Yn, EcsTaskResolutionError as Yt, verifyJwtAuthorizer as Z, LocalStartServiceError as Zn, applyCrossStackResolverToTask as Zt, readMtlsMaterialsFromDisk as _, CfnLocalStateProvider as _n, invokeAgentCore as _t, createLocalStartApiCommand as a, substituteAgainstStateAsync as an, warnIfDeprecatedRegion as ar, invokeAgentCoreWs as at, resolveServiceIntegrationParameters as b, resolveApp as bn, SUPPORTED_CODE_RUNTIMES as bt, resolveProfileCredentials as c, resolveEnvVars as cn, a2aInvokeOnce as ct, attachStageContext as d, createLocalStateProvider as dn, MCP_PROTOCOL_VERSION as dt, detectEcsImageResolutionNeeds as en, appOptions as er, applyCorsResponseHeaders as et, buildStageMap as f, isCfnFlagPresent as fn, mcpInvokeOnce as ft, groupRoutesByServer as g, resolveCfnStackName as gn, AGENTCORE_SESSION_ID_HEADER as gt, filterRoutesByApiIdentifiers as h, resolveCfnRegion as hn, signAgentCoreInvocation as ht, getPublishedHostPort as i, substituteAgainstState as in, parseContextOptions as ir, matchPreflight as it, buildRestV1Event as j, pickRefLogicalId as jn, architectureToPlatform as jt, applyAuthorizerOverlay as k, parseSelectionExpressionPath as kn, invokeRie as kt, createAuthorizerCache as l, materializeLayerFromArn as ln, MCP_CONTAINER_PORT as lt, filterRoutesByApiIdentifier as m, resolveCfnFallbackRegion as mn, AGENTCORE_SIGV4_SERVICE as mt, CloudMapRegistry as n, resolveEcsTaskTarget as nn, contextOptions as nr, buildCorsConfigFromCloudFrontChain as nt, createWatchPredicates as o, substituteEnvVarsFromState as on, A2A_CONTAINER_PORT as ot, availableApiIdentifiers as p, rejectExplicitCfnStackWithMultipleStacks as pn, parseSseForJsonRpc as pt, buildCognitoJwksUrl as q, readCdkPathOrUndefined as qn, resolveRuntimeFileExtension as qt, getContainerNetworkIp as r, applyDeployedEnvFallback as rn, deprecatedRegionOption as rr, isFunctionUrlOacFronted as rt, resolveApiTargetSubset as s, substituteEnvVarsFromStateAsync as sn, A2A_PATH as st, buildCloudMapIndex as t, parseEcsTarget as tn, commonOptions as tr, buildCorsConfigByApiId as tt, createFileWatcher as u, LocalStateSourceError as un, MCP_PATH as ut, startApiServer as v, collectSsmParameterRefs as vn, waitForAgentCorePing as vt, evaluateCachedLambdaPolicy as w, resolveSingleTarget as wn, toCmdArgv as wt, defaultCredentialsLoader as x, resolveWatchConfig as xn, buildAgentCoreCodeImage as xt, resolveSelectionExpression as y, resolveSsmParameters as yn, downloadAndExtractS3Bundle as yt, bufferToBody as z, pickAgentCoreCandidateStack as zn, ensureDockerAvailable as zt };
+//# sourceMappingURL=cloud-map-resolver-DjKCYyIq.js.map