cdk-local 0.154.0 → 0.155.0

package/dist/{local-studio-CJfNARFz.js → local-studio-CsftJJ1r.js}

@@ -30,7 +30,7 @@ import { StringDecoder } from "node:string_decoder";
 import { promisify } from "node:util";
 import { ECRClient, GetAuthorizationTokenCommand } from "@aws-sdk/client-ecr";
 import { readFile } from "fs/promises";
-import { basename as basename$1, dirname as dirname$1, join as join$1 } from "path";
+import { basename as basename$1, dirname as dirname$1, isAbsolute as isAbsolute$1, join as join$1, posix, relative as relative$1, resolve as resolve$1, sep as sep$1 } from "path";
 import { WebSocket, WebSocketServer } from "ws";
 import { Readable } from "node:stream";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -46,6 +46,10 @@ import * as vm from "node:vm";
 import "@aws-sdk/signature-v4a";
 import { CloudFrontClient, paginateListKeyValueStores } from "@aws-sdk/client-cloudfront";
 import { CloudFrontKeyValueStoreClient, GetKeyCommand, ResourceNotFoundException } from "@aws-sdk/client-cloudfront-keyvaluestore";
+import { existsSync as existsSync$1, rmSync as rmSync$1, statSync as statSync$1 } from "fs";
+import { request as request$2 } from "http";
+import { execFile as execFile$1, spawn as spawn$1 } from "child_process";
+import { promisify as promisify$1 } from "util";
 import { EventEmitter } from "node:events";
 
 //#region src/utils/url-authority.ts
@@ -1595,14 +1599,14 @@ function parseTarget(target) {
 function resolveLambdaTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalInvokeResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseTarget(target);
-	const stack = pickStack$5(parsed, stacks, target);
+	const stack = pickStack$6(parsed, stacks, target);
 	const template = stack.template;
 	const resources = template.Resources ?? {};
 	let match;
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(template);
 		const lambdaMatches = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId }) => resources[logicalId]?.Type === "AWS::Lambda::Function");
-		if (lambdaMatches.length === 0) throw notFoundError$3(target, stack, resources);
+		if (lambdaMatches.length === 0) throw notFoundError$4(target, stack, resources);
 		if (lambdaMatches.length > 1) throw new LocalInvokeResolutionError(`Target '${target}' matches ${lambdaMatches.length} Lambda functions in ${displayStackName(stack.stackName)}: ` + lambdaMatches.map((m) => displayIdent(m.logicalId, { listMember: true })).join(", ") + ". Refine the path or use the stack:LogicalId form.");
 		const m = lambdaMatches[0];
 		match = {
@@ -1611,7 +1615,7 @@ function resolveLambdaTarget(target, stacks) {
 		};
 	} else {
 		const resource = resources[parsed.pathOrId];
-		if (!resource) throw notFoundError$3(target, stack, resources);
+		if (!resource) throw notFoundError$4(target, stack, resources);
 		match = {
 			logicalId: parsed.pathOrId,
 			resource
@@ -1624,7 +1628,7 @@ function resolveLambdaTarget(target, stacks) {
 	}
 	return extractLambdaProperties(stack, logicalId, resource, resources);
 }
-function pickStack$5(parsed, stacks, target) {
+function pickStack$6(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -1957,7 +1961,7 @@ function describeLayerEntry(entry) {
 		return Object.prototype.toString.call(entry);
 	}
 }
-function notFoundError$3(target, stack, resources) {
+function notFoundError$4(target, stack, resources) {
 	const lambdas = [];
 	for (const [logicalId, resource] of Object.entries(resources)) {
 		if (resource.Type !== "AWS::Lambda::Function") continue;
@@ -2002,7 +2006,7 @@ var AgentCoreResolutionError = class AgentCoreResolutionError extends Error {
 function resolveAgentCoreTarget(target, stacks, imageContext) {
 	if (stacks.length === 0) throw new AgentCoreResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseTarget(target);
-	const stack = pickStack$4(parsed, stacks, target);
+	const stack = pickStack$5(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	const { logicalId, resource } = matchRuntime(parsed, target, stack, resources);
 	if (resource.Type !== "AWS::BedrockAgentCore::Runtime") throw new AgentCoreResolutionError(`Resource ${displayIdent(logicalId)} in ${stack.stackName} is ${resource.Type}, not ${AGENTCORE_RUNTIME_TYPE}. ${getEmbedConfig().cliName} invoke-agentcore only runs Bedrock AgentCore Runtime resources.`);
@@ -2011,7 +2015,7 @@ function resolveAgentCoreTarget(target, stacks, imageContext) {
 function pickAgentCoreCandidateStack(target, stacks) {
 	return candidateTargetStack(parseTarget(target), target, stacks);
 }
-function pickStack$4(parsed, stacks, target) {
+function pickStack$5(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -2024,7 +2028,7 @@ function matchRuntime(parsed, target, stack, resources) {
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
 		const runtimeMatches = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId }) => resources[logicalId]?.Type === AGENTCORE_RUNTIME_TYPE);
-		if (runtimeMatches.length === 0) throw notFoundError$2(target, stack, resources);
+		if (runtimeMatches.length === 0) throw notFoundError$3(target, stack, resources);
 		if (runtimeMatches.length > 1) throw new AgentCoreResolutionError(`Target '${target}' matches ${runtimeMatches.length} AgentCore Runtimes in ${stack.stackName}: ` + runtimeMatches.map((m) => m.logicalId).join(", ") + ". Refine the path or use the stack:LogicalId form.");
 		const m = runtimeMatches[0];
 		return {
@@ -2033,13 +2037,13 @@ function matchRuntime(parsed, target, stack, resources) {
 		};
 	}
 	const resource = resources[parsed.pathOrId];
-	if (!resource) throw notFoundError$2(target, stack, resources);
+	if (!resource) throw notFoundError$3(target, stack, resources);
 	return {
 		logicalId: parsed.pathOrId,
 		resource
 	};
 }
-function notFoundError$2(target, stack, resources) {
+function notFoundError$3(target, stack, resources) {
 	const available = Object.entries(resources).filter(([, r]) => r.Type === AGENTCORE_RUNTIME_TYPE).map(([id]) => id);
 	const hint = available.length > 0 ? `Available AgentCore Runtimes in ${stack.stackName}: ${available.join(", ")}.` : `No ${AGENTCORE_RUNTIME_TYPE} resources found in ${stack.stackName}.`;
 	return new AgentCoreResolutionError(`Target '${target}' not found. ${hint}`);
@@ -3531,7 +3535,8 @@ function listTargets(stacks) {
 		ecsTaskDefinitions: sortEntries(scanByType(stacks, "AWS::ECS::TaskDefinition")),
 		agentCoreRuntimes: sortEntries(scanAgentCoreRuntimes(stacks)),
 		loadBalancers: sortEntries(scanApplicationLoadBalancers(stacks)),
-		cloudFrontDistributions: sortEntries(scanByType(stacks, "AWS::CloudFront::Distribution"))
+		cloudFrontDistributions: sortEntries(scanByType(stacks, "AWS::CloudFront::Distribution")),
+		webFunctions: sortEntries(scanByType(stacks, "AWS::Lambda::WebFunction"))
 	};
 }
 const pathOf$1 = (e) => e.displayPath ?? e.qualifiedId;
@@ -3554,7 +3559,7 @@ function sortApiEntries(entries) {
 	});
 }
 function countTargets(listing) {
-	return listing.lambdas.length + listing.apis.length + listing.ecsServices.length + listing.ecsTaskDefinitions.length + listing.agentCoreRuntimes.length + listing.loadBalancers.length + listing.cloudFrontDistributions.length;
+	return listing.lambdas.length + listing.apis.length + listing.ecsServices.length + listing.ecsTaskDefinitions.length + listing.agentCoreRuntimes.length + listing.loadBalancers.length + listing.cloudFrontDistributions.length + listing.webFunctions.length;
 }
 
 //#endregion
@@ -5095,28 +5100,28 @@ function parseEcsTarget(target) {
 function resolveEcsTaskTarget(target, stacks, context) {
 	if (stacks.length === 0) throw new EcsTaskResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack$3(parsed, stacks, target);
+	const stack = pickStack$4(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	let logicalId;
 	let resource;
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
 		const taskDefs = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId: l }) => resources[l]?.Type === "AWS::ECS::TaskDefinition");
-		if (taskDefs.length === 0) throw notFoundError$1(target, stack, resources);
+		if (taskDefs.length === 0) throw notFoundError$2(target, stack, resources);
 		if (taskDefs.length > 1) throw new EcsTaskResolutionError(`Target '${target}' matches ${taskDefs.length} task definitions in ${stack.stackName}: ` + taskDefs.map((t) => t.logicalId).join(", ") + ". Refine the path or use the stack:LogicalId form.");
 		logicalId = taskDefs[0].logicalId;
 		resource = resources[logicalId];
 	} else {
 		resource = resources[parsed.pathOrId];
-		if (!resource) throw notFoundError$1(target, stack, resources);
+		if (!resource) throw notFoundError$2(target, stack, resources);
 		logicalId = parsed.pathOrId;
 	}
-	if (!logicalId || !resource) throw notFoundError$1(target, stack, resources);
+	if (!logicalId || !resource) throw notFoundError$2(target, stack, resources);
 	if (resource.Type === "AWS::Lambda::Function") throw new EcsTaskResolutionError(`Resource ${displayIdent(logicalId)} in ${stack.stackName} is a Lambda function, not an ECS task definition. Use \`${getEmbedConfig().cliName} invoke\` for Lambda; \`${getEmbedConfig().cliName} run-task\` is ECS only.`);
 	if (resource.Type !== "AWS::ECS::TaskDefinition") throw new EcsTaskResolutionError(`Resource ${displayIdent(logicalId)} in ${stack.stackName} is ${displayIdent(resource.Type)}, not an AWS::ECS::TaskDefinition.`);
 	return extractTaskDefinitionProperties(stack, logicalId, resource, context);
 }
-function pickStack$3(parsed, stacks, target) {
+function pickStack$4(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -5545,7 +5550,7 @@ function pickStringArray$1(value) {
 	for (const v of value) if (typeof v === "string") out.push(v);
 	return out;
 }
-function notFoundError$1(target, stack, resources) {
+function notFoundError$2(target, stack, resources) {
 	const tasks = [];
 	for (const [logicalId, resource] of Object.entries(resources)) {
 		if (resource.Type !== "AWS::ECS::TaskDefinition") continue;
@@ -6488,7 +6493,7 @@ function pushMap(hash, name, value) {
 
 //#endregion
 //#region src/local/docker-runner.ts
-const execFileAsync$5 = promisify(execFile);
+const execFileAsync$6 = promisify(execFile);
 var DockerRunnerError = class DockerRunnerError extends Error {
 	constructor(message) {
 		super(message);
@@ -6535,7 +6540,7 @@ async function pullImage(image, skipPull, platform) {
 	}
 }
 async function runDetached(opts) {
-	const args = [
+	const args = opts.autoRemove === false ? ["run", "-d"] : [
 		"run",
 		"-d",
 		"--rm"
@@ -6579,7 +6584,7 @@ async function runDetached(opts) {
 	if (refusal !== void 0) throw new DockerRunnerError(refusal);
 	warnFinchArgvExposure(forwardedKeys);
 	try {
-		const { stdout } = await execFileAsync$5(getDockerCmd(), args, {
+		const { stdout } = await execFileAsync$6(getDockerCmd(), args, {
 			maxBuffer: 10 * 1024 * 1024,
 			...execEnvForSecrets(passthroughEnv)
 		});
@@ -6620,7 +6625,7 @@ function createPrefixedLineRelay(prefix, out) {
 		}
 	};
 }
-function streamLogs(containerId) {
+function streamLogs(containerId, opts = {}) {
 	const proc = spawn(getDockerCmd(), [
 		"logs",
 		"-f",
@@ -6630,6 +6635,11 @@ function streamLogs(containerId) {
 		"pipe",
 		"pipe"
 	] });
+	if (opts.onOutput) {
+		const tap = opts.onOutput;
+		proc.stdout?.on("data", (chunk) => tap(chunk));
+		proc.stderr?.on("data", (chunk) => tap(chunk));
+	}
 	let flush = () => void 0;
 	if (process.env["CDKL_PREFIX_CONTAINER_OUTPUT"] === "1") {
 		const tag = `[${flattenToOneLine(containerId.slice(0, 12)).replace(/[\]\s]/g, "_")}] `;
@@ -6656,7 +6666,7 @@ async function removeContainer(containerId) {
 	if (!containerId) return;
 	const logger = getLogger().child("docker");
 	try {
-		await execFileAsync$5(getDockerCmd(), [
+		await execFileAsync$6(getDockerCmd(), [
 			"rm",
 			"-f",
 			containerId
@@ -6670,7 +6680,7 @@ async function removeContainer(containerId) {
 async function ensureDockerAvailable() {
 	const cmd = getDockerCmd();
 	try {
-		await execFileAsync$5(cmd, [
+		await execFileAsync$6(cmd, [
 			"version",
 			"--format",
 			"{{.Server.Version}}"
@@ -14095,7 +14105,7 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 			for (const key of audit.resolvedKeys) logger.debug(`${label}: substituted env var ${key}`);
 			let unresolved = audit.unresolved;
 			const resolvedKeys = [...audit.resolvedKeys];
-			if (unresolved.length > 0 && stateProvider.resolveDeployedFunctionEnv) {
+			if (unresolved.length > 0 && options.deployedFunctionLookups !== false && stateProvider.resolveDeployedFunctionEnv) {
 				const physicalId = loaded.resources[lambda.logicalId]?.physicalId;
 				if (physicalId) {
 					const deployedEnv = await stateProvider.resolveDeployedFunctionEnv(physicalId);
@@ -14137,7 +14147,9 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 	});
 	let resolvedAssumeRoleArn;
 	try {
-		resolvedAssumeRoleArn = await resolveAssumeRoleArnForLambda(options.assumeRole, stateForRoleHint, stateProvider, lambda.logicalId);
+		const fromTemplate = options.assumeRole === true && options.deployedFunctionLookups === false && stateForRoleHint ? await resolveTemplateRoleArnFromState(lambda.resource.Properties?.["Role"], stateForRoleHint, lambda.stack.template, () => resolvePseudoParametersForInvoke(lambda.stack.region, options)) : void 0;
+		if (fromTemplate !== void 0) logger.info(`--assume-role: auto-resolved execution role from state: ${flattenToOneLine(fromTemplate)}`);
+		resolvedAssumeRoleArn = fromTemplate ?? await resolveAssumeRoleArnForLambda(options.assumeRole, stateForRoleHint, options.deployedFunctionLookups === false ? void 0 : stateProvider, lambda.logicalId);
 	} finally {
 		stateProvider?.dispose();
 	}
@@ -14248,6 +14260,28 @@ function resolveExecutionRoleArnFromState(state, logicalId, roleProperty = "Role
 		}
 	}
 }
+async function resolveTemplateRoleArnFromState(templateRole, state, template, pseudo) {
+	if (isIamRoleArn(templateRole)) return templateRole;
+	if (!templateRole || typeof templateRole !== "object" || Array.isArray(templateRole)) return;
+	const ref = pickReferencedLogicalId(templateRole);
+	if (ref === void 0) return void 0;
+	const roleResource = template.Resources?.[ref];
+	if (roleResource?.Type !== "AWS::IAM::Role") return void 0;
+	const deployed = state.resources[ref];
+	if (!deployed) return void 0;
+	const cached = deployed.attributes?.["Arn"];
+	if (isIamRoleArn(cached)) return cached;
+	const physicalId = deployed.physicalId;
+	if (isIamRoleArn(physicalId)) return physicalId;
+	if (typeof physicalId !== "string" || !/^[\w+=,.@-]{1,64}$/.test(physicalId)) return void 0;
+	const rawPath = roleResource.Properties?.["Path"];
+	if (rawPath !== void 0 && typeof rawPath !== "string") return void 0;
+	const rolePath = rawPath ?? "/";
+	const bag = await pseudo();
+	if (!bag?.accountId) return void 0;
+	const arn = `arn:${bag.partition ?? "aws"}:iam::${bag.accountId}:role${rolePath}${physicalId}`;
+	return isIamRoleArn(arn) ? arn : void 0;
+}
 function pickReferencedLogicalId(intrinsic) {
 	if ("Ref" in intrinsic && typeof intrinsic["Ref"] === "string") return intrinsic["Ref"];
 	if ("Fn::GetAtt" in intrinsic) {
@@ -15996,7 +16030,7 @@ async function runAgentCoreWatchLoop(args) {
 		}
 	}
 }
-const execFileAsync$4 = promisify(execFile);
+const execFileAsync$5 = promisify(execFile);
 function describeExecError(err) {
 	if (!(err instanceof Error)) return String(err);
 	const stderr = err.stderr;
@@ -16008,7 +16042,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	const dockerCmd = getDockerCmd();
 	let workdir;
 	try {
-		const { stdout } = await execFileAsync$4(dockerCmd, [
+		const { stdout } = await execFileAsync$5(dockerCmd, [
 			"inspect",
 			"--format",
 			"{{.Config.WorkingDir}}",
@@ -16021,7 +16055,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	const workdirDest = workdir.endsWith("/") ? workdir : `${workdir}/`;
 	logger.info(`Soft-reload: docker cp ${flattenToOneLine(newAssetSourceDir)} -> ${containerId}:${workdirDest}; restart.`);
 	try {
-		await execFileAsync$4(dockerCmd, [
+		await execFileAsync$5(dockerCmd, [
 			"cp",
 			`${newAssetSourceDir}/.`,
 			`${containerId}:${workdirDest}`
@@ -16030,7 +16064,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 		throw new CdkLocalError(`softReloadAgentContainer: docker cp into '${containerId}:${workdir}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_CP_FAILED");
 	}
 	try {
-		await execFileAsync$4(dockerCmd, ["restart", containerId]);
+		await execFileAsync$5(dockerCmd, ["restart", containerId]);
 	} catch (err) {
 		throw new CdkLocalError(`softReloadAgentContainer: docker restart of '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_RESTART_FAILED");
 	}
@@ -16206,7 +16240,7 @@ function writePrefixedLines(prefix, buffer, out) {
 
 //#endregion
 //#region src/local/ecs-network.ts
-const execFileAsync$3 = promisify(execFile);
+const execFileAsync$4 = promisify(execFile);
 const METADATA_ENDPOINT_IMAGE = "amazon/amazon-ecs-local-container-endpoints:latest-amd64";
 const METADATA_ENDPOINT_IP = "169.254.170.2";
 const DEFAULT_METADATA_ENDPOINT_SUBNET = "169.254.170.0/24";
@@ -16242,7 +16276,7 @@ async function sweepOrphanedSvcNetworks(prefix) {
 	const filter = `${prefix}-svc-`;
 	let names;
 	try {
-		const { stdout } = await execFileAsync$3(getDockerCmd(), [
+		const { stdout } = await execFileAsync$4(getDockerCmd(), [
 			"network",
 			"ls",
 			"--filter",
@@ -16260,7 +16294,7 @@ async function sweepOrphanedSvcNetworks(prefix) {
 	for (const name of names) {
 		let attached;
 		try {
-			const { stdout } = await execFileAsync$3(getDockerCmd(), [
+			const { stdout } = await execFileAsync$4(getDockerCmd(), [
 				"network",
 				"inspect",
 				name,
@@ -16288,7 +16322,7 @@ async function createNetworkAndSidecar(args) {
 	await pullImage(METADATA_ENDPOINT_IMAGE, skipPull);
 	logger.info(`Creating docker network ${networkName} (subnet ${cidr})...`);
 	try {
-		await execFileAsync$3(getDockerCmd(), [
+		await execFileAsync$4(getDockerCmd(), [
 			"network",
 			"create",
 			"--driver",
@@ -16325,7 +16359,7 @@ async function createNetworkAndSidecar(args) {
 	warnFinchArgvExposure(Object.keys(sidecarPassthroughEnv));
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
 	try {
-		const { stdout } = await execFileAsync$3(getDockerCmd(), sidecarArgs, {
+		const { stdout } = await execFileAsync$4(getDockerCmd(), sidecarArgs, {
 			maxBuffer: 10 * 1024 * 1024,
 			...execEnvForSecrets(sidecarPassthroughEnv)
 		});
@@ -16373,7 +16407,7 @@ async function destroyNetworkOnly(networkName) {
 	if (!networkName) return;
 	const logger = getLogger().child("ecs-network");
 	try {
-		await execFileAsync$3(getDockerCmd(), [
+		await execFileAsync$4(getDockerCmd(), [
 			"network",
 			"rm",
 			networkName
@@ -16487,7 +16521,7 @@ async function resolveSsm(entry, shape, client) {
 
 //#endregion
 //#region src/local/ecs-task-runner.ts
-const execFileAsync$2 = promisify(execFile);
+const execFileAsync$3 = promisify(execFile);
 var EcsTaskRunnerError = class EcsTaskRunnerError extends Error {
 	constructor(message) {
 		super(message);
@@ -16530,7 +16564,7 @@ async function cleanupEcsRun(state, options) {
 	if (state.network && !state.network.ownedByCaller) await destroyTaskNetwork(state.network);
 	state.network = void 0;
 	for (const v of state.dockerVolumeNames) try {
-		await execFileAsync$2(getDockerCmd(), [
+		await execFileAsync$3(getDockerCmd(), [
 			"volume",
 			"rm",
 			v
@@ -16681,7 +16715,7 @@ async function runEcsTask(task, options, state) {
 		let id;
 		warnFinchArgvExposure(Object.keys(sensitiveEnv));
 		try {
-			const { stdout } = await execFileAsync$2(getDockerCmd(), args, {
+			const { stdout } = await execFileAsync$3(getDockerCmd(), args, {
 				maxBuffer: 10 * 1024 * 1024,
 				...execEnvForSecrets(sensitiveEnv)
 			});
@@ -16773,7 +16807,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 	let lastStatus = "";
 	while (Date.now() < deadline) {
 		try {
-			const { stdout } = await execFileAsync$2(getDockerCmd(), [
+			const { stdout } = await execFileAsync$3(getDockerCmd(), [
 				"inspect",
 				"--format",
 				"{{.State.Health.Status}}",
@@ -16796,7 +16830,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 }
 async function waitForContainerExit(containerId) {
 	try {
-		const { stdout } = await execFileAsync$2(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
+		const { stdout } = await execFileAsync$3(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 		const code = Number.parseInt(stdout.trim(), 10);
 		return Number.isFinite(code) ? code : 1;
 	} catch (err) {
@@ -16806,7 +16840,7 @@ async function waitForContainerExit(containerId) {
 }
 async function stopContainer(containerId, graceSeconds) {
 	try {
-		await execFileAsync$2(getDockerCmd(), [
+		await execFileAsync$3(getDockerCmd(), [
 			"stop",
 			"-t",
 			String(graceSeconds),
@@ -16901,7 +16935,7 @@ async function realizeDockerVolumes(volumes, state) {
 		const dockerVolumeName = `${getEmbedConfig().resourceNamePrefix}-${v.name}-${randHex(4)}`;
 		args.push(dockerVolumeName);
 		try {
-			await execFileAsync$2(getDockerCmd(), args);
+			await execFileAsync$3(getDockerCmd(), args);
 			state.dockerVolumeNames.push(dockerVolumeName);
 			logger.debug(`Created docker volume ${displayIdent(dockerVolumeName)} for task volume ${displayIdent(v.name)}`);
 		} catch (err) {
@@ -17095,23 +17129,23 @@ function shellJoin(parts) {
 function resolveEcsServiceTarget(target, stacks, context, options) {
 	if (stacks.length === 0) throw new EcsTaskResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack$2(parsed, stacks, target);
+	const stack = pickStack$3(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	let serviceLogicalId;
 	let serviceResource;
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
 		const services = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId: l }) => resources[l]?.Type === "AWS::ECS::Service");
-		if (services.length === 0) throw notFoundError(target, stack, resources, parsed);
+		if (services.length === 0) throw notFoundError$1(target, stack, resources, parsed);
 		if (services.length > 1) throw new EcsTaskResolutionError(`Target '${target}' matches ${services.length} ECS services in ${stack.stackName}: ` + services.map((s) => s.logicalId).join(", ") + ". Refine the path or use the stack:LogicalId form.");
 		serviceLogicalId = services[0].logicalId;
 		serviceResource = resources[serviceLogicalId];
 	} else {
 		serviceResource = resources[parsed.pathOrId];
-		if (!serviceResource) throw notFoundError(target, stack, resources, parsed);
+		if (!serviceResource) throw notFoundError$1(target, stack, resources, parsed);
 		serviceLogicalId = parsed.pathOrId;
 	}
-	if (!serviceLogicalId || !serviceResource) throw notFoundError(target, stack, resources, parsed);
+	if (!serviceLogicalId || !serviceResource) throw notFoundError$1(target, stack, resources, parsed);
 	if (serviceResource.Type === "AWS::ECS::TaskDefinition") throw new EcsTaskResolutionError(`Resource ${displayIdent(serviceLogicalId)} in ${stack.stackName} is an ECS TaskDefinition, not a Service. Use \`${getEmbedConfig().cliName} run-task\` for one-shot tasks; \`${getEmbedConfig().cliName} start-service\` is Service-only.`);
 	if (serviceResource.Type !== "AWS::ECS::Service") throw new EcsTaskResolutionError(`Resource ${displayIdent(serviceLogicalId)} in ${stack.stackName} is ${displayIdent(serviceResource.Type)}, not an AWS::ECS::Service.`);
 	return extractServiceProperties(stack, serviceLogicalId, serviceResource, stacks, context, options);
@@ -17267,7 +17301,7 @@ function deriveServiceDisplayName(rawServiceName, serviceLogicalId, metadata) {
 	}
 	return serviceLogicalId;
 }
-function pickStack$2(parsed, stacks, target) {
+function pickStack$3(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -17276,7 +17310,7 @@ function pickStack$2(parsed, stacks, target) {
 		case "ambiguous": throw new EcsTaskResolutionError(`Multiple stacks match '${selection.pattern}': ${describeStacks(selection.matched)}. Refine the pattern, or use the stack's display path (path form).`);
 	}
 }
-function notFoundError(target, stack, resources, parsed) {
+function notFoundError$1(target, stack, resources, parsed) {
 	const services = [];
 	for (const [logicalId, r] of Object.entries(resources)) {
 		if (r.Type !== "AWS::ECS::Service") continue;
@@ -17301,11 +17335,11 @@ function notFoundError(target, stack, resources, parsed) {
 
 //#endregion
 //#region src/local/docker-inspect.ts
-const execFileAsync$1 = promisify(execFile);
+const execFileAsync$2 = promisify(execFile);
 async function getContainerNetworkIp(containerId, networkName) {
 	const format = `{{with index .NetworkSettings.Networks "${networkName}"}}{{.IPAddress}}{{end}}`;
 	try {
-		const { stdout } = await execFileAsync$1(getDockerCmd(), [
+		const { stdout } = await execFileAsync$2(getDockerCmd(), [
 			"inspect",
 			"--format",
 			format,
@@ -17321,7 +17355,7 @@ async function getContainerNetworkIp(containerId, networkName) {
 async function getPublishedHostPort(containerId, containerPort, protocol = "tcp") {
 	const format = `{{with index .NetworkSettings.Ports "${`${containerPort}/${protocol}`}"}}{{with index . 0}}{{.HostPort}}{{end}}{{end}}`;
 	try {
-		const { stdout } = await execFileAsync$1(getDockerCmd(), [
+		const { stdout } = await execFileAsync$2(getDockerCmd(), [
 			"inspect",
 			"--format",
 			format,
@@ -19516,7 +19550,7 @@ function matchBitPrefix(a, b, prefixLength) {
 
 //#endregion
 //#region src/local/front-door-tls.ts
-const execFileAsync = promisify(execFile);
+const execFileAsync$1 = promisify(execFile);
 async function resolveFrontDoorTlsMaterials(opts) {
 	const hasCert = opts.certPath !== void 0 && opts.certPath !== "";
 	const hasKey = opts.keyPath !== void 0 && opts.keyPath !== "";
@@ -19606,7 +19640,7 @@ function readCertNotAfter(certPath) {
 	}
 }
 async function runOpenssl(args) {
-	await execFileAsync("openssl", args, { timeout: 3e4 });
+	await execFileAsync$1("openssl", args, { timeout: 3e4 });
 }
 function readPemOrThrow(path, flagName) {
 	try {
@@ -21809,7 +21843,7 @@ function resolveAlbFrontDoor(stack, albLogicalId) {
 		if (resource.Type !== LISTENER_TYPE) continue;
 		const props = resource.Properties ?? {};
 		if (refOf(props["LoadBalancerArn"]) !== albLogicalId) continue;
-		const port = parsePort$1(props["Port"]);
+		const port = parsePort$2(props["Port"]);
 		if (port === void 0) continue;
 		const protocol = typeof props["Protocol"] === "string" ? props["Protocol"] : "HTTP";
 		if (protocol !== "HTTP" && protocol !== "HTTPS") {
@@ -22174,7 +22208,7 @@ function refOf(raw) {
 		if (typeof ref === "string" && ref.length > 0) return ref;
 	}
 }
-function parsePort$1(raw) {
+function parsePort$2(raw) {
 	if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1 && raw <= 65535) return raw;
 	if (typeof raw === "string" && /^\d+$/.test(raw)) {
 		const n = parseInt(raw, 10);
@@ -22182,7 +22216,7 @@ function parsePort$1(raw) {
 	}
 }
 function parseContainerPort(raw) {
-	return parsePort$1(raw);
+	return parsePort$2(raw);
 }
 function parseWeight(raw) {
 	if (typeof raw === "number" && Number.isFinite(raw)) return raw < 0 ? 0 : raw;
@@ -22276,7 +22310,7 @@ function parseLbPortOverrides(values) {
 function resolveAlbTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalStartServiceError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack$1(parsed, stacks, target);
+	const stack = pickStack$2(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
@@ -22298,7 +22332,7 @@ function resolveAlbTarget(target, stacks) {
 		albLogicalId: parsed.pathOrId
 	};
 }
-function pickStack$1(parsed, stacks, target) {
+function pickStack$2(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -24213,7 +24247,7 @@ async function attachKvsModules(distribution, stacks, options, profileCredential
 function resolveCloudFrontTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalStartCloudFrontError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack(parsed, stacks, target);
+	const stack = pickStack$1(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
@@ -24235,7 +24269,7 @@ function resolveCloudFrontTarget(target, stacks) {
 		logicalId: parsed.pathOrId
 	};
 }
-function pickStack(parsed, stacks, target) {
+function pickStack$1(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -24858,7 +24892,7 @@ function readAuthorizationHeader(headers) {
 
 //#endregion
 //#region src/cli/commands/local-start-agentcore.ts
-function parsePort(raw) {
+function parsePort$1(raw) {
 	const n = Number(raw);
 	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
 	return n;
@@ -25186,7 +25220,761 @@ function createLocalStartAgentCoreCommand(opts = {}) {
 	return cmd;
 }
 function addStartAgentCoreSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--watch", "Re-synth + reload the warm container in place on a CDK source change, keeping the serve up. A per-firing classifier picks rebuild (boot a fresh container, re-point the serve) vs soft-reload (docker cp + docker restart the same container) — the same pattern as start-service / invoke-agentcore --ws --watch.")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort$1)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--watch", "Re-synth + reload the warm container in place on a CDK source change, keeping the serve up. A per-firing classifier picks rebuild (boot a fresh container, re-point the serve) vs soft-reload (docker cp + docker restart the same container) — the same pattern as start-service / invoke-agentcore --ws --watch.")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+}
+
+//#endregion
+//#region src/local/web-function-resolver.ts
+const WEB_FUNCTION_TYPE = "AWS::Lambda::WebFunction";
+const WEB_FUNCTION_REVISION_TYPE = "AWS::Lambda::WebFunctionRevision";
+const WEB_FUNCTION_ENDPOINT_TYPE = "AWS::Lambda::WebFunctionEndpoint";
+const WEB_TYPES = [
+	WEB_FUNCTION_ENDPOINT_TYPE,
+	WEB_FUNCTION_TYPE,
+	WEB_FUNCTION_REVISION_TYPE
+];
+var WebFunctionResolutionError = class WebFunctionResolutionError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WebFunctionResolutionError";
+		Object.setPrototypeOf(this, WebFunctionResolutionError.prototype);
+	}
+};
+function resolveWebFunctionTarget(target, stacks, revisionFlag) {
+	if (stacks.length === 0) throw new WebFunctionResolutionError("No stacks found in the synthesized assembly.");
+	const parsed = parseTarget(target);
+	const stack = pickStack(parsed, stacks, target);
+	const resources = stack.template.Resources ?? {};
+	const { logicalId, resource } = matchWebResource(parsed, target, stack, resources);
+	const functions = logicalIdsOfType(resources, WEB_FUNCTION_TYPE);
+	const linked = (value) => linkedFunctionLogicalId(value, resources, functions);
+	let functionLogicalId;
+	let endpoint;
+	let revisionLogicalId;
+	let selection;
+	if (resource.Type === "AWS::Lambda::WebFunctionRevision") {
+		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
+		revisionLogicalId = logicalId;
+		selection = "target-revision";
+	} else if (resource.Type === "AWS::Lambda::WebFunctionEndpoint") {
+		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
+		endpoint = readEndpoint(logicalId, resource, resources);
+	} else functionLogicalId = logicalId;
+	const revisionsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_REVISION_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
+	const endpointsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_ENDPOINT_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
+	if (revisionFlag !== void 0) {
+		const flagged = resources[revisionFlag];
+		if (!flagged || flagged.Type !== "AWS::Lambda::WebFunctionRevision") throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} is not an ${WEB_FUNCTION_REVISION_TYPE} logical id in ${displayStackName(stack.stackName)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
+		const owner = linked(flagged.Properties?.["FunctionName"]);
+		if (functionLogicalId !== void 0 && owner !== functionLogicalId) throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} belongs to a different web function than ${displayIdent(logicalId)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
+		functionLogicalId ??= owner;
+		revisionLogicalId = revisionFlag;
+		selection = "revision-flag";
+	}
+	if (revisionLogicalId === void 0 && endpoint !== void 0) {
+		revisionLogicalId = pickHighestWeight(endpoint);
+		if (revisionLogicalId !== void 0) selection = "endpoint-weight";
+	}
+	if (revisionLogicalId === void 0) {
+		const revisions = revisionsOfFunction();
+		if (revisions.length === 1) {
+			revisionLogicalId = revisions[0];
+			selection = "only-revision";
+		} else if (endpoint === void 0 && revisions.length > 1) {
+			const endpoints = endpointsOfFunction();
+			if (endpoints.length === 1) {
+				endpoint = readEndpoint(endpoints[0], resources[endpoints[0]], resources);
+				revisionLogicalId = pickHighestWeight(endpoint);
+				if (revisionLogicalId !== void 0) selection = "endpoint-weight";
+			}
+		}
+		if (revisionLogicalId === void 0) throw new WebFunctionResolutionError(revisions.length === 0 ? `${displayIdent(logicalId)} in ${displayStackName(stack.stackName)} resolves to no ${WEB_FUNCTION_REVISION_TYPE} in this template, so there is no code to serve. Target the revision itself, or pass --revision <logicalId>.` : `${displayIdent(logicalId)} has ${revisions.length} revisions and no single endpoint that picks one. Pass --revision <logicalId>, or target one of the function's endpoints. ${describeRevisions(revisions, stack)}`);
+	}
+	if (endpoint === void 0) {
+		const routing = endpointsOfFunction().map((id) => readEndpoint(id, resources[id], resources)).filter((e) => e.weights.some((w) => w.revisionLogicalId === revisionLogicalId));
+		if (routing.length === 1) endpoint = routing[0];
+	}
+	const fnName = (functionLogicalId !== void 0 ? resources[functionLogicalId] : void 0)?.Properties?.["FunctionName"];
+	return {
+		stack,
+		functionLogicalId,
+		functionName: typeof fnName === "string" && fnName.length > 0 ? fnName : functionLogicalId ?? revisionLogicalId,
+		revisionLogicalId,
+		revision: resources[revisionLogicalId],
+		endpoint,
+		selection: selection ?? "only-revision"
+	};
+}
+function pickStack(parsed, stacks, target) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new WebFunctionResolutionError(`Multiple stacks in app, target ${displayIdent(parsed.pathOrId)} is missing a stack prefix. Use StackName:<logicalId> or StackName/... (path form). Available stacks: ${describeStacks(stacks)}.`);
+		case "not-found": throw new WebFunctionResolutionError(`Stack ${displayStackName(selection.pattern)} not found. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new WebFunctionResolutionError(`Stack pattern ${displayStackName(selection.pattern)} matched ${selection.matched.length} stacks: ${describeStacks(selection.matched)}. Use a more specific pattern, or the stack's display path.`);
+	}
+}
+function matchWebResource(parsed, target, stack, resources) {
+	if (parsed.isPath) {
+		const matches = resolveCdkPathToLogicalIds(parsed.pathOrId, buildCdkPathIndex(stack.template)).filter(({ logicalId }) => WEB_TYPES.includes(resources[logicalId]?.Type ?? ""));
+		for (const type of WEB_TYPES) {
+			const ofType = matches.filter(({ logicalId }) => resources[logicalId].Type === type);
+			if (ofType.length === 1) {
+				const id = ofType[0].logicalId;
+				return {
+					logicalId: id,
+					resource: resources[id]
+				};
+			}
+			if (ofType.length > 1) throw new WebFunctionResolutionError(`Target ${displayStackName(target)} matches ${ofType.length} ${type} resources: ${ofType.map((m) => displayIdent(m.logicalId)).join(", ")}. Refine the path or use the StackName:<logicalId> form.`);
+		}
+		throw notFoundError(target, stack, resources);
+	}
+	const resource = resources[parsed.pathOrId];
+	if (!resource) throw notFoundError(target, stack, resources);
+	if (!WEB_TYPES.includes(resource.Type)) throw new WebFunctionResolutionError(`Resource ${displayIdent(parsed.pathOrId)} in ${displayStackName(stack.stackName)} is ${displayIdent(resource.Type)}, not a Lambda web function. ${getEmbedConfig().cliName} start-web-function serves ${WEB_TYPES.join(" / ")} targets.`);
+	return {
+		logicalId: parsed.pathOrId,
+		resource
+	};
+}
+function notFoundError(target, stack, resources) {
+	const available = WEB_TYPES.flatMap((t) => logicalIdsOfType(resources, t));
+	const hint = available.length > 0 ? `Web function resources in ${displayStackName(stack.stackName)}: ${available.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_TYPE} resources found in ${displayStackName(stack.stackName)}.`;
+	return new WebFunctionResolutionError(`Target ${displayStackName(target)} not found. ${hint}`);
+}
+function logicalIdsOfType(resources, type) {
+	return Object.keys(resources).filter((id) => resources[id]?.Type === type);
+}
+function linkedFunctionLogicalId(value, resources, functions) {
+	const ref = referencedLogicalId(value);
+	if (ref !== void 0) return functions.includes(ref) ? ref : void 0;
+	if (typeof value !== "string") return void 0;
+	const byName = functions.filter((id) => resources[id]?.Properties?.["FunctionName"] === value);
+	return byName.length === 1 ? byName[0] : void 0;
+}
+function referencedLogicalId(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const obj = value;
+	if (typeof obj["Ref"] === "string") return obj["Ref"];
+	const getAtt = obj["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
+	if (typeof getAtt === "string") return getAtt.split(".")[0];
+}
+function readEndpoint(logicalId, resource, resources) {
+	const props = resource.Properties ?? {};
+	const rawWeights = props["RevisionWeights"];
+	const weights = [];
+	if (Array.isArray(rawWeights)) for (const entry of rawWeights) {
+		if (!entry || typeof entry !== "object") continue;
+		const e = entry;
+		const ref = referencedLogicalId(e["RevisionId"]);
+		weights.push({
+			revisionLogicalId: ref !== void 0 && resources[ref]?.Type === "AWS::Lambda::WebFunctionRevision" ? ref : void 0,
+			weight: typeof e["Weight"] === "number" ? e["Weight"] : 0
+		});
+	}
+	const str = (v) => typeof v === "string" ? v : void 0;
+	return {
+		logicalId,
+		endpointType: str(props["EndpointType"]),
+		authType: str(props["AuthType"]),
+		weights
+	};
+}
+function pickHighestWeight(endpoint) {
+	let best;
+	for (const w of endpoint.weights) {
+		if (w.revisionLogicalId === void 0) continue;
+		if (best === void 0 || w.weight > best.weight) best = w;
+	}
+	return best?.revisionLogicalId;
+}
+function describeRevisions(revisions, stack) {
+	return revisions.length > 0 ? `Revisions: ${revisions.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_REVISION_TYPE} linked to it in ${displayStackName(stack.stackName)}.`;
+}
+
+//#endregion
+//#region src/local/web-function-artifact.ts
+const SUPPORTED_CODE_CONFIG_KEYS = ["S3Object"];
+function parseWebFunctionBuildConfig(revisionLogicalId, buildConfig) {
+	const subject = `Web function revision ${displayIdent(revisionLogicalId)}`;
+	const build = asObject$1(buildConfig);
+	const runtime = asObject$1(build?.["RuntimeConfig"])?.["Runtime"];
+	if (typeof runtime !== "string" || runtime.length === 0) throw new CdkLocalError(`${subject} has no literal BuildConfig.RuntimeConfig.Runtime.`, "LOCAL_START_WEB_FUNCTION_NO_RUNTIME");
+	const codeConfig = asObject$1(build?.["CodeConfig"]);
+	if (!codeConfig) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
+	const unknownKeys = Object.keys(codeConfig).filter((k) => !SUPPORTED_CODE_CONFIG_KEYS.includes(k));
+	if (unknownKeys.length > 0) throw new CdkLocalError(`${subject} uses BuildConfig.CodeConfig.${unknownKeys.map((k) => displayIdent(k)).join(", ")}, which ${getEmbedConfig().cliName} start-web-function does not support yet. Supported: ${SUPPORTED_CODE_CONFIG_KEYS.join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_CODE_CONFIG");
+	const s3 = asObject$1(codeConfig["S3Object"]);
+	if (!s3) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig.S3Object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
+	const key = s3["Key"];
+	if (typeof key !== "string" || key.length === 0) throw new CdkLocalError(`${subject} has a CodeConfig.S3Object.Key that is not a literal string (${describeValue(key)}). The code must come from a CDK asset in this app (for example an s3assets.Asset passing asset.s3BucketName / asset.s3ObjectKey), whose key synthesizes as a literal.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_NOT_LITERAL");
+	const versionId = s3["VersionId"];
+	return {
+		runtime,
+		s3Object: {
+			bucket: s3["Bucket"],
+			key,
+			...typeof versionId === "string" && { versionId }
+		}
+	};
+}
+function findFileAssetForObjectKey(manifest, key) {
+	for (const [hash, asset] of Object.entries(manifest.files ?? {})) for (const dest of Object.values(asset.destinations ?? {})) if (dest.objectKey === key || dest.objectKey.endsWith(`/${key}`)) return {
+		hash,
+		asset
+	};
+	const hash = key.replace(/^.*\//, "").replace(/\.zip$/, "");
+	const byHash = Object.hasOwn(manifest.files ?? {}, hash) ? manifest.files[hash] : void 0;
+	return byHash ? {
+		hash,
+		asset: byHash
+	} : void 0;
+}
+async function resolveWebFunctionArtifact(stack, revisionLogicalId, code, loader = new AssetManifestLoader()) {
+	const subject = `Web function revision ${displayUntrustedValue(revisionLogicalId)} code bundle`;
+	const notFound = () => new CdkLocalError(`${subject} (S3Object bucket ${describeValue(code.s3Object.bucket)}, key ${displayUntrustedValue(code.s3Object.key)}) matches no file asset in this app's cdk.out. ${getEmbedConfig().cliName} start-web-function runs code that comes from a CDK asset in this app (for example an s3assets.Asset of a directory); it does not download deployed code. Re-synthesize the app, or point the revision at an asset.`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NOT_FOUND");
+	const manifestPath = stack.assetManifestPath;
+	if (!manifestPath) throw notFound();
+	const manifestDir = dirname$1(manifestPath);
+	const manifest = await loader.loadStackManifest(stack, manifestDir);
+	const match = manifest ? findFileAssetForObjectKey(manifest, code.s3Object.key) : void 0;
+	if (!match) throw notFound();
+	if (typeof match.asset.source.path !== "string" || match.asset.source.path.length === 0) throw new CdkLocalError(`${subject} matches file asset ${displayIdent(match.hash)}, which has no source.path (it is produced by source.executable at publish time), so there is no staged bundle in cdk.out to mount. Give the revision an asset of a directory or a .zip file (for example s3assets.Asset with path: '<dir>').`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NO_PATH");
+	const sourcePath = resolveAssetSourcePath({
+		manifestDir,
+		value: match.asset.source.path,
+		assetOutdir: assetPathDirs(stack).assetOutdir,
+		absolute: "honour-warn",
+		field: "source.path",
+		subject,
+		action: "mount it",
+		sink: "bind-mount that directory into the web function container",
+		wrapError: (message) => new CdkLocalError(message, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	});
+	if (!existsSync$1(sourcePath)) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} does not exist. Re-synthesize the app and retry.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_MISSING");
+	if (!statSync$1(sourcePath).isDirectory() && !sourcePath.endsWith(".zip")) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} is neither a directory nor a .zip archive, so it is not a code bundle.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_NOT_BUNDLE");
+	const materialized = materializeAssetCodeDir(sourcePath);
+	return {
+		kind: "zip",
+		runtime: code.runtime,
+		codeDir: materialized.dir,
+		...materialized.tmpDir !== void 0 && { tmpDir: materialized.tmpDir },
+		assetHash: match.hash
+	};
+}
+function disposeWebFunctionArtifact(artifact) {
+	if (artifact?.kind !== "zip" || artifact.tmpDir === void 0) return;
+	try {
+		if (existsSync$1(artifact.tmpDir)) rmSync$1(artifact.tmpDir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
+}
+function asObject$1(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function describeValue(value) {
+	if (typeof value === "string") return displayUntrustedValue(value);
+	let json;
+	try {
+		json = JSON.stringify(value);
+	} catch {
+		json = void 0;
+	}
+	return displayUntrustedValue(json ?? String(value));
+}
+
+//#endregion
+//#region src/local/web-function-runtime.ts
+const NODE_CODE_MOUNT = "/var/task";
+const NODE_ENTRYPOINT_ENV = "AWS_LAMBDA_NODEJS_ENTRYPOINT";
+const NODE_DEFAULT_ENTRY = "index.js";
+function buildNodeEntryFileStart(runtime, env, codeDir, fileExists = existsSync$1) {
+	const configured = env[NODE_ENTRYPOINT_ENV];
+	const entryFile = configured !== void 0 && configured.length > 0 ? configured : NODE_DEFAULT_ENTRY;
+	const hostPath = resolve$1(codeDir, entryFile);
+	const rel = relative$1(codeDir, hostPath);
+	if (isAbsolute$1(entryFile) || rel === "" || rel === ".." || rel.startsWith(`..${sep$1}`) || isAbsolute$1(rel)) throw new CdkLocalError(`${NODE_ENTRYPOINT_ENV}=${displayUntrustedValue(entryFile)} must name a file inside the code bundle, relative to its root.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_OUTSIDE_BUNDLE");
+	if (!fileExists(hostPath)) throw new CdkLocalError(`The ${runtime} web function entry file ${displayUntrustedValue(entryFile)} was not found in the code bundle ${displayUntrustedValue(codeDir)}. The runtime loads ${NODE_DEFAULT_ENTRY} from the package root unless ${NODE_ENTRYPOINT_ENV} names another file.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_MISSING");
+	const posixRel = sep$1 === "\\" ? rel.split("\\").join("/") : rel;
+	return {
+		entryPoint: ["/var/lang/bin/node"],
+		cmd: [posix.join(NODE_CODE_MOUNT, posixRel)],
+		label: entryFile
+	};
+}
+const WEB_FUNCTION_RUNTIMES = { "nodejs24.x": {
+	runtime: "nodejs24.x",
+	baseImage: "public.ecr.aws/lambda/nodejs:24",
+	codeMountPath: NODE_CODE_MOUNT,
+	architectures: ["arm64"],
+	buildStart: (env, codeDir, deps) => buildNodeEntryFileStart("nodejs24.x", env, codeDir, deps?.fileExists)
+} };
+function supportedWebFunctionRuntimes(table = WEB_FUNCTION_RUNTIMES) {
+	return Object.keys(table).sort();
+}
+function resolveWebFunctionRuntime(runtime, table = WEB_FUNCTION_RUNTIMES) {
+	const spec = Object.hasOwn(table, runtime) ? table[runtime] : void 0;
+	if (!spec) throw new CdkLocalError(`Web function runtime ${displayIdent(runtime)} is not supported by ${getEmbedConfig().cliName} start-web-function yet. Supported: ${supportedWebFunctionRuntimes(table).join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_RUNTIME");
+	return spec;
+}
+function defaultWebFunctionPlatform(spec) {
+	return spec.architectures[0] === "x86_64" ? "linux/amd64" : "linux/arm64";
+}
+
+//#endregion
+//#region src/local/web-function-service-config.ts
+const WEB_FUNCTION_HTTP_ENDPOINT_ENV = "AWS_LAMBDA_HTTP_ENDPOINT";
+const APPLICATION_MANAGED_AUTH = "ApplicationManaged";
+const HOME_REGION_ENDPOINT = "HomeRegion";
+function readWebFunctionServiceConfig(revision) {
+	const sc = asObject(revision.Properties?.["ServiceConfig"]) ?? {};
+	const envRaw = sc["EnvironmentVariables"];
+	const envObj = asObject(envRaw);
+	const envKeys = envObj ? Object.keys(envObj) : [];
+	const env = envKeys.length === 1 && (envKeys[0] === "Ref" || envKeys[0].startsWith("Fn::")) ? void 0 : envObj;
+	const logGroup = asObject(asObject(sc["TelemetryConfig"])?.["LoggingConfig"])?.["LogGroup"];
+	return {
+		environmentVariables: env,
+		environmentUnreadable: envRaw !== void 0 && env === void 0,
+		executionRoleArn: sc["ExecutionRoleArn"],
+		egressNetworkConnectorArn: sc["EgressNetworkConnectorArn"],
+		timeoutSeconds: typeof sc["TimeoutSeconds"] === "number" ? sc["TimeoutSeconds"] : void 0,
+		logGroup: typeof logGroup === "string" && logGroup.length > 0 ? logGroup : void 0
+	};
+}
+function buildWebFunctionLambdaView(resolved, config, runtime) {
+	return {
+		kind: "zip",
+		stack: resolved.stack,
+		logicalId: resolved.revisionLogicalId,
+		resource: {
+			Type: resolved.revision.Type,
+			Properties: {
+				...config.environmentVariables !== void 0 && { Environment: { Variables: config.environmentVariables } },
+				...config.executionRoleArn !== void 0 && { Role: config.executionRoleArn }
+			},
+			...resolved.revision.Metadata !== void 0 && { Metadata: resolved.revision.Metadata }
+		},
+		memoryMb: 128,
+		timeoutSec: config.timeoutSeconds ?? 0,
+		layers: [],
+		runtime,
+		handler: "",
+		codePath: null,
+		architecture: "arm64"
+	};
+}
+function webFunctionAssumeRole(assumeRole, config) {
+	if (assumeRole === true && isIamRoleArn(config.executionRoleArn)) return config.executionRoleArn;
+	return assumeRole;
+}
+function finalizeWebFunctionEnv(lambdaEnv, opts) {
+	const env = { ...lambdaEnv };
+	delete env["AWS_LAMBDA_FUNCTION_MEMORY_SIZE"];
+	delete env["AWS_LAMBDA_FUNCTION_VERSION"];
+	delete env["AWS_LAMBDA_FUNCTION_TIMEOUT"];
+	env["AWS_LAMBDA_FUNCTION_NAME"] = opts.functionName;
+	env["AWS_LAMBDA_LOG_GROUP_NAME"] = opts.logGroup ?? `/aws/lambda/${opts.functionName}`;
+	if (opts.timeoutSeconds !== void 0) env["AWS_LAMBDA_FUNCTION_TIMEOUT"] = String(opts.timeoutSeconds);
+	const replacedHttpEndpoint = Object.hasOwn(lambdaEnv, WEB_FUNCTION_HTTP_ENDPOINT_ENV);
+	env[WEB_FUNCTION_HTTP_ENDPOINT_ENV] = `0.0.0.0:${opts.containerPort}`;
+	return {
+		env,
+		replacedHttpEndpoint
+	};
+}
+function webFunctionFidelityWarnings(resolved, config) {
+	const out = [];
+	const rev = displayIdent(resolved.revisionLogicalId);
+	if (config.egressNetworkConnectorArn !== void 0) out.push(`Revision ${rev} sets ServiceConfig.EgressNetworkConnectorArn; the network connector is not emulated, so the container reaches the network through Docker's default bridge.`);
+	if (config.environmentUnreadable) out.push(`Revision ${rev} declares ServiceConfig.EnvironmentVariables as an intrinsic rather than a map; none of its variables reach the container. Supply them with --env-vars.`);
+	const endpoint = resolved.endpoint;
+	if (endpoint) {
+		const ep = displayIdent(endpoint.logicalId);
+		if (endpoint.endpointType !== void 0 && endpoint.endpointType !== "HomeRegion") out.push(`Endpoint ${ep} has EndpointType ${displayIdent(endpoint.endpointType)}; only a single ${HOME_REGION_ENDPOINT} endpoint is reproduced, on one local port.`);
+		if (endpoint.authType !== void 0 && endpoint.authType !== "ApplicationManaged") out.push(`Endpoint ${ep} has AuthType ${displayIdent(endpoint.authType)}; it is not enforced locally — every request reaches the server unauthenticated.`);
+		const routed = endpoint.weights.filter((w) => w.weight > 0);
+		if (routed.length > 1) out.push(`Endpoint ${ep} splits traffic across ${routed.length} revisions; weighted routing is not emulated — every request goes to revision ${rev}.`);
+	}
+	return out;
+}
+function asObject(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+
+//#endregion
+//#region src/local/web-function-runner.ts
+const execFileAsync = promisify$1(execFile$1);
+const WEB_FUNCTION_CONTAINER_PORT = 8080;
+const READY_FAILURE_LOG_LINES = 20;
+const MAX_PROBE_TIMEOUT_MS = 1e4;
+function planWebFunctionContainer(artifact, spec, env, deps) {
+	if (artifact.kind !== "zip") throw new CdkLocalError("A container-image web function source is not supported yet; only a zip bundle from CodeConfig.S3Object runs locally.", "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_ARTIFACT");
+	const start = spec.buildStart(env, artifact.codeDir, deps);
+	return {
+		image: spec.baseImage,
+		mounts: [{
+			hostPath: artifact.codeDir,
+			containerPath: spec.codeMountPath,
+			readOnly: true
+		}],
+		entryPoint: start.entryPoint,
+		cmd: start.cmd,
+		workingDir: spec.codeMountPath,
+		label: start.label
+	};
+}
+async function startWebFunctionContainer(opts) {
+	const { plan } = opts;
+	return runDetached({
+		image: plan.image,
+		mounts: plan.mounts,
+		env: opts.env,
+		...opts.sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys: opts.sensitiveEnvKeys },
+		entryPoint: plan.entryPoint,
+		cmd: plan.cmd,
+		...plan.workingDir !== void 0 && { workingDir: plan.workingDir },
+		hostPort: opts.hostPort,
+		containerPort: WEB_FUNCTION_CONTAINER_PORT,
+		host: opts.host,
+		platform: opts.platform,
+		name: opts.name,
+		autoRemove: false
+	});
+}
+var RecentOutput = class {
+	lines = [];
+	partial = "";
+	max;
+	constructor(max = 20) {
+		this.max = max;
+	}
+	push(chunk) {
+		const parts = (this.partial + chunk.toString()).split("\n");
+		this.partial = parts.pop() ?? "";
+		for (const line of parts) this.add(line);
+		if (this.partial.length > 4096) {
+			this.add(this.partial);
+			this.partial = "";
+		}
+	}
+	tail() {
+		return this.partial.length > 0 ? [...this.lines, this.partial].slice(-this.max) : this.lines;
+	}
+	add(line) {
+		this.lines.push(line.replace(/\r$/, ""));
+		if (this.lines.length > this.max) this.lines.shift();
+	}
+};
+async function waitForWebFunctionReady(args, deps = defaultReadyDeps) {
+	const deadline = deps.now() + args.timeoutMs;
+	let attempt = 0;
+	let last = "refused";
+	while (deps.now() < deadline) {
+		const remaining = Math.max(1, deadline - deps.now());
+		last = await deps.probe(args.host, args.port, Math.min(remaining, MAX_PROBE_TIMEOUT_MS));
+		if (last === "answered") return;
+		attempt++;
+		if (attempt % 4 === 0 && !await deps.isRunning(args.containerId)) throw await containerFailure(`The web function container exited before its server listened on AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
+		if (last === "refused") await deps.sleep(250);
+	}
+	const authority = formatAuthority(args.host, args.port);
+	throw await containerFailure(last === "timeout" ? `The web function server on ${authority} accepted the connection but did not answer GET / within ${args.timeoutMs}ms — it is listening but slow to respond. Raise --timeout, or make / answer sooner (started ${args.label}).` : `The web function server never accepted an HTTP connection on ${authority} within ${args.timeoutMs}ms. It must listen on the host:port given in AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
+}
+async function containerFailure(message, containerId, recent, fetchLogs = readContainerLogTail, code = "LOCAL_START_WEB_FUNCTION_NOT_READY") {
+	let lines = [];
+	try {
+		lines = await fetchLogs(containerId, 20);
+	} catch {
+		lines = [];
+	}
+	if (lines.length === 0) lines = recent.tail();
+	return new CdkLocalError(`${message}${lines.length > 0 ? ` Last ${lines.length} line(s) of container output:\n${lines.map((l) => `  ${displayToolOutput(l)}`).join("\n")}` : " The container printed nothing."}`, code);
+}
+function watchContainerExit(containerId) {
+	let stopped = false;
+	const proc = spawn$1(getDockerCmd(), ["wait", containerId], { stdio: [
+		"ignore",
+		"pipe",
+		"ignore"
+	] });
+	let out = "";
+	proc.stdout?.on("data", (c) => out += c.toString());
+	return {
+		exited: new Promise((resolveExit) => {
+			const done = () => {
+				if (stopped) return;
+				const code = Number.parseInt(out.trim(), 10);
+				resolveExit(Number.isNaN(code) ? void 0 : code);
+			};
+			proc.on("close", done);
+			proc.on("error", done);
+		}),
+		stop: () => {
+			stopped = true;
+			if (!proc.killed) proc.kill("SIGTERM");
+		}
+	};
+}
+function probeHttp(host, port, timeoutMs) {
+	return new Promise((resolveProbe) => {
+		let timedOut = false;
+		let connected = false;
+		const req = request$2({
+			host,
+			port,
+			path: "/",
+			method: "GET",
+			timeout: timeoutMs,
+			headers: { connection: "close" }
+		}, (res) => {
+			res.resume();
+			resolveProbe("answered");
+		});
+		req.on("socket", (socket) => {
+			socket.once("connect", () => {
+				connected = true;
+			});
+		});
+		req.on("timeout", () => {
+			timedOut = true;
+			req.destroy();
+		});
+		req.on("error", () => resolveProbe(timedOut && connected ? "timeout" : "refused"));
+		req.end();
+	});
+}
+async function containerIsRunning(containerId) {
+	try {
+		const { stdout } = await execFileAsync(getDockerCmd(), [
+			"inspect",
+			"-f",
+			"{{.State.Running}}",
+			containerId
+		]);
+		return stdout.trim() === "true";
+	} catch {
+		return false;
+	}
+}
+function readContainerLogTail(containerId, lines, spawnFn = spawn$1) {
+	return new Promise((resolveLogs, rejectLogs) => {
+		const proc = spawnFn(getDockerCmd(), [
+			"logs",
+			"--tail",
+			String(lines),
+			containerId
+		], { stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		] });
+		const chunks = [];
+		let size = 0;
+		const take = (c) => {
+			if (size > 4 * 1024 * 1024) return;
+			chunks.push(c);
+			size += c.length;
+		};
+		proc.stdout?.on("data", take);
+		proc.stderr?.on("data", take);
+		proc.on("error", rejectLogs);
+		proc.on("close", (code) => {
+			if (code !== 0) {
+				rejectLogs(/* @__PURE__ */ new Error(`docker logs exited ${code}`));
+				return;
+			}
+			resolveLogs(Buffer.concat(chunks).toString().split("\n").map((l) => l.replace(/\r$/, "")).filter((l) => l.length > 0).slice(-lines));
+		});
+	});
+}
+const defaultReadyDeps = {
+	probe: probeHttp,
+	isRunning: containerIsRunning,
+	fetchLogs: readContainerLogTail,
+	sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+	now: () => Date.now()
+};
+
+//#endregion
+//#region src/cli/commands/local-start-web-function.ts
+function parsePort(raw) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
+	return n;
+}
+function connectHost(host) {
+	if (host === "0.0.0.0") return "127.0.0.1";
+	if (host === "::" || host === "[::]") return "::1";
+	return host;
+}
+async function localStartWebFunctionCommand(target, options, extraStateProviders, hostSynthesizer) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	let containerId;
+	let stopLogs;
+	let exitWatch;
+	let artifact;
+	let runInFlight;
+	let teardownPromise;
+	let shuttingDown = false;
+	let waitingOnRun = false;
+	let containerName;
+	const forever = () => new Promise(() => void 0);
+	const doTeardown = async () => {
+		exitWatch?.stop();
+		if (containerId === void 0 && runInFlight !== void 0) {
+			waitingOnRun = true;
+			try {
+				containerId = await runInFlight;
+			} catch {} finally {
+				waitingOnRun = false;
+			}
+		}
+		if (stopLogs) try {
+			stopLogs();
+		} catch (err) {
+			logger.debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		if (containerId) await removeContainer(containerId);
+		disposeWebFunctionArtifact(artifact);
+	};
+	const teardown = () => teardownPromise ??= doTeardown();
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region,
+		profile: options.profile
+	});
+	await ensureDockerAvailable();
+	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
+	const appCmd = resolveApp(options.app);
+	if (!appCmd) throw new Error(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
+	logger.info("Synthesizing CDK app...");
+	const synthesizer = hostSynthesizer ?? new Synthesizer();
+	const context = parseContextOptions(options.context);
+	const synthOpts = {
+		app: appCmd,
+		output: options.output,
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile },
+		...Object.keys(context).length > 0 && { context }
+	};
+	const { stacks } = await synthesizer.synthesize(synthOpts);
+	const resolved = resolveWebFunctionTarget(await resolveSingleTarget(target, {
+		entries: listTargets(stacks).webFunctions,
+		message: "Select a Lambda web function to serve",
+		noun: "Lambda web functions",
+		onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} start-web-function requires a <target> (a WebFunction, WebFunctionEndpoint or WebFunctionRevision display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_START_WEB_FUNCTION_TARGET_REQUIRED")
+	}), stacks, options.revision);
+	const code = parseWebFunctionBuildConfig(resolved.revisionLogicalId, resolved.revision.Properties?.["BuildConfig"]);
+	const spec = resolveWebFunctionRuntime(code.runtime);
+	const selectionNote = {
+		"target-revision": "the target revision",
+		"revision-flag": "--revision",
+		"endpoint-weight": `highest weight on endpoint ${displayIdent(resolved.endpoint?.logicalId ?? "")}`,
+		"only-revision": "the function's only revision"
+	};
+	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.revisionLogicalId}`)} (${spec.runtime}; revision chosen by ${selectionNote[resolved.selection]})`);
+	const serviceConfig = readWebFunctionServiceConfig(resolved.revision);
+	for (const line of webFunctionFidelityWarnings(resolved, serviceConfig)) logger.warn(line);
+	artifact = await resolveWebFunctionArtifact(resolved.stack, resolved.revisionLogicalId, code);
+	const shutdown = async (signal, exitCode) => {
+		if (shuttingDown) {
+			if (!waitingOnRun) {
+				logger.info(`Received ${signal} again; still removing the container, please wait...`);
+				return;
+			}
+			disposeWebFunctionArtifact(artifact);
+			logger.warn(`Received ${signal} again; exiting without waiting for docker run to return. The container may still be starting, and its environment holds the forwarded AWS credentials. Remove it by its name (this works even if it is created after this exit): docker rm -f ${containerName ?? "<name>"}`);
+			process.exit(signal === "SIGINT" ? 130 : 143);
+			return;
+		}
+		shuttingDown = true;
+		logger.info(`Received ${signal}, shutting down...`);
+		await teardown();
+		process.exit(exitCode);
+	};
+	process.on("SIGINT", () => void shutdown("SIGINT", 130));
+	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
+	const recent = new RecentOutput();
+	try {
+		const assumeRole = webFunctionAssumeRole(options.assumeRole, serviceConfig);
+		const containerEnv = await resolveLambdaContainerEnv(buildWebFunctionLambdaView(resolved, serviceConfig, spec.runtime), {
+			...options,
+			...assumeRole !== void 0 && { assumeRole },
+			deployedFunctionLookups: false
+		}, profileCredentials, extraStateProviders);
+		const { env, replacedHttpEndpoint } = finalizeWebFunctionEnv(containerEnv.env, {
+			functionName: resolved.functionName,
+			containerPort: WEB_FUNCTION_CONTAINER_PORT,
+			timeoutSeconds: serviceConfig.timeoutSeconds,
+			logGroup: serviceConfig.logGroup
+		});
+		if (replacedHttpEndpoint) logger.warn(`The revision's ${WEB_FUNCTION_HTTP_ENDPOINT_ENV} is replaced with 0.0.0.0:${WEB_FUNCTION_CONTAINER_PORT}: the runtime owns that variable, and the local port is published to it.`);
+		const plan = planWebFunctionContainer(artifact, spec, env);
+		const platform = options.platform ?? defaultWebFunctionPlatform(spec);
+		await pullImage(plan.image, options.pull === false, platform);
+		if (teardownPromise) return await forever();
+		const hostPort = options.port === 0 ? await pickFreePort() : options.port;
+		const name = containerName = `${getEmbedConfig().resourceNamePrefix}-webfn-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+		logger.info(`Starting web function container (image=${plan.image}, start=${plan.label}, port=${hostPort} -> ${WEB_FUNCTION_CONTAINER_PORT})...`);
+		runInFlight = startWebFunctionContainer({
+			plan,
+			env,
+			sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys),
+			host: options.host,
+			hostPort,
+			platform,
+			name
+		});
+		const id = await runInFlight;
+		if (teardownPromise) return await forever();
+		containerId = id;
+		stopLogs = streamLogs(id, { onOutput: (chunk) => recent.push(chunk) });
+		exitWatch = watchContainerExit(id);
+		const probeHost = connectHost(options.host);
+		await waitForWebFunctionReady({
+			containerId: id,
+			host: probeHost,
+			port: hostPort,
+			timeoutMs: options.timeout,
+			recent,
+			label: plan.label
+		});
+		logger.info(`Server listening on http://${formatAuthority(probeHost, hostPort)}  (${displayIdent(resolved.functionName)} (Lambda web function))`);
+		logger.info("Press ^C to shut down.");
+	} catch (err) {
+		if (shuttingDown) return await forever();
+		await teardown();
+		throw err;
+	}
+	if (!exitWatch || !containerId) return await forever();
+	const exitCode = await exitWatch.exited;
+	if (shuttingDown || teardownPromise) return await forever();
+	const failure = await containerFailure(`The web function container exited (exit code ${exitCode ?? "unknown"}) while serving.`, containerId, recent, void 0, "LOCAL_START_WEB_FUNCTION_EXITED");
+	await teardown();
+	throw failure;
+}
+function createLocalStartWebFunctionCommand(opts = {}) {
+	setEmbedConfig(opts.embedConfig);
+	const cmd = new Command("start-web-function").description("Serve an AWS Lambda Web Function locally. Resolves a WebFunction, WebFunctionEndpoint or WebFunctionRevision target to one revision (an endpoint serves its highest-weight revision; --revision overrides), runs its code bundle from cdk.out in a container whose server listens on AWS_LAMBDA_HTTP_ENDPOINT, and publishes it on a local port with the revision's ServiceConfig environment. Target accepts a CDK display path or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C.").argument("[target]", "CDK display path or stack-qualified logical ID of the WebFunction / WebFunctionEndpoint / WebFunctionRevision (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
+		await localStartWebFunctionCommand(target, options, opts.extraStateProviders, opts.synthesizer);
+	}));
+	addStartWebFunctionSpecificOptions(cmd);
+	[
+		...commonOptions(),
+		...appOptions(),
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(regionOption);
+	return cmd;
+}
+function addStartWebFunctionSpecificOptions(cmd) {
+	return cmd.addOption(new Option("--revision <logicalId>", "Serve this WebFunctionRevision (logical ID) instead of the one the endpoint weights pick.")).addOption(new Option("--port <n>", "Local port to serve on. Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Address to publish the port on.").default("127.0.0.1")).addOption(new Option("--platform <platform>", "docker --platform for the server container. Defaults to the runtime's cloud architecture (linux/arm64 for nodejs24.x).").choices(["linux/amd64", "linux/arm64"])).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"RevisionLogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--no-pull", "Skip docker pull of the runtime base image (use the cached image)")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the server to answer HTTP. Default 60000.").default(6e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the revision's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the revision's ServiceConfig.ExecutionRoleArn: a literal ARN as written, or the Fn::GetAtt / Ref CDK synthesizes resolved against --from-cfn-stack deployed state; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
 //#endregion
@@ -25215,7 +26003,7 @@ async function localListCommand(options) {
 	process.stdout.write(`${formatTargetListing(listing, getEmbedConfig().cliName, { long: options.long })}\n`);
 }
 function formatTargetListing(listing, cliName, options = {}) {
-	if (countTargets(listing) === 0) return `No runnable targets (Lambda functions, APIs, ECS services / tasks, AgentCore Runtimes, load balancers, CloudFront distributions) found in this CDK app.`;
+	if (countTargets(listing) === 0) return `No runnable targets (Lambda functions, APIs, ECS services / tasks, AgentCore Runtimes, load balancers, CloudFront distributions, Lambda web functions) found in this CDK app.`;
 	const long = options.long ?? false;
 	return "\n" + [
 		formatSection("Lambda Functions", `${cliName} invoke <target>`, listing.lambdas, long),
@@ -25224,7 +26012,8 @@ function formatTargetListing(listing, cliName, options = {}) {
 		formatSection("ECS Task Definitions", `${cliName} run-task <target>`, listing.ecsTaskDefinitions, long),
 		formatSection("AgentCore Runtimes", `${cliName} invoke-agentcore <target>`, listing.agentCoreRuntimes, long),
 		formatSection("Application Load Balancers", `${cliName} start-alb <target...>`, listing.loadBalancers, long),
-		formatSection("CloudFront Distributions", `${cliName} start-cloudfront <target>`, listing.cloudFrontDistributions, long)
+		formatSection("CloudFront Distributions", `${cliName} start-cloudfront <target>`, listing.cloudFrontDistributions, long),
+		formatSection("Lambda Web Functions", `${cliName} start-web-function <target>`, listing.webFunctions, long)
 	].filter((lines) => lines.length > 0).map((lines) => lines.join("\n")).join("\n\n");
 }
 function formatSection(title, command, entries, long) {
@@ -30500,5 +31289,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { applyEdgeResponseResult as $, defaultCredentialsLoader as $n, resolveCfnFallbackRegion as $r, isLocalCdkAssetImage as $t, startAgentCoreHttpServer as A, LocalInvokeBuildError as Ai, renderCodeDockerfile as An, resolveHostGatewayExtraHosts as Ar, addRunTaskSpecificOptions as At, idFromArn as B, withoutKeys as Bi, createFileWatcher as Bn, buildContainerImage as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, AgentCoreResolutionError as Ci, invokeAgentCore as Cn, pickResponseTemplate as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, formatStateRemedy as Di, SUPPORTED_CODE_RUNTIMES as Dn, HOST_DOCKER_INTERNAL_GATEWAY as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, derivePseudoParametersFromRegion as Ei, downloadAndExtractS3Bundle as En, VtlEvaluationError as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, firstUsableRegion as Fi, addStartApiSpecificOptions as Fn, parseConnectionsPath as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, recordAssumedRole as Gi, availableApiIdentifiers as Gn, substituteAgainstState as Gr, canonicalizeImageOverrideKeys as Gt, createDeployedKvsDataSource as H, assumedRoleRecorded as Hi, buildStageMap as Hn, resolveRuntimeFileExtension as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, keysNotFromTemplate as Ii, createLocalStartApiCommand as In, buildConnectEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, workloadStsClientConfig as Ji, groupRoutesByServer as Jn, substituteEnvVarsFromStateAsync as Jr, parseImageOverrideFlags as Jt, createS3OriginReader as K, resetWorkloadIdentity as Ki, filterRoutesByApiIdentifier as Kn, substituteAgainstStateAsync as Kr, enforceImageOverrideOrphans as Kt, parseKvsFileOverrides as L, keysOverriddenBy as Li, createWatchPredicates as Ln, buildDisconnectEvent as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, DynamicReferenceResolver as Mi, classifySourceChange as Mn, ConnectionRegistry as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, containsDynamicReference as Ni, addInvokeSpecificOptions as Nn, buildMgmtEndpointEnvUrl as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, substituteImagePlaceholders as Oi, buildAgentCoreCodeImage as On, HOST_GATEWAY_MIN_VERSION as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, deployedFillMayBeSecret as Pi, createLocalInvokeCommand as Pn, handleConnectionsRequest as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, isProxyEnvConfigured as Qi, resolveServiceIntegrationParameters as Qn, rejectExplicitCfnStackWithMultipleStacks as Qr, imageOverrideKeyAliases as Qt, parseOriginOverrides as R, parseDynamicReference as Ri, resolveApiTargetSubset as Rn, buildMessageEvent as Rr, parseMaxTasks as Rt, StudioEventBus as S, AGENTCORE_RUNTIME_TYPE as Si, AGENTCORE_SESSION_ID_HEADER as Sn, evaluateResponseParameters as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, resolveAgentCoreTarget as Ti, waitForAgentCorePing as Tn, tryParseStatus as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, deployAccountStsClientConfig as Ui, materializeLayerFromArn as Un, resolveRuntimeImage as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, SECOND_ASSUME_MESSAGE as Vi, attachStageContext as Vn, resolveRuntimeCodeMountPath as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, readEnvCallerCredentials as Wi, resolveEnvVars$1 as Wn, EcsTaskResolutionError as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveProfileCredentials as Xi, startApiServer as Xn, createLocalStateProvider as Xr, runImageOverrideBuilds as Xt, resolveErrorResponseCandidates as Y, buildStsClientConfig as Yi, readMtlsMaterialsFromDisk as Yn, LocalStateSourceError as Yr, resolveImageOverrides as Yt, serveLambdaUrlOrigin as Z, buildProxyClientConfig as Zi, resolveSelectionExpression as Zn, isCfnFlagPresent as Zr, describePinnedImageUri as Zt, filterStudioTargetGroups as _, resolveLambdaArnIntrinsic as _i, MCP_PROTOCOL_VERSION as _n, matchRoute as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, resolveWatchConfig as ai, setShadowReadyTimeoutMs as an, verifyJwtViaDiscovery as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_HTTP_PROTOCOL as bi, AGENTCORE_SIGV4_SERVICE as bn, buildHttpApiV2Event as br, addAlbSpecificOptions as bt, startStudioProxy as c, listTargets as ci, addInvokeAgentCoreSpecificOptions as cn, evaluateCachedLambdaPolicy as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, discoverWebSocketApisOrThrow as di, invokeAgentCoreWs as dn, attachAuthorizers as dr, pickTargetFunctionLogicalId as dt, resolveCfnRegion as ei, listPinnedTargets as en, buildCognitoJwksUrl as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, filterWebSocketApisByIdentifiers as fi, A2A_CONTAINER_PORT as fn, applyCorsResponseHeaders as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, pickRefLogicalId as gi, MCP_PATH as gn, matchPreflight as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, discoverRoutes as hi, MCP_CONTAINER_PORT as hn, isFunctionUrlOacFronted as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSsmParameters as ii, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as in, verifyJwtAuthorizer as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, DynamicReferenceResolutionError as ji, toCmdArgv as jn, bufferToBody as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, tryResolveImageFnJoin as ki, computeCodeImageTag as kn, probeHostGatewaySupport as kr, serviceStrategy as kt, relayServeRequest as l, availableWebSocketApiIdentifiers as li, createLocalInvokeAgentCoreCommand as ln, invokeRequestAuthorizer as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, webSocketApiMatchesIdentifier as mi, a2aInvokeOnce as mn, buildCorsConfigFromCloudFrontChain as mr, runViewerRequest as mt, coerceRunRequest as n, CfnLocalStateProvider as ni, CloudMapRegistry as nn, createJwksCache as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, resolveSingleTarget as oi, getContainerNetworkIp as on, buildMethodArn as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, parseSelectionExpressionPath as pi, A2A_PATH as pn, buildCorsConfigByApiId as pr, compileCloudFrontFunction as pt, matchBehavior as q, workloadClientConfig as qi, filterRoutesByApiIdentifiers as qn, substituteEnvVarsFromState as qr, mergeForService as qt, coerceServeRequest as r, collectSsmParameterRefs as ri, DEFAULT_SHADOW_READY_TIMEOUT_MS as rn, verifyCognitoJwt as rr, httpHeadersToEdge as rt, createStudioServeManager as s, countTargets as si, attachContainerLogStreamer as sn, computeRequestIdentityHash as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, resolveCfnStackName as ti, buildCloudMapIndex as tn, buildJwksUrlFromIssuer as tr, buildEdgeResponseEvent as tt, reinvoke as u, discoverWebSocketApis as ui, bridgeAgentCoreWs as un, invokeTokenAuthorizer as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_A2A_PROTOCOL as vi, mcpInvokeOnce as vn, translateLambdaResponse as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, pickAgentCoreCandidateStack as wi, waitForAgentCoreHttpReady as wn, selectIntegrationResponse as wr, resolveAlbTarget as wt, createStudioStore as x, AGENTCORE_MCP_PROTOCOL as xi, signAgentCoreInvocation as xn, buildRestV1Event as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_AGUI_PROTOCOL as yi, parseSseForJsonRpc as yn, applyAuthorizerOverlay as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, resolveDynamicReferencesInEnv as zi, createAuthorizerCache as zn, architectureToPlatform as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-CJfNARFz.js.map
+export { WEB_FUNCTION_TYPE as $, AgentCoreResolutionError as $i, invokeAgentCore as $n, pickResponseTemplate as $r, parseLbPortOverrides as $t, containerFailure as A, resolveCfnRegion as Ai, listPinnedTargets as An, buildCognitoJwksUrl as Ar, buildEdgeRequestEvent as At, webFunctionAssumeRole as B, discoverWebSocketApis as Bi, bridgeAgentCoreWs as Bn, invokeTokenAuthorizer as Br, pickLambdaEdgeFunctionLogicalId as Bt, addListSpecificOptions as C, workloadClientConfig as Ca, substituteEnvVarsFromState as Ci, mergeForService as Cn, filterRoutesByApiIdentifiers as Cr, matchBehavior as Ct, createLocalStartWebFunctionCommand as D, buildProxyClientConfig as Da, isCfnFlagPresent as Di, describePinnedImageUri as Dn, resolveSelectionExpression as Dr, serveLambdaUrlOrigin as Dt, addStartWebFunctionSpecificOptions as E, resolveProfileCredentials as Ea, createLocalStateProvider as Ei, runImageOverrideBuilds as En, startApiServer as Er, serveFromStaticOrigin as Et, watchContainerExit as F, resolveWatchConfig as Fi, setShadowReadyTimeoutMs as Fn, verifyJwtViaDiscovery as Fr, describeS3OriginDomain as Ft, resolveWebFunctionRuntime as G, discoverRoutes as Gi, MCP_CONTAINER_PORT as Gn, isFunctionUrlOacFronted as Gr, runViewerResponse as Gt, WEB_FUNCTION_RUNTIMES as H, filterWebSocketApisByIdentifiers as Hi, A2A_CONTAINER_PORT as Hn, applyCorsResponseHeaders as Hr, resolveCloudFrontDistribution as Ht, WEB_FUNCTION_HTTP_ENDPOINT_ENV as I, resolveSingleTarget as Ii, getContainerNetworkIp as In, buildMethodArn as Ir, extractKvsAssociations as It, findFileAssetForObjectKey as J, AGENTCORE_A2A_PROTOCOL as Ji, mcpInvokeOnce as Jn, translateLambdaResponse as Jr, createLocalFileKvsDataSource as Jt, supportedWebFunctionRuntimes as K, pickRefLogicalId as Ki, MCP_PATH as Kn, matchPreflight as Kr, stripCloudFrontImport as Kt, buildWebFunctionLambdaView as L, countTargets as Li, attachContainerLogStreamer as Ln, computeRequestIdentityHash as Lr, isCloudFrontDistribution as Lt, readContainerLogTail as M, CfnLocalStateProvider as Mi, CloudMapRegistry as Mn, createJwksCache as Mr, edgeHeadersToHttp as Mt, startWebFunctionContainer as N, collectSsmParameterRefs as Ni, DEFAULT_SHADOW_READY_TIMEOUT_MS as Nn, verifyCognitoJwt as Nr, httpHeadersToEdge as Nt, RecentOutput as O, isProxyEnvConfigured as Oa, rejectExplicitCfnStackWithMultipleStacks as Oi, imageOverrideKeyAliases as On, resolveServiceIntegrationParameters as Or, applyEdgeRequestResult as Ot, waitForWebFunctionReady as P, resolveSsmParameters as Pi, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Pn, verifyJwtAuthorizer as Pr, CLOUDFRONT_DISTRIBUTION_TYPE as Pt, WEB_FUNCTION_REVISION_TYPE as Q, AGENTCORE_RUNTIME_TYPE as Qi, AGENTCORE_SESSION_ID_HEADER as Qn, evaluateResponseParameters as Qr, createLocalStartAlbCommand as Qt, finalizeWebFunctionEnv as R, listTargets as Ri, addInvokeAgentCoreSpecificOptions as Rn, evaluateCachedLambdaPolicy as Rr, pickFunctionUrlLogicalIdFromOrigin as Rt, StudioEventBus as S, resetWorkloadIdentity as Sa, substituteAgainstStateAsync as Si, enforceImageOverrideOrphans as Sn, filterRoutesByApiIdentifier as Sr, createS3OriginReader as St, formatTargetListing as T, buildStsClientConfig as Ta, LocalStateSourceError as Ti, resolveImageOverrides as Tn, readMtlsMaterialsFromDisk as Tr, resolveErrorResponseCandidates as Tt, buildNodeEntryFileStart as U, parseSelectionExpressionPath as Ui, A2A_PATH as Un, buildCorsConfigByApiId as Ur, compileCloudFrontFunction as Ut, webFunctionFidelityWarnings as V, discoverWebSocketApisOrThrow as Vi, invokeAgentCoreWs as Vn, attachAuthorizers as Vr, pickTargetFunctionLogicalId as Vt, defaultWebFunctionPlatform as W, webSocketApiMatchesIdentifier as Wi, a2aInvokeOnce as Wn, buildCorsConfigFromCloudFrontChain as Wr, runViewerRequest as Wt, resolveWebFunctionArtifact as X, AGENTCORE_HTTP_PROTOCOL as Xi, AGENTCORE_SIGV4_SERVICE as Xn, buildHttpApiV2Event as Xr, addAlbSpecificOptions as Xt, parseWebFunctionBuildConfig as Y, AGENTCORE_AGUI_PROTOCOL as Yi, parseSseForJsonRpc as Yn, applyAuthorizerOverlay as Yr, createUnboundCloudFrontModule as Yt, WEB_FUNCTION_ENDPOINT_TYPE as Z, AGENTCORE_MCP_PROTOCOL as Zi, signAgentCoreInvocation as Zn, buildRestV1Event as Zr, albStrategy as Zt, filterStudioTargetGroups as _, SECOND_ASSUME_MESSAGE as _a, resolveRuntimeCodeMountPath as _i, resolveSharedSidecarCredentials as _n, attachStageContext as _r, resolveKvsModulesForDistribution as _t, createLocalStudioCommand as a, tryResolveImageFnJoin as aa, probeHostGatewaySupport as ai, serviceStrategy as an, computeCodeImageTag as ar, selectServeInboundAuth as at, renderStudioHtml as b, readEnvCallerCredentials as ba, EcsTaskResolutionError as bi, buildImageOverrideTag as bn, resolveEnvVars$1 as br, resolveDeployedOriginBucket as bt, startStudioProxy as c, DynamicReferenceResolver as ca, ConnectionRegistry as ci, MAX_TASKS_SUBNET_RANGE_CAP as cn, classifySourceChange as cr, startAgentCoreWsBridge as ct, createStudioDispatcher as d, firstUsableRegion as da, parseConnectionsPath as di, addImageOverrideOptions as dn, addStartApiSpecificOptions as dr, createLocalStartCloudFrontCommand as dt, pickAgentCoreCandidateStack as ea, selectIntegrationResponse as ei, resolveAlbTarget as en, waitForAgentCoreHttpReady as er, WebFunctionResolutionError as et, filterStudioCustomResources as f, keysNotFromTemplate as fa, buildConnectEvent as fi, buildEcsImageResolutionContext$1 as fn, createLocalStartApiCommand as fr, normalizeKvsFileKeys as ft, annotatePinnedEcsTargets as g, withoutKeys as ga, buildContainerImage as gi, resolveEcsAssumeRoleOption as gn, createFileWatcher as gr, idFromArn as gt, annotateEcsTaskPinnedTargets as h, resolveDynamicReferencesInEnv as ha, architectureToPlatform as hi, parseRestartPolicy as hn, createAuthorizerCache as hr, resolveCloudFrontTarget as ht, coerceStopRequest as i, substituteImagePlaceholders as ia, HOST_GATEWAY_MIN_VERSION as ii, createLocalStartServiceCommand as in, buildAgentCoreCodeImage as ir, buildAgentCoreServeAuthCheck as it, planWebFunctionContainer as j, resolveCfnStackName as ji, buildCloudMapIndex as jn, buildJwksUrlFromIssuer as jr, buildEdgeResponseEvent as jt, WEB_FUNCTION_CONTAINER_PORT as k, resolveCfnFallbackRegion as ki, isLocalCdkAssetImage as kn, defaultCredentialsLoader as kr, applyEdgeResponseResult as kt, relayServeRequest as l, containsDynamicReference as la, buildMgmtEndpointEnvUrl as li, addCommonEcsServiceOptions as ln, addInvokeSpecificOptions as lr, LocalStartCloudFrontError as lt, annotateAlbPinnedBackingServices as m, parseDynamicReference as ma, buildMessageEvent as mi, parseMaxTasks as mn, resolveApiTargetSubset as mr, parseOriginOverrides as mt, coerceRunRequest as n, derivePseudoParametersFromRegion as na, VtlEvaluationError as ni, resolveAlbFrontDoor as nn, downloadAndExtractS3Bundle as nr, addStartAgentCoreSpecificOptions as nt, resolveServeBaseUrl as o, LocalInvokeBuildError as oa, resolveHostGatewayExtraHosts as oi, addRunTaskSpecificOptions as on, renderCodeDockerfile as or, startAgentCoreHttpServer as ot, isCustomResourceLambdaTarget as p, keysOverriddenBy as pa, buildDisconnectEvent as pi, ecsClusterOption as pn, createWatchPredicates as pr, parseKvsFileOverrides as pt, disposeWebFunctionArtifact as q, resolveLambdaArnIntrinsic as qi, MCP_PROTOCOL_VERSION as qn, matchRoute as qr, createCloudFrontModule as qt, coerceServeRequest as r, formatStateRemedy as ra, HOST_DOCKER_INTERNAL_GATEWAY as ri, addStartServiceSpecificOptions as rn, SUPPORTED_CODE_RUNTIMES as rr, createLocalStartAgentCoreCommand as rt, createStudioServeManager as s, DynamicReferenceResolutionError as sa, bufferToBody as si, createLocalRunTaskCommand as sn, toCmdArgv as sr, attachAgentCoreWsBridge as st, addStudioSpecificOptions as t, resolveAgentCoreTarget as ta, tryParseStatus as ti, isApplicationLoadBalancer as tn, waitForAgentCorePing as tr, resolveWebFunctionTarget as tt, reinvoke as u, deployedFillMayBeSecret as ua, handleConnectionsRequest as ui, addEcsAssumeRoleOptions as un, createLocalInvokeCommand as ur, addStartCloudFrontSpecificOptions as ut, startStudioServer as v, assumedRoleRecorded as va, resolveRuntimeFileExtension as vi, runEcsServiceEmulator as vn, buildStageMap as vr, createDeployedKvsDataSource as vt, createLocalListCommand as w, workloadStsClientConfig as wa, substituteEnvVarsFromStateAsync as wi, parseImageOverrideFlags as wn, groupRoutesByServer as wr, startCloudFrontServer as wt, createStudioStore as x, recordAssumedRole as xa, substituteAgainstState as xi, canonicalizeImageOverrideKeys as xn, availableApiIdentifiers as xr, classifyS3Error as xt, toStudioTargetGroups as y, deployAccountStsClientConfig as ya, resolveRuntimeImage as yi, ImageOverrideError as yn, materializeLayerFromArn as yr, resolveDeployedKvsArnByName as yt, readWebFunctionServiceConfig as z, availableWebSocketApiIdentifiers as zi, createLocalInvokeAgentCoreCommand as zn, invokeRequestAuthorizer as zr, pickKvsLogicalIdFromArn as zt };
+//# sourceMappingURL=local-studio-CsftJJ1r.js.map