fix(efs): place mount targets in their real subnet

CreateMountTarget now looks the subnet up in EC2 and takes the mount target's VPC, Availability Zone and IP address from it, instead of reporting vpc-12345678 and the region's first zone for every mount target. An unknown subnet is refused with SubnetNotFound, and, as in AWS, a file system gets one mount target per zone, all in one VPC (MountTargetConflict otherwise). Lambda checks a function's VPC against its file system's mount targets, so the made-up VPC kept consoles from finding the security group to use.
Merge pull request 'fix(acm): keep the Export option on RequestCertificate' (#12 ) from fix/acm-request-export-option into main
2026-10-25 17:25:15 -04:00 · 2026-10-25 17:21:08 +00:00 · 2026-10-25 12:30:11 -04:00 · 2026-10-25 14:29:43 +00:00 · 2026-10-25 10:11:34 -04:00 · 2026-10-25 13:49:41 +00:00
8 changed files with 300 additions and 276 deletions
@@ -1,21 +1,17 @@
 <p align="center">
-  <img src="docs/assets/floci-black.svg#gh-light-mode-only" alt="Floci" width="500" />
+  <img src="docs/assets/thecloud-logo.png" alt="TheCloud" width="160" />
  <img src="docs/assets/floci-white.svg#gh-dark-mode-only" alt="Floci" width="500" />
 </p>
 <h1 align="center">TheCloud AWS runtime</h1>
 <p align="center">
  <strong>Any Cloud. Locally.</strong><br />
-  Light, fluffy, and always free<br />
+  The local AWS emulator behind TheCloud.<br />
  No account. No auth token. No feature gates. Just <code>docker compose up</code>.
 </p>
 <p align="center">
  <a href="https://github.com/floci-io/floci/releases/latest"><img src="https://img.shields.io/github/v/release/floci-io/floci?label=latest%20release&color=blue" alt="Latest Release"></a>
  <a href="https://github.com/floci-io/floci/actions/workflows/release.yml"><img src="https://img.shields.io/github/actions/workflow/status/floci-io/floci/release.yml?label=build" alt="Build Status"></a>
  <a href="https://hub.docker.com/r/floci/floci"><img src="https://img.shields.io/docker/pulls/floci/floci?label=docker%20pulls" alt="Docker Pulls"></a>
  <a href="https://hub.docker.com/r/floci/floci"><img src="https://img.shields.io/docker/image-size/floci/floci/latest?label=image%20size" alt="Docker Image Size"></a>
  <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/license-MIT-green" alt="License: MIT"></a>
  <a href="https://github.com/floci-io/floci/stargazers"><img src="https://img.shields.io/github/stars/floci-io/floci?style=flat" alt="GitHub Stars"></a>
 </p>
 <p align="center">
@@ -24,41 +20,43 @@
  <a href="#supported-services">Services</a> ·
  <a href="#sdk-integration">SDKs</a> ·
  <a href="#testcontainers">Testcontainers</a> ·
-  <a href="#migrating-from-localstack">Migration</a> ·
+  <a href="#migrating-from-localstack">Migration</a>
  <a href="https://floci.io/floci/">Docs</a>
 </p>
 ---
-## What is Floci?
+## What is this?
-Floci is a free, open-source local AWS emulator for development, testing, and CI.
+TheCloud's AWS runtime is a local AWS emulator for development, testing, and CI. It is the runtime behind [TheCloud](https://gitea.zacksolutions.dev/Zakaria/floci-ui), a self-hosted cloud console.
-It gives you AWS-shaped services on your machine without requiring a cloud account, an auth token, or paid feature gates. Point your AWS SDK, CLI, Terraform, CDK, OpenTofu, or test suite at `http://localhost:4566` and keep your existing workflows.
+It gives you AWS-shaped services on your machine without a cloud account, an auth token, or paid feature gates. Point your AWS SDK, CLI, Terraform, CDK, OpenTofu, or test suite at `http://localhost:4566` and keep your existing workflows.
-Already using LocalStack? Floci is a drop-in replacement: swap the image and keep going. See [Migrating from LocalStack](#migrating-from-localstack).
+It is a fork of the open-source [Floci](https://github.com/floci-io/floci) emulator. Upstream fixes are brought in by cherry-picking from Floci's `main`, alongside TheCloud's own changes, for example:
-Floci is the AWS member of the [Floci](https://github.com/floci-io) emulator family, named after [floccus](https://en.wikipedia.org/wiki/Cirrocumulus_floccus), the cloud formation that looks like popcorn.
+- Cognito hosted login with identity-provider buttons, and `PreventUserExistenceErrors` honoured on app clients.
 - CloudFront distributions served at `<id>.cloudfront.localhost`.
 - SES delivering real email through an SMTP relay that signs in with a password (Gmail app passwords work).
 - HTTP API JWT authorizers that verify tokens from this runtime's own Cognito pools.
-| Emulator | Cloud | Port |
+Companion runtimes for other clouds come from upstream: [floci-az](https://github.com/floci-io/floci-az) for Azure on port 4577 and [floci-gcp](https://github.com/floci-io/floci-gcp) for GCP on port 4588.
 |---|---|:---:|
 | **[floci](https://github.com/floci-io/floci)** | **AWS** | **4566** |
 | [floci-az](https://github.com/floci-io/floci-az) | Azure | 4577 |
 | [floci-gcp](https://github.com/floci-io/floci-gcp) | GCP | 4588 |
 | [floci-oci](https://github.com/floci-io/floci-oci) | OCI | 4599 |
 ## Quick Start
-The fastest way to run Floci is with the official [CLI](https://github.com/floci-io/floci-cli)
+Build and start the runtime from this repository:
 ```bash
-floci start
+git clone https://gitea.zacksolutions.dev/Zakaria/FlociClone.git
 cd FlociClone
 docker compose up -d
 ```
 Export the AWS environment variables:
 ```bash
-eval $(floci env)
+export AWS_ENDPOINT_URL=http://localhost:4566
 export AWS_DEFAULT_REGION=us-east-1
 export AWS_ACCESS_KEY_ID=test
 export AWS_SECRET_ACCESS_KEY=test
 ```
 Use your existing AWS tools normally:
@@ -75,121 +73,41 @@ aws dynamodb create-table \
 aws dynamodb list-tables
 ```
 ### Watch it run
 This short demo shows the CLI flow: start Floci, export the local AWS environment, run standard AWS CLI commands, and stop the emulator.
 https://github.com/user-attachments/assets/b55714dc-ef36-40ae-a734-cd2cadc288a8
 All AWS services are available at `http://localhost:4566`. Any region works. Credentials can be any non-empty values unless you explicitly enable stricter service-specific auth checks.
 <details>
-<summary>Prefer Docker Compose?</summary>
+<summary>Prefer <code>docker run</code>, or dev mode?</summary>
-Create a `compose.yaml` file:
+Build the image, then run it with the Docker socket so container-backed services work:
 ```yaml
 services:
  floci:
    image: floci/floci:latest
    ports:
      - "4566:4566"
 ```
 Start Floci:
 ```bash
-docker compose up
+docker build -f docker/Dockerfile -t floci-floci:latest .
 docker run -d --name floci -p 4566:4566 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  floci-floci:latest
 ```
-Then configure your AWS environment manually:
+Or run it in Quarkus dev mode, which needs JDK 25:
 ```bash
-export AWS_ENDPOINT_URL=http://localhost:4566
+./mvnw quarkus:dev
 export AWS_DEFAULT_REGION=us-east-1
 export AWS_ACCESS_KEY_ID=test
 export AWS_SECRET_ACCESS_KEY=test
 ```
 </details>
 <details>
 <summary>Using the old <code>hectorvent/floci</code> image?</summary>
 Update your image name:
 ```yaml
 # Before
 image: hectorvent/floci:latest
 # After
 image: floci/floci:latest
 ```
 The old `hectorvent/floci` repository no longer receives updates.
 </details>
 ## Web Console
-Floci ships a browser console for inspecting the resources in your local emulator.
+[TheCloud](https://gitea.zacksolutions.dev/Zakaria/floci-ui) is the console for this runtime. It runs as its own app on port 4500, talks to the runtime at `FLOCI_ENDPOINT`, and covers the services listed in its README.
-**Open it at:** `http://localhost:4566/_floci/ui`
+The runtime can also start a console for you as a sidecar container on first visit to `http://localhost:4566/_floci/ui`. That needs the Docker socket, and the image is set with `FLOCI_SERVICES_UI_IMAGE`; point it at your TheCloud build to use it.
 Nothing runs at boot. The first request pulls the console image, starts it as a sidecar container on Floci's Docker network, hands it Floci's own reachable address plus the standard AWS environment, polls its health endpoint, and redirects the browser once it reports it can reach Floci. The sidecar's port is bound by Docker, so it needs no `ports:` entry of your own, and its logs are streamed into CloudWatch Logs under `/floci/ui`.
 Starting a container needs the Docker socket:
 ```yaml
 services:
  floci:
    image: floci/floci:latest
    ports:
      - "4566:4566"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
 ```
 | Variable | Default | Description |
 |---|---|---|
 | `FLOCI_SERVICES_UI_ENABLED` | `true` | Enable the console sidecar |
-| `FLOCI_SERVICES_UI_IMAGE` | `floci/floci-ui:latest` | Console image to run |
+| `FLOCI_SERVICES_UI_IMAGE` | `floci/floci-ui:latest` | Console image to run, for example `floci/floci-ui:local` for a local TheCloud build |
 | `FLOCI_SERVICES_UI_CONTAINER_NAME` | `floci-ui` | Name of the sidecar container |
 | `FLOCI_SERVICES_UI_PORT` | `4500` | Host port the console is published on |
-| `FLOCI_SERVICES_UI_KEEP_RUNNING_ON_SHUTDOWN` | `false` | Leave the sidecar running when Floci stops |
+| `FLOCI_SERVICES_UI_KEEP_RUNNING_ON_SHUTDOWN` | `false` | Leave the sidecar running when the runtime stops |
 ### Running a different console
 The console is not fixed to the one Floci ships. Any console implementing the [Floci console contract](https://floci.io/floci/ui/console-contract/) runs with nothing but an image name: listen on the port in `PORT`, serve `GET /api/health`, talk to Floci at `AWS_ENDPOINT_URL`.
 ```yaml
 environment:
  FLOCI_SERVICES_UI_IMAGE: acme/my-console:1.0
 ```
 A console that differs from the contract's defaults says so in its own `io.floci.console.*` image labels, so its operators do not have to. [StackPort](https://github.com/DaviReisVieira/stackport), for example, listens on 8080 rather than 4500; on an image that predates the labels, say it by hand:
 ```yaml
 environment:
  FLOCI_SERVICES_UI_IMAGE: davireis/stackport:latest
  FLOCI_SERVICES_UI_CONTAINER_NAME: floci-stackport
  FLOCI_SERVICES_UI_PORT: "8080"
  FLOCI_SERVICES_UI_INTERNAL_PORT: "8080"
 ```
 [Floci Dash](https://github.com/ofsazib/floci-dash) is another. It honours `PORT`, so only the two things it does differ on need naming:
 ```yaml
 environment:
  FLOCI_SERVICES_UI_IMAGE: ghcr.io/ofsazib/floci-dash:latest
  FLOCI_SERVICES_UI_CONTAINER_NAME: floci-dash
  FLOCI_SERVICES_UI_ENDPOINT_ENV: FLOCI_URL
  FLOCI_SERVICES_UI_STATUS_PATH: /api/healthz
 ```
 The endpoint itself is never configured by hand: Floci resolves its own reachable address at start time and injects it as `AWS_ENDPOINT_URL`.
 Full reference: [Web Console](https://floci.io/floci/ui/) and [Console Contract v1](https://floci.io/floci/ui/console-contract/).
 ## Features
@@ -212,14 +130,7 @@ Lambda, RDS, Neptune, ElastiCache, MSK, MSK Connect, ECS, EC2, EKS, OpenSearch,
 Point standard AWS clients at `http://localhost:4566`. Existing credentials, regions, SDKs, CLI commands, and IaC workflows stay familiar.
-Terraform can provision AWS-shaped resources locally through Floci using the standard HashiCorp AWS provider. See the [Terraform with Floci guide](docs/getting-started/terraform.md) for provider configuration, resource examples, and optional emulated S3 state.
+Terraform can provision AWS-shaped resources locally through this runtime using the standard HashiCorp AWS provider. See the [Terraform guide](docs/getting-started/terraform.md) for provider configuration, resource examples, and optional emulated S3 state.
 </details>
 <details>
 <summary><strong>Fast enough for CI</strong></summary>
 The native image starts in milliseconds and keeps idle memory low, making it practical for local development and test pipelines.
 </details>
@@ -230,36 +141,13 @@ Choose from in-memory, persistent, hybrid, and write-ahead log storage depending
 </details>
 ## Why Floci?
 LocalStack's community edition [sunset in March 2026](https://blog.localstack.cloud/the-road-ahead-for-localstack/), requiring auth tokens and freezing security updates. Floci is the no-strings-attached alternative.
 | Capability | Floci | LocalStack Community |
 |---|:---:|:---:|
 | Auth token required | No | Yes |
 | Security updates | Yes | Frozen |
 | Startup time | ~24 ms | ~3.3 s |
 | Idle memory | ~13 MiB | ~143 MiB |
 | Docker image size | ~90 MB | ~1.0 GB |
 | License | MIT | Restricted |
 | API Gateway v2 / HTTP API | Yes | No |
 | Cognito | Yes | No |
 | RDS, ElastiCache, MSK, MSK Connect | Real Docker | No |
 | Neptune (graph DB + Gremlin WebSocket) | Real Docker | No |
 | DocumentDB (MongoDB-compatible) | Real Docker | No |
 | ECS, EC2, EKS | Real Docker | No |
 | CodeBuild | Real Docker execution | No |
 | Native binary | ~40 MB | No |
 **Broad AWS coverage. Free forever.** See the [Services Overview](https://floci.io/floci/services/) for the full list of emulated services.
 ## Architecture Overview
 ```mermaid
 flowchart LR
    Client["AWS SDK / CLI"]
-    subgraph Floci ["Floci, port 4566"]
+    subgraph Runtime ["TheCloud AWS runtime, port 4566"]
        Router["HTTP Router\nJAX-RS / Vert.x"]
        subgraph Stateless ["Stateless Services"]
@@ -288,7 +176,7 @@ flowchart LR
 ## Supported Services
-Floci supports local emulation for application services, data services, eventing, identity, infrastructure, billing, and container-backed workloads.
+The runtime emulates application services, data services, eventing, identity, infrastructure, billing, and container-backed workloads.
 | Category | Services |
 |---|---|
@@ -303,7 +191,7 @@ Floci supports local emulation for application services, data services, eventing
 | Cost and billing | AWS Budgets, Pricing, Cost Explorer, Cost and Usage Reports, BCM Pricing Calculator, BCM Data Exports |
 | Resilience, backup, and config | AWS FIS, AWS Backup, AWS Config, AppConfig, AppConfigData, CloudFormation, Cloud Control API |
-For operation-level compatibility, see the [Services Overview](https://floci.io/floci/services/).
+For operation-level detail, see upstream Floci's [Services Overview](https://floci.io/floci/services/); it can list upstream work this fork has not picked up yet.
 <details>
 <summary>Detailed service notes</summary>
@@ -378,7 +266,7 @@ For operation-level compatibility, see the [Services Overview](https://floci.io/
 | AWS Backup | In-process | Vaults, backup plans, selections, simulated job lifecycle, recovery points |
 | AWS FIS | In-process | All 26 management APIs for templates, experiments, target accounts, action and target discovery, safety lever, tagging, and pagination; experiment execution is a safe control-plane simulation and does not inject faults into other services |
 | AWS Config | In-process | Config rules, evaluation-driven compliance (PutEvaluations, compliance details and summaries), configuration recorders, delivery channels, retention configuration, conformance packs, tagging |
-| Organizations | In-process | Organizations, roots, nested OUs, member accounts, all policy types with `FullAWSAccess` and effective-policy inheritance, trusted service access, delegated administrators, resource policy, and the full invitation/handshake flow; created accounts are usable Floci accounts and member accounts can read the organization they belong to |
+| Organizations | In-process | Organizations, roots, nested OUs, member accounts, all policy types with `FullAWSAccess` and effective-policy inheritance, trusted service access, delegated administrators, resource policy, and the full invitation/handshake flow; created accounts are usable accounts in the runtime and member accounts can read the organization they belong to |
 | CloudTrail | In-process | Trails, event selectors (S3 data events with bucket/prefix matching), `StartLogging`/`StopLogging`, scheduled gzipped log file emission to the destination bucket at AWS-shaped key paths, IAM-deny path emits `AccessDenied` records |
 | CloudFront | In-process | Distributions, origins, cache behaviors, invalidations, tagging |
 | WAF v2 | In-process | Web ACLs, IP sets, regex pattern sets, rule groups, logging configs, resource associations, tagging (REGIONAL and CLOUDFRONT scopes) |
@@ -389,7 +277,7 @@ For operation-level compatibility, see the [Services Overview](https://floci.io/
 | Textract | In-process stub | API-compatible stubs, dummy block data, async job simulation |
 | Transcribe | In-process stub | Transcription jobs and custom vocabularies; jobs complete immediately, no real audio processing |
 | Pricing | In-process with static snapshot | Product discovery, attributes, price list files, pagination |
-| Cost Explorer | In-process | Cost synthesized from Floci resource state and pricing snapshots |
+| Cost Explorer | In-process | Cost synthesized from the runtime's resource state and pricing snapshots |
 | Cost and Usage Reports | In-process with floci-duck sidecar | CUR 2.0 and FOCUS 1.2 columns, account-scoped storage, Parquet emission |
 | BCM Pricing Calculator | In-process | Workload estimate create, usage pricing, read, and delete lifecycle |
 | BCM Data Exports | In-process | Export lifecycle, executions, update and delete operations |
@@ -398,7 +286,7 @@ For operation-level compatibility, see the [Services Overview](https://floci.io/
 ## Real Docker Integration
-Floci uses real Docker containers when in-process emulation would reduce fidelity. This applies to stateful databases, connection-heavy protocols, runtimes, and build systems.
+The runtime uses real Docker containers when in-process emulation would reduce fidelity. This applies to stateful databases, connection-heavy protocols, runtimes, and build systems.
 | Service | Default image | What is real |
 |---|---|---|
@@ -416,12 +304,12 @@ Floci uses real Docker containers when in-process emulation would reduce fidelit
 | EC2 | AMI-mapped Linux images | Linux containers, SSH key injection, UserData, IMDS, IAM credentials |
 | ECS | User-specified task image | Container lifecycle, start, stop, health checks |
 | EKS | `rancher/k3s:latest` | Kubernetes API server via k3s |
-| MWAA | `apache/airflow:<version>-python3.12` + `postgres:16-alpine` | Real Apache Airflow (LocalExecutor: scheduler + webserver) with its own Postgres metadata DB; webserver/CLI reachable via Floci's proxy |
+| MWAA | `apache/airflow:<version>-python3.12` + `postgres:16-alpine` | Real Apache Airflow (LocalExecutor: scheduler + webserver) with its own Postgres metadata DB; webserver/CLI reachable via the runtime's proxy |
 | CodeBuild | User-specified environment image | Buildspec execution, log streaming, S3 artifact upload |
 | OpenSearch | `opensearchproject/opensearch:2` | Full OpenSearch engine with REST API |
 | ECR | `registry:2` | OCI-compatible registry for docker push and docker pull |
-| Verified Permissions | `floci/floci-sidecar-cedar:1.1.0` | Cedar 4 policy parsing, schema validation and authorization decisions, via a [Floci sidecar](https://github.com/floci-io/floci-sidecars) |
+| Verified Permissions | `floci/floci-sidecar-cedar:1.1.0` | Cedar 4 policy parsing, schema validation and authorization decisions, via an upstream [Floci sidecar](https://github.com/floci-io/floci-sidecars) |
-| AppSync | `floci/floci-sidecar-graphql:0.2.0` | graphql-java schema validation, query planning and execution, via a [Floci sidecar](https://github.com/floci-io/floci-sidecars) |
+| AppSync | `floci/floci-sidecar-graphql:0.2.0` | graphql-java schema validation, query planning and execution, via an upstream [Floci sidecar](https://github.com/floci-io/floci-sidecars) |
 Docker-backed services require the Docker socket:
@@ -430,7 +318,7 @@ docker run -d --name floci \
  -p 4566:4566 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -u root \
-  floci/floci:latest
+  floci-floci:latest
 ```
 ### Overriding default images
@@ -454,7 +342,7 @@ docker run -d --name floci \
 ## Persistence and Storage Modes
-Floci can trade speed for durability depending on the workflow. Configure the default mode with `FLOCI_STORAGE_MODE`, or override storage per service.
+The runtime can trade speed for durability depending on the workflow. Configure the default mode with `FLOCI_STORAGE_MODE`, or override storage per service.
 | Mode | Behavior | Best for | Durability |
 |---|---|---|:---:|
@@ -465,22 +353,22 @@ Floci can trade speed for durability depending on the workflow. Configure the de
 Use `memory` for fast test runs. Use `hybrid` when you want state preserved across container restarts without much overhead.
-For more detail, see the [Storage Configuration documentation](https://floci.io/floci/configuration/storage/).
+For more detail, see upstream Floci's [Storage Configuration documentation](https://floci.io/floci/configuration/storage/).
 ## Multi-Account Isolation
-Floci supports per-account resource isolation with no extra setup. If `AWS_ACCESS_KEY_ID` is exactly 12 digits, Floci uses it as the account ID. Resources created by one account are invisible to another.
+The runtime supports per-account resource isolation with no extra setup. If `AWS_ACCESS_KEY_ID` is exactly 12 digits, it is used as the account ID. Resources created by one account are invisible to another.
 ```bash
 AWS_ACCESS_KEY_ID=111111111111 aws sqs create-queue --queue-name orders
 AWS_ACCESS_KEY_ID=222222222222 aws sqs create-queue --queue-name orders
 ```
-Any other key format, such as `test` or `AKIA...`, causes Floci to fall back to `FLOCI_DEFAULT_ACCOUNT_ID`, which defaults to `000000000000`.
+Any other key format, such as `test` or `AKIA...`, falls back to `FLOCI_DEFAULT_ACCOUNT_ID`, which defaults to `000000000000`.
 STS temporary credentials are routed too: credentials from `AssumeRole` resolve to the assumed role's account, so the cross-account assume-role-then-provision pattern works locally. Resolution precedence is 12-digit AKID → temporary-session lookup → `FLOCI_DEFAULT_ACCOUNT_ID`.
-See the [Multi-Account Isolation docs](https://floci.io/floci/configuration/multi-account/).
+See upstream Floci's [Multi-Account Isolation docs](https://floci.io/floci/configuration/multi-account/).
 ## SDK Integration
@@ -526,7 +414,7 @@ client = boto3.client(
 client.put_parameter(
    Name="/demo/app/message",
-    Value="hello from floci",
+    Value="hello from TheCloud",
    Type="String",
    Overwrite=True,
 )
@@ -552,7 +440,7 @@ const client = new SQSClient({
 await client.send(
  new SendMessageCommand({
    QueueUrl: "http://localhost:4566/000000000000/demo-queue",
-    MessageBody: "hello from floci",
+    MessageBody: "hello from TheCloud",
  }),
 );
 ```
@@ -613,7 +501,7 @@ use aws_sdk_secretsmanager::Client;
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let config = aws_config::defaults(aws_config::BehaviorVersion::latest())
        .region(Region::new("us-east-1"))
-        .credentials_provider(Credentials::new("test", "test", None, None, "floci"))
+        .credentials_provider(Credentials::new("test", "test", None, None, "thecloud"))
        .endpoint_url("http://localhost:4566")
        .load()
        .await;
@@ -623,7 +511,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
    client
        .create_secret()
        .name("demo/secret")
-        .secret_string("hello from floci")
+        .secret_string("hello from TheCloud")
        .send()
        .await?;
@@ -649,7 +537,7 @@ aws --endpoint-url http://localhost:4566 s3 ls
 ## Testcontainers
-Floci has Testcontainers modules for starting isolated Floci instances directly from tests. This avoids shared state, manual daemon setup, and port conflicts.
+Upstream Floci publishes Testcontainers modules for starting isolated instances directly from tests. This avoids shared state, manual daemon setup, and port conflicts. They start upstream's `floci/floci` image by default, so they test against upstream Floci rather than this fork unless you give them your own image.
 For Testcontainers 1.x, use the versions as indicated in the table below.
@@ -767,7 +655,7 @@ def test_s3_create_bucket():
 ## Compatibility Testing
-The [`compatibility-tests`](./compatibility-tests/) directory validates Floci across SDKs and tooling workflows.
+The [`compatibility-tests`](./compatibility-tests/) directory validates the runtime across SDKs and tooling workflows.
 | Module | Language / Tool | SDK / Client | Tests |
 |---|---|---|---:|
@@ -784,22 +672,19 @@ The [`compatibility-tests`](./compatibility-tests/) directory validates Floci ac
 ## Migrating from LocalStack
-Floci is a drop-in replacement for LocalStack Community. The port, credentials, SDK configuration, and CLI endpoint pattern work the same way. Swap the image and keep going.
+The runtime is a drop-in replacement for LocalStack Community. The port, credentials, SDK configuration, and CLI endpoint pattern work the same way. Swap the image and keep going.
 ```yaml
 # Before
 image: localstack/localstack
-# After, standard image
+# After, your local build of this repository
-image: floci/floci:latest
+image: floci-floci:latest
 # After, if init scripts need AWS CLI or boto3
 image: floci/floci:latest-compat
 ```
 LocalStack environment variables are translated automatically:
-| LocalStack | Floci equivalent |
+| LocalStack | Equivalent |
 |---|---|
 | `LOCALSTACK_HOST` | `FLOCI_HOSTNAME` |
 | `PERSISTENCE=1` | `FLOCI_STORAGE_MODE=persistent` |
@@ -809,43 +694,23 @@ LocalStack environment variables are translated automatically:
 Init scripts mounted under `/etc/localstack/init/` run unchanged. The `/_localstack/init` and `/_localstack/health` endpoints are still served. Once the emulator is up, the log also ends with a LocalStack-style `Ready.` line, so tooling that watches the log for it, such as the default wait strategy of Testcontainers' `LocalStackContainer`, works unchanged. Set `LOCALSTACK_PARITY=false` to opt out of automatic translation.
-See the [full migration guide](https://floci.io/floci/getting-started/migrate-from-localstack/).
+See upstream Floci's [full migration guide](https://floci.io/floci/getting-started/migrate-from-localstack/).
-## Image Tags
+## Building and Updating
-Every tag combines a variant and a channel.
+The image is built from this repository; nothing is published to Docker Hub:
-| Channel | Standard | Baseline (ARM64 only) | Compat with AWS CLI and boto3 |
+```bash
-|---|---|---|---|
+docker build -f docker/Dockerfile -t floci-floci:latest .
 | Release, floating | `latest` | `latest-baseline` | `latest-compat` |
 | Release, pinned | `x.y.z` | `x.y.z-baseline` | `x.y.z-compat` |
 | Nightly, floating | `nightly` | — | `nightly-compat` |
 | Nightly, dated | `nightly-mmddyyyy` | — | `nightly-mmddyyyy-compat` |
 Use `latest` for stable releases, a pinned version for reproducible builds, and `nightly` to track `main`.
 ```yaml
 # Recommended
 image: floci/floci:latest
 # Includes AWS CLI and boto3
 image: floci/floci:latest-compat
 # ARM64 baseline for Raspberry Pi 4 / pre-LSE cores
 image: floci/floci:latest-baseline
 # Pinned release
 image: floci/floci:x.y.z
 # Track main
 image: floci/floci:nightly
 ```
-### Release train
+Tests run with Maven and JDK 25:
-Stable releases ship on the **1st and 3rd Tuesday of each month**. Between trains, `floci/floci:nightly` tracks `main`. Every merged fix is available the next day, and dated `nightly-mmddyyyy` tags let you pin a specific night's build.
+```bash
 ./mvnw test
 ```
-Versions are derived from Conventional Commits by [semantic-release](https://github.com/semantic-release/semantic-release); `CHANGELOG.md` is generated, never hand-edited. Releases are cut from `main` only: there are no maintenance branches.
+Upstream fixes come in by cherry-picking commits from Floci's `main` onto a branch, which then goes through review like any other change.
 ## Configuration
@@ -853,26 +718,26 @@ All settings are overridable through environment variables with the `FLOCI_` pre
 | Variable | Default | Description |
 |---|---|---|
-| `FLOCI_PORT` | `4566` | Port exposed by the Floci API |
+| `FLOCI_PORT` | `4566` | Port the runtime's API listens on |
 | `FLOCI_DEFAULT_REGION` | `us-east-1` | Default AWS region |
 | `FLOCI_DEFAULT_ACCOUNT_ID` | `000000000000` | Default AWS account ID |
-| `FLOCI_BASE_URL` | `http://localhost:4566` | Base URL used when Floci returns service URLs |
+| `FLOCI_BASE_URL` | `http://localhost:4566` | Base URL used in service URLs the runtime returns |
-| `FLOCI_HOSTNAME` | Unset | Hostname used in returned URLs when Floci runs inside Docker Compose |
+| `FLOCI_HOSTNAME` | Unset | Hostname used in returned URLs when the runtime runs inside Docker Compose |
 | `FLOCI_STORAGE_MODE` | `memory` | Storage mode: `memory`, `persistent`, `hybrid`, or `wal` |
 | `FLOCI_STORAGE_PERSISTENT_PATH` | `./data` | Directory used for persisted state |
 | `FLOCI_SERVICES_LAMBDA_ECR_BASE_URI` | `public.ecr.aws` | ECR base URI used when pulling Lambda runtime images (legacy name `FLOCI_ECR_BASE_URI` still works) |
 | `FLOCI_SERVICES_S3_ENFORCE_AUTH` | `false` | Enforce S3 public/private read access and reject unknown signed S3 access keys |
-Full reference: [configuration docs](https://floci.io/floci/configuration/advanced/application-yml)
+Full reference: [`src/main/resources/application.yml`](src/main/resources/application.yml), and upstream Floci's [configuration docs](https://floci.io/floci/configuration/advanced/application-yml).
 ### Multi-container Docker Compose
-When your application runs in a different container, set `FLOCI_HOSTNAME` to the Floci service name so returned URLs, such as SQS `QueueUrl` values, resolve correctly.
+When your application runs in a different container, set `FLOCI_HOSTNAME` to the runtime's service name so returned URLs, such as SQS `QueueUrl` values, resolve correctly.
 ```yaml
 services:
  floci:
-    image: floci/floci:latest
+    image: floci-floci:latest
    ports:
      - "4566:4566"
    environment:
@@ -887,59 +752,6 @@ services:
 Without this, services may return URLs using `localhost`, which points to the wrong container from the application container.
 ## Community
 Join the Floci community on [Slack](https://join.slack.com/t/floci/shared_invite/zt-3tjn02s3q-A00kEjJ1cZxsg_imTfy6Cw) or [GitHub Discussions](https://github.com/orgs/floci-io/discussions). Feature ideas, compatibility questions, design tradeoffs, and rough proposals are welcome.
 ## Sponsors
 Floci is independent open source, funded by the people and companies who use it.
 Sponsorship buys gratitude and nothing else: every emulated service is free for
 everyone, forever, and no sponsor gets features, priority, or roadmap influence
 that the rest of the Flock does not.
 ### 🥇 Gold
 Large logo with top placement in the emulator READMEs and on floci.io, plus a
 mention in release notes.
 [IceGuard](https://github.com/iceguard) · [Softmax](https://softmax.com/)
 ### 🥈 Silver
 Logo in the emulator READMEs and on floci.io, plus a mention in release notes.
 *Your logo here. [Become a sponsor](https://github.com/sponsors/floci-io).*
 ### 🥉 Community
 Name in the emulator READMEs, a sponsor badge on GitHub, and our sincere thanks.
 [AutoScout24](https://www.autoscout24.com) · [Nexxion AI](https://nexxion.ai/)
 Every sponsor, including the Friends of the Flock who support Floci outside these
 tiers, is listed in [THANKS.md](https://github.com/floci-io/.github/blob/main/THANKS.md).
 **[Sponsor Floci](https://github.com/sponsors/floci-io)**
 ## Star History
 <p align="center">
  <a href="https://www.star-history.com/?repos=floci-io%2Ffloci&type=date&legend=top-left">
    <picture>
      <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=floci-io/floci&type=date&theme=dark&legend=top-left" />
      <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=floci-io/floci&type=date&legend=top-left" />
      <img width="600" alt="Star History Chart" src="https://api.star-history.com/chart?repos=floci-io/floci&type=date&legend=top-left" />
    </picture>
  </a>
 </p>
 ## Contributors
 <a href="https://github.com/floci-io/floci/graphs/contributors">
  <img src="https://contrib.rocks/image?repo=floci-io/floci&max=100&columns=20" />
 </a>
 ## License
-MIT. Use it however you want.
+MIT. TheCloud's AWS runtime is a fork of [Floci](https://github.com/floci-io/floci); thanks to the Floci contributors and sponsors whose work it builds on.
@@ -563,8 +563,10 @@ public class AcmJsonHandler {
    private CertificateOptions parseOptions(JsonNode optionsNode) {
        if (optionsNode.isMissingNode()) return null;
-        String ctPref = optionsNode.path("CertificateTransparencyLoggingPreference").asText("ENABLED");
+        String ctPref = parseOptionValue(optionsNode, "CertificateTransparencyLoggingPreference");
-        return new CertificateOptions(ctPref, "DISABLED");
+        String export = parseOptionValue(optionsNode, "Export");
        // An exportable public certificate is requested with Export ENABLED, and keeps it for life.
        return new CertificateOptions(ctPref != null ? ctPref : "ENABLED", export != null ? export : "DISABLED");
    }
    private List<CertificateStatus> parseCertificateStatuses(JsonNode node) {
@@ -29,6 +29,10 @@ public class EfsException extends AwsException {
        return new EfsException(Status.NOT_FOUND, "MountTargetNotFound", "Mount target " + mountTargetId + " does not exist.");
    }
    public static EfsException subnetNotFound(String subnetId) {
        return new EfsException(Status.BAD_REQUEST, "SubnetNotFound", "The subnet ID '" + subnetId + "' does not exist");
    }
    public static EfsException mountTargetConflict(String message) {
        return new EfsException(Status.CONFLICT, "MountTargetConflict", message);
    }
@@ -2,7 +2,10 @@ package io.github.hectorvent.floci.services.efs;
 import io.github.hectorvent.floci.core.storage.StorageBackend;
 import io.github.hectorvent.floci.core.storage.StorageFactory;
 import io.github.hectorvent.floci.core.common.AwsException;
 import io.github.hectorvent.floci.core.common.Resettable;
 import io.github.hectorvent.floci.services.ec2.Ec2Service;
 import io.github.hectorvent.floci.services.ec2.model.Subnet;
 import io.github.hectorvent.floci.services.efs.model.*;
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
@@ -33,13 +36,16 @@ public class EfsService implements Resettable {
    private final ConcurrentHashMap<String, Object> syncLocks = new ConcurrentHashMap<>();
    private final RegionResolver regionResolver;
    private final Ec2Service ec2Service;
    private Object lockFor(String key) {
        return syncLocks.computeIfAbsent(key, k -> new Object());
    }
    @Inject
-    public EfsService(StorageFactory storageFactory, RegionResolver regionResolver) {
+    public EfsService(StorageFactory storageFactory, RegionResolver regionResolver, Ec2Service ec2Service) {
        this.regionResolver = regionResolver;
        this.ec2Service = ec2Service;
        this.fileSystemStore = storageFactory.create("efs", "efs-filesystems.json",
                new com.fasterxml.jackson.core.type.TypeReference<java.util.Map<String, FileSystem>>() {});
        this.mountTargetStore = storageFactory.create("efs", "efs-mounttargets.json",
@@ -361,14 +367,24 @@ public class EfsService implements Resettable {
    public MountTarget createMountTarget(CreateMountTargetRequest request, String region) {
        synchronized (lockFor(regionKey(region, request.getFileSystemId()))) {
            FileSystem fs = getFileSystem(region, request.getFileSystemId());
-            
+            Subnet subnet = requireSubnet(region, request.getSubnetId());
-            for (MountTarget existing : mountTargetStore.scan(k -> k.startsWith(region + "::"))) {
+
            List<MountTarget> regionMountTargets = mountTargetStore.scan(k -> k.startsWith(region + "::"));
            for (MountTarget existing : regionMountTargets) {
                if (existing.getFileSystemId().equals(request.getFileSystemId())) {
                    if (existing.getSubnetId().equals(request.getSubnetId())) {
                        throw EfsException.mountTargetConflict("Mount target already exists in this subnet");
                    }
                    // AWS allows one mount target per Availability Zone, all in one VPC.
                    if (subnet.getAvailabilityZone().equals(existing.getAvailabilityZoneName())) {
                        throw EfsException.mountTargetConflict("Mount target already exists in this AZ");
                    }
                    if (!subnet.getVpcId().equals(existing.getVpcId())) {
                        throw EfsException.mountTargetConflict("Mount targets of a file system must be in the same VPC");
                    }
                }
            }
            long inSubnet = regionMountTargets.stream().filter(existing -> request.getSubnetId().equals(existing.getSubnetId())).count();
            String mtId = "fsmt-" + UUID.randomUUID().toString().replace("-", "").substring(0, 17);
@@ -376,11 +392,11 @@ public class EfsService implements Resettable {
            mt.setMountTargetId(mtId);
            mt.setFileSystemId(request.getFileSystemId());
            mt.setSubnetId(request.getSubnetId());
-            mt.setIpAddress(request.getIpAddress() != null ? request.getIpAddress() : "10.0.0.10");
+            mt.setIpAddress(request.getIpAddress() != null ? request.getIpAddress() : hostAddress(subnet.getCidrBlock(), inSubnet));
            mt.setLifeCycleState(LifeCycleState.available);
-            mt.setVpcId("vpc-12345678");
+            mt.setVpcId(subnet.getVpcId());
-            mt.setAvailabilityZoneName(region + "a");
+            mt.setAvailabilityZoneName(subnet.getAvailabilityZone());
-            mt.setAvailabilityZoneId(generateAzId(region + "a"));
+            mt.setAvailabilityZoneId(generateAzId(subnet.getAvailabilityZone()));
        mt.setNetworkInterfaceId("eni-" + UUID.randomUUID().toString().replace("-", "").substring(0, 17));
        if (request.getSecurityGroups() != null) {
            mt.setSecurityGroups(new ArrayList<>(request.getSecurityGroups()));
@@ -613,6 +629,32 @@ public class EfsService implements Resettable {
        return region + "::" + id;
    }
    private Subnet requireSubnet(String region, String subnetId) {
        if (subnetId == null || subnetId.isBlank()) {
            throw EfsException.badRequest("SubnetId is required.");
        }
        try {
            return ec2Service.requireSubnet(region, subnetId);
        } catch (AwsException e) {
            throw EfsException.subnetNotFound(subnetId);
        }
    }
    /**
     * An address inside the subnet for its n-th mount target, skipping the first four
     * addresses AWS reserves in every subnet.
     */
    static String hostAddress(String cidrBlock, long index) {
        String[] parts = cidrBlock.split("/");
        String[] octets = parts[0].split("\\.");
        long base = 0;
        for (String octet : octets) {
            base = (base << 8) | Long.parseLong(octet);
        }
        long address = base + 4 + index;
        return ((address >> 24) & 0xff) + "." + ((address >> 16) & 0xff) + "." + ((address >> 8) & 0xff) + "." + (address & 0xff);
    }
    private String generateAzId(String azName) {
        if (azName == null || azName.length() < 2) return azName + "-id";
        String region = azName.substring(0, azName.length() - 1);
@@ -0,0 +1,70 @@
 package io.github.hectorvent.floci.services.acm;
 import io.github.hectorvent.floci.testing.RestAssuredJsonUtils;
 import io.quarkus.test.junit.QuarkusTest;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import static io.restassured.RestAssured.given;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.notNullValue;
@QuarkusTest
 class AcmExportableRequestTest {
    private static final String ACM_CONTENT_TYPE = "application/x-amz-json-1.1";
    @BeforeAll
    static void configureRestAssured() {
        RestAssuredJsonUtils.configureAwsContentTypes();
    }
    @Test
    void requestCertificateKeepsTheExportOption() {
        String exportable = request("{\"DomainName\":\"exportable.example.com\",\"Options\":{\"Export\":\"ENABLED\"}}");
        call("DescribeCertificate", "{\"CertificateArn\":\"" + exportable + "\"}")
            .statusCode(200)
            .body("Certificate.Options.Export", equalTo("ENABLED"))
            .body("Certificate.Options.CertificateTransparencyLoggingPreference", equalTo("ENABLED"));
        call("ExportCertificate", "{\"CertificateArn\":\"" + exportable + "\",\"Passphrase\":\"c2VjcmV0\"}")
            .statusCode(200)
            .body("PrivateKey", notNullValue());
    }
    @Test
    void requestCertificateWithoutExportIsNotExportable() {
        String plain = request("{\"DomainName\":\"plain.example.com\",\"Options\":{\"CertificateTransparencyLoggingPreference\":\"DISABLED\"}}");
        call("DescribeCertificate", "{\"CertificateArn\":\"" + plain + "\"}")
            .statusCode(200)
            .body("Certificate.Options.Export", equalTo("DISABLED"))
            .body("Certificate.Options.CertificateTransparencyLoggingPreference", equalTo("DISABLED"));
        call("ExportCertificate", "{\"CertificateArn\":\"" + plain + "\",\"Passphrase\":\"c2VjcmV0\"}")
            .statusCode(400)
            .body("__type", equalTo("ValidationException"));
    }
    @Test
    void requestCertificateRejectsAnUnknownExportValue() {
        call("RequestCertificate", "{\"DomainName\":\"bad.example.com\",\"Options\":{\"Export\":\"MAYBE\"}}")
            .statusCode(400)
            .body("__type", equalTo("ValidationException"));
    }
    private String request(String body) {
        return call("RequestCertificate", body).statusCode(200).extract().jsonPath().getString("CertificateArn");
    }
    private io.restassured.response.ValidatableResponse call(String action, String body) {
        return given()
            .header("X-Amz-Target", "CertificateManager." + action)
            .contentType(ACM_CONTENT_TYPE)
            .body(body)
        .when()
            .post("/")
        .then();
    }
 }
@@ -90,7 +90,7 @@ class EfsIntegrationTest {
            .body("""
                {
                    "FileSystemId": "%s",
-                    "SubnetId": "subnet-12345",
+                    "SubnetId": "subnet-default-us-east-1-a",
                    "SecurityGroups": ["sg-11111"]
                }
                """.formatted(fileSystemId))
@@ -100,7 +100,10 @@ class EfsIntegrationTest {
            .statusCode(200)
            .body("MountTargetId", startsWith("fsmt-"))
            .body("FileSystemId", equalTo(fileSystemId))
-            .body("SubnetId", equalTo("subnet-12345"))
+            .body("SubnetId", equalTo("subnet-default-us-east-1-a"))
            .body("VpcId", equalTo("vpc-default-us-east-1"))
            .body("AvailabilityZoneName", equalTo("us-east-1a"))
            .body("IpAddress", equalTo("172.31.0.4"))
            .extract().jsonPath().getString("MountTargetId");
    }
@@ -0,0 +1,91 @@
 package io.github.hectorvent.floci.services.efs;
 import io.github.hectorvent.floci.testing.RestAssuredJsonUtils;
 import io.quarkus.test.junit.QuarkusTest;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import static io.restassured.RestAssured.given;
 import static org.hamcrest.Matchers.equalTo;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 /** Mount targets take their VPC, zone and address from the EC2 subnet they are created in. */
@QuarkusTest
 class EfsMountTargetSubnetTest {
    @BeforeAll
    static void configureRestAssured() {
        RestAssuredJsonUtils.configureAwsContentTypes();
    }
    private String createFileSystem(String token) {
        return given()
            .contentType("application/json")
            .body("{\"CreationToken\": \"" + token + "\"}")
        .when()
            .post("/2015-02-01/file-systems")
        .then()
            .statusCode(201)
            .extract().jsonPath().getString("FileSystemId");
    }
    private io.restassured.response.ValidatableResponse createMountTarget(String fileSystemId, String subnetId) {
        return given()
            .contentType("application/json")
            .body("{\"FileSystemId\": \"" + fileSystemId + "\", \"SubnetId\": \"" + subnetId + "\"}")
        .when()
            .post("/2015-02-01/mount-targets")
        .then();
    }
    @Test
    void usesTheZoneAndVpcOfEachSubnet() {
        String fileSystemId = createFileSystem("subnet-zones");
        createMountTarget(fileSystemId, "subnet-default-us-east-1-b")
            .statusCode(200)
            .body("VpcId", equalTo("vpc-default-us-east-1"))
            .body("AvailabilityZoneName", equalTo("us-east-1b"))
            .body("IpAddress", equalTo("172.31.16.4"));
        createMountTarget(fileSystemId, "subnet-default-us-east-1-c")
            .statusCode(200)
            .body("AvailabilityZoneName", equalTo("us-east-1c"));
    }
    @Test
    void refusesASubnetThatDoesNotExist() {
        String fileSystemId = createFileSystem("subnet-missing");
        createMountTarget(fileSystemId, "subnet-nope")
            .statusCode(400)
            .body("__type", equalTo("SubnetNotFound"));
    }
    @Test
    void allowsOneMountTargetPerZone() {
        String fileSystemId = createFileSystem("subnet-one-per-zone");
        String vpcId = "vpc-default-us-east-1";
        String secondSubnet = given()
            .formParam("Action", "CreateSubnet")
            .formParam("VpcId", vpcId)
            .formParam("CidrBlock", "172.31.200.0/24")
            .formParam("AvailabilityZone", "us-east-1a")
            .header("Authorization", "AWS4-HMAC-SHA256 Credential=test/20260101/us-east-1/ec2/aws4_request")
        .when()
            .post("/")
        .then()
            .statusCode(200)
            .extract().path("CreateSubnetResponse.subnet.subnetId");
        createMountTarget(fileSystemId, "subnet-default-us-east-1-a").statusCode(200);
        createMountTarget(fileSystemId, secondSubnet)
            .statusCode(409)
            .body("__type", equalTo("MountTargetConflict"));
    }
    @Test
    void picksAddressesAfterTheFourAwsReserves() {
        assertEquals("10.0.1.4", EfsService.hostAddress("10.0.1.0/24", 0));
        assertEquals("10.0.2.1", EfsService.hostAddress("10.0.1.0/24", 253));
    }
 }
Author	SHA1	Message	Date
Zakaria	5dd9a1e346	fix(efs): place mount targets in their real subnet CreateMountTarget now looks the subnet up in EC2 and takes the mount target's VPC, Availability Zone and IP address from it, instead of reporting vpc-12345678 and the region's first zone for every mount target. An unknown subnet is refused with SubnetNotFound, and, as in AWS, a file system gets one mount target per zone, all in one VPC (MountTargetConflict otherwise). Lambda checks a function's VPC against its file system's mount targets, so the made-up VPC kept consoles from finding the security group to use.	2026-10-25 17:25:15 -04:00
Zakaria	00b3af3813	Merge pull request 'fix(acm): keep the Export option on RequestCertificate' (#12 ) from fix/acm-request-export-option into main Reviewed-on: #12	2026-10-25 17:21:08 +00:00
Zakaria	d8d7dd021b	fix(acm): keep the Export option on RequestCertificate RequestCertificate always stored Export as DISABLED, so an exportable public certificate could never be exported. Read Export and the transparency logging preference the way UpdateCertificateOptions does, rejecting values other than ENABLED and DISABLED.	2026-10-25 12:30:11 -04:00
Zakaria	eaf5ca6ade	Merge pull request 'docs: rebrand the README as TheCloud's AWS runtime' (#11 ) from docs/readme-thecloud into main Reviewed-on: #11	2026-10-25 14:29:43 +00:00
Zakaria	cc64729599	docs: rebrand the README as TheCloud's AWS runtime Use TheCloud's logo and name, describe the repository as the fork of Floci behind TheCloud with its own changes, and replace instructions for upstream's published artifacts (Floci CLI, Docker Hub tags and release train) with building and running this repository. Drop the upstream badges, comparison table, community, sponsor, star-history and contributor sections, keep literal identifiers (FLOCI_* settings, upstream package names), and credit Floci under License.	2026-10-25 10:11:34 -04:00
Zakaria	9f17f72cc3	Merge pull request 'fix(apigatewayv2): verify tokens from Floci's own Cognito pools in-process' (#10 ) from fix/apigatewayv2-local-cognito-issuer into main Reviewed-on: #10	2026-10-25 13:49:41 +00:00