cdk-local 0.135.0 → 0.136.0

package/dist/{local-studio-CdpdUbIA.js → local-studio-BqHODjfP.js}

@@ -18469,8 +18469,8 @@ function defaultFetchObject$1(options) {
 * plain HTTP. `cdkl invoke-agentcore` runs the container, waits for `/ping`,
 * then POSTs one event to `/invocations` (invoke-once).
 */
-const PING_PATH$1 = "/ping";
-const INVOCATIONS_PATH$1 = "/invocations";
+const PING_PATH = "/ping";
+const INVOCATIONS_PATH = "/invocations";
 /**
 * Header AgentCore Runtime uses to carry the session id to the container.
 * Real AgentCore always sends it; we generate one (or pass the user's
@@ -18507,7 +18507,7 @@ async function waitForAgentCorePing(host, port, timeoutMs = 3e4) {
 		await setTimeout$1(150);
 	}
 	const tail = lastDetail ? `: ${lastDetail}` : "";
-	throw new Error(`AgentCore agent did not become ready on ${host}:${port} within ${timeoutMs}ms${tail}. The container may have exited early or may not serve GET ${PING_PATH$1} — check 'docker logs' output.`);
+	throw new Error(`AgentCore agent did not become ready on ${host}:${port} within ${timeoutMs}ms${tail}. The container may have exited early or may not serve GET ${PING_PATH} — check 'docker logs' output.`);
 }
 /**
 * Issue `GET /ping`. Returns the HTTP status on any response, undefined on
@@ -18518,7 +18518,7 @@ async function pingProbe(host, port, timeoutMs) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
-		const response = await fetch(`http://${host}:${port}${PING_PATH$1}`, {
+		const response = await fetch(`http://${host}:${port}${PING_PATH}`, {
 			method: "GET",
 			signal: controller.signal
 		});
@@ -18532,6 +18532,47 @@ async function pingProbe(host, port, timeoutMs) {
 	}
 }
 /**
+* Wait until the container's HTTP server on `host:port` answers a probe `POST`
+* at `path` with ANY HTTP status, or throw after `timeoutMs`. This is the
+* readiness gate for the MCP / A2A warm serve (`cdkl start-agentcore`), which —
+* unlike the HTTP / AGUI protocol — have no `GET /ping`: an HTTP response (even
+* a 4xx for the probe's empty body) proves the app's HTTP server is bound and
+* routing the protocol path, so the warm serve can advertise its endpoint
+* without racing container boot. Only transient connect failures (the
+* container still coming up) are retried; the probe does NOT interpret the
+* protocol — the real client drives the MCP handshake / A2A JSON-RPC through
+* the serve.
+*
+* A TCP-only probe would be too early (Docker's port forwarder accepts the
+* connection before the agent's HTTP server binds); an HTTP response is the
+* honest "the app is up" signal.
+*/
+async function waitForAgentCoreHttpReady(host, port, path, timeoutMs = 3e4) {
+	const deadline = Date.now() + timeoutMs;
+	let lastDetail = "";
+	while (Date.now() < deadline) {
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), 1e3);
+		try {
+			await (await fetch(`http://${host}:${port}${path}`, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: "{}",
+				signal: controller.signal
+			})).text().catch(() => void 0);
+			return;
+		} catch (err) {
+			if (!isTransientNetworkError$2(err)) throw err;
+			lastDetail = err instanceof Error ? err.message : String(err);
+		} finally {
+			clearTimeout(timer);
+		}
+		await setTimeout$1(150);
+	}
+	const tail = lastDetail ? `: ${lastDetail}` : "";
+	throw new Error(`AgentCore agent did not become ready on ${host}:${port} within ${timeoutMs}ms${tail}. The container may have exited early or may not serve POST ${path} — check 'docker logs' output.`);
+}
+/**
 * `fetch()` failures during container boot manifest as a generic
 * `TypeError: fetch failed` whose `.cause` carries the underlying Node
 * `ECONNRESET` / `ECONNREFUSED` / `UND_ERR_SOCKET`. Treat all of those —
@@ -18557,7 +18598,7 @@ function isTransientNetworkError$2(err) {
 * a missing sink) is buffered into `raw` and returned verbatim.
 */
 async function invokeAgentCore(host, port, event, options) {
-	const url = `http://${host}:${port}${INVOCATIONS_PATH$1}`;
+	const url = `http://${host}:${port}${INVOCATIONS_PATH}`;
 	const body = JSON.stringify(event ?? {});
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), options.timeoutMs);
@@ -31010,33 +31051,14 @@ function startAgentCoreWsBridge(config) {
 
 //#endregion
 //#region src/local/agentcore-http-server.ts
-/**
-* Host HTTP serve in front of a warm AgentCore runtime container, the serving
-* primitive behind `cdkl start-agentcore` for HTTP / AGUI protocols (issue
-* #454). Unlike the single-shot `cdkl invoke-agentcore` — which boots a
-* container, POSTs ONE `/invocations`, and tears it down — this keeps the
-* container warm and serves its native HTTP contract until `^C`, so a client
-* can hit `POST /invocations` (and `GET /ping`) repeatedly against the SAME
-* warm container. That mirrors AgentCore's deployed model, where many
-* `InvokeAgentRuntime` calls on the same `runtimeSessionId` reuse one warm
-* microVM.
-*
-* One host `http.Server` serves all three:
-*  - `GET  /ping`         -> proxied to the container's `/ping`
-*  - `POST /invocations`  -> proxied to the container's `/invocations`
-*    (request body streamed up, response — JSON or SSE — streamed back)
-*  - `/ws` upgrade        -> the existing header-injecting bridge
-*    ({@link attachAgentCoreWsBridge}) on the same port, so a header-less
-*    browser `WebSocket` still works exactly as before.
-*
-* Auth parity: the boot-resolved `authorization` (the `--bearer-token`
-* validated once at boot under a `customJwtAuthorizer`, or the `--sigv4`
-* header set) is injected on every forwarded request — the same model the
-* `/ws` bridge uses. Per-request inbound JWT verification is out of scope for
-* this slice.
-*/
-const PING_PATH = "/ping";
-const INVOCATIONS_PATH = "/invocations";
+/** Default routing table — the HTTP / AGUI contract (POST /invocations + GET /ping). */
+const DEFAULT_ROUTES = [{
+	method: "POST",
+	path: "/invocations"
+}, {
+	method: "GET",
+	path: "/ping"
+}];
 /**
 * Proxy one inbound HTTP request to the warm container, injecting the
 * session-id + Authorization (+ any extra) headers, and stream the response
@@ -31077,22 +31099,25 @@ function proxyToContainer(clientReq, clientRes, config, upstreamPath) {
 */
 function startAgentCoreHttpServer(config) {
 	const host = config.host ?? "127.0.0.1";
+	const routes = config.routes ?? DEFAULT_ROUTES;
+	const attachWs = config.attachWs ?? true;
+	const notFoundHint = buildNotFoundHint(routes, attachWs);
 	const httpServer = createServer$1((req, res) => {
 		const path = (req.url ?? "/").split("?")[0];
-		if (req.method === "GET" && path === PING_PATH) return proxyToContainer(req, res, config, PING_PATH);
-		if (req.method === "POST" && path === INVOCATIONS_PATH) return proxyToContainer(req, res, config, INVOCATIONS_PATH);
+		const match = routes.find((r) => r.method === req.method && r.path === path);
+		if (match) return proxyToContainer(req, res, config, match.path);
 		res.writeHead(404, { "content-type": "application/json" });
 		res.end(JSON.stringify({
 			error: "not found",
-			hint: "POST /invocations or GET /ping (WebSocket: connect to /ws)"
+			hint: notFoundHint
 		}));
 	});
-	const bridge = attachAgentCoreWsBridge(httpServer, {
+	const bridge = attachWs ? attachAgentCoreWsBridge(httpServer, {
 		containerHost: config.containerHost,
 		containerPort: config.containerPort,
 		...config.sessionId && { sessionId: config.sessionId },
 		...config.authorization && { authorization: config.authorization }
-	});
+	}) : void 0;
 	return new Promise((resolve, reject) => {
 		httpServer.once("error", reject);
 		httpServer.listen(config.port ?? 0, host, () => {
@@ -31101,15 +31126,26 @@ function startAgentCoreHttpServer(config) {
 			const port = httpServer.address().port;
 			resolve({
 				httpUrl: `http://${host}:${port}`,
-				wsUrl: `ws://${host}:${port}${bridge.path}`,
+				...bridge && { wsUrl: `ws://${host}:${port}${bridge.path}` },
 				port,
 				close: () => new Promise((res) => {
-					bridge.close().then(() => httpServer.close(() => res()));
+					if (bridge) bridge.close().then(() => httpServer.close(() => res()));
+					else httpServer.close(() => res());
 				})
 			});
 		});
 	});
 }
+/**
+* Build the 404 hint from the served routes, appending the `/ws` pointer when
+* the WebSocket bridge is attached. e.g. HTTP / AGUI ->
+* `POST /invocations or GET /ping (WebSocket: connect to /ws)`; MCP ->
+* `POST /mcp`.
+*/
+function buildNotFoundHint(routes, attachWs) {
+	const base = routes.map((r) => `${r.method} ${r.path}`).join(" or ");
+	return attachWs ? `${base} (WebSocket: connect to /ws)` : base;
+}
 
 //#endregion
 //#region src/cli/commands/local-start-agentcore.ts
@@ -31122,31 +31158,66 @@ function parsePort(raw) {
 	return n;
 }
 /**
-* Reject MCP / A2A runtimes: the `/ws` WebSocket endpoint this command serves
-* exists only on the HTTP / AGUI protocols. MCP (`POST /mcp`) and A2A
-* (`POST /`) are single-shot request/response contracts with no bidirectional
-* socket. Exported so a unit test can drive the gate without the Docker
-* pipeline.
+* Map a resolved runtime's protocol to its warm-serve plan. All four protocols
+* are served (issue #454): HTTP / AGUI on 8080 (`POST /invocations` + `GET
+* /ping` + the `/ws` bridge), MCP on 8000 (`POST /mcp`), A2A on 9000
+* (`POST /`). MCP / A2A are pure request/response pass-through with no `/ws`.
 */
-function assertAgentCoreWsServable(resolved) {
-	if (resolved.protocol === "MCP" || resolved.protocol === "A2A") throw new CdkLocalError(`${getEmbedConfig().cliName} start-agentcore serves the HTTP / AGUI /ws WebSocket endpoint, but '${resolved.logicalId}' is a ${resolved.protocol} runtime, which has no /ws. Use \`${getEmbedConfig().cliName} invoke-agentcore\` for ${resolved.protocol} runtimes.`, "LOCAL_START_AGENTCORE_PROTOCOL_UNSUPPORTED");
+function resolveAgentCoreServePlan(protocol) {
+	if (protocol === "MCP") return {
+		containerPort: MCP_CONTAINER_PORT,
+		containerPortLabel: `${MCP_CONTAINER_PORT}${MCP_PATH}`,
+		routes: [{
+			method: "POST",
+			path: MCP_PATH
+		}],
+		attachWs: false,
+		readyPath: MCP_PATH
+	};
+	if (protocol === "A2A") return {
+		containerPort: A2A_CONTAINER_PORT,
+		containerPortLabel: `${A2A_CONTAINER_PORT}${"/"}`,
+		routes: [{
+			method: "POST",
+			path: "/"
+		}],
+		attachWs: false,
+		readyPath: "/"
+	};
+	return {
+		containerPort: void 0,
+		containerPortLabel: "8080",
+		routes: [{
+			method: "POST",
+			path: "/invocations"
+		}, {
+			method: "GET",
+			path: "/ping"
+		}],
+		attachWs: true,
+		readyPath: void 0
+	};
 }
 /**
 * `cdkl start-agentcore <target>` — boot a Bedrock AgentCore Runtime container
-* locally and serve its bidirectional `/ws` WebSocket endpoint behind a
-* long-running host bridge, so a browser (or any WebSocket client) can hold an
-* interactive multi-frame session against it.
-*
-* Why a bridge rather than the published container port directly: the
-* AgentCore `/ws` upgrade requires the session-id (and, under a
-* `customJwtAuthorizer`, `Authorization`) header, which a browser `WebSocket`
-* cannot set. The bridge accepts a header-less client and injects those
-* headers on the container leg. HTTP / AGUI protocols only — MCP / A2A
-* runtimes have no `/ws`.
+* locally ONCE, keep it warm, and serve its native contract on one host port
+* until SIGINT / SIGTERM, so a client can hit the agent repeatedly against the
+* SAME warm container (issue #454).
+*
+* All four protocols are served (the proxy is protocol-agnostic; only the
+* routing + readiness differ per {@link resolveAgentCoreServePlan}):
+*  - HTTP / AGUI (8080): `POST /invocations` + `GET /ping`, plus the
+*    bidirectional `/ws` endpoint behind a host bridge. The `/ws` upgrade
+*    requires the session-id (and, under a `customJwtAuthorizer`,
+*    `Authorization`) header a browser `WebSocket` cannot set, so the bridge
+*    accepts a header-less client and injects those headers on the container
+*    leg.
+*  - MCP (8000): `POST /mcp`. A2A (9000): `POST /`. No `/ws` — pure
+*    request/response pass-through (the client drives the handshake).
 *
 * The container is booted once via the SAME image / env / auth resolution as
 * `cdkl invoke-agentcore`; the process then blocks until SIGINT / SIGTERM,
-* tearing down the bridge and the container.
+* tearing down the serve and the container.
 */
 async function localStartAgentCoreCommand(target, options, extraStateProviders) {
 	const logger = getLogger();
@@ -31218,7 +31289,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 	};
 	const resolved = resolveAgentCoreTarget(resolvedTarget, stacks, imageContext);
 	logger.info(`Target: ${resolved.stack.stackName}/${resolved.logicalId} (${resolved.protocol})`);
-	assertAgentCoreWsServable(resolved);
+	const plan = resolveAgentCoreServePlan(resolved.protocol);
 	const authorization = await resolveInboundAuthorization(resolved, options);
 	await resolveFromS3BucketIntrinsic(resolved, stateProvider, loadedState, imageContext);
 	const image = await resolveAgentCoreImage(resolved, options, loadedState, stateProvider);
@@ -31226,7 +31297,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 	const containerHostPort = await pickFreePort();
 	const containerHost = options.containerHost;
 	const containerName = `${getEmbedConfig().resourceNamePrefix}-agentcore-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
-	logger.info(`Starting agent container (image=${image}, port=${containerHostPort} -> 8080)...`);
+	logger.info(`Starting agent container (image=${image}, port=${containerHostPort} -> ${plan.containerPortLabel})...`);
 	containerId = await runDetached({
 		image,
 		mounts: [],
@@ -31236,6 +31307,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 		host: containerHost,
 		platform: options.platform,
 		name: containerName,
+		...plan.containerPort !== void 0 && { containerPort: plan.containerPort },
 		...sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys }
 	});
 	stopLogs = streamLogs(containerId);
@@ -31249,12 +31321,15 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 	process.on("SIGINT", () => void shutdown("SIGINT", 130));
 	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
 	try {
-		await waitForAgentCorePing(containerHost, containerHostPort, options.timeout);
+		if (plan.readyPath === void 0) await waitForAgentCorePing(containerHost, containerHostPort, options.timeout);
+		else await waitForAgentCoreHttpReady(containerHost, containerHostPort, plan.readyPath, options.timeout);
 		server = await startAgentCoreHttpServer({
 			containerHost,
 			containerPort: containerHostPort,
 			host: options.host,
 			port: options.port,
+			routes: plan.routes,
+			attachWs: plan.attachWs,
 			...authorization && { authorization },
 			...options.sessionId && { sessionId: options.sessionId }
 		});
@@ -31262,21 +31337,30 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders)
 		await teardown();
 		throw err;
 	}
-	logger.info(`Server listening on ${server.wsUrl}  (${resolved.logicalId} (AgentCore WebSocket))`);
-	logger.info(`HTTP contract served on ${server.httpUrl} — POST ${server.httpUrl}/invocations, GET ${server.httpUrl}/ping`);
+	if (server.wsUrl) {
+		logger.info(`Server listening on ${server.wsUrl}  (${resolved.logicalId} (AgentCore WebSocket))`);
+		logger.info(`HTTP contract served on ${server.httpUrl} — POST ${server.httpUrl}/invocations, GET ${server.httpUrl}/ping`);
+	} else {
+		const contractPath = plan.routes[0]?.path ?? "/";
+		const contractUrl = `${server.httpUrl}${contractPath}`;
+		logger.info(`Server listening on ${server.httpUrl}  (${resolved.logicalId})`);
+		logger.info(`${resolved.protocol} contract served on ${contractUrl} — POST ${contractUrl}`);
+	}
 	logger.info("Press ^C to shut down.");
 	await new Promise(() => void 0);
 }
 /**
-* `cdkl start-agentcore <target>` — long-running serve for a Bedrock AgentCore
-* Runtime's `/ws` WebSocket endpoint, fronted by a host bridge that injects the
-* session-id / Authorization upgrade headers a browser `WebSocket` cannot set.
-* The serve counterpart of the single-shot `cdkl invoke-agentcore`; the studio
+* `cdkl start-agentcore <target>` — long-running warm serve for a Bedrock
+* AgentCore Runtime. Boots the container once and serves its native contract on
+* one host port: HTTP / AGUI get `POST /invocations` + `GET /ping` plus the
+* `/ws` bridge (which injects the session-id / Authorization upgrade headers a
+* browser `WebSocket` cannot set), MCP gets `POST /mcp`, A2A gets `POST /`. The
+* serve counterpart of the single-shot `cdkl invoke-agentcore`; the studio
 * `agentcore-ws` serve kind spawns this command.
 */
 function createLocalStartAgentCoreCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("start-agentcore").description("Serve a Bedrock AgentCore Runtime's bidirectional /ws WebSocket endpoint locally for an interactive multi-frame session. Boots the AWS::BedrockAgentCore::Runtime container (same image / env / credential resolution as invoke-agentcore), then runs a host WebSocket bridge that injects the AgentCore session-id (and Authorization under a customJwtAuthorizer) on the container upgrade so a header-less client (e.g. a browser) can connect. HTTP / AGUI protocols only (MCP / A2A runtimes have no /ws). Target accepts a CDK display path (MyStack/MyAgent) or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C.").argument("[target]", "CDK display path or stack-qualified logical ID of the AgentCore Runtime to serve (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
+	const cmd = new Command("start-agentcore").description("Serve a Bedrock AgentCore Runtime's contract locally against a warm container. Boots the AWS::BedrockAgentCore::Runtime container ONCE (same image / env / credential resolution as invoke-agentcore) and keeps it warm, so a client can hit it repeatedly. HTTP / AGUI runtimes serve POST /invocations + GET /ping plus the bidirectional /ws endpoint behind a host bridge (injects the AgentCore session-id, and Authorization under a customJwtAuthorizer, so a header-less client like a browser can connect); MCP runtimes serve POST /mcp, A2A POST /. Target accepts a CDK display path (MyStack/MyAgent) or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C.").argument("[target]", "CDK display path or stack-qualified logical ID of the AgentCore Runtime to serve (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
 		await localStartAgentCoreCommand(target, options, opts.extraStateProviders);
 	}));
 	addStartAgentCoreSpecificOptions(cmd);
@@ -31296,7 +31380,7 @@ function createLocalStartAgentCoreCommand(opts = {}) {
 * `.addOption(...)` blocks. Chainable: returns `cmd`.
 */
 function addStartAgentCoreSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <n>", "Bridge-server bind port the client (browser) connects to. Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Bridge-server bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every connection (default: a fresh random UUID per connection, so each client is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on the container /ws upgrade for every bridged connection.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
 //#endregion
@@ -36848,5 +36932,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { edgeHeadersToHttp as $, verifyJwtViaDiscovery as $n, countTargets as $r, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as $t, startAgentCoreWsBridge as A, createLocalStartApiCommand as An, buildMessageEvent as Ar, addCommonEcsServiceOptions as At, resolveDeployedKvsArnByName as B, filterRoutesByApiIdentifier as Bn, substituteEnvVarsFromStateAsync as Br, ImageOverrideError as Bt, addListSpecificOptions as C, buildStsClientConfig as Ci, computeCodeImageTag as Cn, bufferToBody as Cr, resolveAlbFrontDoor as Ct, createLocalStartAgentCoreCommand as D, addInvokeSpecificOptions as Dn, parseConnectionsPath as Dr, addRunTaskSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, classifySourceChange as En, handleConnectionsRequest as Er, serviceStrategy as Et, parseOriginOverrides as F, attachStageContext as Fn, resolveRuntimeImage as Fr, parseMaxTasks as Ft, startCloudFrontServer as G, resolveSelectionExpression as Gn, resolveCfnFallbackRegion as Gr, resolveImageOverrides as Gt, classifyS3Error as H, groupRoutesByServer as Hn, createLocalStateProvider as Hr, enforceImageOverrideOrphans as Ht, resolveCloudFrontTarget as I, buildStageMap as In, EcsTaskResolutionError as Ir, parseRestartPolicy as It, serveLambdaUrlOrigin as J, buildCognitoJwksUrl as Jn, CfnLocalStateProvider as Jr, isLocalCdkAssetImage as Jt, resolveErrorResponseCandidates as K, resolveServiceIntegrationParameters as Kn, resolveCfnRegion as Kr, runImageOverrideBuilds as Kt, idFromArn as L, materializeLayerFromArn as Ln, substituteAgainstState as Lr, resolveEcsAssumeRoleOption as Lt, addStartCloudFrontSpecificOptions as M, resolveApiTargetSubset as Mn, buildContainerImage as Mr, addImageOverrideOptions as Mt, createLocalStartCloudFrontCommand as N, createAuthorizerCache as Nn, resolveRuntimeCodeMountPath as Nr, buildEcsImageResolutionContext$1 as Nt, startAgentCoreHttpServer as O, createLocalInvokeCommand as On, buildConnectEvent as Or, createLocalRunTaskCommand as Ot, parseKvsFileOverrides as P, createFileWatcher as Pn, resolveRuntimeFileExtension as Pr, ecsClusterOption as Pt, buildEdgeResponseEvent as Q, verifyJwtAuthorizer as Qn, resolveSingleTarget as Qr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Qt, resolveKvsModulesForDistribution as R, resolveEnvVars$1 as Rn, substituteAgainstStateAsync as Rr, resolveSharedSidecarCredentials as Rt, StudioEventBus as S, LocalInvokeBuildError as Si, buildAgentCoreCodeImage as Sn, probeHostGatewaySupport as Sr, isApplicationLoadBalancer as St, formatTargetListing as T, toCmdArgv as Tn, buildMgmtEndpointEnvUrl as Tr, createLocalStartServiceCommand as Tt, createS3OriginReader as U, readMtlsMaterialsFromDisk as Un, isCfnFlagPresent as Ur, mergeForService as Ut, resolveDeployedOriginBucket as V, filterRoutesByApiIdentifiers as Vn, LocalStateSourceError as Vr, buildImageOverrideTag as Vt, matchBehavior as W, startApiServer as Wn, rejectExplicitCfnStackWithMultipleStacks as Wr, parseImageOverrideFlags as Wt, applyEdgeResponseResult as X, createJwksCache as Xn, resolveSsmParameters as Xr, buildCloudMapIndex as Xt, applyEdgeRequestResult as Y, buildJwksUrlFromIssuer as Yn, collectSsmParameterRefs as Yr, listPinnedTargets as Yt, buildEdgeRequestEvent as Z, verifyCognitoJwt as Zn, resolveWatchConfig as Zr, CloudMapRegistry as Zt, filterStudioTargetGroups as _, resolveAgentCoreTarget as _i, AGENTCORE_SESSION_ID_HEADER as _n, pickResponseTemplate as _r, addAlbSpecificOptions as _t, createLocalStudioCommand as a, parseSelectionExpressionPath as ai, bridgeAgentCoreWs as an, attachAuthorizers as ar, pickFunctionUrlLogicalIdFromOrigin as at, renderStudioHtml as b, substituteImagePlaceholders as bi, downloadAndExtractS3Bundle as bn, VtlEvaluationError as br, parseLbPortOverrides as bt, startStudioProxy as c, pickRefLogicalId as ci, A2A_PATH as cn, buildCorsConfigFromCloudFrontChain as cr, pickTargetFunctionLogicalId as ct, createStudioDispatcher as d, AGENTCORE_AGUI_PROTOCOL as di, MCP_PATH as dn, matchRoute as dr, runViewerRequest as dt, listTargets as ei, setShadowReadyTimeoutMs as en, buildMethodArn as er, httpHeadersToEdge as et, filterStudioCustomResources as f, AGENTCORE_HTTP_PROTOCOL as fi, MCP_PROTOCOL_VERSION as fn, translateLambdaResponse as fr, runViewerResponse as ft, annotatePinnedEcsTargets as g, pickAgentCoreCandidateStack as gi, signAgentCoreInvocation as gn, evaluateResponseParameters as gr, createUnboundCloudFrontModule as gt, annotateEcsTaskPinnedTargets as h, AgentCoreResolutionError as hi, AGENTCORE_SIGV4_SERVICE as hn, buildRestV1Event as hr, createLocalFileKvsDataSource as ht, coerceStopRequest as i, filterWebSocketApisByIdentifiers as ii, createLocalInvokeAgentCoreCommand as in, invokeTokenAuthorizer as ir, isCloudFrontDistribution as it, LocalStartCloudFrontError as j, createWatchPredicates as jn, architectureToPlatform as jr, addEcsAssumeRoleOptions as jt, attachAgentCoreWsBridge as k, addStartApiSpecificOptions as kn, buildDisconnectEvent as kr, MAX_TASKS_SUBNET_RANGE_CAP as kt, relayServeRequest as l, resolveLambdaArnIntrinsic as li, a2aInvokeOnce as ln, isFunctionUrlOacFronted as lr, resolveCloudFrontDistribution as lt, annotateAlbPinnedBackingServices as m, AGENTCORE_RUNTIME_TYPE as mi, parseSseForJsonRpc as mn, buildHttpApiV2Event as mr, createCloudFrontModule as mt, coerceRunRequest as n, discoverWebSocketApis as ni, attachContainerLogStreamer as nn, evaluateCachedLambdaPolicy as nr, describeS3OriginDomain as nt, resolveServeBaseUrl as o, webSocketApiMatchesIdentifier as oi, invokeAgentCoreWs as on, applyCorsResponseHeaders as or, pickKvsLogicalIdFromArn as ot, isCustomResourceLambdaTarget as p, AGENTCORE_MCP_PROTOCOL as pi, mcpInvokeOnce as pn, applyAuthorizerOverlay as pr, stripCloudFrontImport as pt, serveFromStaticOrigin as q, defaultCredentialsLoader as qn, resolveCfnStackName as qr, describePinnedImageUri as qt, coerceServeRequest as r, discoverWebSocketApisOrThrow as ri, addInvokeAgentCoreSpecificOptions as rn, invokeRequestAuthorizer as rr, extractKvsAssociations as rt, createStudioServeManager as s, discoverRoutes as si, A2A_CONTAINER_PORT as sn, buildCorsConfigByApiId as sr, pickLambdaEdgeFunctionLogicalId as st, addStudioSpecificOptions as t, availableWebSocketApiIdentifiers as ti, getContainerNetworkIp as tn, computeRequestIdentityHash as tr, CLOUDFRONT_DISTRIBUTION_TYPE as tt, reinvoke as u, AGENTCORE_A2A_PROTOCOL as ui, MCP_CONTAINER_PORT as un, matchPreflight as ur, compileCloudFrontFunction as ut, startStudioServer as v, derivePseudoParametersFromRegion as vi, invokeAgentCore as vn, selectIntegrationResponse as vr, albStrategy as vt, createLocalListCommand as w, resolveProfileCredentials as wi, renderCodeDockerfile as wn, ConnectionRegistry as wr, addStartServiceSpecificOptions as wt, createStudioStore as x, tryResolveImageFnJoin as xi, SUPPORTED_CODE_RUNTIMES as xn, HOST_GATEWAY_MIN_VERSION as xr, resolveAlbTarget as xt, toStudioTargetGroups as y, formatStateRemedy as yi, waitForAgentCorePing as yn, tryParseStatus as yr, createLocalStartAlbCommand as yt, createDeployedKvsDataSource as z, availableApiIdentifiers as zn, substituteEnvVarsFromState as zr, runEcsServiceEmulator as zt };
-//# sourceMappingURL=local-studio-CdpdUbIA.js.map
+export { edgeHeadersToHttp as $, verifyJwtAuthorizer as $n, resolveSingleTarget as $r, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as $t, startAgentCoreWsBridge as A, addStartApiSpecificOptions as An, buildDisconnectEvent as Ar, addCommonEcsServiceOptions as At, resolveDeployedKvsArnByName as B, availableApiIdentifiers as Bn, substituteEnvVarsFromState as Br, ImageOverrideError as Bt, addListSpecificOptions as C, LocalInvokeBuildError as Ci, buildAgentCoreCodeImage as Cn, probeHostGatewaySupport as Cr, resolveAlbFrontDoor as Ct, createLocalStartAgentCoreCommand as D, classifySourceChange as Dn, handleConnectionsRequest as Dr, addRunTaskSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, toCmdArgv as En, buildMgmtEndpointEnvUrl as Er, serviceStrategy as Et, parseOriginOverrides as F, createFileWatcher as Fn, resolveRuntimeFileExtension as Fr, parseMaxTasks as Ft, startCloudFrontServer as G, startApiServer as Gn, rejectExplicitCfnStackWithMultipleStacks as Gr, resolveImageOverrides as Gt, classifyS3Error as H, filterRoutesByApiIdentifiers as Hn, LocalStateSourceError as Hr, enforceImageOverrideOrphans as Ht, resolveCloudFrontTarget as I, attachStageContext as In, resolveRuntimeImage as Ir, parseRestartPolicy as It, serveLambdaUrlOrigin as J, defaultCredentialsLoader as Jn, resolveCfnStackName as Jr, isLocalCdkAssetImage as Jt, resolveErrorResponseCandidates as K, resolveSelectionExpression as Kn, resolveCfnFallbackRegion as Kr, runImageOverrideBuilds as Kt, idFromArn as L, buildStageMap as Ln, EcsTaskResolutionError as Lr, resolveEcsAssumeRoleOption as Lt, addStartCloudFrontSpecificOptions as M, createWatchPredicates as Mn, architectureToPlatform as Mr, addImageOverrideOptions as Mt, createLocalStartCloudFrontCommand as N, resolveApiTargetSubset as Nn, buildContainerImage as Nr, buildEcsImageResolutionContext$1 as Nt, startAgentCoreHttpServer as O, addInvokeSpecificOptions as On, parseConnectionsPath as Or, createLocalRunTaskCommand as Ot, parseKvsFileOverrides as P, createAuthorizerCache as Pn, resolveRuntimeCodeMountPath as Pr, ecsClusterOption as Pt, buildEdgeResponseEvent as Q, verifyCognitoJwt as Qn, resolveWatchConfig as Qr, DEFAULT_SHADOW_READY_TIMEOUT_MS as Qt, resolveKvsModulesForDistribution as R, materializeLayerFromArn as Rn, substituteAgainstState as Rr, resolveSharedSidecarCredentials as Rt, StudioEventBus as S, tryResolveImageFnJoin as Si, SUPPORTED_CODE_RUNTIMES as Sn, HOST_GATEWAY_MIN_VERSION as Sr, isApplicationLoadBalancer as St, formatTargetListing as T, resolveProfileCredentials as Ti, renderCodeDockerfile as Tn, ConnectionRegistry as Tr, createLocalStartServiceCommand as Tt, createS3OriginReader as U, groupRoutesByServer as Un, createLocalStateProvider as Ur, mergeForService as Ut, resolveDeployedOriginBucket as V, filterRoutesByApiIdentifier as Vn, substituteEnvVarsFromStateAsync as Vr, buildImageOverrideTag as Vt, matchBehavior as W, readMtlsMaterialsFromDisk as Wn, isCfnFlagPresent as Wr, parseImageOverrideFlags as Wt, applyEdgeResponseResult as X, buildJwksUrlFromIssuer as Xn, collectSsmParameterRefs as Xr, buildCloudMapIndex as Xt, applyEdgeRequestResult as Y, buildCognitoJwksUrl as Yn, CfnLocalStateProvider as Yr, listPinnedTargets as Yt, buildEdgeRequestEvent as Z, createJwksCache as Zn, resolveSsmParameters as Zr, CloudMapRegistry as Zt, filterStudioTargetGroups as _, pickAgentCoreCandidateStack as _i, AGENTCORE_SESSION_ID_HEADER as _n, evaluateResponseParameters as _r, addAlbSpecificOptions as _t, createLocalStudioCommand as a, filterWebSocketApisByIdentifiers as ai, bridgeAgentCoreWs as an, invokeTokenAuthorizer as ar, pickFunctionUrlLogicalIdFromOrigin as at, renderStudioHtml as b, formatStateRemedy as bi, waitForAgentCorePing as bn, tryParseStatus as br, parseLbPortOverrides as bt, startStudioProxy as c, discoverRoutes as ci, A2A_PATH as cn, buildCorsConfigByApiId as cr, pickTargetFunctionLogicalId as ct, createStudioDispatcher as d, AGENTCORE_A2A_PROTOCOL as di, MCP_PATH as dn, matchPreflight as dr, runViewerRequest as dt, countTargets as ei, setShadowReadyTimeoutMs as en, verifyJwtViaDiscovery as er, httpHeadersToEdge as et, filterStudioCustomResources as f, AGENTCORE_AGUI_PROTOCOL as fi, MCP_PROTOCOL_VERSION as fn, matchRoute as fr, runViewerResponse as ft, annotatePinnedEcsTargets as g, AgentCoreResolutionError as gi, signAgentCoreInvocation as gn, buildRestV1Event as gr, createUnboundCloudFrontModule as gt, annotateEcsTaskPinnedTargets as h, AGENTCORE_RUNTIME_TYPE as hi, AGENTCORE_SIGV4_SERVICE as hn, buildHttpApiV2Event as hr, createLocalFileKvsDataSource as ht, coerceStopRequest as i, discoverWebSocketApisOrThrow as ii, createLocalInvokeAgentCoreCommand as in, invokeRequestAuthorizer as ir, isCloudFrontDistribution as it, LocalStartCloudFrontError as j, createLocalStartApiCommand as jn, buildMessageEvent as jr, addEcsAssumeRoleOptions as jt, attachAgentCoreWsBridge as k, createLocalInvokeCommand as kn, buildConnectEvent as kr, MAX_TASKS_SUBNET_RANGE_CAP as kt, relayServeRequest as l, pickRefLogicalId as li, a2aInvokeOnce as ln, buildCorsConfigFromCloudFrontChain as lr, resolveCloudFrontDistribution as lt, annotateAlbPinnedBackingServices as m, AGENTCORE_MCP_PROTOCOL as mi, parseSseForJsonRpc as mn, applyAuthorizerOverlay as mr, createCloudFrontModule as mt, coerceRunRequest as n, availableWebSocketApiIdentifiers as ni, attachContainerLogStreamer as nn, computeRequestIdentityHash as nr, describeS3OriginDomain as nt, resolveServeBaseUrl as o, parseSelectionExpressionPath as oi, invokeAgentCoreWs as on, attachAuthorizers as or, pickKvsLogicalIdFromArn as ot, isCustomResourceLambdaTarget as p, AGENTCORE_HTTP_PROTOCOL as pi, mcpInvokeOnce as pn, translateLambdaResponse as pr, stripCloudFrontImport as pt, serveFromStaticOrigin as q, resolveServiceIntegrationParameters as qn, resolveCfnRegion as qr, describePinnedImageUri as qt, coerceServeRequest as r, discoverWebSocketApis as ri, addInvokeAgentCoreSpecificOptions as rn, evaluateCachedLambdaPolicy as rr, extractKvsAssociations as rt, createStudioServeManager as s, webSocketApiMatchesIdentifier as si, A2A_CONTAINER_PORT as sn, applyCorsResponseHeaders as sr, pickLambdaEdgeFunctionLogicalId as st, addStudioSpecificOptions as t, listTargets as ti, getContainerNetworkIp as tn, buildMethodArn as tr, CLOUDFRONT_DISTRIBUTION_TYPE as tt, reinvoke as u, resolveLambdaArnIntrinsic as ui, MCP_CONTAINER_PORT as un, isFunctionUrlOacFronted as ur, compileCloudFrontFunction as ut, startStudioServer as v, resolveAgentCoreTarget as vi, invokeAgentCore as vn, pickResponseTemplate as vr, albStrategy as vt, createLocalListCommand as w, buildStsClientConfig as wi, computeCodeImageTag as wn, bufferToBody as wr, addStartServiceSpecificOptions as wt, createStudioStore as x, substituteImagePlaceholders as xi, downloadAndExtractS3Bundle as xn, VtlEvaluationError as xr, resolveAlbTarget as xt, toStudioTargetGroups as y, derivePseudoParametersFromRegion as yi, waitForAgentCoreHttpReady as yn, selectIntegrationResponse as yr, createLocalStartAlbCommand as yt, createDeployedKvsDataSource as z, resolveEnvVars$1 as zn, substituteAgainstStateAsync as zr, runEcsServiceEmulator as zt };
+//# sourceMappingURL=local-studio-BqHODjfP.js.map