cdk-local 0.134.1 → 0.136.0

package/dist/{local-studio-TaIoevIn.js → local-studio-BqHODjfP.js}

@@ -18532,6 +18532,47 @@ async function pingProbe(host, port, timeoutMs) {
 	}
 }
 /**
+* Wait until the container's HTTP server on `host:port` answers a probe `POST`
+* at `path` with ANY HTTP status, or throw after `timeoutMs`. This is the
+* readiness gate for the MCP / A2A warm serve (`cdkl start-agentcore`), which —
+* unlike the HTTP / AGUI protocol — have no `GET /ping`: an HTTP response (even
+* a 4xx for the probe's empty body) proves the app's HTTP server is bound and
+* routing the protocol path, so the warm serve can advertise its endpoint
+* without racing container boot. Only transient connect failures (the
+* container still coming up) are retried; the probe does NOT interpret the
+* protocol — the real client drives the MCP handshake / A2A JSON-RPC through
+* the serve.
+*
+* A TCP-only probe would be too early (Docker's port forwarder accepts the
+* connection before the agent's HTTP server binds); an HTTP response is the
+* honest "the app is up" signal.
+*/
+async function waitForAgentCoreHttpReady(host, port, path, timeoutMs = 3e4) {
+	const deadline = Date.now() + timeoutMs;
+	let lastDetail = "";
+	while (Date.now() < deadline) {
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), 1e3);
+		try {
+			await (await fetch(`http://${host}:${port}${path}`, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: "{}",
+				signal: controller.signal
+			})).text().catch(() => void 0);
+			return;
+		} catch (err) {
+			if (!isTransientNetworkError$2(err)) throw err;
+			lastDetail = err instanceof Error ? err.message : String(err);
+		} finally {
+			clearTimeout(timer);
+		}
+		await setTimeout$1(150);
+	}
+	const tail = lastDetail ? `: ${lastDetail}` : "";
+	throw new Error(`AgentCore agent did not become ready on ${host}:${port} within ${timeoutMs}ms${tail}. The container may have exited early or may not serve POST ${path} — check 'docker logs' output.`);
+}
+/**
 * `fetch()` failures during container boot manifest as a generic
 * `TypeError: fetch failed` whose `.cause` carries the underlying Node
 * `ECONNRESET` / `ECONNREFUSED` / `UND_ERR_SOCKET`. Treat all of those —
@@ -30916,17 +30957,19 @@ function decodeBrowserFrame(data, isBinary) {
 	return (Buffer.isBuffer(data) ? data : Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data)).toString("utf-8");
 }
 /**
-* Start the bridge server. Resolves once it is listening; the returned handle
-* carries the connectable `url` and a `close()` that tears down the server and
-* every live bridged connection.
+* Attach the AgentCore `/ws` bridge to an EXISTING `http.Server`: registers a
+* `WebSocketServer` on `config.path` and, for each inbound (header-less)
+* client, opens a container `/ws` leg with the session-id / Authorization
+* headers injected (via {@link bridgeAgentCoreWs}), piping frames both ways.
+*
+* Shared by {@link startAgentCoreWsBridge} (a standalone `/ws`-only bridge) and
+* the HTTP serve (`startAgentCoreHttpServer`, issue #454), which serves the
+* same warm container's `POST /invocations` + `GET /ping` on the SAME port and
+* delegates the `/ws` upgrade here. The caller owns `httpServer.listen()` and
+* the host port; this helper only owns the WebSocket layer.
 */
-function startAgentCoreWsBridge(config) {
-	const host = config.host ?? "127.0.0.1";
+function attachAgentCoreWsBridge(httpServer, config) {
 	const path = config.path ?? DEFAULT_PATH;
-	const httpServer = createServer$1((_req, res) => {
-		res.writeHead(426, { "Content-Type": "text/plain" });
-		res.end("Upgrade required: connect over WebSocket.\n");
-	});
 	const wss = new WebSocketServer({
 		server: httpServer,
 		path
@@ -30968,6 +31011,27 @@ function startAgentCoreWsBridge(config) {
 			handle.close();
 		});
 	});
+	return {
+		path,
+		close: () => new Promise((res) => {
+			for (const closeLeg of liveCloses) closeLeg();
+			liveCloses.clear();
+			wss.close(() => res());
+		})
+	};
+}
+/**
+* Start a standalone `/ws`-only bridge server. Resolves once it is listening;
+* the returned handle carries the connectable `url` and a `close()` that tears
+* down the server and every live bridged connection.
+*/
+function startAgentCoreWsBridge(config) {
+	const host = config.host ?? "127.0.0.1";
+	const httpServer = createServer$1((_req, res) => {
+		res.writeHead(426, { "Content-Type": "text/plain" });
+		res.end("Upgrade required: connect over WebSocket.\n");
+	});
+	const attached = attachAgentCoreWsBridge(httpServer, config);
 	return new Promise((resolve, reject) => {
 		httpServer.once("error", reject);
 		httpServer.listen(config.port ?? 0, host, () => {
@@ -30975,18 +31039,114 @@ function startAgentCoreWsBridge(config) {
 			httpServer.on("error", (err) => getLogger().debug(`agentcore-ws bridge server error: ${err.message}`));
 			const port = httpServer.address().port;
 			resolve({
-				url: `ws://${host}:${port}${path}`,
+				url: `ws://${host}:${port}${attached.path}`,
 				port,
 				close: () => new Promise((res) => {
-					for (const closeLeg of liveCloses) closeLeg();
-					liveCloses.clear();
-					wss.close(() => httpServer.close(() => res()));
+					attached.close().then(() => httpServer.close(() => res()));
 				})
 			});
 		});
 	});
 }
 
+//#endregion
+//#region src/local/agentcore-http-server.ts
+/** Default routing table — the HTTP / AGUI contract (POST /invocations + GET /ping). */
+const DEFAULT_ROUTES = [{
+	method: "POST",
+	path: "/invocations"
+}, {
+	method: "GET",
+	path: "/ping"
+}];
+/**
+* Proxy one inbound HTTP request to the warm container, injecting the
+* session-id + Authorization (+ any extra) headers, and stream the response
+* back. Used for both `GET /ping` and `POST /invocations`; piping the response
+* preserves an SSE (`text/event-stream`) stream.
+*/
+function proxyToContainer(clientReq, clientRes, config, upstreamPath) {
+	const headers = { ...clientReq.headers };
+	delete headers["host"];
+	headers[AGENTCORE_SESSION_ID_HEADER] = config.sessionId ?? randomUUID();
+	if (config.authorization) headers["authorization"] = config.authorization;
+	const upstream = request({
+		host: config.containerHost,
+		port: config.containerPort,
+		path: upstreamPath,
+		method: clientReq.method,
+		headers
+	}, (upRes) => {
+		clientRes.writeHead(upRes.statusCode ?? 502, upRes.headers);
+		upRes.on("error", () => clientRes.destroy());
+		upRes.pipe(clientRes);
+	});
+	upstream.on("error", (err) => {
+		getLogger().debug(`agentcore http serve upstream error: ${err.message}`);
+		if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
+		clientRes.end(JSON.stringify({ error: `upstream error: ${err.message}` }));
+	});
+	clientReq.on("error", (err) => {
+		getLogger().debug(`agentcore http serve client error: ${err.message}`);
+		upstream.destroy();
+	});
+	clientReq.pipe(upstream);
+}
+/**
+* Start the HTTP serve. Resolves once it is listening; the returned handle
+* carries the connectable `httpUrl` / `wsUrl` and a `close()` that tears down
+* the server + the `/ws` bridge + every live bridged connection.
+*/
+function startAgentCoreHttpServer(config) {
+	const host = config.host ?? "127.0.0.1";
+	const routes = config.routes ?? DEFAULT_ROUTES;
+	const attachWs = config.attachWs ?? true;
+	const notFoundHint = buildNotFoundHint(routes, attachWs);
+	const httpServer = createServer$1((req, res) => {
+		const path = (req.url ?? "/").split("?")[0];
+		const match = routes.find((r) => r.method === req.method && r.path === path);
+		if (match) return proxyToContainer(req, res, config, match.path);
+		res.writeHead(404, { "content-type": "application/json" });
+		res.end(JSON.stringify({
+			error: "not found",
+			hint: notFoundHint
+		}));
+	});
+	const bridge = attachWs ? attachAgentCoreWsBridge(httpServer, {
+		containerHost: config.containerHost,
+		containerPort: config.containerPort,
+		...config.sessionId && { sessionId: config.sessionId },
+		...config.authorization && { authorization: config.authorization }
+	}) : void 0;
+	return new Promise((resolve, reject) => {
+		httpServer.once("error", reject);
+		httpServer.listen(config.port ?? 0, host, () => {
+			httpServer.removeListener("error", reject);
+			httpServer.on("error", (err) => getLogger().debug(`agentcore http serve server error: ${err.message}`));
+			const port = httpServer.address().port;
+			resolve({
+				httpUrl: `http://${host}:${port}`,
+				...bridge && { wsUrl: `ws://${host}:${port}${bridge.path}` },
+				port,
+				close: () => new Promise((res) => {
+					if (bridge) bridge.close().then(() => httpServer.close(() => res()));
+					else httpServer.close(() => res());
+				})
+			});
+		});
+	});
+}
+/**
+* Build the 404 hint from the served routes, appending the `/ws` pointer when
+* the WebSocket bridge is attached. e.g. HTTP / AGUI ->
+* `POST /invocations or GET /ping (WebSocket: connect to /ws)`; MCP ->
+* `POST /mcp`.
+*/
+function buildNotFoundHint(routes, attachWs) {
+	const base = routes.map((r) => `${r.method} ${r.path}`).join(" or ");
+	return attachWs ? `${base} (WebSocket: connect to /ws)` : base;
+}
+
 //#endregion
 //#region src/cli/commands/local-start-agentcore.ts
 /**
@@ -30998,38 +31158,73 @@ function parsePort(raw) {
 	return n;
 }
 /**
-* Reject MCP / A2A runtimes: the `/ws` WebSocket endpoint this command serves
-* exists only on the HTTP / AGUI protocols. MCP (`POST /mcp`) and A2A
-* (`POST /`) are single-shot request/response contracts with no bidirectional
-* socket. Exported so a unit test can drive the gate without the Docker
-* pipeline.
+* Map a resolved runtime's protocol to its warm-serve plan. All four protocols
+* are served (issue #454): HTTP / AGUI on 8080 (`POST /invocations` + `GET
+* /ping` + the `/ws` bridge), MCP on 8000 (`POST /mcp`), A2A on 9000
+* (`POST /`). MCP / A2A are pure request/response pass-through with no `/ws`.
 */
-function assertAgentCoreWsServable(resolved) {
-	if (resolved.protocol === "MCP" || resolved.protocol === "A2A") throw new CdkLocalError(`${getEmbedConfig().cliName} start-agentcore serves the HTTP / AGUI /ws WebSocket endpoint, but '${resolved.logicalId}' is a ${resolved.protocol} runtime, which has no /ws. Use \`${getEmbedConfig().cliName} invoke-agentcore\` for ${resolved.protocol} runtimes.`, "LOCAL_START_AGENTCORE_PROTOCOL_UNSUPPORTED");
+function resolveAgentCoreServePlan(protocol) {
+	if (protocol === "MCP") return {
+		containerPort: MCP_CONTAINER_PORT,
+		containerPortLabel: `${MCP_CONTAINER_PORT}${MCP_PATH}`,
+		routes: [{
+			method: "POST",
+			path: MCP_PATH
+		}],
+		attachWs: false,
+		readyPath: MCP_PATH
+	};
+	if (protocol === "A2A") return {
+		containerPort: A2A_CONTAINER_PORT,
+		containerPortLabel: `${A2A_CONTAINER_PORT}${"/"}`,
+		routes: [{
+			method: "POST",
+			path: "/"
+		}],
+		attachWs: false,
+		readyPath: "/"
+	};
+	return {
+		containerPort: void 0,
+		containerPortLabel: "8080",
+		routes: [{
+			method: "POST",
+			path: "/invocations"
+		}, {
+			method: "GET",
+			path: "/ping"
+		}],
+		attachWs: true,
+		readyPath: void 0
+	};
 }
 /**
 * `cdkl start-agentcore <target>` — boot a Bedrock AgentCore Runtime container
-* locally and serve its bidirectional `/ws` WebSocket endpoint behind a
-* long-running host bridge, so a browser (or any WebSocket client) can hold an
-* interactive multi-frame session against it.
-*
-* Why a bridge rather than the published container port directly: the
-* AgentCore `/ws` upgrade requires the session-id (and, under a
-* `customJwtAuthorizer`, `Authorization`) header, which a browser `WebSocket`
-* cannot set. The bridge accepts a header-less client and injects those
-* headers on the container leg. HTTP / AGUI protocols only — MCP / A2A
-* runtimes have no `/ws`.
+* locally ONCE, keep it warm, and serve its native contract on one host port
+* until SIGINT / SIGTERM, so a client can hit the agent repeatedly against the
+* SAME warm container (issue #454).
+*
+* All four protocols are served (the proxy is protocol-agnostic; only the
+* routing + readiness differ per {@link resolveAgentCoreServePlan}):
+*  - HTTP / AGUI (8080): `POST /invocations` + `GET /ping`, plus the
+*    bidirectional `/ws` endpoint behind a host bridge. The `/ws` upgrade
+*    requires the session-id (and, under a `customJwtAuthorizer`,
+*    `Authorization`) header a browser `WebSocket` cannot set, so the bridge
+*    accepts a header-less client and injects those headers on the container
+*    leg.
+*  - MCP (8000): `POST /mcp`. A2A (9000): `POST /`. No `/ws` — pure
+*    request/response pass-through (the client drives the handshake).
 *
 * The container is booted once via the SAME image / env / auth resolution as
 * `cdkl invoke-agentcore`; the process then blocks until SIGINT / SIGTERM,
-* tearing down the bridge and the container.
+* tearing down the serve and the container.
 */
 async function localStartAgentCoreCommand(target, options, extraStateProviders) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	let containerId;
 	let stopLogs;
-	let bridge;
+	let server;
 	let profileCredsFile;
 	let stateProvider;
 	let shuttingDown = false;
@@ -31037,10 +31232,10 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 	const teardown = async () => {
 		if (tornDown) return;
 		tornDown = true;
-		if (bridge) try {
-			await bridge.close();
+		if (server) try {
+			await server.close();
 		} catch (err) {
-			logger.debug(`bridge close failed: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`server close failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		if (stopLogs) try {
 			stopLogs();
@@ -31094,7 +31289,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 	};
 	const resolved = resolveAgentCoreTarget(resolvedTarget, stacks, imageContext);
 	logger.info(`Target: ${resolved.stack.stackName}/${resolved.logicalId} (${resolved.protocol})`);
-	assertAgentCoreWsServable(resolved);
+	const plan = resolveAgentCoreServePlan(resolved.protocol);
 	const authorization = await resolveInboundAuthorization(resolved, options);
 	await resolveFromS3BucketIntrinsic(resolved, stateProvider, loadedState, imageContext);
 	const image = await resolveAgentCoreImage(resolved, options, loadedState, stateProvider);
@@ -31102,7 +31297,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 	const containerHostPort = await pickFreePort();
 	const containerHost = options.containerHost;
 	const containerName = `${getEmbedConfig().resourceNamePrefix}-agentcore-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
-	logger.info(`Starting agent container (image=${image}, port=${containerHostPort} -> 8080)...`);
+	logger.info(`Starting agent container (image=${image}, port=${containerHostPort} -> ${plan.containerPortLabel})...`);
 	containerId = await runDetached({
 		image,
 		mounts: [],
@@ -31112,6 +31307,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 		host: containerHost,
 		platform: options.platform,
 		name: containerName,
+		...plan.containerPort !== void 0 && { containerPort: plan.containerPort },
 		...sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys }
 	});
 	stopLogs = streamLogs(containerId);
@@ -31125,12 +31321,15 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 	process.on("SIGINT", () => void shutdown("SIGINT", 130));
 	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
 	try {
-		await waitForAgentCorePing(containerHost, containerHostPort, options.timeout);
-		bridge = await startAgentCoreWsBridge({
+		if (plan.readyPath === void 0) await waitForAgentCorePing(containerHost, containerHostPort, options.timeout);
+		else await waitForAgentCoreHttpReady(containerHost, containerHostPort, plan.readyPath, options.timeout);
+		server = await startAgentCoreHttpServer({
 			containerHost,
 			containerPort: containerHostPort,
 			host: options.host,
 			port: options.port,
+			routes: plan.routes,
+			attachWs: plan.attachWs,
 			...authorization && { authorization },
 			...options.sessionId && { sessionId: options.sessionId }
 		});
@@ -31138,20 +31337,30 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 		await teardown();
 		throw err;
 	}
-	logger.info(`Server listening on ${bridge.url}  (${resolved.logicalId} (AgentCore WebSocket))`);
+	if (server.wsUrl) {
+		logger.info(`Server listening on ${server.wsUrl}  (${resolved.logicalId} (AgentCore WebSocket))`);
+		logger.info(`HTTP contract served on ${server.httpUrl} — POST ${server.httpUrl}/invocations, GET ${server.httpUrl}/ping`);
+	} else {
+		const contractPath = plan.routes[0]?.path ?? "/";
+		const contractUrl = `${server.httpUrl}${contractPath}`;
+		logger.info(`Server listening on ${server.httpUrl}  (${resolved.logicalId})`);
+		logger.info(`${resolved.protocol} contract served on ${contractUrl} — POST ${contractUrl}`);
+	}
 	logger.info("Press ^C to shut down.");
 	await new Promise(() => void 0);
 }
 /**
-* `cdkl start-agentcore <target>` — long-running serve for a Bedrock AgentCore
-* Runtime's `/ws` WebSocket endpoint, fronted by a host bridge that injects the
-* session-id / Authorization upgrade headers a browser `WebSocket` cannot set.
-* The serve counterpart of the single-shot `cdkl invoke-agentcore`; the studio
+* `cdkl start-agentcore <target>` — long-running warm serve for a Bedrock
+* AgentCore Runtime. Boots the container once and serves its native contract on
+* one host port: HTTP / AGUI get `POST /invocations` + `GET /ping` plus the
+* `/ws` bridge (which injects the session-id / Authorization upgrade headers a
+* browser `WebSocket` cannot set), MCP gets `POST /mcp`, A2A gets `POST /`. The
+* serve counterpart of the single-shot `cdkl invoke-agentcore`; the studio
 * `agentcore-ws` serve kind spawns this command.
 */
 function createLocalStartAgentCoreCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("start-agentcore").description("Serve a Bedrock AgentCore Runtime's bidirectional /ws WebSocket endpoint locally for an interactive multi-frame session. Boots the AWS::BedrockAgentCore::Runtime container (same image / env / credential resolution as invoke-agentcore), then runs a host WebSocket bridge that injects the AgentCore session-id (and Authorization under a customJwtAuthorizer) on the container upgrade so a header-less client (e.g. a browser) can connect. HTTP / AGUI protocols only (MCP / A2A runtimes have no /ws). Target accepts a CDK display path (MyStack/MyAgent) or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C.").argument("[target]", "CDK display path or stack-qualified logical ID of the AgentCore Runtime to serve (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
+	const cmd = new Command("start-agentcore").description("Serve a Bedrock AgentCore Runtime's contract locally against a warm container. Boots the AWS::BedrockAgentCore::Runtime container ONCE (same image / env / credential resolution as invoke-agentcore) and keeps it warm, so a client can hit it repeatedly. HTTP / AGUI runtimes serve POST /invocations + GET /ping plus the bidirectional /ws endpoint behind a host bridge (injects the AgentCore session-id, and Authorization under a customJwtAuthorizer, so a header-less client like a browser can connect); MCP runtimes serve POST /mcp, A2A POST /. Target accepts a CDK display path (MyStack/MyAgent) or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C.").argument("[target]", "CDK display path or stack-qualified logical ID of the AgentCore Runtime to serve (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
 		await localStartAgentCoreCommand(target, options, opts.extraStateProviders);
 	}));
 	addStartAgentCoreSpecificOptions(cmd);
@@ -31171,7 +31380,7 @@ function createLocalStartAgentCoreCommand(opts = {}) {
 * `.addOption(...)` blocks. Chainable: returns `cmd`.
 */
 function addStartAgentCoreSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <n>", "Bridge-server bind port the client (browser) connects to. Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Bridge-server bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every connection (default: a fresh random UUID per connection, so each client is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on the container /ws upgrade for every bridged connection.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
 //#endregion
@@ -36723,5 +36932,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { CLOUDFRONT_DISTRIBUTION_TYPE as $, computeRequestIdentityHash as $n, availableWebSocketApiIdentifiers as $r, getContainerNetworkIp as $t, addStartCloudFrontSpecificOptions as A, resolveApiTargetSubset as An, buildContainerImage as Ar, addImageOverrideOptions as At, classifyS3Error as B, groupRoutesByServer as Bn, createLocalStateProvider as Br, enforceImageOverrideOrphans as Bt, addListSpecificOptions as C, toCmdArgv as Cn, buildMgmtEndpointEnvUrl as Cr, createLocalStartServiceCommand as Ct, createLocalStartAgentCoreCommand as D, addStartApiSpecificOptions as Dn, buildDisconnectEvent as Dr, MAX_TASKS_SUBNET_RANGE_CAP as Dt, addStartAgentCoreSpecificOptions as E, createLocalInvokeCommand as En, buildConnectEvent as Er, createLocalRunTaskCommand as Et, idFromArn as F, materializeLayerFromArn as Fn, substituteAgainstState as Fr, resolveEcsAssumeRoleOption as Ft, serveFromStaticOrigin as G, defaultCredentialsLoader as Gn, resolveCfnStackName as Gr, describePinnedImageUri as Gt, matchBehavior as H, startApiServer as Hn, rejectExplicitCfnStackWithMultipleStacks as Hr, parseImageOverrideFlags as Ht, resolveKvsModulesForDistribution as I, resolveEnvVars$1 as In, substituteAgainstStateAsync as Ir, resolveSharedSidecarCredentials as It, applyEdgeResponseResult as J, createJwksCache as Jn, resolveSsmParameters as Jr, buildCloudMapIndex as Jt, serveLambdaUrlOrigin as K, buildCognitoJwksUrl as Kn, CfnLocalStateProvider as Kr, isLocalCdkAssetImage as Kt, createDeployedKvsDataSource as L, availableApiIdentifiers as Ln, substituteEnvVarsFromState as Lr, runEcsServiceEmulator as Lt, parseKvsFileOverrides as M, createFileWatcher as Mn, resolveRuntimeFileExtension as Mr, ecsClusterOption as Mt, parseOriginOverrides as N, attachStageContext as Nn, resolveRuntimeImage as Nr, parseMaxTasks as Nt, startAgentCoreWsBridge as O, createLocalStartApiCommand as On, buildMessageEvent as Or, addCommonEcsServiceOptions as Ot, resolveCloudFrontTarget as P, buildStageMap as Pn, EcsTaskResolutionError as Pr, parseRestartPolicy as Pt, httpHeadersToEdge as Q, buildMethodArn as Qn, listTargets as Qr, setShadowReadyTimeoutMs as Qt, resolveDeployedKvsArnByName as R, filterRoutesByApiIdentifier as Rn, substituteEnvVarsFromStateAsync as Rr, ImageOverrideError as Rt, StudioEventBus as S, resolveProfileCredentials as Si, renderCodeDockerfile as Sn, ConnectionRegistry as Sr, addStartServiceSpecificOptions as St, formatTargetListing as T, addInvokeSpecificOptions as Tn, parseConnectionsPath as Tr, addRunTaskSpecificOptions as Tt, startCloudFrontServer as U, resolveSelectionExpression as Un, resolveCfnFallbackRegion as Ur, resolveImageOverrides as Ut, createS3OriginReader as V, readMtlsMaterialsFromDisk as Vn, isCfnFlagPresent as Vr, mergeForService as Vt, resolveErrorResponseCandidates as W, resolveServiceIntegrationParameters as Wn, resolveCfnRegion as Wr, runImageOverrideBuilds as Wt, buildEdgeResponseEvent as X, verifyJwtAuthorizer as Xn, resolveSingleTarget as Xr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Xt, buildEdgeRequestEvent as Y, verifyCognitoJwt as Yn, resolveWatchConfig as Yr, CloudMapRegistry as Yt, edgeHeadersToHttp as Z, verifyJwtViaDiscovery as Zn, countTargets as Zr, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Zt, filterStudioTargetGroups as _, formatStateRemedy as _i, waitForAgentCorePing as _n, tryParseStatus as _r, createLocalStartAlbCommand as _t, createLocalStudioCommand as a, discoverRoutes as ai, A2A_CONTAINER_PORT as an, buildCorsConfigByApiId as ar, pickLambdaEdgeFunctionLogicalId as at, renderStudioHtml as b, LocalInvokeBuildError as bi, buildAgentCoreCodeImage as bn, probeHostGatewaySupport as br, isApplicationLoadBalancer as bt, startStudioProxy as c, AGENTCORE_A2A_PROTOCOL as ci, MCP_CONTAINER_PORT as cn, matchPreflight as cr, compileCloudFrontFunction as ct, createStudioDispatcher as d, AGENTCORE_MCP_PROTOCOL as di, mcpInvokeOnce as dn, applyAuthorizerOverlay as dr, stripCloudFrontImport as dt, discoverWebSocketApis as ei, attachContainerLogStreamer as en, evaluateCachedLambdaPolicy as er, describeS3OriginDomain as et, filterStudioCustomResources as f, AGENTCORE_RUNTIME_TYPE as fi, parseSseForJsonRpc as fn, buildHttpApiV2Event as fr, createCloudFrontModule as ft, annotatePinnedEcsTargets as g, derivePseudoParametersFromRegion as gi, invokeAgentCore as gn, selectIntegrationResponse as gr, albStrategy as gt, annotateEcsTaskPinnedTargets as h, resolveAgentCoreTarget as hi, AGENTCORE_SESSION_ID_HEADER as hn, pickResponseTemplate as hr, addAlbSpecificOptions as ht, coerceStopRequest as i, webSocketApiMatchesIdentifier as ii, invokeAgentCoreWs as in, applyCorsResponseHeaders as ir, pickKvsLogicalIdFromArn as it, createLocalStartCloudFrontCommand as j, createAuthorizerCache as jn, resolveRuntimeCodeMountPath as jr, buildEcsImageResolutionContext$1 as jt, LocalStartCloudFrontError as k, createWatchPredicates as kn, architectureToPlatform as kr, addEcsAssumeRoleOptions as kt, relayServeRequest as l, AGENTCORE_AGUI_PROTOCOL as li, MCP_PATH as ln, matchRoute as lr, runViewerRequest as lt, annotateAlbPinnedBackingServices as m, pickAgentCoreCandidateStack as mi, signAgentCoreInvocation as mn, evaluateResponseParameters as mr, createUnboundCloudFrontModule as mt, coerceRunRequest as n, filterWebSocketApisByIdentifiers as ni, createLocalInvokeAgentCoreCommand as nn, invokeTokenAuthorizer as nr, isCloudFrontDistribution as nt, resolveServeBaseUrl as o, pickRefLogicalId as oi, A2A_PATH as on, buildCorsConfigFromCloudFrontChain as or, pickTargetFunctionLogicalId as ot, isCustomResourceLambdaTarget as p, AgentCoreResolutionError as pi, AGENTCORE_SIGV4_SERVICE as pn, buildRestV1Event as pr, createLocalFileKvsDataSource as pt, applyEdgeRequestResult as q, buildJwksUrlFromIssuer as qn, collectSsmParameterRefs as qr, listPinnedTargets as qt, coerceServeRequest as r, parseSelectionExpressionPath as ri, bridgeAgentCoreWs as rn, attachAuthorizers as rr, pickFunctionUrlLogicalIdFromOrigin as rt, createStudioServeManager as s, resolveLambdaArnIntrinsic as si, a2aInvokeOnce as sn, isFunctionUrlOacFronted as sr, resolveCloudFrontDistribution as st, addStudioSpecificOptions as t, discoverWebSocketApisOrThrow as ti, addInvokeAgentCoreSpecificOptions as tn, invokeRequestAuthorizer as tr, extractKvsAssociations as tt, reinvoke as u, AGENTCORE_HTTP_PROTOCOL as ui, MCP_PROTOCOL_VERSION as un, translateLambdaResponse as ur, runViewerResponse as ut, startStudioServer as v, substituteImagePlaceholders as vi, downloadAndExtractS3Bundle as vn, VtlEvaluationError as vr, parseLbPortOverrides as vt, createLocalListCommand as w, classifySourceChange as wn, handleConnectionsRequest as wr, serviceStrategy as wt, createStudioStore as x, buildStsClientConfig as xi, computeCodeImageTag as xn, bufferToBody as xr, resolveAlbFrontDoor as xt, toStudioTargetGroups as y, tryResolveImageFnJoin as yi, SUPPORTED_CODE_RUNTIMES as yn, HOST_GATEWAY_MIN_VERSION as yr, resolveAlbTarget as yt, resolveDeployedOriginBucket as z, filterRoutesByApiIdentifiers as zn, LocalStateSourceError as zr, buildImageOverrideTag as zt };
-//# sourceMappingURL=local-studio-TaIoevIn.js.map
+export { edgeHeadersToHttp as $, verifyJwtAuthorizer as $n, resolveSingleTarget as $r, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as $t, startAgentCoreWsBridge as A, addStartApiSpecificOptions as An, buildDisconnectEvent as Ar, addCommonEcsServiceOptions as At, resolveDeployedKvsArnByName as B, availableApiIdentifiers as Bn, substituteEnvVarsFromState as Br, ImageOverrideError as Bt, addListSpecificOptions as C, LocalInvokeBuildError as Ci, buildAgentCoreCodeImage as Cn, probeHostGatewaySupport as Cr, resolveAlbFrontDoor as Ct, createLocalStartAgentCoreCommand as D, classifySourceChange as Dn, handleConnectionsRequest as Dr, addRunTaskSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, toCmdArgv as En, buildMgmtEndpointEnvUrl as Er, serviceStrategy as Et, parseOriginOverrides as F, createFileWatcher as Fn, resolveRuntimeFileExtension as Fr, parseMaxTasks as Ft, startCloudFrontServer as G, startApiServer as Gn, rejectExplicitCfnStackWithMultipleStacks as Gr, resolveImageOverrides as Gt, classifyS3Error as H, filterRoutesByApiIdentifiers as Hn, LocalStateSourceError as Hr, enforceImageOverrideOrphans as Ht, resolveCloudFrontTarget as I, attachStageContext as In, resolveRuntimeImage as Ir, parseRestartPolicy as It, serveLambdaUrlOrigin as J, defaultCredentialsLoader as Jn, resolveCfnStackName as Jr, isLocalCdkAssetImage as Jt, resolveErrorResponseCandidates as K, resolveSelectionExpression as Kn, resolveCfnFallbackRegion as Kr, runImageOverrideBuilds as Kt, idFromArn as L, buildStageMap as Ln, EcsTaskResolutionError as Lr, resolveEcsAssumeRoleOption as Lt, addStartCloudFrontSpecificOptions as M, createWatchPredicates as Mn, architectureToPlatform as Mr, addImageOverrideOptions as Mt, createLocalStartCloudFrontCommand as N, resolveApiTargetSubset as Nn, buildContainerImage as Nr, buildEcsImageResolutionContext$1 as Nt, startAgentCoreHttpServer as O, addInvokeSpecificOptions as On, parseConnectionsPath as Or, createLocalRunTaskCommand as Ot, parseKvsFileOverrides as P, createAuthorizerCache as Pn, resolveRuntimeCodeMountPath as Pr, ecsClusterOption as Pt, buildEdgeResponseEvent as Q, verifyCognitoJwt as Qn, resolveWatchConfig as Qr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Qt, resolveKvsModulesForDistribution as R, materializeLayerFromArn as Rn, substituteAgainstState as Rr, resolveSharedSidecarCredentials as Rt, StudioEventBus as S, tryResolveImageFnJoin as Si, SUPPORTED_CODE_RUNTIMES as Sn, HOST_GATEWAY_MIN_VERSION as Sr, isApplicationLoadBalancer as St, formatTargetListing as T, resolveProfileCredentials as Ti, renderCodeDockerfile as Tn, ConnectionRegistry as Tr, createLocalStartServiceCommand as Tt, createS3OriginReader as U, groupRoutesByServer as Un, createLocalStateProvider as Ur, mergeForService as Ut, resolveDeployedOriginBucket as V, filterRoutesByApiIdentifier as Vn, substituteEnvVarsFromStateAsync as Vr, buildImageOverrideTag as Vt, matchBehavior as W, readMtlsMaterialsFromDisk as Wn, isCfnFlagPresent as Wr, parseImageOverrideFlags as Wt, applyEdgeResponseResult as X, buildJwksUrlFromIssuer as Xn, collectSsmParameterRefs as Xr, buildCloudMapIndex as Xt, applyEdgeRequestResult as Y, buildCognitoJwksUrl as Yn, CfnLocalStateProvider as Yr, listPinnedTargets as Yt, buildEdgeRequestEvent as Z, createJwksCache as Zn, resolveSsmParameters as Zr, CloudMapRegistry as Zt, filterStudioTargetGroups as _, pickAgentCoreCandidateStack as _i, AGENTCORE_SESSION_ID_HEADER as _n, evaluateResponseParameters as _r, addAlbSpecificOptions as _t, createLocalStudioCommand as a, filterWebSocketApisByIdentifiers as ai, bridgeAgentCoreWs as an, invokeTokenAuthorizer as ar, pickFunctionUrlLogicalIdFromOrigin as at, renderStudioHtml as b, formatStateRemedy as bi, waitForAgentCorePing as bn, tryParseStatus as br, parseLbPortOverrides as bt, startStudioProxy as c, discoverRoutes as ci, A2A_PATH as cn, buildCorsConfigByApiId as cr, pickTargetFunctionLogicalId as ct, createStudioDispatcher as d, AGENTCORE_A2A_PROTOCOL as di, MCP_PATH as dn, matchPreflight as dr, runViewerRequest as dt, countTargets as ei, setShadowReadyTimeoutMs as en, verifyJwtViaDiscovery as er, httpHeadersToEdge as et, filterStudioCustomResources as f, AGENTCORE_AGUI_PROTOCOL as fi, MCP_PROTOCOL_VERSION as fn, matchRoute as fr, runViewerResponse as ft, annotatePinnedEcsTargets as g, AgentCoreResolutionError as gi, signAgentCoreInvocation as gn, buildRestV1Event as gr, createUnboundCloudFrontModule as gt, annotateEcsTaskPinnedTargets as h, AGENTCORE_RUNTIME_TYPE as hi, AGENTCORE_SIGV4_SERVICE as hn, buildHttpApiV2Event as hr, createLocalFileKvsDataSource as ht, coerceStopRequest as i, discoverWebSocketApisOrThrow as ii, createLocalInvokeAgentCoreCommand as in, invokeRequestAuthorizer as ir, isCloudFrontDistribution as it, LocalStartCloudFrontError as j, createLocalStartApiCommand as jn, buildMessageEvent as jr, addEcsAssumeRoleOptions as jt, attachAgentCoreWsBridge as k, createLocalInvokeCommand as kn, buildConnectEvent as kr, MAX_TASKS_SUBNET_RANGE_CAP as kt, relayServeRequest as l, pickRefLogicalId as li, a2aInvokeOnce as ln, buildCorsConfigFromCloudFrontChain as lr, resolveCloudFrontDistribution as lt, annotateAlbPinnedBackingServices as m, AGENTCORE_MCP_PROTOCOL as mi, parseSseForJsonRpc as mn, applyAuthorizerOverlay as mr, createCloudFrontModule as mt, coerceRunRequest as n, availableWebSocketApiIdentifiers as ni, attachContainerLogStreamer as nn, computeRequestIdentityHash as nr, describeS3OriginDomain as nt, resolveServeBaseUrl as o, parseSelectionExpressionPath as oi, invokeAgentCoreWs as on, attachAuthorizers as or, pickKvsLogicalIdFromArn as ot, isCustomResourceLambdaTarget as p, AGENTCORE_HTTP_PROTOCOL as pi, mcpInvokeOnce as pn, translateLambdaResponse as pr, stripCloudFrontImport as pt, serveFromStaticOrigin as q, resolveServiceIntegrationParameters as qn, resolveCfnRegion as qr, describePinnedImageUri as qt, coerceServeRequest as r, discoverWebSocketApis as ri, addInvokeAgentCoreSpecificOptions as rn, evaluateCachedLambdaPolicy as rr, extractKvsAssociations as rt, createStudioServeManager as s, webSocketApiMatchesIdentifier as si, A2A_CONTAINER_PORT as sn, applyCorsResponseHeaders as sr, pickLambdaEdgeFunctionLogicalId as st, addStudioSpecificOptions as t, listTargets as ti, getContainerNetworkIp as tn, buildMethodArn as tr, CLOUDFRONT_DISTRIBUTION_TYPE as tt, reinvoke as u, resolveLambdaArnIntrinsic as ui, MCP_CONTAINER_PORT as un, isFunctionUrlOacFronted as ur, compileCloudFrontFunction as ut, startStudioServer as v, resolveAgentCoreTarget as vi, invokeAgentCore as vn, pickResponseTemplate as vr, albStrategy as vt, createLocalListCommand as w, buildStsClientConfig as wi, computeCodeImageTag as wn, bufferToBody as wr, addStartServiceSpecificOptions as wt, createStudioStore as x, substituteImagePlaceholders as xi, downloadAndExtractS3Bundle as xn, VtlEvaluationError as xr, resolveAlbTarget as xt, toStudioTargetGroups as y, derivePseudoParametersFromRegion as yi, waitForAgentCoreHttpReady as yn, selectIntegrationResponse as yr, createLocalStartAlbCommand as yt, createDeployedKvsDataSource as z, resolveEnvVars$1 as zn, substituteAgainstStateAsync as zr, runEcsServiceEmulator as zt };
+//# sourceMappingURL=local-studio-BqHODjfP.js.map