@aws/agentcore 1.0.0-preview.3 → 1.0.0-preview.30

package/dist/lib/packaging/build-context-dockerignore.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Default `.dockerignore` written at a Container agent's build-context root when `buildContextPath`
+ * is set and none exists. Keeps secrets and build junk out of the image and out of the CodeBuild
+ * upload. Both local `agentcore dev`/`package` and `agentcore deploy` honor this same file, so what
+ * is excluded locally is exactly what is excluded on deploy.
+ */
+export declare const BUILD_CONTEXT_DOCKERIGNORE_TEMPLATE = "# Generated by agentcore because this agent sets buildContextPath \u2014 the whole of this directory is the\n# Docker build context, so secrets/junk here would otherwise be baked into the image and uploaded to\n# CodeBuild. Patterns are listed both bare and '**/'-prefixed so nested copies (e.g.\n# app/agent-one/node_modules, app/agent-one/.env) are excluded too, not just the top level \u2014 Docker\n# matches .dockerignore patterns root-relative. Both 'agentcore dev'/'package' and 'agentcore deploy'\n# honor this file. Edit freely; to intentionally include a file listed here (e.g. a non-secret\n# .env.production), add a '!'-prefixed line for it below.\n.env\n.env.*\n**/.env\n**/.env.*\n.git\n**/.git\n.venv\n**/.venv\nnode_modules\n**/node_modules\n__pycache__\n**/__pycache__\n.pytest_cache\n**/.pytest_cache\n.DS_Store\n**/.DS_Store\nagentcore/\n";
+/**
+ * Ensure a `.dockerignore` exists at the resolved build-context root. No-op when the directory does
+ * not exist or a `.dockerignore` is already present (the user's file is never overwritten). Returns
+ * the path when it creates one, otherwise null.
+ *
+ * Guards the DIRECTORY, not just the file: a missing/typo'd `buildContextPath` would otherwise make
+ * `writeFileSync` throw a raw ENOENT — crashing `agentcore dev`, bypassing `PackagingError` in
+ * `package`, and masking preflight's friendly "Dockerfile not found". Callers invoke this only AFTER
+ * validating that the Dockerfile exists, so on a failing build/deploy no stray `.dockerignore` is
+ * left behind.
+ *
+ * Called only when `buildContextPath` is set — that is when the context is widened beyond the agent's
+ * own `codeLocation` (e.g. to a monorepo root) and a stray root-level `.env`/`.git` would be swept in.
+ */
+export declare function ensureBuildContextDockerignore(resolvedBuildContext: string): string | null;
+//# sourceMappingURL=build-context-dockerignore.d.ts.map

package/dist/lib/packaging/build-context-dockerignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-context-dockerignore.d.ts","sourceRoot":"","sources":["../../../src/lib/packaging/build-context-dockerignore.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,81BAwB/C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,oBAAoB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU1F"}

package/dist/lib/packaging/build-context-dockerignore.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUILD_CONTEXT_DOCKERIGNORE_TEMPLATE = void 0;
+exports.ensureBuildContextDockerignore = ensureBuildContextDockerignore;
+const fs_1 = require("fs");
+const path_1 = require("path");
+/**
+ * Default `.dockerignore` written at a Container agent's build-context root when `buildContextPath`
+ * is set and none exists. Keeps secrets and build junk out of the image and out of the CodeBuild
+ * upload. Both local `agentcore dev`/`package` and `agentcore deploy` honor this same file, so what
+ * is excluded locally is exactly what is excluded on deploy.
+ */
+exports.BUILD_CONTEXT_DOCKERIGNORE_TEMPLATE = `# Generated by agentcore because this agent sets buildContextPath — the whole of this directory is the
+# Docker build context, so secrets/junk here would otherwise be baked into the image and uploaded to
+# CodeBuild. Patterns are listed both bare and '**/'-prefixed so nested copies (e.g.
+# app/agent-one/node_modules, app/agent-one/.env) are excluded too, not just the top level — Docker
+# matches .dockerignore patterns root-relative. Both 'agentcore dev'/'package' and 'agentcore deploy'
+# honor this file. Edit freely; to intentionally include a file listed here (e.g. a non-secret
+# .env.production), add a '!'-prefixed line for it below.
+.env
+.env.*
+**/.env
+**/.env.*
+.git
+**/.git
+.venv
+**/.venv
+node_modules
+**/node_modules
+__pycache__
+**/__pycache__
+.pytest_cache
+**/.pytest_cache
+.DS_Store
+**/.DS_Store
+agentcore/
+`;
+/**
+ * Ensure a `.dockerignore` exists at the resolved build-context root. No-op when the directory does
+ * not exist or a `.dockerignore` is already present (the user's file is never overwritten). Returns
+ * the path when it creates one, otherwise null.
+ *
+ * Guards the DIRECTORY, not just the file: a missing/typo'd `buildContextPath` would otherwise make
+ * `writeFileSync` throw a raw ENOENT — crashing `agentcore dev`, bypassing `PackagingError` in
+ * `package`, and masking preflight's friendly "Dockerfile not found". Callers invoke this only AFTER
+ * validating that the Dockerfile exists, so on a failing build/deploy no stray `.dockerignore` is
+ * left behind.
+ *
+ * Called only when `buildContextPath` is set — that is when the context is widened beyond the agent's
+ * own `codeLocation` (e.g. to a monorepo root) and a stray root-level `.env`/`.git` would be swept in.
+ */
+function ensureBuildContextDockerignore(resolvedBuildContext) {
+    if (!(0, fs_1.existsSync)(resolvedBuildContext)) {
+        return null;
+    }
+    const dockerignorePath = (0, path_1.join)(resolvedBuildContext, '.dockerignore');
+    if ((0, fs_1.existsSync)(dockerignorePath)) {
+        return null;
+    }
+    (0, fs_1.writeFileSync)(dockerignorePath, exports.BUILD_CONTEXT_DOCKERIGNORE_TEMPLATE);
+    return dockerignorePath;
+}
+//# sourceMappingURL=build-context-dockerignore.js.map

package/dist/lib/packaging/build-context-dockerignore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-context-dockerignore.js","sourceRoot":"","sources":["../../../src/lib/packaging/build-context-dockerignore.ts"],"names":[],"mappings":";;;AAiDA,wEAUC;AA3DD,2BAA+C;AAC/C,+BAA4B;AAE5B;;;;;GAKG;AACU,QAAA,mCAAmC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBlD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,SAAgB,8BAA8B,CAAC,oBAA4B;IACzE,IAAI,CAAC,IAAA,eAAU,EAAC,oBAAoB,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAA,WAAI,EAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;IACrE,IAAI,IAAA,eAAU,EAAC,gBAAgB,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAA,kBAAa,EAAC,gBAAgB,EAAE,2CAAmC,CAAC,CAAC;IACrE,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}

package/dist/lib/packaging/build-context.d.ts

@@ -0,0 +1,21 @@
+import type { AgentEnvSpec } from '../../schema';
+/** Resolved Docker build context and Dockerfile path for a Container agent. */
+export interface ResolvedBuildContext {
+    /** Absolute path to the Docker build context (`buildContextPath` when set, else `codeLocation`). */
+    buildContext: string;
+    /** Absolute path to the Dockerfile, resolved against the build context. */
+    dockerfilePath: string;
+}
+/**
+ * Resolve the Docker build context + Dockerfile path for a Container agent — the single source of
+ * truth shared by `package` (ContainerPackager), `deploy` preflight, and `dev`.
+ *
+ * The context is `buildContextPath` when set, otherwise `codeLocation`, resolved via
+ * `resolveCodeLocation` (the same resolver the deploy-side `ContainerSourceAsset` uses to upload it),
+ * and the Dockerfile is resolved against that context (matching the CodeBuild buildspec's `-f`).
+ * Collapsing this into one function keeps local `dev`/`package` and `deploy` from ever resolving the
+ * context differently — a divergence would otherwise let a config build from one directory locally and
+ * a different one on deploy.
+ */
+export declare function resolveBuildContext(spec: Pick<AgentEnvSpec, 'codeLocation' | 'buildContextPath' | 'dockerfile'>, baseDir: string): ResolvedBuildContext;
+//# sourceMappingURL=build-context.d.ts.map

package/dist/lib/packaging/build-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-context.d.ts","sourceRoot":"","sources":["../../../src/lib/packaging/build-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAIjD,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,oGAAoG;IACpG,YAAY,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,GAAG,kBAAkB,GAAG,YAAY,CAAC,EAC5E,OAAO,EAAE,MAAM,GACd,oBAAoB,CAGtB"}

package/dist/lib/packaging/build-context.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveBuildContext = resolveBuildContext;
+const constants_1 = require("../constants");
+const helpers_1 = require("./helpers");
+/**
+ * Resolve the Docker build context + Dockerfile path for a Container agent — the single source of
+ * truth shared by `package` (ContainerPackager), `deploy` preflight, and `dev`.
+ *
+ * The context is `buildContextPath` when set, otherwise `codeLocation`, resolved via
+ * `resolveCodeLocation` (the same resolver the deploy-side `ContainerSourceAsset` uses to upload it),
+ * and the Dockerfile is resolved against that context (matching the CodeBuild buildspec's `-f`).
+ * Collapsing this into one function keeps local `dev`/`package` and `deploy` from ever resolving the
+ * context differently — a divergence would otherwise let a config build from one directory locally and
+ * a different one on deploy.
+ */
+function resolveBuildContext(spec, baseDir) {
+    const buildContext = (0, helpers_1.resolveCodeLocation)(spec.buildContextPath ?? spec.codeLocation, baseDir);
+    return { buildContext, dockerfilePath: (0, constants_1.getDockerfilePath)(buildContext, spec.dockerfile) };
+}
+//# sourceMappingURL=build-context.js.map

package/dist/lib/packaging/build-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-context.js","sourceRoot":"","sources":["../../../src/lib/packaging/build-context.ts"],"names":[],"mappings":";;AAuBA,kDAMC;AA5BD,4CAAiD;AACjD,uCAAgD;AAUhD;;;;;;;;;;GAUG;AACH,SAAgB,mBAAmB,CACjC,IAA4E,EAC5E,OAAe;IAEf,MAAM,YAAY,GAAG,IAAA,6BAAmB,EAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9F,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,IAAA,6BAAiB,EAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;AAC5F,CAAC"}

package/dist/lib/packaging/container.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../../src/lib/packaging/container.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAKjD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAmBzF;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,eAAe;IACvD,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;CAkEhF"}
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../../src/lib/packaging/container.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAOjD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAmBzF;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,eAAe;IACvD,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;CA4EhF"}

package/dist/lib/packaging/container.js

@@ -2,8 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ContainerPackager = void 0;
 const constants_1 = require("../constants");
+const types_1 = require("../errors/types");
 const build_args_1 = require("./build-args");
-const errors_1 = require("./errors");
+const build_context_1 = require("./build-context");
+const build_context_dockerignore_1 = require("./build-context-dockerignore");
 const helpers_1 = require("./helpers");
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
@@ -29,15 +31,22 @@ function detectContainerRuntimeSync() {
 class ContainerPackager {
     pack(spec, options = {}) {
         if (spec.build !== 'Container') {
-            return Promise.reject(new errors_1.PackagingError('ContainerPackager only supports Container build type.'));
+            return Promise.reject(new types_1.PackagingError('ContainerPackager only supports Container build type.'));
         }
         const agentName = options.agentName ?? spec.name;
         const configBaseDir = options.artifactDir ?? options.projectRoot ?? process.cwd();
         const codeLocation = (0, helpers_1.resolveCodeLocation)(spec.codeLocation, configBaseDir);
-        const dockerfilePath = (0, constants_1.getDockerfilePath)(codeLocation, spec.dockerfile);
+        // Build context + Dockerfile via the shared resolver (identical to the deploy/CodeBuild path).
+        const { buildContext, dockerfilePath } = (0, build_context_1.resolveBuildContext)(spec, configBaseDir);
         // Preflight: Dockerfile must exist
         if (!(0, fs_1.existsSync)(dockerfilePath)) {
-            return Promise.reject(new errors_1.PackagingError(`${spec.dockerfile ?? constants_1.DOCKERFILE_NAME} not found at ${dockerfilePath}. Container agents require a Dockerfile.`));
+            return Promise.reject(new types_1.PackagingError(`${spec.dockerfile ?? constants_1.DOCKERFILE_NAME} not found at ${dockerfilePath}. Container agents require a Dockerfile.`));
+        }
+        // Dockerfile validated — when buildContextPath widens the context, ensure a .dockerignore keeps
+        // secrets/junk out of the local image (the same file the deploy path honors). No-op if the dir is
+        // missing or a .dockerignore already exists, so a failing build never leaves a stray file.
+        if (spec.buildContextPath) {
+            (0, build_context_dockerignore_1.ensureBuildContextDockerignore)(buildContext);
         }
         // Detect container runtime
         const runtime = detectContainerRuntimeSync();
@@ -49,13 +58,15 @@ class ContainerPackager {
                 stagingPath: codeLocation,
             });
         }
-        // Build locally
-        const imageName = `agentcore-package-${agentName}`;
-        const buildResult = (0, child_process_1.spawnSync)(runtime, ['build', '-t', imageName, '-f', dockerfilePath, ...(0, build_args_1.getUvBuildArgs)(), codeLocation], {
+        // Build locally. Docker image tags must be lowercase, but agent names allow uppercase
+        // (e.g. the default "AgentOne"), so lower-case the tag — matching the dev server.
+        const imageName = `agentcore-package-${agentName}`.toLowerCase();
+        const buildArgFlags = (0, build_args_1.getCustomBuildArgs)(spec.customDockerBuildArgs);
+        const buildResult = (0, child_process_1.spawnSync)(runtime, ['build', '-t', imageName, '-f', dockerfilePath, ...(0, build_args_1.getUvBuildArgs)(), ...buildArgFlags, buildContext], {
             stdio: 'pipe',
         });
         if (buildResult.status !== 0) {
-            return Promise.reject(new errors_1.PackagingError(`Container build failed:\n${buildResult.stderr?.toString()}`));
+            return Promise.reject(new types_1.PackagingError(`Container build failed:\n${buildResult.stderr?.toString()}`));
         }
         // Validate size (1GB limit)
         const inspectResult = (0, child_process_1.spawnSync)(runtime, ['image', 'inspect', imageName, '--format', '{{.Size}}'], {
@@ -64,7 +75,7 @@ class ContainerPackager {
         const sizeBytes = parseInt(inspectResult.stdout?.toString().trim() ?? '0', 10);
         if (sizeBytes > constants_1.ONE_GB) {
             const sizeMb = (sizeBytes / (1024 * 1024)).toFixed(2);
-            return Promise.reject(new errors_1.PackagingError(`Container image exceeds 1GB limit (${sizeMb}MB). ` +
+            return Promise.reject(new types_1.PackagingError(`Container image exceeds 1GB limit (${sizeMb}MB). ` +
                 'Optimize your Dockerfile: use multi-stage builds, minimize dependencies, add .dockerignore.'));
         }
         return Promise.resolve({

package/dist/lib/packaging/container.js.map

@@ -1 +1 @@
-{"version":3,"file":"container.js","sourceRoot":"","sources":["../../../src/lib/packaging/container.ts"],"names":[],"mappings":";;;AACA,4CAA8F;AAC9F,6CAA8C;AAC9C,qCAA0C;AAC1C,uCAAgD;AAEhD,iDAA0C;AAC1C,2BAAgC;AAEhC;;;GAGG;AACH,SAAS,0BAA0B;IACjC,KAAK,MAAM,OAAO,IAAI,8BAAkB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,aAAa,GAAG,IAAA,yBAAS,EAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAa,iBAAiB;IAC5B,IAAI,CAAC,IAAkB,EAAE,UAA0B,EAAE;QACnD,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,uBAAc,CAAC,uDAAuD,CAAC,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC;QACjD,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClF,MAAM,YAAY,GAAG,IAAA,6BAAmB,EAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC3E,MAAM,cAAc,GAAG,IAAA,6BAAiB,EAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAExE,mCAAmC;QACnC,IAAI,CAAC,IAAA,eAAU,EAAC,cAAc,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,uBAAc,CAChB,GAAG,IAAI,CAAC,UAAU,IAAI,2BAAe,iBAAiB,cAAc,0CAA0C,CAC/G,CACF,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,iFAAiF;YACjF,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,YAAY,EAAE,EAAE;gBAChB,SAAS,EAAE,CAAC;gBACZ,WAAW,EAAE,YAAY;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,gBAAgB;QAChB,MAAM,SAAS,GAAG,qBAAqB,SAAS,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,IAAA,yBAAS,EAC3B,OAAO,EACP,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,IAAA,2BAAc,GAAE,EAAE,YAAY,CAAC,EACnF;YACE,KAAK,EAAE,MAAM;SACd,CACF,CAAC;QAEF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,uBAAc,CAAC,4BAA4B,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1G,CAAC;QAED,4BAA4B;QAC5B,MAAM,aAAa,GAAG,IAAA,yBAAS,EAAC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE;YACjG,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,SAAS,GAAG,kBAAM,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,CAAC,SAAS,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,uBAAc,CAChB,sCAAsC,MAAM,OAAO;gBACjD,6FAA6F,CAChG,CACF,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,YAAY,EAAE,GAAG,OAAO,MAAM,SAAS,EAAE;YACzC,SAAS;YACT,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;IACL,CAAC;CACF;AAnED,8CAmEC"}
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../../src/lib/packaging/container.ts"],"names":[],"mappings":";;;AACA,4CAA2E;AAC3E,2CAAiD;AACjD,6CAAkE;AAClE,mDAAsD;AACtD,6EAA8E;AAC9E,uCAAgD;AAEhD,iDAA0C;AAC1C,2BAAgC;AAEhC;;;GAGG;AACH,SAAS,0BAA0B;IACjC,KAAK,MAAM,OAAO,IAAI,8BAAkB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,aAAa,GAAG,IAAA,yBAAS,EAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAa,iBAAiB;IAC5B,IAAI,CAAC,IAAkB,EAAE,UAA0B,EAAE;QACnD,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,sBAAc,CAAC,uDAAuD,CAAC,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC;QACjD,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClF,MAAM,YAAY,GAAG,IAAA,6BAAmB,EAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC3E,+FAA+F;QAC/F,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,IAAA,mCAAmB,EAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAElF,mCAAmC;QACnC,IAAI,CAAC,IAAA,eAAU,EAAC,cAAc,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,sBAAc,CAChB,GAAG,IAAI,CAAC,UAAU,IAAI,2BAAe,iBAAiB,cAAc,0CAA0C,CAC/G,CACF,CAAC;QACJ,CAAC;QAED,gGAAgG;QAChG,kGAAkG;QAClG,2FAA2F;QAC3F,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,IAAA,2DAA8B,EAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;QAED,2BAA2B;QAC3B,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,iFAAiF;YACjF,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,YAAY,EAAE,EAAE;gBAChB,SAAS,EAAE,CAAC;gBACZ,WAAW,EAAE,YAAY;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,sFAAsF;QACtF,kFAAkF;QAClF,MAAM,SAAS,GAAG,qBAAqB,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;QACjE,MAAM,aAAa,GAAG,IAAA,+BAAkB,EAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAA,yBAAS,EAC3B,OAAO,EACP,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,IAAA,2BAAc,GAAE,EAAE,GAAG,aAAa,EAAE,YAAY,CAAC,EACrG;YACE,KAAK,EAAE,MAAM;SACd,CACF,CAAC;QAEF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,sBAAc,CAAC,4BAA4B,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1G,CAAC;QAED,4BAA4B;QAC5B,MAAM,aAAa,GAAG,IAAA,yBAAS,EAAC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE;YACjG,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,SAAS,GAAG,kBAAM,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,CAAC,SAAS,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,sBAAc,CAChB,sCAAsC,MAAM,OAAO;gBACjD,6FAA6F,CAChG,CACF,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,YAAY,EAAE,GAAG,OAAO,MAAM,SAAS,EAAE;YACzC,SAAS;YACT,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;IACL,CAAC;CACF;AA7ED,8CA6EC"}

package/dist/lib/packaging/helpers.d.ts

@@ -33,6 +33,22 @@ export declare function runCommand(command: string, args: string[], cwd?: string
 export declare function createZipFromDir(sourceDir: string, outputZip: string): Promise<void>;
 export declare function enforceZipSizeLimit(zipPath: string): Promise<number>;
 export declare function resolveProjectPathsSync(options?: PackageOptions, agentName?: string): ResolvedPaths;
+/**
+ * Resolve filesystem paths for a Node.js/TypeScript agent project during packaging.
+ *
+ * Locates the nearest package.json (equivalent of pyproject.toml for Python agents),
+ * then derives:
+ * - projectRoot: directory containing package.json
+ * - srcDir: source directory (defaults to projectRoot)
+ * - artifactDir: where CDK config and build outputs live (agentcore/ directory)
+ * - buildDir/stagingDir: per-agent temp directories used during CodeZip packaging
+ *
+ * Note: `pyprojectPath` in the return type is reused from the Python ResolvedPaths
+ * interface — for Node projects it points to package.json.
+ */
+export declare function resolveNodeProjectPaths(options?: PackageOptions, agentName?: string): Promise<ResolvedPaths>;
+/** Synchronous version of resolveNodeProjectPaths — used in contexts where async is not available. */
+export declare function resolveNodeProjectPathsSync(options?: PackageOptions, agentName?: string): ResolvedPaths;
 export declare function ensureDirCleanSync(dir: string): void;
 export declare function copySourceTreeSync(srcDir: string, destination: string): void;
 export declare function ensureBinaryAvailableSync(binary: string, installHint?: string): void;

package/dist/lib/packaging/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/packaging/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAwBxD;;GAEG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAEvE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAErE;AAED,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAID,eAAO,MAAM,kBAAkB,QAAoB,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAUvF;AA8BD,wBAAsB,mBAAmB,CAAC,OAAO,GAAE,cAAmB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA+BlH;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG/D;AAwBD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKvF;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/F;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1F;AAsBD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1E;AAsBD,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,cAAmB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,aAAa,CA8BvG;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAGpD;AAsBD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAK5E;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAcpF;AAsBD,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAO/E;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAM/D;AAmED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCpF;AAgCD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAiCzE"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/packaging/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAwBxD;;GAEG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAEvE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAErE;AAED,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAgDD,eAAO,MAAM,kBAAkB,QAAoB,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAUvF;AA8BD,wBAAsB,mBAAmB,CAAC,OAAO,GAAE,cAAmB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA+BlH;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG/D;AAqBD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKvF;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/F;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1F;AAqBD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1E;AAsBD,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,cAAmB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,aAAa,CA8BvG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE,cAAmB,EAC5B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CA0BxB;AAED,sGAAsG;AACtG,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,cAAmB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,aAAa,CA0B3G;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAGpD;AAmBD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAK5E;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAcpF;AAqBD,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAO/E;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAM/D;AAmED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCpF;AAgCD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAiCzE"}

package/dist/lib/packaging/helpers.js

@@ -12,6 +12,8 @@ exports.runCommand = runCommand;
 exports.createZipFromDir = createZipFromDir;
 exports.enforceZipSizeLimit = enforceZipSizeLimit;
 exports.resolveProjectPathsSync = resolveProjectPathsSync;
+exports.resolveNodeProjectPaths = resolveNodeProjectPaths;
+exports.resolveNodeProjectPathsSync = resolveNodeProjectPathsSync;
 exports.ensureDirCleanSync = ensureDirCleanSync;
 exports.copySourceTreeSync = copySourceTreeSync;
 exports.ensureBinaryAvailableSync = ensureBinaryAvailableSync;
@@ -20,9 +22,9 @@ exports.enforceZipSizeLimitSync = enforceZipSizeLimitSync;
 exports.convertWindowsScriptsToLinux = convertWindowsScriptsToLinux;
 exports.convertWindowsScriptsToLinuxSync = convertWindowsScriptsToLinuxSync;
 const constants_1 = require("../constants");
+const types_1 = require("../errors/types");
 const platform_1 = require("../utils/platform");
 const subprocess_1 = require("../utils/subprocess");
-const errors_1 = require("./errors");
 const fflate_1 = require("fflate");
 const fs_1 = require("fs");
 const promises_1 = require("fs/promises");
@@ -44,6 +46,52 @@ function isNodeRuntime(runtimeVersion) {
     return runtimeVersion.startsWith('NODE_');
 }
 const EXCLUDED_ENTRIES = new Set(['.git', '.venv', '__pycache__', '.pytest_cache', '.DS_Store', 'node_modules']);
+/**
+ * True for any .env / .env.local / .env.* file — per-environment secret files
+ * customers expect to stay local. Excluded at every packaging stage and depth.
+ */
+function isEnvSecretEntry(entryName) {
+    // .env.* (e.g. .env.production, .env.development) is the same family.
+    return entryName === '.env' || entryName === '.env.local' || entryName.startsWith('.env.');
+}
+/**
+ * Decide whether a directory entry should be skipped at the COPY stage (when
+ * staging the source tree into the artifact dir). Excludes:
+ *   - the build-tooling artefacts in EXCLUDED_ENTRIES (.git / .venv / etc.)
+ *   - the project agentcore/ config directory ONLY when it sits at the
+ *     root of the package source (an in-tree dependency that ships its own
+ *     agentcore/ sub-module — see issue #843 — must still be packaged).
+ *   - any .env / .env.local / .env.* file at any depth.
+ *
+ * The .env bucket closes a footgun where a project with `--code-location .`
+ * (BYO at project root) would otherwise have `agentcore/.env.local` staged
+ * — but is depth-aware to avoid breaking legitimate dependency code.
+ */
+function shouldExcludeEntry(entryName, source, rootDir) {
+    if (EXCLUDED_ENTRIES.has(entryName))
+        return true;
+    if (entryName === constants_1.CONFIG_DIR && (0, path_1.resolve)(source) === (0, path_1.resolve)(rootDir))
+        return true;
+    if (isEnvSecretEntry(entryName))
+        return true;
+    return false;
+}
+/**
+ * Decide whether a directory entry should be skipped at the ZIP stage. The zip
+ * runs against the staging directory (not the project root), where the
+ * project's own agentcore/ config dir is already absent — so a top-level
+ * `agentcore/` here is a real Python package (e.g. an installed dependency)
+ * and MUST be included (issue #1408 / PR #1424). Unlike the copy stage, we
+ * therefore do NOT skip CONFIG_DIR; we only drop build artefacts and .env
+ * secret files.
+ */
+function isZipExcludedEntry(entryName) {
+    if (EXCLUDED_ENTRIES.has(entryName))
+        return true;
+    if (isEnvSecretEntry(entryName))
+        return true;
+    return false;
+}
 exports.MAX_ZIP_SIZE_BYTES = 250 * 1024 * 1024;
 /**
  * Resolve CodeLocation path relative to repository root
@@ -94,7 +142,7 @@ async function resolveProjectPaths(options = {}, agentName) {
         ? (0, path_1.resolve)(options.pyprojectPath)
         : await findUp('pyproject.toml', startDir);
     if (!candidatePyproject || !(await pathExists(candidatePyproject))) {
-        throw new errors_1.MissingProjectFileError(options.pyprojectPath ?? (0, path_1.join)(startDir, 'pyproject.toml'));
+        throw new types_1.MissingProjectFileError(options.pyprojectPath ?? (0, path_1.join)(startDir, 'pyproject.toml'));
     }
     const pyprojectPath = candidatePyproject;
     const projectRoot = options.projectRoot ? (0, path_1.resolve)(options.projectRoot) : (0, path_1.dirname)(pyprojectPath);
@@ -125,10 +173,7 @@ async function copyEntry(source, destination, rootDir) {
         await (0, promises_1.mkdir)(destination, { recursive: true });
         const entries = await (0, promises_1.readdir)(source);
         for (const entry of entries) {
-            if (EXCLUDED_ENTRIES.has(entry)) {
-                continue;
-            }
-            if (entry === constants_1.CONFIG_DIR && (0, path_1.resolve)(source) === (0, path_1.resolve)(rootDir)) {
+            if (shouldExcludeEntry(entry, source, rootDir)) {
                 continue;
             }
             await copyEntry((0, path_1.join)(source, entry), (0, path_1.join)(destination, entry), rootDir);
@@ -141,7 +186,7 @@ async function copyEntry(source, destination, rootDir) {
 }
 async function copySourceTree(srcDir, destination) {
     if (!(await pathExists(srcDir))) {
-        throw new errors_1.MissingProjectFileError(srcDir);
+        throw new types_1.MissingProjectFileError(srcDir);
     }
     await copyEntry(srcDir, destination, srcDir);
 }
@@ -156,7 +201,7 @@ async function ensureBinaryAvailable(binary, installHint) {
             return;
         }
     }
-    throw new errors_1.MissingDependencyError(binary, installHint);
+    throw new types_1.MissingDependencyError(binary, installHint);
 }
 async function runCommand(command, args, cwd) {
     await (0, subprocess_1.runSubprocess)(command, args, { cwd });
@@ -164,22 +209,20 @@ async function runCommand(command, args, cwd) {
 async function createZipFromDir(sourceDir, outputZip) {
     await (0, promises_1.rm)(outputZip, { force: true });
     await (0, promises_1.mkdir)((0, path_1.dirname)(outputZip), { recursive: true });
-    const files = await collectFiles(sourceDir, sourceDir);
+    const files = await collectFiles(sourceDir);
     const zipped = (0, fflate_1.zipSync)(files);
     await (0, promises_1.writeFile)(outputZip, zipped);
 }
-async function collectFiles(directory, rootDir, basePath = '') {
+async function collectFiles(directory, basePath = '') {
     const result = {};
     const entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
     for (const entry of entries) {
-        if (EXCLUDED_ENTRIES.has(entry.name))
-            continue;
-        if (entry.name === constants_1.CONFIG_DIR && (0, path_1.resolve)(directory) === (0, path_1.resolve)(rootDir))
+        if (isZipExcludedEntry(entry.name))
             continue;
         const fullPath = (0, path_1.join)(directory, entry.name);
         const zipPath = basePath ? `${basePath}/${entry.name}` : entry.name;
         if (entry.isDirectory()) {
-            Object.assign(result, await collectFiles(fullPath, rootDir, zipPath));
+            Object.assign(result, await collectFiles(fullPath, zipPath));
         }
         else if (entry.isFile()) {
             result[zipPath] = [await (0, promises_1.readFile)(fullPath), { level: 6 }];
@@ -190,7 +233,7 @@ async function collectFiles(directory, rootDir, basePath = '') {
 async function enforceZipSizeLimit(zipPath) {
     const { size } = await (0, promises_1.stat)(zipPath);
     if (size > exports.MAX_ZIP_SIZE_BYTES) {
-        throw new errors_1.ArtifactSizeError(exports.MAX_ZIP_SIZE_BYTES, size);
+        throw new types_1.ArtifactSizeError(exports.MAX_ZIP_SIZE_BYTES, size);
     }
     return size;
 }
@@ -217,7 +260,7 @@ function resolveProjectPathsSync(options = {}, agentName) {
         ? (0, path_1.resolve)(options.pyprojectPath)
         : findUpSync('pyproject.toml', startDir);
     if (!candidatePyproject || !pathExistsSync(candidatePyproject)) {
-        throw new errors_1.MissingProjectFileError(options.pyprojectPath ?? (0, path_1.join)(startDir, 'pyproject.toml'));
+        throw new types_1.MissingProjectFileError(options.pyprojectPath ?? (0, path_1.join)(startDir, 'pyproject.toml'));
     }
     const pyprojectPath = candidatePyproject;
     const projectRoot = options.projectRoot ? (0, path_1.resolve)(options.projectRoot) : (0, path_1.dirname)(pyprojectPath);
@@ -238,6 +281,66 @@ function resolveProjectPathsSync(options = {}, agentName) {
         artifactsDir,
     };
 }
+/**
+ * Resolve filesystem paths for a Node.js/TypeScript agent project during packaging.
+ *
+ * Locates the nearest package.json (equivalent of pyproject.toml for Python agents),
+ * then derives:
+ * - projectRoot: directory containing package.json
+ * - srcDir: source directory (defaults to projectRoot)
+ * - artifactDir: where CDK config and build outputs live (agentcore/ directory)
+ * - buildDir/stagingDir: per-agent temp directories used during CodeZip packaging
+ *
+ * Note: `pyprojectPath` in the return type is reused from the Python ResolvedPaths
+ * interface — for Node projects it points to package.json.
+ */
+async function resolveNodeProjectPaths(options = {}, agentName) {
+    const startDir = options.projectRoot ? (0, path_1.resolve)(options.projectRoot) : process.cwd();
+    const candidatePackageJson = await findUp('package.json', startDir);
+    if (!candidatePackageJson || !(await pathExists(candidatePackageJson))) {
+        throw new types_1.MissingProjectFileError((0, path_1.join)(startDir, 'package.json'));
+    }
+    const projectRoot = options.projectRoot ? (0, path_1.resolve)(options.projectRoot) : (0, path_1.dirname)(candidatePackageJson);
+    const srcDir = (0, path_1.resolve)(projectRoot, options.srcDir ?? '.');
+    const artifactDir = (0, path_1.resolve)(options.artifactDir ?? (0, path_1.join)(projectRoot, constants_1.CONFIG_DIR));
+    const name = agentName ?? 'default';
+    const buildDir = (0, path_1.join)(artifactDir, name);
+    const stagingDir = (0, path_1.join)(buildDir, 'staging');
+    const artifactsDir = artifactDir;
+    return {
+        projectRoot,
+        srcDir,
+        pyprojectPath: candidatePackageJson,
+        artifactDir,
+        buildDir,
+        stagingDir,
+        artifactsDir,
+    };
+}
+/** Synchronous version of resolveNodeProjectPaths — used in contexts where async is not available. */
+function resolveNodeProjectPathsSync(options = {}, agentName) {
+    const startDir = options.projectRoot ? (0, path_1.resolve)(options.projectRoot) : process.cwd();
+    const candidatePackageJson = findUpSync('package.json', startDir);
+    if (!candidatePackageJson || !pathExistsSync(candidatePackageJson)) {
+        throw new types_1.MissingProjectFileError((0, path_1.join)(startDir, 'package.json'));
+    }
+    const projectRoot = options.projectRoot ? (0, path_1.resolve)(options.projectRoot) : (0, path_1.dirname)(candidatePackageJson);
+    const srcDir = (0, path_1.resolve)(projectRoot, options.srcDir ?? '.');
+    const artifactDir = (0, path_1.resolve)(options.artifactDir ?? (0, path_1.join)(projectRoot, constants_1.CONFIG_DIR));
+    const name = agentName ?? 'default';
+    const buildDir = (0, path_1.join)(artifactDir, name);
+    const stagingDir = (0, path_1.join)(buildDir, 'staging');
+    const artifactsDir = artifactDir;
+    return {
+        projectRoot,
+        srcDir,
+        pyprojectPath: candidatePackageJson,
+        artifactDir,
+        buildDir,
+        stagingDir,
+        artifactsDir,
+    };
+}
 function ensureDirCleanSync(dir) {
     (0, fs_1.rmSync)(dir, { recursive: true, force: true });
     (0, fs_1.mkdirSync)(dir, { recursive: true });
@@ -248,10 +351,7 @@ function copyEntrySync(source, destination, rootDir) {
         (0, fs_1.mkdirSync)(destination, { recursive: true });
         const entries = (0, fs_1.readdirSync)(source);
         for (const entry of entries) {
-            if (EXCLUDED_ENTRIES.has(entry)) {
-                continue;
-            }
-            if (entry === constants_1.CONFIG_DIR && (0, path_1.resolve)(source) === (0, path_1.resolve)(rootDir)) {
+            if (shouldExcludeEntry(entry, source, rootDir)) {
                 continue;
             }
             copyEntrySync((0, path_1.join)(source, entry), (0, path_1.join)(destination, entry), rootDir);
@@ -262,7 +362,7 @@ function copyEntrySync(source, destination, rootDir) {
 }
 function copySourceTreeSync(srcDir, destination) {
     if (!pathExistsSync(srcDir)) {
-        throw new errors_1.MissingProjectFileError(srcDir);
+        throw new types_1.MissingProjectFileError(srcDir);
     }
     copyEntrySync(srcDir, destination, srcDir);
 }
@@ -277,20 +377,18 @@ function ensureBinaryAvailableSync(binary, installHint) {
             return;
         }
     }
-    throw new errors_1.MissingDependencyError(binary, installHint);
+    throw new types_1.MissingDependencyError(binary, installHint);
 }
-function collectFilesSync(directory, rootDir, basePath = '') {
+function collectFilesSync(directory, basePath = '') {
     const result = {};
     const entries = (0, fs_1.readdirSync)(directory, { withFileTypes: true });
     for (const entry of entries) {
-        if (EXCLUDED_ENTRIES.has(entry.name))
-            continue;
-        if (entry.name === constants_1.CONFIG_DIR && (0, path_1.resolve)(directory) === (0, path_1.resolve)(rootDir))
+        if (isZipExcludedEntry(entry.name))
             continue;
         const fullPath = (0, path_1.join)(directory, entry.name);
         const zipPath = basePath ? `${basePath}/${entry.name}` : entry.name;
         if (entry.isDirectory()) {
-            Object.assign(result, collectFilesSync(fullPath, rootDir, zipPath));
+            Object.assign(result, collectFilesSync(fullPath, zipPath));
         }
         else if (entry.isFile()) {
             result[zipPath] = [(0, fs_1.readFileSync)(fullPath), { level: 6 }];
@@ -301,14 +399,14 @@ function collectFilesSync(directory, rootDir, basePath = '') {
 function createZipFromDirSync(sourceDir, outputZip) {
     (0, fs_1.rmSync)(outputZip, { force: true });
     (0, fs_1.mkdirSync)((0, path_1.dirname)(outputZip), { recursive: true });
-    const files = collectFilesSync(sourceDir, sourceDir);
+    const files = collectFilesSync(sourceDir);
     const zipped = (0, fflate_1.zipSync)(files);
     (0, fs_1.writeFileSync)(outputZip, zipped);
 }
 function enforceZipSizeLimitSync(zipPath) {
     const { size } = (0, fs_1.statSync)(zipPath);
     if (size > exports.MAX_ZIP_SIZE_BYTES) {
-        throw new errors_1.ArtifactSizeError(exports.MAX_ZIP_SIZE_BYTES, size);
+        throw new types_1.ArtifactSizeError(exports.MAX_ZIP_SIZE_BYTES, size);
     }
     return size;
 }