cdk-local 0.62.0 → 0.62.1

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { An as SsmParameterRef, Bn as substituteEnvVarsFromStateAsync, Cn as rejectExplicitCfnStackWithMultipleStacks, D as listTargets, Dn as LocalStateProvider, E as countTargets, En as resolveCfnStackName, Fn as StateEnvSubstitutionAudit, In as SubstitutionContext, Ln as substituteAgainstState, M as CreateLocalStartApiCommandOptions, Mn as resolveSsmParameters, Nn as CrossStackResolver, On as LocalStateRecord, P as createLocalStartApiCommand, Pn as PseudoParameters, Rn as substituteAgainstStateAsync, Sn as isCfnFlagPresent, T as TargetListing, Tn as resolveCfnRegion, Vn as CloudFormationTemplate, _n as ExtraStateProviders, bn as LocalStateSourceOptions, gn as setEmbedConfig, hn as resetEmbedConfig, jn as collectSsmParameterRefs, kn as ResolvedSsmParameters, mn as getEmbedConfig, pn as CdkLocalEmbedConfig, vn as LocalStateProviderFactory, w as TargetEntry, wn as resolveCfnFallbackRegion, xn as createLocalStateProvider, yn as LocalStateSourceError, zn as substituteEnvVarsFromState } from "./ecs-service-emulator-aM8AsadH.js";
+import { An as SsmParameterRef, Bn as substituteEnvVarsFromStateAsync, Cn as rejectExplicitCfnStackWithMultipleStacks, D as listTargets, Dn as LocalStateProvider, E as countTargets, En as resolveCfnStackName, Fn as StateEnvSubstitutionAudit, In as SubstitutionContext, Ln as substituteAgainstState, M as CreateLocalStartApiCommandOptions, Mn as resolveSsmParameters, Nn as CrossStackResolver, On as LocalStateRecord, P as createLocalStartApiCommand, Pn as PseudoParameters, Rn as substituteAgainstStateAsync, Sn as isCfnFlagPresent, T as TargetListing, Tn as resolveCfnRegion, Vn as CloudFormationTemplate, _n as ExtraStateProviders, bn as LocalStateSourceOptions, gn as setEmbedConfig, hn as resetEmbedConfig, jn as collectSsmParameterRefs, kn as ResolvedSsmParameters, mn as getEmbedConfig, pn as CdkLocalEmbedConfig, vn as LocalStateProviderFactory, w as TargetEntry, wn as resolveCfnFallbackRegion, xn as createLocalStateProvider, yn as LocalStateSourceError, zn as substituteEnvVarsFromState } from "./ecs-service-emulator-D4aFpgn1.js";
 import { Command } from "commander";
 import { CloudFormationClient } from "@aws-sdk/client-cloudformation";
 
@@ -60,15 +60,18 @@ declare class CfnLocalStateProvider implements LocalStateProvider {
   private client;
   private lambdaClient;
   private ssmClient;
+  private agentCoreControlClient;
   private readonly clientOptions;
   private disposed;
   constructor(opts: CfnLocalStateProviderOptions);
   private getClient;
   private getLambdaClient;
+  private getAgentCoreControlClient;
   private getSsmClient;
   resolveTemplateSsmParameters(template: CloudFormationTemplate): Promise<ResolvedSsmParameters>;
   resolveDeployedFunctionEnv(functionPhysicalId: string): Promise<Record<string, string> | undefined>;
   resolveLambdaExecutionRoleArn(functionPhysicalId: string): Promise<string | undefined>;
+  resolveAgentCoreRuntimeRoleArn(runtimePhysicalId: string): Promise<string | undefined>;
   load(_stackName: string, _synthRegion: string | undefined): Promise<LocalStateRecord | undefined>;
   buildCrossStackResolver(_consumerRegion: string): Promise<CrossStackResolver | undefined>;
   dispose(): void;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/cli/commands/local-invoke.ts","../src/cli/commands/local-invoke-agentcore.ts","../src/cli/commands/local-run-task.ts","../src/cli/commands/local-start-service.ts","../src/cli/commands/local-start-alb.ts","../src/cli/commands/local-list.ts","../src/local/cfn-local-state-provider.ts"],"mappings":";;;;;UA8IiB,+BAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAg+BA,wBAAA,CAAyB,IAAA,GAAM,+BAAA,GAAuC,OAAA;;;UCz6BrE,wCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA6wCA,iCAAA,CACd,IAAA,GAAM,wCAAA,GACL,OAAA;;;UC/2Cc,gCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAmhBA,yBAAA,CAA0B,IAAA,GAAM,gCAAA,GAAwC,OAAA;;;UCvmBvE,qCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAmCA,8BAAA,CACd,IAAA,GAAM,qCAAA,GACL,OAAA;;;UChCc,iCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA6QA,0BAAA,CAA2B,IAAA,GAAM,iCAAA,GAAyC,OAAA;;;UCzQzE,6BAAA;EAEf,WAAA,GAAc,mBAAA;AAAA;AAAA,UAuCC,0BAAA;EAOf,IAAA;AAAA;AAAA,iBAYc,mBAAA,CACd,OAAA,EAAS,aAAA,EACT,OAAA,UACA,OAAA,GAAS,0BAAA;AAAA,iBAuEK,sBAAA,CAAuB,IAAA,GAAM,6BAAA,GAAqC,OAAA;;;UC/FjE,4BAAA;EAOf,YAAA;EAKA,MAAA;EAiBA,OAAA;AAAA;AAAA,cAGW,qBAAA,YAAiC,kBAAA;EAAA,SAG5B,KAAA;EAAA,iBACC,YAAA;EAAA,iBACA,MAAA;EAAA,QAKT,MAAA;EAAA,QAKA,YAAA;EAAA,QAKA,SAAA;EAAA,iBACS,aAAA;EAAA,QAQT,QAAA;cAEI,IAAA,EAAM,4BAAA;EAAA,QAOV,SAAA;EAAA,QAmBA,eAAA;EAAA,QAaA,YAAA;EA6BK,4BAAA,CACX,QAAA,EAAU,sBAAA,GACT,OAAA,CAAQ,qBAAA;EAsBE,0BAAA,CACX,kBAAA,WACC,OAAA,CAAQ,MAAA;EAiCE,6BAAA,CACX,kBAAA,WACC,OAAA;EAmCU,IAAA,CACX,UAAA,UACA,YAAA,uBACC,OAAA,CAAQ,gBAAA;EA2DE,uBAAA,CACX,eAAA,WACC,OAAA,CAAQ,kBAAA;EA8DJ,OAAA,CAAA;AAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/cli/commands/local-invoke.ts","../src/cli/commands/local-invoke-agentcore.ts","../src/cli/commands/local-run-task.ts","../src/cli/commands/local-start-service.ts","../src/cli/commands/local-start-alb.ts","../src/cli/commands/local-list.ts","../src/local/cfn-local-state-provider.ts"],"mappings":";;;;;UA8IiB,+BAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAg+BA,wBAAA,CAAyB,IAAA,GAAM,+BAAA,GAAuC,OAAA;;;UCz6BrE,wCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAizCA,iCAAA,CACd,IAAA,GAAM,wCAAA,GACL,OAAA;;;UCn5Cc,gCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAmhBA,yBAAA,CAA0B,IAAA,GAAM,gCAAA,GAAwC,OAAA;;;UCvmBvE,qCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAmCA,8BAAA,CACd,IAAA,GAAM,qCAAA,GACL,OAAA;;;UChCc,iCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA6QA,0BAAA,CAA2B,IAAA,GAAM,iCAAA,GAAyC,OAAA;;;UCzQzE,6BAAA;EAEf,WAAA,GAAc,mBAAA;AAAA;AAAA,UAuCC,0BAAA;EAOf,IAAA;AAAA;AAAA,iBAYc,mBAAA,CACd,OAAA,EAAS,aAAA,EACT,OAAA,UACA,OAAA,GAAS,0BAAA;AAAA,iBAuEK,sBAAA,CAAuB,IAAA,GAAM,6BAAA,GAAqC,OAAA;;;UC3FjE,4BAAA;EAOf,YAAA;EAKA,MAAA;EAiBA,OAAA;AAAA;AAAA,cAGW,qBAAA,YAAiC,kBAAA;EAAA,SAG5B,KAAA;EAAA,iBACC,YAAA;EAAA,iBACA,MAAA;EAAA,QAKT,MAAA;EAAA,QAKA,YAAA;EAAA,QAKA,SAAA;EAAA,QAKA,sBAAA;EAAA,iBACS,aAAA;EAAA,QAQT,QAAA;cAEI,IAAA,EAAM,4BAAA;EAAA,QAOV,SAAA;EAAA,QAmBA,eAAA;EAAA,QAaA,yBAAA;EAAA,QAaA,YAAA;EA6BK,4BAAA,CACX,QAAA,EAAU,sBAAA,GACT,OAAA,CAAQ,qBAAA;EAsBE,0BAAA,CACX,kBAAA,WACC,OAAA,CAAQ,MAAA;EAiCE,6BAAA,CACX,kBAAA,WACC,OAAA;EAiCU,8BAAA,CACX,iBAAA,WACC,OAAA;EAmCU,IAAA,CACX,UAAA,UACA,YAAA,uBACC,OAAA,CAAQ,gBAAA;EA2DE,uBAAA,CACX,eAAA,WACC,OAAA,CAAQ,kBAAA;EA8DJ,OAAA,CAAA;AAAA"}

package/dist/index.js

@@ -1,5 +1,5 @@
 import { c as getEmbedConfig, l as resetEmbedConfig, u as setEmbedConfig } from "./docker-cmd-voNPrcRh.js";
-import { An as countTargets, Cn as CfnLocalStateProvider, Sn as resolveCfnStackName, Tn as resolveSsmParameters, _ as createLocalStartApiCommand, _n as createLocalStateProvider, bn as resolveCfnFallbackRegion, dn as substituteAgainstStateAsync, fn as substituteEnvVarsFromState, gn as LocalStateSourceError, jn as listTargets, pn as substituteEnvVarsFromStateAsync, un as substituteAgainstState, vn as isCfnFlagPresent, wn as collectSsmParameterRefs, xn as resolveCfnRegion, yn as rejectExplicitCfnStackWithMultipleStacks } from "./elb-front-door-resolver-Vpf2Gpvg.js";
-import { a as createLocalRunTaskCommand, i as createLocalStartServiceCommand, n as formatTargetListing, o as createLocalInvokeAgentCoreCommand, r as createLocalStartAlbCommand, s as createLocalInvokeCommand, t as createLocalListCommand } from "./local-list-n6I3s-DR.js";
+import { An as countTargets, Cn as CfnLocalStateProvider, Sn as resolveCfnStackName, Tn as resolveSsmParameters, _ as createLocalStartApiCommand, _n as createLocalStateProvider, bn as resolveCfnFallbackRegion, dn as substituteAgainstStateAsync, fn as substituteEnvVarsFromState, gn as LocalStateSourceError, jn as listTargets, pn as substituteEnvVarsFromStateAsync, un as substituteAgainstState, vn as isCfnFlagPresent, wn as collectSsmParameterRefs, xn as resolveCfnRegion, yn as rejectExplicitCfnStackWithMultipleStacks } from "./elb-front-door-resolver-CsCmMUqz.js";
+import { a as createLocalRunTaskCommand, i as createLocalStartServiceCommand, n as formatTargetListing, o as createLocalInvokeAgentCoreCommand, r as createLocalStartAlbCommand, s as createLocalInvokeCommand, t as createLocalListCommand } from "./local-list-BPbd4EMs.js";
 
 export { CfnLocalStateProvider, LocalStateSourceError, collectSsmParameterRefs, countTargets, createLocalInvokeAgentCoreCommand, createLocalInvokeCommand, createLocalListCommand, createLocalRunTaskCommand, createLocalStartAlbCommand, createLocalStartApiCommand, createLocalStartServiceCommand, createLocalStateProvider, formatTargetListing, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resetEmbedConfig, resolveCfnFallbackRegion, resolveCfnRegion, resolveCfnStackName, resolveSsmParameters, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync };

package/dist/internal.d.ts

@@ -1,4 +1,4 @@
-import { $ as AuthorizerCache, $t as AGENTCORE_RUNTIME_TYPE, A as EcsTaskResolutionError, At as A2A_CONTAINER_PORT, B as readMtlsMaterialsFromDisk, Bt as McpInvokeResult, C as resolveAlbFrontDoor, Ct as CdkWatchConfig, Dt as AgentCoreWsResult, Et as resolveEnvVars, F as createWatchPredicates, Ft as a2aInvokeOnce, G as JwksCache, Gt as AgentCoreInvokeResult, H as CredentialsLoader, Ht as mcpInvokeOnce, I as resolveApiTargetSubset, It as MCP_CONTAINER_PORT, J as buildJwksUrlFromIssuer, Jt as waitForAgentCorePing, K as JwtCustomClaim, Kt as InvokeAgentCoreOptions, L as MtlsServerConfig, Lt as MCP_PATH, Mt as A2aInvokeOptions, N as WatchPredicates, Nt as A2aInvokeResult, O as CdkLocalError, Ot as InvokeAgentCoreWsOptions, Pt as A2aJsonRpcRequest, Q as verifyJwtViaDiscovery, Qt as AGENTCORE_MCP_PROTOCOL, R as ServerState, Rt as MCP_PROTOCOL_VERSION, S as isApplicationLoadBalancer, St as ContainerPool, Tt as EnvOverrideFile, U as defaultCredentialsLoader, Ut as parseSseForJsonRpc, V as startApiServer, Vn as CloudFormationTemplate, Vt as McpJsonRpcRequest, W as DiscoveryJwtAuthorizer, Wt as AGENTCORE_SESSION_ID_HEADER, X as verifyCognitoJwt, Xt as AGENTCORE_AGUI_PROTOCOL, Y as createJwksCache, Yt as AGENTCORE_A2A_PROTOCOL, Z as verifyJwtAuthorizer, Zt as AGENTCORE_HTTP_PROTOCOL, _ as parseRestartPolicy, _t as evaluateResponseParameters, a as PlannedAction, an as pickAgentCoreCandidateStack, at as RouteWithAuth, b as FrontDoorForwardTarget, bt as tryParseStatus, c as PlannedForwardAction, cn as derivePseudoParametersFromRegion, ct as applyCorsResponseHeaders, d as PlannedLambdaForwardTarget, dn as ResolvedArnLambdaLayer, dt as isFunctionUrlOacFronted, en as AgentCoreCodeArtifact, et as CachedAuthorizerResult, f as PlannedRedirectAction, fn as StackInfo, ft as matchPreflight, g as parseMaxTasks, gt as IntegrationResponseEntry, h as buildEcsImageResolutionContext, ht as discoverRoutes, i as MAX_TASKS_SUBNET_RANGE_CAP, in as ResolvedAgentCoreRuntime, it as LambdaTokenAuthorizer, j as ApiTargetSubset, jt as A2A_PATH, k as LocalInvokeBuildError, kt as invokeAgentCoreWs, l as PlannedForwardTarget, ln as substituteImagePlaceholders, lt as buildCorsConfigByApiId, m as addCommonEcsServiceOptions, mt as RestV1IntegrationConfig, n as EmulatorStrategy, nn as AgentCoreJwtAuthorizer, nt as AuthorizerInfo, o as PlannedEcsForwardTarget, on as resolveAgentCoreTarget, ot as attachAuthorizers, p as ServiceBoot, pt as DiscoveredRoute, q as buildCognitoJwksUrl, qt as invokeAgentCore, r as FrontDoorPlan, rn as AgentCoreResolutionError, rt as LambdaRequestAuthorizer, s as PlannedFixedResponseAction, sn as ImageResolutionContext, st as CorsConfig, t as EcsServiceEmulatorOptions, tn as AgentCoreCustomClaim, tt as createAuthorizerCache, u as PlannedFrontDoorListener, un as tryResolveImageFnJoin, ut as buildCorsConfigFromCloudFrontChain, v as resolveSharedSidecarCredentials, vt as pickResponseTemplate, w as TargetEntry, wt as resolveWatchConfig, x as ResolvedListenerAction, xt as VtlEvaluationError, y as runEcsServiceEmulator, yt as selectIntegrationResponse, z as StartedApiServer, zt as McpInvokeOptions } from "./ecs-service-emulator-aM8AsadH.js";
+import { $ as AuthorizerCache, $t as AGENTCORE_RUNTIME_TYPE, A as EcsTaskResolutionError, At as A2A_CONTAINER_PORT, B as readMtlsMaterialsFromDisk, Bt as McpInvokeResult, C as resolveAlbFrontDoor, Ct as CdkWatchConfig, Dt as AgentCoreWsResult, Et as resolveEnvVars, F as createWatchPredicates, Ft as a2aInvokeOnce, G as JwksCache, Gt as AgentCoreInvokeResult, H as CredentialsLoader, Ht as mcpInvokeOnce, I as resolveApiTargetSubset, It as MCP_CONTAINER_PORT, J as buildJwksUrlFromIssuer, Jt as waitForAgentCorePing, K as JwtCustomClaim, Kt as InvokeAgentCoreOptions, L as MtlsServerConfig, Lt as MCP_PATH, Mt as A2aInvokeOptions, N as WatchPredicates, Nt as A2aInvokeResult, O as CdkLocalError, Ot as InvokeAgentCoreWsOptions, Pt as A2aJsonRpcRequest, Q as verifyJwtViaDiscovery, Qt as AGENTCORE_MCP_PROTOCOL, R as ServerState, Rt as MCP_PROTOCOL_VERSION, S as isApplicationLoadBalancer, St as ContainerPool, Tt as EnvOverrideFile, U as defaultCredentialsLoader, Ut as parseSseForJsonRpc, V as startApiServer, Vn as CloudFormationTemplate, Vt as McpJsonRpcRequest, W as DiscoveryJwtAuthorizer, Wt as AGENTCORE_SESSION_ID_HEADER, X as verifyCognitoJwt, Xt as AGENTCORE_AGUI_PROTOCOL, Y as createJwksCache, Yt as AGENTCORE_A2A_PROTOCOL, Z as verifyJwtAuthorizer, Zt as AGENTCORE_HTTP_PROTOCOL, _ as parseRestartPolicy, _t as evaluateResponseParameters, a as PlannedAction, an as pickAgentCoreCandidateStack, at as RouteWithAuth, b as FrontDoorForwardTarget, bt as tryParseStatus, c as PlannedForwardAction, cn as derivePseudoParametersFromRegion, ct as applyCorsResponseHeaders, d as PlannedLambdaForwardTarget, dn as ResolvedArnLambdaLayer, dt as isFunctionUrlOacFronted, en as AgentCoreCodeArtifact, et as CachedAuthorizerResult, f as PlannedRedirectAction, fn as StackInfo, ft as matchPreflight, g as parseMaxTasks, gt as IntegrationResponseEntry, h as buildEcsImageResolutionContext, ht as discoverRoutes, i as MAX_TASKS_SUBNET_RANGE_CAP, in as ResolvedAgentCoreRuntime, it as LambdaTokenAuthorizer, j as ApiTargetSubset, jt as A2A_PATH, k as LocalInvokeBuildError, kt as invokeAgentCoreWs, l as PlannedForwardTarget, ln as substituteImagePlaceholders, lt as buildCorsConfigByApiId, m as addCommonEcsServiceOptions, mt as RestV1IntegrationConfig, n as EmulatorStrategy, nn as AgentCoreJwtAuthorizer, nt as AuthorizerInfo, o as PlannedEcsForwardTarget, on as resolveAgentCoreTarget, ot as attachAuthorizers, p as ServiceBoot, pt as DiscoveredRoute, q as buildCognitoJwksUrl, qt as invokeAgentCore, r as FrontDoorPlan, rn as AgentCoreResolutionError, rt as LambdaRequestAuthorizer, s as PlannedFixedResponseAction, sn as ImageResolutionContext, st as CorsConfig, t as EcsServiceEmulatorOptions, tn as AgentCoreCustomClaim, tt as createAuthorizerCache, u as PlannedFrontDoorListener, un as tryResolveImageFnJoin, ut as buildCorsConfigFromCloudFrontChain, v as resolveSharedSidecarCredentials, vt as pickResponseTemplate, w as TargetEntry, wt as resolveWatchConfig, x as ResolvedListenerAction, xt as VtlEvaluationError, y as runEcsServiceEmulator, yt as selectIntegrationResponse, z as StartedApiServer, zt as McpInvokeOptions } from "./ecs-service-emulator-D4aFpgn1.js";
 import { WebSocket } from "ws";
 import { IncomingMessage, ServerResponse } from "node:http";
 

package/dist/internal.js

@@ -1,3 +1,3 @@
-import { $ as buildMgmtEndpointEnvUrl, $t as resolveRuntimeCodeMountPath, A as startApiServer, At as waitForAgentCorePing, B as translateLambdaResponse, Bn as AGENTCORE_HTTP_PROTOCOL, C as attachStageContext, Ct as MCP_PROTOCOL_VERSION, D as filterRoutesByApiIdentifiers, Dn as resolveWatchConfig, Dt as signAgentCoreInvocation, E as filterRoutesByApiIdentifier, Et as AGENTCORE_SIGV4_SERVICE, F as computeRequestIdentityHash, Fn as discoverRoutes, Ft as renderCodeDockerfile, G as pickResponseTemplate, Gn as resolveAgentCoreTarget, H as buildHttpApiV2Event, Hn as AGENTCORE_RUNTIME_TYPE, I as evaluateCachedLambdaPolicy, In as pickRefLogicalId, It as toCmdArgv, J as VtlEvaluationError, Jn as substituteImagePlaceholders, K as selectIntegrationResponse, L as invokeRequestAuthorizer, Ln as resolveLambdaArnIntrinsic, M as resolveServiceIntegrationParameters, Mn as discoverWebSocketApis, Mt as SUPPORTED_CODE_RUNTIMES, N as defaultCredentialsLoader, Nn as discoverWebSocketApisOrThrow, Nt as buildAgentCoreCodeImage, O as groupRoutesByServer, Ot as AGENTCORE_SESSION_ID_HEADER, P as buildMethodArn, Pn as parseSelectionExpressionPath, Pt as computeCodeImageTag, Q as ConnectionRegistry, R as invokeTokenAuthorizer, Rn as AGENTCORE_A2A_PROTOCOL, S as createFileWatcher, St as MCP_PATH, T as availableApiIdentifiers, Tt as parseSseForJsonRpc, U as buildRestV1Event, Un as AgentCoreResolutionError, Ut as architectureToPlatform, V as applyAuthorizerOverlay, Vn as AGENTCORE_MCP_PROTOCOL, W as evaluateResponseParameters, Wn as pickAgentCoreCandidateStack, Wt as buildContainerImage, X as probeHostGatewaySupport, Y as HOST_GATEWAY_MIN_VERSION, Yn as tryResolveImageFnJoin, Z as bufferToBody, _t as invokeAgentCoreWs, a as buildEcsImageResolutionContext, at as buildCognitoJwksUrl, bt as a2aInvokeOnce, c as resolveSharedSidecarCredentials, ct as verifyCognitoJwt, d as CloudMapRegistry, dt as attachAuthorizers, en as resolveRuntimeFileExtension, et as handleConnectionsRequest, f as getContainerNetworkIp, ft as applyCorsResponseHeaders, gt as matchPreflight, hn as materializeLayerFromArn, ht as isFunctionUrlOacFronted, i as addCommonEcsServiceOptions, it as buildMessageEvent, j as resolveSelectionExpression, jt as downloadAndExtractS3Bundle, k as readMtlsMaterialsFromDisk, kn as resolveSingleTarget, kt as invokeAgentCore, l as runEcsServiceEmulator, lt as verifyJwtAuthorizer, mn as resolveEnvVars, mt as buildCorsConfigFromCloudFrontChain, n as resolveAlbFrontDoor, nn as EcsTaskResolutionError, nt as buildConnectEvent, o as parseMaxTasks, ot as buildJwksUrlFromIssuer, pt as buildCorsConfigByApiId, q as tryParseStatus, qn as derivePseudoParametersFromRegion, r as MAX_TASKS_SUBNET_RANGE_CAP, rt as buildDisconnectEvent, s as parseRestartPolicy, st as createJwksCache, t as isApplicationLoadBalancer, tn as resolveRuntimeImage, tr as LocalInvokeBuildError, tt as parseConnectionsPath, u as buildCloudMapIndex, ut as verifyJwtViaDiscovery, v as createWatchPredicates, vt as A2A_CONTAINER_PORT, w as buildStageMap, wt as mcpInvokeOnce, x as createAuthorizerCache, xt as MCP_CONTAINER_PORT, y as resolveApiTargetSubset, yt as A2A_PATH, z as matchRoute, zn as AGENTCORE_AGUI_PROTOCOL } from "./elb-front-door-resolver-Vpf2Gpvg.js";
+import { $ as buildMgmtEndpointEnvUrl, $t as resolveRuntimeCodeMountPath, A as startApiServer, At as waitForAgentCorePing, B as translateLambdaResponse, Bn as AGENTCORE_HTTP_PROTOCOL, C as attachStageContext, Ct as MCP_PROTOCOL_VERSION, D as filterRoutesByApiIdentifiers, Dn as resolveWatchConfig, Dt as signAgentCoreInvocation, E as filterRoutesByApiIdentifier, Et as AGENTCORE_SIGV4_SERVICE, F as computeRequestIdentityHash, Fn as discoverRoutes, Ft as renderCodeDockerfile, G as pickResponseTemplate, Gn as resolveAgentCoreTarget, H as buildHttpApiV2Event, Hn as AGENTCORE_RUNTIME_TYPE, I as evaluateCachedLambdaPolicy, In as pickRefLogicalId, It as toCmdArgv, J as VtlEvaluationError, Jn as substituteImagePlaceholders, K as selectIntegrationResponse, L as invokeRequestAuthorizer, Ln as resolveLambdaArnIntrinsic, M as resolveServiceIntegrationParameters, Mn as discoverWebSocketApis, Mt as SUPPORTED_CODE_RUNTIMES, N as defaultCredentialsLoader, Nn as discoverWebSocketApisOrThrow, Nt as buildAgentCoreCodeImage, O as groupRoutesByServer, Ot as AGENTCORE_SESSION_ID_HEADER, P as buildMethodArn, Pn as parseSelectionExpressionPath, Pt as computeCodeImageTag, Q as ConnectionRegistry, R as invokeTokenAuthorizer, Rn as AGENTCORE_A2A_PROTOCOL, S as createFileWatcher, St as MCP_PATH, T as availableApiIdentifiers, Tt as parseSseForJsonRpc, U as buildRestV1Event, Un as AgentCoreResolutionError, Ut as architectureToPlatform, V as applyAuthorizerOverlay, Vn as AGENTCORE_MCP_PROTOCOL, W as evaluateResponseParameters, Wn as pickAgentCoreCandidateStack, Wt as buildContainerImage, X as probeHostGatewaySupport, Y as HOST_GATEWAY_MIN_VERSION, Yn as tryResolveImageFnJoin, Z as bufferToBody, _t as invokeAgentCoreWs, a as buildEcsImageResolutionContext, at as buildCognitoJwksUrl, bt as a2aInvokeOnce, c as resolveSharedSidecarCredentials, ct as verifyCognitoJwt, d as CloudMapRegistry, dt as attachAuthorizers, en as resolveRuntimeFileExtension, et as handleConnectionsRequest, f as getContainerNetworkIp, ft as applyCorsResponseHeaders, gt as matchPreflight, hn as materializeLayerFromArn, ht as isFunctionUrlOacFronted, i as addCommonEcsServiceOptions, it as buildMessageEvent, j as resolveSelectionExpression, jt as downloadAndExtractS3Bundle, k as readMtlsMaterialsFromDisk, kn as resolveSingleTarget, kt as invokeAgentCore, l as runEcsServiceEmulator, lt as verifyJwtAuthorizer, mn as resolveEnvVars, mt as buildCorsConfigFromCloudFrontChain, n as resolveAlbFrontDoor, nn as EcsTaskResolutionError, nt as buildConnectEvent, o as parseMaxTasks, ot as buildJwksUrlFromIssuer, pt as buildCorsConfigByApiId, q as tryParseStatus, qn as derivePseudoParametersFromRegion, r as MAX_TASKS_SUBNET_RANGE_CAP, rt as buildDisconnectEvent, s as parseRestartPolicy, st as createJwksCache, t as isApplicationLoadBalancer, tn as resolveRuntimeImage, tr as LocalInvokeBuildError, tt as parseConnectionsPath, u as buildCloudMapIndex, ut as verifyJwtViaDiscovery, v as createWatchPredicates, vt as A2A_CONTAINER_PORT, w as buildStageMap, wt as mcpInvokeOnce, x as createAuthorizerCache, xt as MCP_CONTAINER_PORT, y as resolveApiTargetSubset, yt as A2A_PATH, z as matchRoute, zn as AGENTCORE_AGUI_PROTOCOL } from "./elb-front-door-resolver-CsCmMUqz.js";
 
 export { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_HTTP_PROTOCOL, AGENTCORE_MCP_PROTOCOL, AGENTCORE_RUNTIME_TYPE, AGENTCORE_SESSION_ID_HEADER, AGENTCORE_SIGV4_SERVICE, AgentCoreResolutionError, CloudMapRegistry, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MAX_TASKS_SUBNET_RANGE_CAP, MCP_CONTAINER_PORT, MCP_PATH, MCP_PROTOCOL_VERSION, SUPPORTED_CODE_RUNTIMES, VtlEvaluationError, a2aInvokeOnce, addCommonEcsServiceOptions, applyAuthorizerOverlay, applyCorsResponseHeaders, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCloudMapIndex, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildEcsImageResolutionContext, buildHttpApiV2Event, buildJwksUrlFromIssuer, buildMessageEvent, buildMethodArn, buildMgmtEndpointEnvUrl, buildRestV1Event, buildStageMap, computeCodeImageTag, computeRequestIdentityHash, createAuthorizerCache, createFileWatcher, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, discoverWebSocketApisOrThrow, downloadAndExtractS3Bundle, evaluateCachedLambdaPolicy, evaluateResponseParameters, filterRoutesByApiIdentifier, filterRoutesByApiIdentifiers, getContainerNetworkIp, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, invokeRequestAuthorizer, invokeTokenAuthorizer, isApplicationLoadBalancer, isFunctionUrlOacFronted, matchPreflight, matchRoute, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseMaxTasks, parseRestartPolicy, parseSelectionExpressionPath, parseSseForJsonRpc, pickAgentCoreCandidateStack, pickRefLogicalId, pickResponseTemplate, probeHostGatewaySupport, readMtlsMaterialsFromDisk, renderCodeDockerfile, resolveAgentCoreTarget, resolveAlbFrontDoor, resolveApiTargetSubset, resolveEnvVars, resolveLambdaArnIntrinsic, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSelectionExpression, resolveServiceIntegrationParameters, resolveSharedSidecarCredentials, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, selectIntegrationResponse, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, toCmdArgv, translateLambdaResponse, tryParseStatus, tryResolveImageFnJoin, verifyCognitoJwt, verifyJwtAuthorizer, verifyJwtViaDiscovery, waitForAgentCorePing };

package/dist/{local-list-n6I3s-DR.js → local-list-BPbd4EMs.js}

@@ -1,5 +1,5 @@
 import { c as getEmbedConfig, s as getLogger, u as setEmbedConfig } from "./docker-cmd-voNPrcRh.js";
-import { $n as resolveCdkPathToLogicalIds, $t as resolveRuntimeCodeMountPath, An as countTargets, At as waitForAgentCorePing, Bt as getDockerImageBySourceHash, Dt as signAgentCoreInvocation, En as resolveApp, Gn as resolveAgentCoreTarget, Gt as parseEcrUri, Ht as waitForRieReady, Jt as pickFreePort, Kn as resolveLambdaTarget, Kt as pullEcrImage, Lt as writeProfileCredentialsFile, Nt as buildAgentCoreCodeImage, On as Synthesizer, Qn as readCdkPathOrUndefined, Qt as streamLogs, Rn as AGENTCORE_A2A_PROTOCOL, Rt as singleFlight, St as MCP_PATH, Ut as architectureToPlatform, Vn as AGENTCORE_MCP_PROTOCOL, Vt as invokeRie, Wn as pickAgentCoreCandidateStack, Wt as buildContainerImage, Xn as matchStacks, Xt as removeContainer, Yt as pullImage, Zn as buildCdkPathIndex, Zt as runDetached, _n as createLocalStateProvider, _t as invokeAgentCoreWs, an as derivePartitionAndUrlSuffix, ar as appOptions, b as resolveProfileCredentials$1, bn as resolveCfnFallbackRegion, bt as a2aInvokeOnce, cn as resolveEcsTaskTarget, cr as deprecatedRegionOption, dn as substituteAgainstStateAsync, en as resolveRuntimeFileExtension, er as CdkLocalError, g as runEcsTask, h as parseHostPortOverrides, hn as materializeLayerFromArn, i as addCommonEcsServiceOptions, in as applyCrossStackResolverToTask, ir as applyRoleArnIfSet, jn as listTargets, jt as downloadAndExtractS3Bundle, kn as resolveSingleTarget, kt as invokeAgentCore, l as runEcsServiceEmulator, ln as applyDeployedEnvFallback, lr as parseContextOptions, m as createEcsRunState, mn as resolveEnvVars, n as resolveAlbFrontDoor, nr as LocalStartServiceError, on as detectEcsImageResolutionNeeds, or as commonOptions, p as cleanupEcsRun, pn as substituteEnvVarsFromStateAsync, qn as derivePseudoParametersFromRegion, qt as ensureDockerAvailable, rn as TASK_ROLE_ACCOUNT_PLACEHOLDER, rr as withErrorHandling, sn as parseEcsTarget, sr as contextOptions, st as createJwksCache, t as isApplicationLoadBalancer, tn as resolveRuntimeImage, ur as warnIfDeprecatedRegion, ut as verifyJwtViaDiscovery, vt as A2A_CONTAINER_PORT, wt as mcpInvokeOnce, xt as MCP_CONTAINER_PORT, yt as A2A_PATH, zn as AGENTCORE_AGUI_PROTOCOL, zt as AssetManifestLoader } from "./elb-front-door-resolver-Vpf2Gpvg.js";
+import { $n as resolveCdkPathToLogicalIds, $t as resolveRuntimeCodeMountPath, An as countTargets, At as waitForAgentCorePing, Bt as getDockerImageBySourceHash, Dt as signAgentCoreInvocation, En as resolveApp, Gn as resolveAgentCoreTarget, Gt as parseEcrUri, Ht as waitForRieReady, Jt as pickFreePort, Kn as resolveLambdaTarget, Kt as pullEcrImage, Lt as writeProfileCredentialsFile, Nt as buildAgentCoreCodeImage, On as Synthesizer, Qn as readCdkPathOrUndefined, Qt as streamLogs, Rn as AGENTCORE_A2A_PROTOCOL, Rt as singleFlight, St as MCP_PATH, Ut as architectureToPlatform, Vn as AGENTCORE_MCP_PROTOCOL, Vt as invokeRie, Wn as pickAgentCoreCandidateStack, Wt as buildContainerImage, Xn as matchStacks, Xt as removeContainer, Yt as pullImage, Zn as buildCdkPathIndex, Zt as runDetached, _n as createLocalStateProvider, _t as invokeAgentCoreWs, an as derivePartitionAndUrlSuffix, ar as appOptions, b as resolveProfileCredentials$1, bn as resolveCfnFallbackRegion, bt as a2aInvokeOnce, cn as resolveEcsTaskTarget, cr as deprecatedRegionOption, dn as substituteAgainstStateAsync, en as resolveRuntimeFileExtension, er as CdkLocalError, g as runEcsTask, h as parseHostPortOverrides, hn as materializeLayerFromArn, i as addCommonEcsServiceOptions, in as applyCrossStackResolverToTask, ir as applyRoleArnIfSet, jn as listTargets, jt as downloadAndExtractS3Bundle, kn as resolveSingleTarget, kt as invokeAgentCore, l as runEcsServiceEmulator, ln as applyDeployedEnvFallback, lr as parseContextOptions, m as createEcsRunState, mn as resolveEnvVars, n as resolveAlbFrontDoor, nr as LocalStartServiceError, on as detectEcsImageResolutionNeeds, or as commonOptions, p as cleanupEcsRun, pn as substituteEnvVarsFromStateAsync, qn as derivePseudoParametersFromRegion, qt as ensureDockerAvailable, rn as TASK_ROLE_ACCOUNT_PLACEHOLDER, rr as withErrorHandling, sn as parseEcsTarget, sr as contextOptions, st as createJwksCache, t as isApplicationLoadBalancer, tn as resolveRuntimeImage, ur as warnIfDeprecatedRegion, ut as verifyJwtViaDiscovery, vt as A2A_CONTAINER_PORT, wt as mcpInvokeOnce, xt as MCP_CONTAINER_PORT, yt as A2A_PATH, zn as AGENTCORE_AGUI_PROTOCOL, zt as AssetManifestLoader } from "./elb-front-door-resolver-CsCmMUqz.js";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import * as path from "node:path";
@@ -730,7 +730,7 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 			}
 		} else authorization = await resolveInboundAuthorization(resolved, options);
 		await resolveFromS3BucketIntrinsic(resolved, stateProvider, loadedState, imageContext);
-		const image = await resolveAgentCoreImage(resolved, options, loadedState);
+		const image = await resolveAgentCoreImage(resolved, options, loadedState, stateProvider);
 		const { env: dockerEnv, sensitiveEnvKeys } = await buildContainerEnv(resolved, options, profileCredentials, profileCredsFile, stateProvider, loadedState, imageContext);
 		const hostPort = await pickFreePort();
 		const containerHost = options.containerHost;
@@ -780,7 +780,7 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 			emitWsResult(wsResult);
 		} else {
 			await waitForAgentCorePing(containerHost, hostPort);
-			const additionalHeaders = await buildSigV4HeadersIfRequested(options, resolved, loadedState, containerHost, hostPort, event, sessionId);
+			const additionalHeaders = await buildSigV4HeadersIfRequested(options, resolved, loadedState, containerHost, hostPort, event, sessionId, stateProvider);
 			const result = await invokeAgentCore(containerHost, hostPort, event, {
 				sessionId,
 				timeoutMs: options.timeout,
@@ -843,7 +843,7 @@ async function resolveInboundAuthorization(resolved, options) {
 *
 * Exported so a unit test can drive the gate without the full Docker pipeline.
 */
-async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, port, event, sessionId) {
+async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, port, event, sessionId, stateProvider) {
 	if (!options.sigv4) return void 0;
 	if (options.bearerToken) throw new CdkLocalError(`--sigv4 and --bearer-token are mutually exclusive: pick one inbound auth.`, "LOCAL_INVOKE_AGENTCORE_AUTH_CONFLICT");
 	if (resolved.jwtAuthorizer) {
@@ -853,7 +853,7 @@ async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, por
 	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
 	if (!region) throw new CdkLocalError("--sigv4: no region resolved for the AgentCore signing scope. Pass --region <region>, set AWS_REGION, or use --from-cfn-stack with a region-bound stack.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_REGION");
 	const signed = await signAgentCoreInvocation({
-		credentials: await resolveHostCredentialsForSigV4(options, resolved, loaded, region),
+		credentials: await resolveHostCredentialsForSigV4(options, resolved, loaded, region, stateProvider),
 		region,
 		host,
 		port,
@@ -880,9 +880,9 @@ async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, por
 * Throws a {@link CdkLocalError} when none are available — `--sigv4` cannot
 * proceed without credentials, unlike the unsigned path.
 */
-async function resolveHostCredentialsForSigV4(options, resolved, loaded, region) {
+async function resolveHostCredentialsForSigV4(options, resolved, loaded, region, stateProvider) {
 	const logger = getLogger();
-	const assumeRoleArn = resolveAssumeRoleArn(options, resolved, loaded);
+	const assumeRoleArn = await resolveAssumeRoleArn(options, resolved, loaded, stateProvider);
 	if (assumeRoleArn) try {
 		return await assumeAgentCoreExecutionRole(assumeRoleArn, region);
 	} catch (err) {
@@ -917,12 +917,14 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region)
 *
 * `loaded` is the `--from-cfn-stack` state record (when available) — threaded
 * through so a bare `--assume-role` can resolve the execution-role ARN from
-* state for the fromS3 download.
+* state for the fromS3 download. `stateProvider` enables the issue-#187
+* live-fallback to `bedrock-agentcore-control:GetAgentRuntime` when the
+* static state lookup misses.
 */
-async function resolveAgentCoreImage(resolved, options, loaded) {
+async function resolveAgentCoreImage(resolved, options, loaded, stateProvider) {
 	const logger = getLogger();
 	const architecture = platformToArchitecture(options.platform);
-	if (resolved.codeArtifact) return resolveAgentCoreCodeImage(resolved, resolved.codeArtifact, options, architecture, loaded);
+	if (resolved.codeArtifact) return resolveAgentCoreCodeImage(resolved, resolved.codeArtifact, options, architecture, loaded, stateProvider);
 	const containerUri = resolved.containerUri;
 	if (containerUri === void 0) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' has neither a container image nor a code artifact to run.`, "LOCAL_INVOKE_AGENTCORE_NO_ARTIFACT");
 	const manifestPath = resolved.stack.assetManifestPath;
@@ -958,8 +960,8 @@ async function resolveAgentCoreImage(resolved, options, loaded) {
 *   run the same from-source build (generated Dockerfile → install deps → run
 *   EntryPoint).
 */
-async function resolveAgentCoreCodeImage(resolved, code, options, architecture, loaded) {
-	if (code.s3Source) return resolveAgentCoreCodeImageFromS3(resolved, code, code.s3Source, options, architecture, loaded);
+async function resolveAgentCoreCodeImage(resolved, code, options, architecture, loaded, stateProvider) {
+	if (code.s3Source) return resolveAgentCoreCodeImageFromS3(resolved, code, code.s3Source, options, architecture, loaded, stateProvider);
 	const manifestPath = resolved.stack.assetManifestPath;
 	if (!manifestPath) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' uses a code artifact, but its stack has no asset manifest in cdk.out to read the bundle source from.`, "LOCAL_INVOKE_AGENTCORE_CODE_NO_MANIFEST");
 	const cdkOutDir = dirname(manifestPath);
@@ -988,7 +990,7 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 * creds for the download; otherwise `--profile` / the default chain is used.
 * The region is `--region` / `--stack-region` / env / the stack's region.
 */
-async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options, architecture, loaded) {
+async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options, architecture, loaded, stateProvider) {
 	const logger = getLogger();
 	if (typeof s3Source.bucket !== "string" || s3Source.bucket.length === 0) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' fromS3 bundle reached the image step with no literal bucket. This is a cdk-local bug — please report it.`, "LOCAL_INVOKE_AGENTCORE_FROMS3_BUCKET_UNRESOLVED");
 	const location = {
@@ -997,7 +999,7 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 		...s3Source.versionId !== void 0 && { versionId: s3Source.versionId }
 	};
 	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
-	const assumeRoleArn = resolveAssumeRoleArn(options, resolved, loaded);
+	const assumeRoleArn = await resolveAssumeRoleArn(options, resolved, loaded, stateProvider);
 	let credentials;
 	if (assumeRoleArn) try {
 		credentials = await assumeAgentCoreExecutionRole(assumeRoleArn, region);
@@ -1071,7 +1073,7 @@ async function buildContainerEnv(resolved, options, profileCredentials, profileC
 		logger.warn(`Environment variable ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${overrideKeyExample}":{"${key}":"<literal>"}}), or pass a state-source flag (e.g. --from-cfn-stack) to recover deployed values.`);
 	}
 	const dockerEnv = { ...envResult.resolved };
-	const assumeRoleArn = resolveAssumeRoleArn(options, resolved, loaded);
+	const assumeRoleArn = await resolveAssumeRoleArn(options, resolved, loaded, stateProvider);
 	await applyAgentCoreCredentialEnv(dockerEnv, {
 		...assumeRoleArn !== void 0 && { assumeRoleArn },
 		...options.region !== void 0 && { region: options.region },
@@ -1212,22 +1214,34 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 * Resolve the role ARN to assume, honoring the three `--assume-role` forms.
 * Bare `--assume-role` uses the runtime's literal `RoleArn`; when that is an
 * intrinsic (the common L2 case — `Fn::GetAtt` to an auto-created role) it
-* resolves the execution-role ARN from `--from-cfn-stack` state, and only
-* warns + falls back to dev creds when neither is available.
+* resolves the execution-role ARN from `--from-cfn-stack` state first; when
+* that misses (issue #187 — `ListStackResources` returns the role's name,
+* not its ARN, so `attributes.Arn` is empty on the CFn state map) it falls
+* back to `stateProvider.resolveAgentCoreRuntimeRoleArn(<physicalId>)`
+* (a `bedrock-agentcore-control:GetAgentRuntime` call) so a same-stack
+* execution role still resolves. Only warns + falls back to dev creds
+* when all of those miss.
 */
-function resolveAssumeRoleArn(options, resolved, loaded) {
+async function resolveAssumeRoleArn(options, resolved, loaded, stateProvider) {
 	if (typeof options.assumeRole === "string") return options.assumeRole;
-	if (options.assumeRole === true) {
-		if (resolved.roleArn) return resolved.roleArn;
-		if (loaded) {
-			const fromState = resolveExecutionRoleArnFromState(loaded, resolved.logicalId, "RoleArn");
-			if (fromState) {
-				getLogger().debug(`--assume-role: resolved RoleArn from state: ${fromState}`);
-				return fromState;
+	if (options.assumeRole !== true) return void 0;
+	if (resolved.roleArn) return resolved.roleArn;
+	if (loaded) {
+		const fromState = resolveExecutionRoleArnFromState(loaded, resolved.logicalId, "RoleArn");
+		if (fromState) {
+			getLogger().debug(`--assume-role: resolved RoleArn from state: ${fromState}`);
+			return fromState;
+		}
+		const runtimePhysicalId = loaded.resources[resolved.logicalId]?.physicalId;
+		if (stateProvider?.resolveAgentCoreRuntimeRoleArn && runtimePhysicalId) {
+			const liveArn = await stateProvider.resolveAgentCoreRuntimeRoleArn(runtimePhysicalId);
+			if (liveArn) {
+				getLogger().info(`--assume-role: auto-resolved execution role from GetAgentRuntime: ${liveArn}`);
+				return liveArn;
 			}
 		}
-		getLogger().warn("--assume-role passed without an ARN, but the runtime's RoleArn is not a literal ARN in the template " + (loaded ? "and could not be resolved from the deployed stack state. " : "and no --from-cfn-stack state is available to resolve it. ") + "Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.");
 	}
+	getLogger().warn("--assume-role passed without an ARN, but the runtime's RoleArn is not a literal ARN in the template " + (loaded ? "and could not be resolved from the deployed stack state. " : "and no --from-cfn-stack state is available to resolve it. ") + "Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.");
 }
 function emitResult(result) {
 	const logger = getLogger();
@@ -2019,4 +2033,4 @@ function createLocalListCommand(opts = {}) {
 
 //#endregion
 export { createLocalRunTaskCommand as a, createLocalStartServiceCommand as i, formatTargetListing as n, createLocalInvokeAgentCoreCommand as o, createLocalStartAlbCommand as r, createLocalInvokeCommand as s, createLocalListCommand as t };
-//# sourceMappingURL=local-list-n6I3s-DR.js.map
+//# sourceMappingURL=local-list-BPbd4EMs.js.map