nasa · cgokey · Aug 21, 2026 · Aug 13, 2026 · Aug 14, 2026 · Aug 14, 2026
diff --git a/README.md b/README.md
@@ -52,6 +52,19 @@ To run local server with SAM watch mode enabled
 npm run start-local:watch
 ```
 
+#### Unsupported `nodejs24.x` runtime
+
+If local startup reports that `nodejs24.x` is unsupported, upgrade AWS SAM CLI. Local Lambdas are run by SAM, so rebuilding LocalStack will not resolve this error.
+
+```bash
+sam --version
+brew update
+brew upgrade aws-sam-cli
+sam --version
+```
+
+After upgrading, rerun `npm run start-local`. SAM will download the Node.js 24 Lambda runtime image when it is first needed.
+
 ### Why local uses SAM and LocalStack
 
 Local development intentionally splits responsibilities between SAM and LocalStack:
@@ -475,6 +488,7 @@ export bamboo_SUBNET_ID_C={subnet #3}
 export bamboo_VPC_ID={your vpc id}
 export bamboo_RDF4J_USER_NAME=[your rdfdb user name]
 export bamboo_RDF4J_PASSWORD=[your rdfdb password]
+export bamboo_RDF_MIRROR_SOURCE_ENV=[optional sit|uat|prod source for RDF mirroring]
 export bamboo_EDL_HOST=[edl host name]
 export bamboo_EDL_UID=[edl user id]
 export bamboo_EDL_PASSWORD=[edl password]
@@ -501,6 +515,9 @@ Notes:
 - When configured, `bamboo_CMR_SYSTEM_TOKEN_PARAMETER_NAME` is the primary source for the CMR
   authorization value. `bamboo_CMR_WRITER_TOKEN` is used only as a fallback and must include the
   `Bearer` prefix.
+- Set `bamboo_RDF_MIRROR_SOURCE_ENV` to `sit`, `uat`, or `prod` to enable the nightly published
+  and draft RDF mirror from that environment. Leave it empty to disable automatic imports; an
+  authenticated `POST /rdf/mirror` can also run the configured mirror manually.
 - Leave `bamboo_CMR_WRITEBACK_PROVIDERS` empty to disable provider rollout for CMR writeback.
 - Set `bamboo_CMR_WRITEBACK_VALIDATE_KEYWORDS` and `bamboo_CMR_WRITEBACK_VALIDATE_UMM_C`
   to `true` to reject writebacks that still fail CMR keyword or UMM-C validation.

diff --git a/bin/deploy-bamboo.sh b/bin/deploy-bamboo.sh
@@ -61,6 +61,7 @@ dockerRun() {
         --env "VPC_ID=$bamboo_VPC_ID" \
         --env "RDF4J_USER_NAME=$bamboo_RDF4J_USER_NAME" \
         --env "RDF4J_PASSWORD=$bamboo_RDF4J_PASSWORD" \
+        --env "RDF_MIRROR_SOURCE_ENV=${bamboo_RDF_MIRROR_SOURCE_ENV:-}" \
         --env "EDL_PASSWORD=$bamboo_EDL_PASSWORD" \
         --env "EDL_CLIENT_ID=$bamboo_EDL_CLIENT_ID" \
         --env "CMR_BASE_URL=$bamboo_CMR_BASE_URL" \

diff --git a/bin/env/local_env.sh b/bin/env/local_env.sh
@@ -5,6 +5,7 @@ export RDF4J_SERVICE_URL="${RDF4J_SERVICE_URL:-http://rdf4j-server:8080}"
 export RDF4J_HOST_SERVICE_URL="${RDF4J_HOST_SERVICE_URL:-http://localhost:8081}"
 export RDF4J_USER_NAME="${RDF4J_USER_NAME:-rdf4j}"
 export RDF4J_PASSWORD="${RDF4J_PASSWORD:-rdf4j}"
+export RDF_MIRROR_SOURCE_ENV="${RDF_MIRROR_SOURCE_ENV:-local}"
 export CMR_BASE_URL="${CMR_BASE_URL:-}"
 export RDF4J_CONTAINER_MEMORY_LIMIT="${RDF4J_CONTAINER_MEMORY_LIMIT:-2048}"
 export REDIS_ENABLED="${REDIS_ENABLED:-true}"

diff --git a/bin/start-local.sh b/bin/start-local.sh
@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -e
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
 # shellcheck source=bin/env/local_env.sh
@@ -37,14 +39,14 @@ fi
 
 clearStaleSAMContainers
 
-"${PROJECT_ROOT}/scripts/localstack/run_bridge.sh" &
-LOCAL_BRIDGE_PID=$!
-
 rm -rf "${PROJECT_ROOT}/cdk/cdk.out"
 
 # Synthesize the CDK stack
-cd cdk
-cdk synth --context useLocalstack="true" --output ./cdk.out > /dev/null 2>&1
+cd "${PROJECT_ROOT}/cdk"
+npx cdk synth --context useLocalstack="true" --output ./cdk.out > /dev/null
+
+"${PROJECT_ROOT}/scripts/localstack/run_bridge.sh" &
+LOCAL_BRIDGE_PID=$!
 
 # Start SAM local
 sam local start-api \

diff --git a/cdk/app/lib/CmrEventProcessingStack.ts b/cdk/app/lib/CmrEventProcessingStack.ts
@@ -88,6 +88,7 @@ export class CmrEventProcessingStack extends cdk.Stack {
 
     const listenerSetup = new CmrKeywordEventsListenerSetup(this, 'CmrKeywordEventsListener', {
       cmrBaseUrl: props.cmrBaseUrl,
+      cmrSystemTokenParameterName: props.cmrSystemTokenParameterName,
       prefix: props.prefix,
       stage: props.stage,
       keywordEventsTopic: topic,

diff --git a/cdk/app/lib/KmsStack.ts b/cdk/app/lib/KmsStack.ts
@@ -42,6 +42,7 @@ export interface KmsStackProps extends cdk.StackProps {
     AWS_ENDPOINT_URL?: string
     RDF_BUCKET_NAME: string
     RDF4J_PASSWORD: string
+    RDF_MIRROR_SOURCE_ENV?: string
     RDF4J_SERVICE_URL: string
     RDF4J_USER_NAME: string
   }

diff --git a/cdk/app/lib/helper/CmrKeywordEventsListenerSetup.ts b/cdk/app/lib/helper/CmrKeywordEventsListenerSetup.ts
@@ -2,6 +2,7 @@ import * as path from 'path'
 
 import * as cdk from 'aws-cdk-lib'
 import * as ec2 from 'aws-cdk-lib/aws-ec2'
+import * as iam from 'aws-cdk-lib/aws-iam'
 import * as eventsources from 'aws-cdk-lib/aws-lambda-event-sources'
 import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs'
 import * as sns from 'aws-cdk-lib/aws-sns'
@@ -16,6 +17,7 @@ import { NODE_LAMBDA_RUNTIME } from './NodeLambdaRuntime'
  */
 interface CmrKeywordEventsListenerSetupProps {
   cmrBaseUrl: string
+  cmrSystemTokenParameterName?: string
   prefix: string
   securityGroup: ec2.SecurityGroup
   stage: string
@@ -45,6 +47,7 @@ export class CmrKeywordEventsListenerSetup extends Construct {
 
     const {
       cmrBaseUrl,
+      cmrSystemTokenParameterName,
       keywordEventsTopic,
       metadataCorrectionRequestsTopic,
       prefix,
@@ -72,6 +75,9 @@ export class CmrKeywordEventsListenerSetup extends Construct {
       memorySize: 1024,
       environment: {
         CMR_BASE_URL: cmrBaseUrl,
+        ...(cmrSystemTokenParameterName
+          ? { CMR_SYSTEM_TOKEN_PARAMETER_NAME: cmrSystemTokenParameterName }
+          : {}),
         METADATA_CORRECTION_REQUESTS_TOPIC_ARN: metadataCorrectionRequestsTopic.topicArn
       },
       depsLockFilePath: path.join(projectRoot, 'package-lock.json'),
@@ -92,6 +98,19 @@ export class CmrKeywordEventsListenerSetup extends Construct {
     this.queue.grantConsumeMessages(this.listenerLambda)
     metadataCorrectionRequestsTopic.grantPublish(this.listenerLambda)
 
+    if (cmrSystemTokenParameterName) {
+      const systemTokenParameterArn = cdk.Stack.of(this).formatArn({
+        service: 'ssm',
+        resource: 'parameter',
+        resourceName: cmrSystemTokenParameterName.replace(/^\//, '')
+      })
+
+      this.listenerLambda.addToRolePolicy(new iam.PolicyStatement({
+        actions: ['ssm:GetParameter'],
+        resources: [systemTokenParameterArn]
+      }))
+    }
+
     this.queueUrlOutput = new cdk.CfnOutput(this, 'CmrKeywordEventsQueueUrl', {
       description: 'Queue URL for CMR keyword event processing',
       exportName: `${prefix}-CmrKeywordEventsQueueUrl`,

diff --git a/cdk/app/lib/helper/IamSetup.ts b/cdk/app/lib/helper/IamSetup.ts
@@ -103,8 +103,7 @@ export class IamSetup {
         's3:ListBucket',
         's3:PutLifecycleConfiguration',
         's3:GetBucketLocation',
-        's3:ListAllMyBuckets',
-        's3:HeadBucket'
+        's3:ListAllMyBuckets'
       ],
       resources: [
         `arn:aws:s3:::kms-rdf-backup-${stage}`,

diff --git a/cdk/app/lib/helper/KmsLambdaFunctions.ts b/cdk/app/lib/helper/KmsLambdaFunctions.ts
@@ -45,6 +45,7 @@ interface LambdaFunctionsProps {
     LOG_LEVEL?: string;
     RDF_BUCKET_NAME: string,
     RDF4J_PASSWORD: string;
+    RDF_MIRROR_SOURCE_ENV?: string;
     RDF4J_SERVICE_URL: string;
     RDF4J_USER_NAME: string;
     KEYWORD_EVENTS_TOPIC_ARN?: string;
@@ -144,6 +145,7 @@ export class LambdaFunctions {
     this.createTreeOperationApiLambdas(scope)
     this.createNightlyCachePrimeCron(scope)
     this.createCrudOperationApiLambdas(scope)
+    this.createRdfMirrorApiAndCron(scope)
     this.createPublishEventBridgeWiring(scope)
   }
 
@@ -405,6 +407,16 @@ export class LambdaFunctions {
       true
     )
 
+    this.createApiLambda(
+      scope,
+      'exportRdf/handler.js',
+      'export-rdf',
+      'exportRdf',
+      '/rdf/export',
+      'POST',
+      false
+    )
+
     this.createApiLambda(
       scope,
       'rebuildRedisCache/handler.js',
@@ -661,6 +673,37 @@ export class LambdaFunctions {
     )
   }
 
+  /**
+   * Creates the manually invokable RDF mirror endpoint and its optional nightly schedule.
+   * The schedule is omitted when no source environment is configured.
+   * @param {Construct} scope Construct scope.
+   * @private
+   */
+  private createRdfMirrorApiAndCron(scope: Construct) {
+    const mirrorLambda = this.createApiLambda(
+      scope,
+      'mirrorRdf/handler.js',
+      'mirror-rdf',
+      'mirrorRdf',
+      '/rdf/mirror',
+      'POST',
+      true,
+      Duration.minutes(15),
+      2048
+    )
+
+    if (!this.props.environment.RDF_MIRROR_SOURCE_ENV) return
+
+    this.setupCronJob(
+      scope,
+      mirrorLambda,
+      // EventBridge cron is UTC; 05:00 UTC is midnight EST (01:00 EDT).
+      'cron(0 5 * * ? *)',
+      {},
+      'NightlyRdfMirror'
+    )
+  }
+
   /**
    * Sets up a CloudWatch Events Rule to trigger a Lambda function on a schedule.
    *

diff --git a/cdk/bin/main.ts b/cdk/bin/main.ts
@@ -85,7 +85,9 @@ async function main() {
     }
 
   const vpcId = useLocalstack ? 'dummy-vpc-id' : process.env.VPC_ID
-  const cmrBaseUrl = requireEnv('CMR_BASE_URL')
+  const cmrBaseUrl = useLocalstack
+    ? process.env.CMR_BASE_URL || ''
+    : requireEnv('CMR_BASE_URL')
 
   if (!vpcId) {
     throw new Error('VPC_ID environment variable is not set')
@@ -200,6 +202,7 @@ async function main() {
         : (lbStack?.rdf4jServiceUrl || process.env.RDF4J_SERVICE_URL || 'http://localhost:8081'),
       RDF4J_USER_NAME: process.env.RDF4J_USER_NAME || 'rdf4j',
       RDF4J_PASSWORD: process.env.RDF4J_PASSWORD || 'rdf4j',
+      RDF_MIRROR_SOURCE_ENV: process.env.RDF_MIRROR_SOURCE_ENV || '',
       RDF_BUCKET_NAME: process.env.RDF_BUCKET_NAME || 'kms-rdf-backup',
       CMR_BASE_URL: cmrBaseUrl,
       EDL_PASSWORD: process.env.EDL_PASSWORD || '',