cdk-local 0.154.0 → 0.156.0

package/dist/{local-studio-CJfNARFz.js → local-studio-BhFxp-jM.js}

@@ -30,7 +30,7 @@ import { StringDecoder } from "node:string_decoder";
 import { promisify } from "node:util";
 import { ECRClient, GetAuthorizationTokenCommand } from "@aws-sdk/client-ecr";
 import { readFile } from "fs/promises";
-import { basename as basename$1, dirname as dirname$1, join as join$1 } from "path";
+import { basename as basename$1, dirname as dirname$1, isAbsolute as isAbsolute$1, join as join$1, posix, relative as relative$1, resolve as resolve$1, sep as sep$1 } from "path";
 import { WebSocket, WebSocketServer } from "ws";
 import { Readable } from "node:stream";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -46,6 +46,11 @@ import * as vm from "node:vm";
 import "@aws-sdk/signature-v4a";
 import { CloudFrontClient, paginateListKeyValueStores } from "@aws-sdk/client-cloudfront";
 import { CloudFrontKeyValueStoreClient, GetKeyCommand, ResourceNotFoundException } from "@aws-sdk/client-cloudfront-keyvaluestore";
+import { existsSync as existsSync$1, readFileSync as readFileSync$1, rmSync as rmSync$1, statSync as statSync$1 } from "fs";
+import { request as request$2 } from "http";
+import { execFile as execFile$1, spawn as spawn$1 } from "child_process";
+import { promisify as promisify$1 } from "util";
+import { randomUUID as randomUUID$1 } from "crypto";
 import { EventEmitter } from "node:events";
 
 //#region src/utils/url-authority.ts
@@ -1595,14 +1600,14 @@ function parseTarget(target) {
 function resolveLambdaTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalInvokeResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseTarget(target);
-	const stack = pickStack$5(parsed, stacks, target);
+	const stack = pickStack$6(parsed, stacks, target);
 	const template = stack.template;
 	const resources = template.Resources ?? {};
 	let match;
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(template);
 		const lambdaMatches = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId }) => resources[logicalId]?.Type === "AWS::Lambda::Function");
-		if (lambdaMatches.length === 0) throw notFoundError$3(target, stack, resources);
+		if (lambdaMatches.length === 0) throw notFoundError$4(target, stack, resources);
 		if (lambdaMatches.length > 1) throw new LocalInvokeResolutionError(`Target '${target}' matches ${lambdaMatches.length} Lambda functions in ${displayStackName(stack.stackName)}: ` + lambdaMatches.map((m) => displayIdent(m.logicalId, { listMember: true })).join(", ") + ". Refine the path or use the stack:LogicalId form.");
 		const m = lambdaMatches[0];
 		match = {
@@ -1611,7 +1616,7 @@ function resolveLambdaTarget(target, stacks) {
 		};
 	} else {
 		const resource = resources[parsed.pathOrId];
-		if (!resource) throw notFoundError$3(target, stack, resources);
+		if (!resource) throw notFoundError$4(target, stack, resources);
 		match = {
 			logicalId: parsed.pathOrId,
 			resource
@@ -1624,7 +1629,7 @@ function resolveLambdaTarget(target, stacks) {
 	}
 	return extractLambdaProperties(stack, logicalId, resource, resources);
 }
-function pickStack$5(parsed, stacks, target) {
+function pickStack$6(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -1957,7 +1962,7 @@ function describeLayerEntry(entry) {
 		return Object.prototype.toString.call(entry);
 	}
 }
-function notFoundError$3(target, stack, resources) {
+function notFoundError$4(target, stack, resources) {
 	const lambdas = [];
 	for (const [logicalId, resource] of Object.entries(resources)) {
 		if (resource.Type !== "AWS::Lambda::Function") continue;
@@ -2002,7 +2007,7 @@ var AgentCoreResolutionError = class AgentCoreResolutionError extends Error {
 function resolveAgentCoreTarget(target, stacks, imageContext) {
 	if (stacks.length === 0) throw new AgentCoreResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseTarget(target);
-	const stack = pickStack$4(parsed, stacks, target);
+	const stack = pickStack$5(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	const { logicalId, resource } = matchRuntime(parsed, target, stack, resources);
 	if (resource.Type !== "AWS::BedrockAgentCore::Runtime") throw new AgentCoreResolutionError(`Resource ${displayIdent(logicalId)} in ${stack.stackName} is ${resource.Type}, not ${AGENTCORE_RUNTIME_TYPE}. ${getEmbedConfig().cliName} invoke-agentcore only runs Bedrock AgentCore Runtime resources.`);
@@ -2011,7 +2016,7 @@ function resolveAgentCoreTarget(target, stacks, imageContext) {
 function pickAgentCoreCandidateStack(target, stacks) {
 	return candidateTargetStack(parseTarget(target), target, stacks);
 }
-function pickStack$4(parsed, stacks, target) {
+function pickStack$5(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -2024,7 +2029,7 @@ function matchRuntime(parsed, target, stack, resources) {
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
 		const runtimeMatches = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId }) => resources[logicalId]?.Type === AGENTCORE_RUNTIME_TYPE);
-		if (runtimeMatches.length === 0) throw notFoundError$2(target, stack, resources);
+		if (runtimeMatches.length === 0) throw notFoundError$3(target, stack, resources);
 		if (runtimeMatches.length > 1) throw new AgentCoreResolutionError(`Target '${target}' matches ${runtimeMatches.length} AgentCore Runtimes in ${stack.stackName}: ` + runtimeMatches.map((m) => m.logicalId).join(", ") + ". Refine the path or use the stack:LogicalId form.");
 		const m = runtimeMatches[0];
 		return {
@@ -2033,13 +2038,13 @@ function matchRuntime(parsed, target, stack, resources) {
 		};
 	}
 	const resource = resources[parsed.pathOrId];
-	if (!resource) throw notFoundError$2(target, stack, resources);
+	if (!resource) throw notFoundError$3(target, stack, resources);
 	return {
 		logicalId: parsed.pathOrId,
 		resource
 	};
 }
-function notFoundError$2(target, stack, resources) {
+function notFoundError$3(target, stack, resources) {
 	const available = Object.entries(resources).filter(([, r]) => r.Type === AGENTCORE_RUNTIME_TYPE).map(([id]) => id);
 	const hint = available.length > 0 ? `Available AgentCore Runtimes in ${stack.stackName}: ${available.join(", ")}.` : `No ${AGENTCORE_RUNTIME_TYPE} resources found in ${stack.stackName}.`;
 	return new AgentCoreResolutionError(`Target '${target}' not found. ${hint}`);
@@ -3531,7 +3536,9 @@ function listTargets(stacks) {
 		ecsTaskDefinitions: sortEntries(scanByType(stacks, "AWS::ECS::TaskDefinition")),
 		agentCoreRuntimes: sortEntries(scanAgentCoreRuntimes(stacks)),
 		loadBalancers: sortEntries(scanApplicationLoadBalancers(stacks)),
-		cloudFrontDistributions: sortEntries(scanByType(stacks, "AWS::CloudFront::Distribution"))
+		cloudFrontDistributions: sortEntries(scanByType(stacks, "AWS::CloudFront::Distribution")),
+		webFunctions: sortEntries(scanByType(stacks, "AWS::Lambda::WebFunction")),
+		microvmImages: sortEntries(scanByType(stacks, "AWS::Lambda::MicrovmImage"))
 	};
 }
 const pathOf$1 = (e) => e.displayPath ?? e.qualifiedId;
@@ -3554,7 +3561,7 @@ function sortApiEntries(entries) {
 	});
 }
 function countTargets(listing) {
-	return listing.lambdas.length + listing.apis.length + listing.ecsServices.length + listing.ecsTaskDefinitions.length + listing.agentCoreRuntimes.length + listing.loadBalancers.length + listing.cloudFrontDistributions.length;
+	return listing.lambdas.length + listing.apis.length + listing.ecsServices.length + listing.ecsTaskDefinitions.length + listing.agentCoreRuntimes.length + listing.loadBalancers.length + listing.cloudFrontDistributions.length + listing.webFunctions.length + listing.microvmImages.length;
 }
 
 //#endregion
@@ -5095,28 +5102,28 @@ function parseEcsTarget(target) {
 function resolveEcsTaskTarget(target, stacks, context) {
 	if (stacks.length === 0) throw new EcsTaskResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack$3(parsed, stacks, target);
+	const stack = pickStack$4(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	let logicalId;
 	let resource;
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
 		const taskDefs = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId: l }) => resources[l]?.Type === "AWS::ECS::TaskDefinition");
-		if (taskDefs.length === 0) throw notFoundError$1(target, stack, resources);
+		if (taskDefs.length === 0) throw notFoundError$2(target, stack, resources);
 		if (taskDefs.length > 1) throw new EcsTaskResolutionError(`Target '${target}' matches ${taskDefs.length} task definitions in ${stack.stackName}: ` + taskDefs.map((t) => t.logicalId).join(", ") + ". Refine the path or use the stack:LogicalId form.");
 		logicalId = taskDefs[0].logicalId;
 		resource = resources[logicalId];
 	} else {
 		resource = resources[parsed.pathOrId];
-		if (!resource) throw notFoundError$1(target, stack, resources);
+		if (!resource) throw notFoundError$2(target, stack, resources);
 		logicalId = parsed.pathOrId;
 	}
-	if (!logicalId || !resource) throw notFoundError$1(target, stack, resources);
+	if (!logicalId || !resource) throw notFoundError$2(target, stack, resources);
 	if (resource.Type === "AWS::Lambda::Function") throw new EcsTaskResolutionError(`Resource ${displayIdent(logicalId)} in ${stack.stackName} is a Lambda function, not an ECS task definition. Use \`${getEmbedConfig().cliName} invoke\` for Lambda; \`${getEmbedConfig().cliName} run-task\` is ECS only.`);
 	if (resource.Type !== "AWS::ECS::TaskDefinition") throw new EcsTaskResolutionError(`Resource ${displayIdent(logicalId)} in ${stack.stackName} is ${displayIdent(resource.Type)}, not an AWS::ECS::TaskDefinition.`);
 	return extractTaskDefinitionProperties(stack, logicalId, resource, context);
 }
-function pickStack$3(parsed, stacks, target) {
+function pickStack$4(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -5545,7 +5552,7 @@ function pickStringArray$1(value) {
 	for (const v of value) if (typeof v === "string") out.push(v);
 	return out;
 }
-function notFoundError$1(target, stack, resources) {
+function notFoundError$2(target, stack, resources) {
 	const tasks = [];
 	for (const [logicalId, resource] of Object.entries(resources)) {
 		if (resource.Type !== "AWS::ECS::TaskDefinition") continue;
@@ -6488,7 +6495,7 @@ function pushMap(hash, name, value) {
 
 //#endregion
 //#region src/local/docker-runner.ts
-const execFileAsync$5 = promisify(execFile);
+const execFileAsync$7 = promisify(execFile);
 var DockerRunnerError = class DockerRunnerError extends Error {
 	constructor(message) {
 		super(message);
@@ -6535,7 +6542,7 @@ async function pullImage(image, skipPull, platform) {
 	}
 }
 async function runDetached(opts) {
-	const args = [
+	const args = opts.autoRemove === false ? ["run", "-d"] : [
 		"run",
 		"-d",
 		"--rm"
@@ -6550,6 +6557,7 @@ async function runDetached(opts) {
 	const host = opts.host ?? "127.0.0.1";
 	args.push("-p", `${host}:${opts.hostPort}:${opts.containerPort ?? 8080}`);
 	if (opts.debugPort !== void 0) args.push("-p", `${host}:${opts.debugPort}:${opts.debugPort}`);
+	for (const extra of opts.extraPorts ?? []) args.push("-p", `${host}:${extra.hostPort}:${extra.containerPort}`);
 	for (const mount of opts.mounts) {
 		const ro = mount.readOnly ? ":ro" : "";
 		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
@@ -6579,7 +6587,7 @@ async function runDetached(opts) {
 	if (refusal !== void 0) throw new DockerRunnerError(refusal);
 	warnFinchArgvExposure(forwardedKeys);
 	try {
-		const { stdout } = await execFileAsync$5(getDockerCmd(), args, {
+		const { stdout } = await execFileAsync$7(getDockerCmd(), args, {
 			maxBuffer: 10 * 1024 * 1024,
 			...execEnvForSecrets(passthroughEnv)
 		});
@@ -6620,7 +6628,7 @@ function createPrefixedLineRelay(prefix, out) {
 		}
 	};
 }
-function streamLogs(containerId) {
+function streamLogs(containerId, opts = {}) {
 	const proc = spawn(getDockerCmd(), [
 		"logs",
 		"-f",
@@ -6630,9 +6638,14 @@ function streamLogs(containerId) {
 		"pipe",
 		"pipe"
 	] });
+	if (opts.onOutput) {
+		const tap = opts.onOutput;
+		proc.stdout?.on("data", (chunk) => tap(chunk));
+		proc.stderr?.on("data", (chunk) => tap(chunk));
+	}
 	let flush = () => void 0;
-	if (process.env["CDKL_PREFIX_CONTAINER_OUTPUT"] === "1") {
-		const tag = `[${flattenToOneLine(containerId.slice(0, 12)).replace(/[\]\s]/g, "_")}] `;
+	if (opts.prefix !== void 0 || process.env["CDKL_PREFIX_CONTAINER_OUTPUT"] === "1") {
+		const tag = opts.prefix ?? `[${flattenToOneLine(containerId.slice(0, 12)).replace(/[\]\s]/g, "_")}] `;
 		const stdoutRelay = createPrefixedLineRelay(tag, process.stdout);
 		const stderrRelay = createPrefixedLineRelay(tag, process.stderr);
 		proc.stdout?.on("data", (chunk) => stdoutRelay.push(chunk));
@@ -6656,7 +6669,7 @@ async function removeContainer(containerId) {
 	if (!containerId) return;
 	const logger = getLogger().child("docker");
 	try {
-		await execFileAsync$5(getDockerCmd(), [
+		await execFileAsync$7(getDockerCmd(), [
 			"rm",
 			"-f",
 			containerId
@@ -6670,7 +6683,7 @@ async function removeContainer(containerId) {
 async function ensureDockerAvailable() {
 	const cmd = getDockerCmd();
 	try {
-		await execFileAsync$5(cmd, [
+		await execFileAsync$7(cmd, [
 			"version",
 			"--format",
 			"{{.Server.Version}}"
@@ -7203,14 +7216,14 @@ async function handleConnectionsRequest(opts) {
 	const { req, res, registry } = opts;
 	const parsed = parseConnectionsPath(req.url ?? "");
 	if (!parsed) {
-		writeJson(res, 404, { message: "Not Found" });
+		writeJson$1(res, 404, { message: "Not Found" });
 		return;
 	}
 	const { connectionId } = parsed;
 	const entry = registry.get(connectionId);
 	const method = (req.method ?? "").toUpperCase();
 	if (!entry) {
-		writeJson(res, 410, { message: "GoneException" });
+		writeJson$1(res, 410, { message: "GoneException" });
 		return;
 	}
 	if (method === "POST") {
@@ -7218,17 +7231,17 @@ async function handleConnectionsRequest(opts) {
 		try {
 			body = await readRequestBody$1(req);
 		} catch (err) {
-			writeJson(res, 500, { message: `Failed to read request body: ${err instanceof Error ? err.message : String(err)}` });
+			writeJson$1(res, 500, { message: `Failed to read request body: ${err instanceof Error ? err.message : String(err)}` });
 			return;
 		}
 		if (entry.socket.readyState !== entry.socket.OPEN) {
-			writeJson(res, 410, { message: "GoneException" });
+			writeJson$1(res, 410, { message: "GoneException" });
 			return;
 		}
 		try {
 			entry.socket.send(body);
 		} catch (err) {
-			writeJson(res, 500, { message: `Failed to deliver to socket: ${err instanceof Error ? err.message : String(err)}` });
+			writeJson$1(res, 500, { message: `Failed to deliver to socket: ${err instanceof Error ? err.message : String(err)}` });
 			return;
 		}
 		res.writeHead(200);
@@ -7239,7 +7252,7 @@ async function handleConnectionsRequest(opts) {
 		try {
 			entry.socket.close(1e3, "DeleteConnection");
 		} catch (err) {
-			writeJson(res, 500, { message: `Failed to close socket: ${err instanceof Error ? err.message : String(err)}` });
+			writeJson$1(res, 500, { message: `Failed to close socket: ${err instanceof Error ? err.message : String(err)}` });
 			return;
 		}
 		res.writeHead(204);
@@ -7247,7 +7260,7 @@ async function handleConnectionsRequest(opts) {
 		return;
 	}
 	if (method === "GET") {
-		writeJson(res, 200, {
+		writeJson$1(res, 200, {
 			ConnectedAt: new Date(entry.connectedAt).toISOString(),
 			Identity: { SourceIp: "127.0.0.1" },
 			LastActiveAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -7255,9 +7268,9 @@ async function handleConnectionsRequest(opts) {
 		return;
 	}
 	res.setHeader("Allow", "POST, GET, DELETE");
-	writeJson(res, 405, { message: "MethodNotAllowedException" });
+	writeJson$1(res, 405, { message: "MethodNotAllowedException" });
 }
-function writeJson(res, status, body) {
+function writeJson$1(res, status, body) {
 	const json = JSON.stringify(body);
 	res.writeHead(status, {
 		"Content-Type": "application/json",
@@ -11039,7 +11052,7 @@ async function startApiServer(opts) {
 	const logger = getLogger().child("start-api");
 	let currentState = opts.state;
 	const requestHandler = (req, res) => {
-		handleRequest$2(req, res, currentState, opts).catch((err) => {
+		handleRequest$3(req, res, currentState, opts).catch((err) => {
 			logger.error(`Unhandled request error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
 			if (!res.headersSent) writeError$1(res, 502);
 		});
@@ -11091,7 +11104,7 @@ async function startApiServer(opts) {
 		getServerState: () => currentState
 	};
 }
-async function handleRequest$2(req, res, state, opts) {
+async function handleRequest$3(req, res, state, opts) {
 	const logger = getLogger().child("start-api");
 	if (opts.preDispatch) try {
 		if (await opts.preDispatch(req, res)) return;
@@ -14095,7 +14108,7 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 			for (const key of audit.resolvedKeys) logger.debug(`${label}: substituted env var ${key}`);
 			let unresolved = audit.unresolved;
 			const resolvedKeys = [...audit.resolvedKeys];
-			if (unresolved.length > 0 && stateProvider.resolveDeployedFunctionEnv) {
+			if (unresolved.length > 0 && options.deployedFunctionLookups !== false && stateProvider.resolveDeployedFunctionEnv) {
 				const physicalId = loaded.resources[lambda.logicalId]?.physicalId;
 				if (physicalId) {
 					const deployedEnv = await stateProvider.resolveDeployedFunctionEnv(physicalId);
@@ -14137,7 +14150,9 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 	});
 	let resolvedAssumeRoleArn;
 	try {
-		resolvedAssumeRoleArn = await resolveAssumeRoleArnForLambda(options.assumeRole, stateForRoleHint, stateProvider, lambda.logicalId);
+		const fromTemplate = options.assumeRole === true && options.deployedFunctionLookups === false && stateForRoleHint ? await resolveTemplateRoleArnFromState(lambda.resource.Properties?.["Role"], stateForRoleHint, lambda.stack.template, () => resolvePseudoParametersForInvoke(lambda.stack.region, options)) : void 0;
+		if (fromTemplate !== void 0) logger.info(`--assume-role: auto-resolved execution role from state: ${flattenToOneLine(fromTemplate)}`);
+		resolvedAssumeRoleArn = fromTemplate ?? await resolveAssumeRoleArnForLambda(options.assumeRole, stateForRoleHint, options.deployedFunctionLookups === false ? void 0 : stateProvider, lambda.logicalId);
 	} finally {
 		stateProvider?.dispose();
 	}
@@ -14248,6 +14263,28 @@ function resolveExecutionRoleArnFromState(state, logicalId, roleProperty = "Role
 		}
 	}
 }
+async function resolveTemplateRoleArnFromState(templateRole, state, template, pseudo) {
+	if (isIamRoleArn(templateRole)) return templateRole;
+	if (!templateRole || typeof templateRole !== "object" || Array.isArray(templateRole)) return;
+	const ref = pickReferencedLogicalId(templateRole);
+	if (ref === void 0) return void 0;
+	const roleResource = template.Resources?.[ref];
+	if (roleResource?.Type !== "AWS::IAM::Role") return void 0;
+	const deployed = state.resources[ref];
+	if (!deployed) return void 0;
+	const cached = deployed.attributes?.["Arn"];
+	if (isIamRoleArn(cached)) return cached;
+	const physicalId = deployed.physicalId;
+	if (isIamRoleArn(physicalId)) return physicalId;
+	if (typeof physicalId !== "string" || !/^[\w+=,.@-]{1,64}$/.test(physicalId)) return void 0;
+	const rawPath = roleResource.Properties?.["Path"];
+	if (rawPath !== void 0 && typeof rawPath !== "string") return void 0;
+	const rolePath = rawPath ?? "/";
+	const bag = await pseudo();
+	if (!bag?.accountId) return void 0;
+	const arn = `arn:${bag.partition ?? "aws"}:iam::${bag.accountId}:role${rolePath}${physicalId}`;
+	return isIamRoleArn(arn) ? arn : void 0;
+}
 function pickReferencedLogicalId(intrinsic) {
 	if ("Ref" in intrinsic && typeof intrinsic["Ref"] === "string") return intrinsic["Ref"];
 	if ("Fn::GetAtt" in intrinsic) {
@@ -15996,7 +16033,7 @@ async function runAgentCoreWatchLoop(args) {
 		}
 	}
 }
-const execFileAsync$4 = promisify(execFile);
+const execFileAsync$6 = promisify(execFile);
 function describeExecError(err) {
 	if (!(err instanceof Error)) return String(err);
 	const stderr = err.stderr;
@@ -16008,7 +16045,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	const dockerCmd = getDockerCmd();
 	let workdir;
 	try {
-		const { stdout } = await execFileAsync$4(dockerCmd, [
+		const { stdout } = await execFileAsync$6(dockerCmd, [
 			"inspect",
 			"--format",
 			"{{.Config.WorkingDir}}",
@@ -16021,7 +16058,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	const workdirDest = workdir.endsWith("/") ? workdir : `${workdir}/`;
 	logger.info(`Soft-reload: docker cp ${flattenToOneLine(newAssetSourceDir)} -> ${containerId}:${workdirDest}; restart.`);
 	try {
-		await execFileAsync$4(dockerCmd, [
+		await execFileAsync$6(dockerCmd, [
 			"cp",
 			`${newAssetSourceDir}/.`,
 			`${containerId}:${workdirDest}`
@@ -16030,7 +16067,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 		throw new CdkLocalError(`softReloadAgentContainer: docker cp into '${containerId}:${workdir}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_CP_FAILED");
 	}
 	try {
-		await execFileAsync$4(dockerCmd, ["restart", containerId]);
+		await execFileAsync$6(dockerCmd, ["restart", containerId]);
 	} catch (err) {
 		throw new CdkLocalError(`softReloadAgentContainer: docker restart of '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_RESTART_FAILED");
 	}
@@ -16206,7 +16243,7 @@ function writePrefixedLines(prefix, buffer, out) {
 
 //#endregion
 //#region src/local/ecs-network.ts
-const execFileAsync$3 = promisify(execFile);
+const execFileAsync$5 = promisify(execFile);
 const METADATA_ENDPOINT_IMAGE = "amazon/amazon-ecs-local-container-endpoints:latest-amd64";
 const METADATA_ENDPOINT_IP = "169.254.170.2";
 const DEFAULT_METADATA_ENDPOINT_SUBNET = "169.254.170.0/24";
@@ -16242,7 +16279,7 @@ async function sweepOrphanedSvcNetworks(prefix) {
 	const filter = `${prefix}-svc-`;
 	let names;
 	try {
-		const { stdout } = await execFileAsync$3(getDockerCmd(), [
+		const { stdout } = await execFileAsync$5(getDockerCmd(), [
 			"network",
 			"ls",
 			"--filter",
@@ -16260,7 +16297,7 @@ async function sweepOrphanedSvcNetworks(prefix) {
 	for (const name of names) {
 		let attached;
 		try {
-			const { stdout } = await execFileAsync$3(getDockerCmd(), [
+			const { stdout } = await execFileAsync$5(getDockerCmd(), [
 				"network",
 				"inspect",
 				name,
@@ -16288,7 +16325,7 @@ async function createNetworkAndSidecar(args) {
 	await pullImage(METADATA_ENDPOINT_IMAGE, skipPull);
 	logger.info(`Creating docker network ${networkName} (subnet ${cidr})...`);
 	try {
-		await execFileAsync$3(getDockerCmd(), [
+		await execFileAsync$5(getDockerCmd(), [
 			"network",
 			"create",
 			"--driver",
@@ -16325,7 +16362,7 @@ async function createNetworkAndSidecar(args) {
 	warnFinchArgvExposure(Object.keys(sidecarPassthroughEnv));
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
 	try {
-		const { stdout } = await execFileAsync$3(getDockerCmd(), sidecarArgs, {
+		const { stdout } = await execFileAsync$5(getDockerCmd(), sidecarArgs, {
 			maxBuffer: 10 * 1024 * 1024,
 			...execEnvForSecrets(sidecarPassthroughEnv)
 		});
@@ -16373,7 +16410,7 @@ async function destroyNetworkOnly(networkName) {
 	if (!networkName) return;
 	const logger = getLogger().child("ecs-network");
 	try {
-		await execFileAsync$3(getDockerCmd(), [
+		await execFileAsync$5(getDockerCmd(), [
 			"network",
 			"rm",
 			networkName
@@ -16487,7 +16524,7 @@ async function resolveSsm(entry, shape, client) {
 
 //#endregion
 //#region src/local/ecs-task-runner.ts
-const execFileAsync$2 = promisify(execFile);
+const execFileAsync$4 = promisify(execFile);
 var EcsTaskRunnerError = class EcsTaskRunnerError extends Error {
 	constructor(message) {
 		super(message);
@@ -16530,7 +16567,7 @@ async function cleanupEcsRun(state, options) {
 	if (state.network && !state.network.ownedByCaller) await destroyTaskNetwork(state.network);
 	state.network = void 0;
 	for (const v of state.dockerVolumeNames) try {
-		await execFileAsync$2(getDockerCmd(), [
+		await execFileAsync$4(getDockerCmd(), [
 			"volume",
 			"rm",
 			v
@@ -16681,7 +16718,7 @@ async function runEcsTask(task, options, state) {
 		let id;
 		warnFinchArgvExposure(Object.keys(sensitiveEnv));
 		try {
-			const { stdout } = await execFileAsync$2(getDockerCmd(), args, {
+			const { stdout } = await execFileAsync$4(getDockerCmd(), args, {
 				maxBuffer: 10 * 1024 * 1024,
 				...execEnvForSecrets(sensitiveEnv)
 			});
@@ -16773,7 +16810,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 	let lastStatus = "";
 	while (Date.now() < deadline) {
 		try {
-			const { stdout } = await execFileAsync$2(getDockerCmd(), [
+			const { stdout } = await execFileAsync$4(getDockerCmd(), [
 				"inspect",
 				"--format",
 				"{{.State.Health.Status}}",
@@ -16796,7 +16833,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 }
 async function waitForContainerExit(containerId) {
 	try {
-		const { stdout } = await execFileAsync$2(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
+		const { stdout } = await execFileAsync$4(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 		const code = Number.parseInt(stdout.trim(), 10);
 		return Number.isFinite(code) ? code : 1;
 	} catch (err) {
@@ -16806,7 +16843,7 @@ async function waitForContainerExit(containerId) {
 }
 async function stopContainer(containerId, graceSeconds) {
 	try {
-		await execFileAsync$2(getDockerCmd(), [
+		await execFileAsync$4(getDockerCmd(), [
 			"stop",
 			"-t",
 			String(graceSeconds),
@@ -16901,7 +16938,7 @@ async function realizeDockerVolumes(volumes, state) {
 		const dockerVolumeName = `${getEmbedConfig().resourceNamePrefix}-${v.name}-${randHex(4)}`;
 		args.push(dockerVolumeName);
 		try {
-			await execFileAsync$2(getDockerCmd(), args);
+			await execFileAsync$4(getDockerCmd(), args);
 			state.dockerVolumeNames.push(dockerVolumeName);
 			logger.debug(`Created docker volume ${displayIdent(dockerVolumeName)} for task volume ${displayIdent(v.name)}`);
 		} catch (err) {
@@ -17095,23 +17132,23 @@ function shellJoin(parts) {
 function resolveEcsServiceTarget(target, stacks, context, options) {
 	if (stacks.length === 0) throw new EcsTaskResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack$2(parsed, stacks, target);
+	const stack = pickStack$3(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	let serviceLogicalId;
 	let serviceResource;
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
 		const services = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId: l }) => resources[l]?.Type === "AWS::ECS::Service");
-		if (services.length === 0) throw notFoundError(target, stack, resources, parsed);
+		if (services.length === 0) throw notFoundError$1(target, stack, resources, parsed);
 		if (services.length > 1) throw new EcsTaskResolutionError(`Target '${target}' matches ${services.length} ECS services in ${stack.stackName}: ` + services.map((s) => s.logicalId).join(", ") + ". Refine the path or use the stack:LogicalId form.");
 		serviceLogicalId = services[0].logicalId;
 		serviceResource = resources[serviceLogicalId];
 	} else {
 		serviceResource = resources[parsed.pathOrId];
-		if (!serviceResource) throw notFoundError(target, stack, resources, parsed);
+		if (!serviceResource) throw notFoundError$1(target, stack, resources, parsed);
 		serviceLogicalId = parsed.pathOrId;
 	}
-	if (!serviceLogicalId || !serviceResource) throw notFoundError(target, stack, resources, parsed);
+	if (!serviceLogicalId || !serviceResource) throw notFoundError$1(target, stack, resources, parsed);
 	if (serviceResource.Type === "AWS::ECS::TaskDefinition") throw new EcsTaskResolutionError(`Resource ${displayIdent(serviceLogicalId)} in ${stack.stackName} is an ECS TaskDefinition, not a Service. Use \`${getEmbedConfig().cliName} run-task\` for one-shot tasks; \`${getEmbedConfig().cliName} start-service\` is Service-only.`);
 	if (serviceResource.Type !== "AWS::ECS::Service") throw new EcsTaskResolutionError(`Resource ${displayIdent(serviceLogicalId)} in ${stack.stackName} is ${displayIdent(serviceResource.Type)}, not an AWS::ECS::Service.`);
 	return extractServiceProperties(stack, serviceLogicalId, serviceResource, stacks, context, options);
@@ -17267,7 +17304,7 @@ function deriveServiceDisplayName(rawServiceName, serviceLogicalId, metadata) {
 	}
 	return serviceLogicalId;
 }
-function pickStack$2(parsed, stacks, target) {
+function pickStack$3(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -17276,7 +17313,7 @@ function pickStack$2(parsed, stacks, target) {
 		case "ambiguous": throw new EcsTaskResolutionError(`Multiple stacks match '${selection.pattern}': ${describeStacks(selection.matched)}. Refine the pattern, or use the stack's display path (path form).`);
 	}
 }
-function notFoundError(target, stack, resources, parsed) {
+function notFoundError$1(target, stack, resources, parsed) {
 	const services = [];
 	for (const [logicalId, r] of Object.entries(resources)) {
 		if (r.Type !== "AWS::ECS::Service") continue;
@@ -17301,11 +17338,11 @@ function notFoundError(target, stack, resources, parsed) {
 
 //#endregion
 //#region src/local/docker-inspect.ts
-const execFileAsync$1 = promisify(execFile);
+const execFileAsync$3 = promisify(execFile);
 async function getContainerNetworkIp(containerId, networkName) {
 	const format = `{{with index .NetworkSettings.Networks "${networkName}"}}{{.IPAddress}}{{end}}`;
 	try {
-		const { stdout } = await execFileAsync$1(getDockerCmd(), [
+		const { stdout } = await execFileAsync$3(getDockerCmd(), [
 			"inspect",
 			"--format",
 			format,
@@ -17321,7 +17358,7 @@ async function getContainerNetworkIp(containerId, networkName) {
 async function getPublishedHostPort(containerId, containerPort, protocol = "tcp") {
 	const format = `{{with index .NetworkSettings.Ports "${`${containerPort}/${protocol}`}"}}{{with index . 0}}{{.HostPort}}{{end}}{{end}}`;
 	try {
-		const { stdout } = await execFileAsync$1(getDockerCmd(), [
+		const { stdout } = await execFileAsync$3(getDockerCmd(), [
 			"inspect",
 			"--format",
 			format,
@@ -18619,7 +18656,7 @@ function buildHeaderMaps(headers) {
 		multi
 	};
 }
-function firstHeader(headers, name) {
+function firstHeader$1(headers, name) {
 	const lower = name.toLowerCase();
 	for (const [k, v] of Object.entries(headers)) if (k.toLowerCase() === lower) return v[0];
 }
@@ -18627,8 +18664,8 @@ function buildAlbLambdaEvent(req, opts) {
 	const { path, rawQuery } = splitRawUrl(req.rawUrl);
 	const query = parseQuery(rawQuery);
 	const headerMaps = buildHeaderMaps(req.headers);
-	const contentEncoding = firstHeader(req.headers, "content-encoding");
-	const contentType = firstHeader(req.headers, "content-type") ?? "";
+	const contentEncoding = firstHeader$1(req.headers, "content-encoding");
+	const contentType = firstHeader$1(req.headers, "content-type") ?? "";
 	const isBase64Encoded = req.body.length > 0 && (contentEncoding !== void 0 ? true : !isTextualContentType(contentType));
 	const body = isBase64Encoded ? req.body.toString("base64") : req.body.toString("utf-8");
 	const event = {
@@ -18731,7 +18768,7 @@ async function startFrontDoorServer(opts) {
 	const scheme = opts.tls ? "https" : "http";
 	server.on("connection", (socket) => socket.setNoDelay(true));
 	server.on("upgrade", (req, clientSocket, head) => {
-		handleUpgrade(req, clientSocket, head, effectiveOpts).catch((err) => {
+		handleUpgrade$1(req, clientSocket, head, effectiveOpts).catch((err) => {
 			logger.debug(`front-door upgrade error: ${err instanceof Error ? err.message : String(err)}`);
 			if (!clientSocket.destroyed) clientSocket.destroy();
 		});
@@ -19075,7 +19112,7 @@ function writeError(res, statusCode, message) {
 	res.writeHead(statusCode, { "content-type": "text/plain; charset=utf-8" });
 	res.end(`${message}\n`);
 }
-function handleUpgrade(req, clientSocket, head, opts) {
+function handleUpgrade$1(req, clientSocket, head, opts) {
 	clientSocket.setNoDelay?.(true);
 	if (!opts.route) {
 		writeRawHttpError(clientSocket, 404, "Not Found");
@@ -19262,7 +19299,9 @@ function sanitizeRawHeaderValue(value) {
 const STATUS_TEXT$1 = {
 	301: "Moved Permanently",
 	302: "Found",
+	400: "Bad Request",
 	401: "Unauthorized",
+	403: "Forbidden",
 	404: "Not Found",
 	502: "Bad Gateway",
 	503: "Service Unavailable"
@@ -19516,7 +19555,7 @@ function matchBitPrefix(a, b, prefixLength) {
 
 //#endregion
 //#region src/local/front-door-tls.ts
-const execFileAsync = promisify(execFile);
+const execFileAsync$2 = promisify(execFile);
 async function resolveFrontDoorTlsMaterials(opts) {
 	const hasCert = opts.certPath !== void 0 && opts.certPath !== "";
 	const hasKey = opts.keyPath !== void 0 && opts.keyPath !== "";
@@ -19606,7 +19645,7 @@ function readCertNotAfter(certPath) {
 	}
 }
 async function runOpenssl(args) {
-	await execFileAsync("openssl", args, { timeout: 3e4 });
+	await execFileAsync$2("openssl", args, { timeout: 3e4 });
 }
 function readPemOrThrow(path, flagName) {
 	try {
@@ -21809,7 +21848,7 @@ function resolveAlbFrontDoor(stack, albLogicalId) {
 		if (resource.Type !== LISTENER_TYPE) continue;
 		const props = resource.Properties ?? {};
 		if (refOf(props["LoadBalancerArn"]) !== albLogicalId) continue;
-		const port = parsePort$1(props["Port"]);
+		const port = parsePort$3(props["Port"]);
 		if (port === void 0) continue;
 		const protocol = typeof props["Protocol"] === "string" ? props["Protocol"] : "HTTP";
 		if (protocol !== "HTTP" && protocol !== "HTTPS") {
@@ -22174,7 +22213,7 @@ function refOf(raw) {
 		if (typeof ref === "string" && ref.length > 0) return ref;
 	}
 }
-function parsePort$1(raw) {
+function parsePort$3(raw) {
 	if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1 && raw <= 65535) return raw;
 	if (typeof raw === "string" && /^\d+$/.test(raw)) {
 		const n = parseInt(raw, 10);
@@ -22182,7 +22221,7 @@ function parsePort$1(raw) {
 	}
 }
 function parseContainerPort(raw) {
-	return parsePort$1(raw);
+	return parsePort$3(raw);
 }
 function parseWeight(raw) {
 	if (typeof raw === "number" && Number.isFinite(raw)) return raw < 0 ? 0 : raw;
@@ -22276,7 +22315,7 @@ function parseLbPortOverrides(values) {
 function resolveAlbTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalStartServiceError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack$1(parsed, stacks, target);
+	const stack = pickStack$2(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
@@ -22298,7 +22337,7 @@ function resolveAlbTarget(target, stacks) {
 		albLogicalId: parsed.pathOrId
 	};
 }
-function pickStack$1(parsed, stacks, target) {
+function pickStack$2(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -23520,7 +23559,7 @@ async function startCloudFrontServer(options) {
 	const s3OriginReaders = options.s3OriginReaders ?? /* @__PURE__ */ new Map();
 	const state = { distribution: options.distribution };
 	const handler = (req, res) => {
-		handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger).catch((err) => {
+		handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger).catch((err) => {
 			logger.warn(`Request handling failed: ${err instanceof Error ? err.message : String(err)}`);
 			if (!res.headersSent) {
 				res.statusCode = 500;
@@ -23549,7 +23588,7 @@ async function startCloudFrontServer(options) {
 		}
 	};
 }
-async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger) {
+async function handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger) {
 	const distribution = state.distribution;
 	const rawUrl = req.url ?? "/";
 	const queryIdx = rawUrl.indexOf("?");
@@ -24213,7 +24252,7 @@ async function attachKvsModules(distribution, stacks, options, profileCredential
 function resolveCloudFrontTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalStartCloudFrontError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack(parsed, stacks, target);
+	const stack = pickStack$1(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
@@ -24235,7 +24274,7 @@ function resolveCloudFrontTarget(target, stacks) {
 		logicalId: parsed.pathOrId
 	};
 }
-function pickStack(parsed, stacks, target) {
+function pickStack$1(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
@@ -24858,7 +24897,7 @@ function readAuthorizationHeader(headers) {
 
 //#endregion
 //#region src/cli/commands/local-start-agentcore.ts
-function parsePort(raw) {
+function parsePort$2(raw) {
 	const n = Number(raw);
 	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
 	return n;
@@ -25186,7 +25225,1949 @@ function createLocalStartAgentCoreCommand(opts = {}) {
 	return cmd;
 }
 function addStartAgentCoreSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--watch", "Re-synth + reload the warm container in place on a CDK source change, keeping the serve up. A per-firing classifier picks rebuild (boot a fresh container, re-point the serve) vs soft-reload (docker cp + docker restart the same container) — the same pattern as start-service / invoke-agentcore --ws --watch.")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort$2)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--watch", "Re-synth + reload the warm container in place on a CDK source change, keeping the serve up. A per-firing classifier picks rebuild (boot a fresh container, re-point the serve) vs soft-reload (docker cp + docker restart the same container) — the same pattern as start-service / invoke-agentcore --ws --watch.")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+}
+
+//#endregion
+//#region src/local/web-function-resolver.ts
+const WEB_FUNCTION_TYPE = "AWS::Lambda::WebFunction";
+const WEB_FUNCTION_REVISION_TYPE = "AWS::Lambda::WebFunctionRevision";
+const WEB_FUNCTION_ENDPOINT_TYPE = "AWS::Lambda::WebFunctionEndpoint";
+const WEB_TYPES = [
+	WEB_FUNCTION_ENDPOINT_TYPE,
+	WEB_FUNCTION_TYPE,
+	WEB_FUNCTION_REVISION_TYPE
+];
+var WebFunctionResolutionError = class WebFunctionResolutionError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WebFunctionResolutionError";
+		Object.setPrototypeOf(this, WebFunctionResolutionError.prototype);
+	}
+};
+function resolveWebFunctionTarget(target, stacks, revisionFlag) {
+	if (stacks.length === 0) throw new WebFunctionResolutionError("No stacks found in the synthesized assembly.");
+	const parsed = parseTarget(target);
+	const stack = pickStack(parsed, stacks, target);
+	const resources = stack.template.Resources ?? {};
+	const { logicalId, resource } = matchWebResource(parsed, target, stack, resources);
+	const functions = logicalIdsOfType(resources, WEB_FUNCTION_TYPE);
+	const linked = (value) => linkedFunctionLogicalId(value, resources, functions);
+	let functionLogicalId;
+	let endpoint;
+	let revisionLogicalId;
+	let selection;
+	if (resource.Type === "AWS::Lambda::WebFunctionRevision") {
+		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
+		revisionLogicalId = logicalId;
+		selection = "target-revision";
+	} else if (resource.Type === "AWS::Lambda::WebFunctionEndpoint") {
+		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
+		endpoint = readEndpoint(logicalId, resource, resources);
+	} else functionLogicalId = logicalId;
+	const revisionsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_REVISION_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
+	const endpointsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_ENDPOINT_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
+	if (revisionFlag !== void 0) {
+		const flagged = resources[revisionFlag];
+		if (!flagged || flagged.Type !== "AWS::Lambda::WebFunctionRevision") throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} is not an ${WEB_FUNCTION_REVISION_TYPE} logical id in ${displayStackName(stack.stackName)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
+		const owner = linked(flagged.Properties?.["FunctionName"]);
+		if (functionLogicalId !== void 0 && owner !== functionLogicalId) throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} belongs to a different web function than ${displayIdent(logicalId)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
+		functionLogicalId ??= owner;
+		revisionLogicalId = revisionFlag;
+		selection = "revision-flag";
+	}
+	if (revisionLogicalId === void 0 && endpoint !== void 0) {
+		revisionLogicalId = pickHighestWeight(endpoint);
+		if (revisionLogicalId !== void 0) selection = "endpoint-weight";
+	}
+	if (revisionLogicalId === void 0) {
+		const revisions = revisionsOfFunction();
+		if (revisions.length === 1) {
+			revisionLogicalId = revisions[0];
+			selection = "only-revision";
+		} else if (endpoint === void 0 && revisions.length > 1) {
+			const endpoints = endpointsOfFunction();
+			if (endpoints.length === 1) {
+				endpoint = readEndpoint(endpoints[0], resources[endpoints[0]], resources);
+				revisionLogicalId = pickHighestWeight(endpoint);
+				if (revisionLogicalId !== void 0) selection = "endpoint-weight";
+			}
+		}
+		if (revisionLogicalId === void 0) throw new WebFunctionResolutionError(revisions.length === 0 ? `${displayIdent(logicalId)} in ${displayStackName(stack.stackName)} resolves to no ${WEB_FUNCTION_REVISION_TYPE} in this template, so there is no code to serve. Target the revision itself, or pass --revision <logicalId>.` : `${displayIdent(logicalId)} has ${revisions.length} revisions and no single endpoint that picks one. Pass --revision <logicalId>, or target one of the function's endpoints. ${describeRevisions(revisions, stack)}`);
+	}
+	if (endpoint === void 0) {
+		const routing = endpointsOfFunction().map((id) => readEndpoint(id, resources[id], resources)).filter((e) => e.weights.some((w) => w.revisionLogicalId === revisionLogicalId));
+		if (routing.length === 1) endpoint = routing[0];
+	}
+	const fnName = (functionLogicalId !== void 0 ? resources[functionLogicalId] : void 0)?.Properties?.["FunctionName"];
+	return {
+		stack,
+		functionLogicalId,
+		functionName: typeof fnName === "string" && fnName.length > 0 ? fnName : functionLogicalId ?? revisionLogicalId,
+		revisionLogicalId,
+		revision: resources[revisionLogicalId],
+		endpoint,
+		selection: selection ?? "only-revision"
+	};
+}
+function pickStack(parsed, stacks, target) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new WebFunctionResolutionError(`Multiple stacks in app, target ${displayIdent(parsed.pathOrId)} is missing a stack prefix. Use StackName:<logicalId> or StackName/... (path form). Available stacks: ${describeStacks(stacks)}.`);
+		case "not-found": throw new WebFunctionResolutionError(`Stack ${displayStackName(selection.pattern)} not found. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new WebFunctionResolutionError(`Stack pattern ${displayStackName(selection.pattern)} matched ${selection.matched.length} stacks: ${describeStacks(selection.matched)}. Use a more specific pattern, or the stack's display path.`);
+	}
+}
+function matchWebResource(parsed, target, stack, resources) {
+	if (parsed.isPath) {
+		const matches = resolveCdkPathToLogicalIds(parsed.pathOrId, buildCdkPathIndex(stack.template)).filter(({ logicalId }) => WEB_TYPES.includes(resources[logicalId]?.Type ?? ""));
+		for (const type of WEB_TYPES) {
+			const ofType = matches.filter(({ logicalId }) => resources[logicalId].Type === type);
+			if (ofType.length === 1) {
+				const id = ofType[0].logicalId;
+				return {
+					logicalId: id,
+					resource: resources[id]
+				};
+			}
+			if (ofType.length > 1) throw new WebFunctionResolutionError(`Target ${displayStackName(target)} matches ${ofType.length} ${type} resources: ${ofType.map((m) => displayIdent(m.logicalId)).join(", ")}. Refine the path or use the StackName:<logicalId> form.`);
+		}
+		throw notFoundError(target, stack, resources);
+	}
+	const resource = resources[parsed.pathOrId];
+	if (!resource) throw notFoundError(target, stack, resources);
+	if (!WEB_TYPES.includes(resource.Type)) throw new WebFunctionResolutionError(`Resource ${displayIdent(parsed.pathOrId)} in ${displayStackName(stack.stackName)} is ${displayIdent(resource.Type)}, not a Lambda web function. ${getEmbedConfig().cliName} start-web-function serves ${WEB_TYPES.join(" / ")} targets.`);
+	return {
+		logicalId: parsed.pathOrId,
+		resource
+	};
+}
+function notFoundError(target, stack, resources) {
+	const available = WEB_TYPES.flatMap((t) => logicalIdsOfType(resources, t));
+	const hint = available.length > 0 ? `Web function resources in ${displayStackName(stack.stackName)}: ${available.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_TYPE} resources found in ${displayStackName(stack.stackName)}.`;
+	return new WebFunctionResolutionError(`Target ${displayStackName(target)} not found. ${hint}`);
+}
+function logicalIdsOfType(resources, type) {
+	return Object.keys(resources).filter((id) => resources[id]?.Type === type);
+}
+function linkedFunctionLogicalId(value, resources, functions) {
+	const ref = referencedLogicalId(value);
+	if (ref !== void 0) return functions.includes(ref) ? ref : void 0;
+	if (typeof value !== "string") return void 0;
+	const byName = functions.filter((id) => resources[id]?.Properties?.["FunctionName"] === value);
+	return byName.length === 1 ? byName[0] : void 0;
+}
+function referencedLogicalId(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const obj = value;
+	if (typeof obj["Ref"] === "string") return obj["Ref"];
+	const getAtt = obj["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
+	if (typeof getAtt === "string") return getAtt.split(".")[0];
+}
+function readEndpoint(logicalId, resource, resources) {
+	const props = resource.Properties ?? {};
+	const rawWeights = props["RevisionWeights"];
+	const weights = [];
+	if (Array.isArray(rawWeights)) for (const entry of rawWeights) {
+		if (!entry || typeof entry !== "object") continue;
+		const e = entry;
+		const ref = referencedLogicalId(e["RevisionId"]);
+		weights.push({
+			revisionLogicalId: ref !== void 0 && resources[ref]?.Type === "AWS::Lambda::WebFunctionRevision" ? ref : void 0,
+			weight: typeof e["Weight"] === "number" ? e["Weight"] : 0
+		});
+	}
+	const str = (v) => typeof v === "string" ? v : void 0;
+	return {
+		logicalId,
+		endpointType: str(props["EndpointType"]),
+		authType: str(props["AuthType"]),
+		weights
+	};
+}
+function pickHighestWeight(endpoint) {
+	let best;
+	for (const w of endpoint.weights) {
+		if (w.revisionLogicalId === void 0) continue;
+		if (best === void 0 || w.weight > best.weight) best = w;
+	}
+	return best?.revisionLogicalId;
+}
+function describeRevisions(revisions, stack) {
+	return revisions.length > 0 ? `Revisions: ${revisions.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_REVISION_TYPE} linked to it in ${displayStackName(stack.stackName)}.`;
+}
+
+//#endregion
+//#region src/local/web-function-artifact.ts
+const SUPPORTED_CODE_CONFIG_KEYS = ["S3Object"];
+function parseWebFunctionBuildConfig(revisionLogicalId, buildConfig) {
+	const subject = `Web function revision ${displayIdent(revisionLogicalId)}`;
+	const build = asObject$2(buildConfig);
+	const runtime = asObject$2(build?.["RuntimeConfig"])?.["Runtime"];
+	if (typeof runtime !== "string" || runtime.length === 0) throw new CdkLocalError(`${subject} has no literal BuildConfig.RuntimeConfig.Runtime.`, "LOCAL_START_WEB_FUNCTION_NO_RUNTIME");
+	const codeConfig = asObject$2(build?.["CodeConfig"]);
+	if (!codeConfig) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
+	const unknownKeys = Object.keys(codeConfig).filter((k) => !SUPPORTED_CODE_CONFIG_KEYS.includes(k));
+	if (unknownKeys.length > 0) throw new CdkLocalError(`${subject} uses BuildConfig.CodeConfig.${unknownKeys.map((k) => displayIdent(k)).join(", ")}, which ${getEmbedConfig().cliName} start-web-function does not support yet. Supported: ${SUPPORTED_CODE_CONFIG_KEYS.join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_CODE_CONFIG");
+	const s3 = asObject$2(codeConfig["S3Object"]);
+	if (!s3) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig.S3Object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
+	const key = s3["Key"];
+	if (typeof key !== "string" || key.length === 0) throw new CdkLocalError(`${subject} has a CodeConfig.S3Object.Key that is not a literal string (${describeValue$1(key)}). The code must come from a CDK asset in this app (for example an s3assets.Asset passing asset.s3BucketName / asset.s3ObjectKey), whose key synthesizes as a literal.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_NOT_LITERAL");
+	const versionId = s3["VersionId"];
+	return {
+		runtime,
+		s3Object: {
+			bucket: s3["Bucket"],
+			key,
+			...typeof versionId === "string" && { versionId }
+		}
+	};
+}
+function findFileAssetForObjectKey(manifest, key) {
+	for (const [hash, asset] of Object.entries(manifest.files ?? {})) for (const dest of Object.values(asset.destinations ?? {})) if (dest.objectKey === key || dest.objectKey.endsWith(`/${key}`)) return {
+		hash,
+		asset
+	};
+	const hash = key.replace(/^.*\//, "").replace(/\.zip$/, "");
+	const byHash = Object.hasOwn(manifest.files ?? {}, hash) ? manifest.files[hash] : void 0;
+	return byHash ? {
+		hash,
+		asset: byHash
+	} : void 0;
+}
+async function resolveWebFunctionArtifact(stack, revisionLogicalId, code, loader = new AssetManifestLoader()) {
+	const subject = `Web function revision ${displayUntrustedValue(revisionLogicalId)} code bundle`;
+	const notFound = () => new CdkLocalError(`${subject} (S3Object bucket ${describeValue$1(code.s3Object.bucket)}, key ${displayUntrustedValue(code.s3Object.key)}) matches no file asset in this app's cdk.out. ${getEmbedConfig().cliName} start-web-function runs code that comes from a CDK asset in this app (for example an s3assets.Asset of a directory); it does not download deployed code. Re-synthesize the app, or point the revision at an asset.`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NOT_FOUND");
+	const manifestPath = stack.assetManifestPath;
+	if (!manifestPath) throw notFound();
+	const manifestDir = dirname$1(manifestPath);
+	const manifest = await loader.loadStackManifest(stack, manifestDir);
+	const match = manifest ? findFileAssetForObjectKey(manifest, code.s3Object.key) : void 0;
+	if (!match) throw notFound();
+	if (typeof match.asset.source.path !== "string" || match.asset.source.path.length === 0) throw new CdkLocalError(`${subject} matches file asset ${displayIdent(match.hash)}, which has no source.path (it is produced by source.executable at publish time), so there is no staged bundle in cdk.out to mount. Give the revision an asset of a directory or a .zip file (for example s3assets.Asset with path: '<dir>').`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NO_PATH");
+	const sourcePath = resolveAssetSourcePath({
+		manifestDir,
+		value: match.asset.source.path,
+		assetOutdir: assetPathDirs(stack).assetOutdir,
+		absolute: "honour-warn",
+		field: "source.path",
+		subject,
+		action: "mount it",
+		sink: "bind-mount that directory into the web function container",
+		wrapError: (message) => new CdkLocalError(message, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	});
+	if (!existsSync$1(sourcePath)) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} does not exist. Re-synthesize the app and retry.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_MISSING");
+	if (!statSync$1(sourcePath).isDirectory() && !sourcePath.endsWith(".zip")) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} is neither a directory nor a .zip archive, so it is not a code bundle.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_NOT_BUNDLE");
+	const materialized = materializeAssetCodeDir(sourcePath);
+	return {
+		kind: "zip",
+		runtime: code.runtime,
+		codeDir: materialized.dir,
+		...materialized.tmpDir !== void 0 && { tmpDir: materialized.tmpDir },
+		assetHash: match.hash
+	};
+}
+function disposeWebFunctionArtifact(artifact) {
+	if (artifact?.kind !== "zip" || artifact.tmpDir === void 0) return;
+	try {
+		if (existsSync$1(artifact.tmpDir)) rmSync$1(artifact.tmpDir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
+}
+function asObject$2(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function describeValue$1(value) {
+	if (typeof value === "string") return displayUntrustedValue(value);
+	let json;
+	try {
+		json = JSON.stringify(value);
+	} catch {
+		json = void 0;
+	}
+	return displayUntrustedValue(json ?? String(value));
+}
+
+//#endregion
+//#region src/local/web-function-runtime.ts
+const NODE_CODE_MOUNT = "/var/task";
+const NODE_ENTRYPOINT_ENV = "AWS_LAMBDA_NODEJS_ENTRYPOINT";
+const NODE_DEFAULT_ENTRY = "index.js";
+function buildNodeEntryFileStart(runtime, env, codeDir, fileExists = existsSync$1) {
+	const configured = env[NODE_ENTRYPOINT_ENV];
+	const entryFile = configured !== void 0 && configured.length > 0 ? configured : NODE_DEFAULT_ENTRY;
+	const hostPath = resolve$1(codeDir, entryFile);
+	const rel = relative$1(codeDir, hostPath);
+	if (isAbsolute$1(entryFile) || rel === "" || rel === ".." || rel.startsWith(`..${sep$1}`) || isAbsolute$1(rel)) throw new CdkLocalError(`${NODE_ENTRYPOINT_ENV}=${displayUntrustedValue(entryFile)} must name a file inside the code bundle, relative to its root.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_OUTSIDE_BUNDLE");
+	if (!fileExists(hostPath)) throw new CdkLocalError(`The ${runtime} web function entry file ${displayUntrustedValue(entryFile)} was not found in the code bundle ${displayUntrustedValue(codeDir)}. The runtime loads ${NODE_DEFAULT_ENTRY} from the package root unless ${NODE_ENTRYPOINT_ENV} names another file.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_MISSING");
+	const posixRel = sep$1 === "\\" ? rel.split("\\").join("/") : rel;
+	return {
+		entryPoint: ["/var/lang/bin/node"],
+		cmd: [posix.join(NODE_CODE_MOUNT, posixRel)],
+		label: entryFile
+	};
+}
+const WEB_FUNCTION_RUNTIMES = { "nodejs24.x": {
+	runtime: "nodejs24.x",
+	baseImage: "public.ecr.aws/lambda/nodejs:24",
+	codeMountPath: NODE_CODE_MOUNT,
+	architectures: ["arm64"],
+	buildStart: (env, codeDir, deps) => buildNodeEntryFileStart("nodejs24.x", env, codeDir, deps?.fileExists)
+} };
+function supportedWebFunctionRuntimes(table = WEB_FUNCTION_RUNTIMES) {
+	return Object.keys(table).sort();
+}
+function resolveWebFunctionRuntime(runtime, table = WEB_FUNCTION_RUNTIMES) {
+	const spec = Object.hasOwn(table, runtime) ? table[runtime] : void 0;
+	if (!spec) throw new CdkLocalError(`Web function runtime ${displayIdent(runtime)} is not supported by ${getEmbedConfig().cliName} start-web-function yet. Supported: ${supportedWebFunctionRuntimes(table).join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_RUNTIME");
+	return spec;
+}
+function defaultWebFunctionPlatform(spec) {
+	return spec.architectures[0] === "x86_64" ? "linux/amd64" : "linux/arm64";
+}
+
+//#endregion
+//#region src/local/web-function-service-config.ts
+const WEB_FUNCTION_HTTP_ENDPOINT_ENV = "AWS_LAMBDA_HTTP_ENDPOINT";
+const APPLICATION_MANAGED_AUTH = "ApplicationManaged";
+const HOME_REGION_ENDPOINT = "HomeRegion";
+function readWebFunctionServiceConfig(revision) {
+	const sc = asObject$1(revision.Properties?.["ServiceConfig"]) ?? {};
+	const envRaw = sc["EnvironmentVariables"];
+	const envObj = asObject$1(envRaw);
+	const envKeys = envObj ? Object.keys(envObj) : [];
+	const env = envKeys.length === 1 && (envKeys[0] === "Ref" || envKeys[0].startsWith("Fn::")) ? void 0 : envObj;
+	const logGroup = asObject$1(asObject$1(sc["TelemetryConfig"])?.["LoggingConfig"])?.["LogGroup"];
+	return {
+		environmentVariables: env,
+		environmentUnreadable: envRaw !== void 0 && env === void 0,
+		executionRoleArn: sc["ExecutionRoleArn"],
+		egressNetworkConnectorArn: sc["EgressNetworkConnectorArn"],
+		timeoutSeconds: typeof sc["TimeoutSeconds"] === "number" ? sc["TimeoutSeconds"] : void 0,
+		logGroup: typeof logGroup === "string" && logGroup.length > 0 ? logGroup : void 0
+	};
+}
+function buildWebFunctionLambdaView(resolved, config, runtime) {
+	return {
+		kind: "zip",
+		stack: resolved.stack,
+		logicalId: resolved.revisionLogicalId,
+		resource: {
+			Type: resolved.revision.Type,
+			Properties: {
+				...config.environmentVariables !== void 0 && { Environment: { Variables: config.environmentVariables } },
+				...config.executionRoleArn !== void 0 && { Role: config.executionRoleArn }
+			},
+			...resolved.revision.Metadata !== void 0 && { Metadata: resolved.revision.Metadata }
+		},
+		memoryMb: 128,
+		timeoutSec: config.timeoutSeconds ?? 0,
+		layers: [],
+		runtime,
+		handler: "",
+		codePath: null,
+		architecture: "arm64"
+	};
+}
+function webFunctionAssumeRole(assumeRole, config) {
+	if (assumeRole === true && isIamRoleArn(config.executionRoleArn)) return config.executionRoleArn;
+	return assumeRole;
+}
+function finalizeWebFunctionEnv(lambdaEnv, opts) {
+	const env = { ...lambdaEnv };
+	delete env["AWS_LAMBDA_FUNCTION_MEMORY_SIZE"];
+	delete env["AWS_LAMBDA_FUNCTION_VERSION"];
+	delete env["AWS_LAMBDA_FUNCTION_TIMEOUT"];
+	env["AWS_LAMBDA_FUNCTION_NAME"] = opts.functionName;
+	env["AWS_LAMBDA_LOG_GROUP_NAME"] = opts.logGroup ?? `/aws/lambda/${opts.functionName}`;
+	if (opts.timeoutSeconds !== void 0) env["AWS_LAMBDA_FUNCTION_TIMEOUT"] = String(opts.timeoutSeconds);
+	const replacedHttpEndpoint = Object.hasOwn(lambdaEnv, WEB_FUNCTION_HTTP_ENDPOINT_ENV);
+	env[WEB_FUNCTION_HTTP_ENDPOINT_ENV] = `0.0.0.0:${opts.containerPort}`;
+	return {
+		env,
+		replacedHttpEndpoint
+	};
+}
+function webFunctionFidelityWarnings(resolved, config) {
+	const out = [];
+	const rev = displayIdent(resolved.revisionLogicalId);
+	if (config.egressNetworkConnectorArn !== void 0) out.push(`Revision ${rev} sets ServiceConfig.EgressNetworkConnectorArn; the network connector is not emulated, so the container reaches the network through Docker's default bridge.`);
+	if (config.environmentUnreadable) out.push(`Revision ${rev} declares ServiceConfig.EnvironmentVariables as an intrinsic rather than a map; none of its variables reach the container. Supply them with --env-vars.`);
+	const endpoint = resolved.endpoint;
+	if (endpoint) {
+		const ep = displayIdent(endpoint.logicalId);
+		if (endpoint.endpointType !== void 0 && endpoint.endpointType !== "HomeRegion") out.push(`Endpoint ${ep} has EndpointType ${displayIdent(endpoint.endpointType)}; only a single ${HOME_REGION_ENDPOINT} endpoint is reproduced, on one local port.`);
+		if (endpoint.authType !== void 0 && endpoint.authType !== "ApplicationManaged") out.push(`Endpoint ${ep} has AuthType ${displayIdent(endpoint.authType)}; it is not enforced locally — every request reaches the server unauthenticated.`);
+		const routed = endpoint.weights.filter((w) => w.weight > 0);
+		if (routed.length > 1) out.push(`Endpoint ${ep} splits traffic across ${routed.length} revisions; weighted routing is not emulated — every request goes to revision ${rev}.`);
+	}
+	return out;
+}
+function asObject$1(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+
+//#endregion
+//#region src/local/web-function-runner.ts
+const execFileAsync$1 = promisify$1(execFile$1);
+const WEB_FUNCTION_CONTAINER_PORT = 8080;
+const READY_FAILURE_LOG_LINES = 20;
+const MAX_PROBE_TIMEOUT_MS = 1e4;
+function planWebFunctionContainer(artifact, spec, env, deps) {
+	if (artifact.kind !== "zip") throw new CdkLocalError("A container-image web function source is not supported yet; only a zip bundle from CodeConfig.S3Object runs locally.", "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_ARTIFACT");
+	const start = spec.buildStart(env, artifact.codeDir, deps);
+	return {
+		image: spec.baseImage,
+		mounts: [{
+			hostPath: artifact.codeDir,
+			containerPath: spec.codeMountPath,
+			readOnly: true
+		}],
+		entryPoint: start.entryPoint,
+		cmd: start.cmd,
+		workingDir: spec.codeMountPath,
+		label: start.label
+	};
+}
+async function startWebFunctionContainer(opts) {
+	const { plan } = opts;
+	return runDetached({
+		image: plan.image,
+		mounts: plan.mounts,
+		env: opts.env,
+		...opts.sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys: opts.sensitiveEnvKeys },
+		entryPoint: plan.entryPoint,
+		cmd: plan.cmd,
+		...plan.workingDir !== void 0 && { workingDir: plan.workingDir },
+		hostPort: opts.hostPort,
+		containerPort: WEB_FUNCTION_CONTAINER_PORT,
+		host: opts.host,
+		platform: opts.platform,
+		name: opts.name,
+		autoRemove: false
+	});
+}
+var RecentOutput = class {
+	lines = [];
+	partial = "";
+	max;
+	constructor(max = 20) {
+		this.max = max;
+	}
+	push(chunk) {
+		const parts = (this.partial + chunk.toString()).split("\n");
+		this.partial = parts.pop() ?? "";
+		for (const line of parts) this.add(line);
+		if (this.partial.length > 4096) {
+			this.add(this.partial);
+			this.partial = "";
+		}
+	}
+	tail() {
+		return this.partial.length > 0 ? [...this.lines, this.partial].slice(-this.max) : this.lines;
+	}
+	add(line) {
+		this.lines.push(line.replace(/\r$/, ""));
+		if (this.lines.length > this.max) this.lines.shift();
+	}
+};
+async function waitForWebFunctionReady(args, deps = defaultReadyDeps) {
+	const deadline = deps.now() + args.timeoutMs;
+	let attempt = 0;
+	let last = "refused";
+	while (deps.now() < deadline) {
+		const remaining = Math.max(1, deadline - deps.now());
+		last = await deps.probe(args.host, args.port, Math.min(remaining, MAX_PROBE_TIMEOUT_MS));
+		if (last === "answered") return;
+		attempt++;
+		if (attempt % 4 === 0 && !await deps.isRunning(args.containerId)) throw await containerFailure(`The web function container exited before its server listened on AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
+		if (last === "refused") await deps.sleep(250);
+	}
+	const authority = formatAuthority(args.host, args.port);
+	throw await containerFailure(last === "timeout" ? `The web function server on ${authority} accepted the connection but did not answer GET / within ${args.timeoutMs}ms — it is listening but slow to respond. Raise --timeout, or make / answer sooner (started ${args.label}).` : `The web function server never accepted an HTTP connection on ${authority} within ${args.timeoutMs}ms. It must listen on the host:port given in AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
+}
+async function containerFailure(message, containerId, recent, fetchLogs = readContainerLogTail, code = "LOCAL_START_WEB_FUNCTION_NOT_READY") {
+	let lines = [];
+	try {
+		lines = await fetchLogs(containerId, 20);
+	} catch {
+		lines = [];
+	}
+	if (lines.length === 0) lines = recent.tail();
+	return new CdkLocalError(`${message}${lines.length > 0 ? ` Last ${lines.length} line(s) of container output:\n${lines.map((l) => `  ${displayToolOutput(l)}`).join("\n")}` : " The container printed nothing."}`, code);
+}
+function watchContainerExit(containerId) {
+	let stopped = false;
+	const proc = spawn$1(getDockerCmd(), ["wait", containerId], { stdio: [
+		"ignore",
+		"pipe",
+		"ignore"
+	] });
+	let out = "";
+	proc.stdout?.on("data", (c) => out += c.toString());
+	return {
+		exited: new Promise((resolveExit) => {
+			const done = () => {
+				if (stopped) return;
+				const code = Number.parseInt(out.trim(), 10);
+				resolveExit(Number.isNaN(code) ? void 0 : code);
+			};
+			proc.on("close", done);
+			proc.on("error", done);
+		}),
+		stop: () => {
+			stopped = true;
+			if (!proc.killed) proc.kill("SIGTERM");
+		}
+	};
+}
+function probeHttp(host, port, timeoutMs) {
+	return new Promise((resolveProbe) => {
+		let timedOut = false;
+		let connected = false;
+		const req = request$2({
+			host,
+			port,
+			path: "/",
+			method: "GET",
+			timeout: timeoutMs,
+			headers: { connection: "close" }
+		}, (res) => {
+			res.resume();
+			resolveProbe("answered");
+		});
+		req.on("socket", (socket) => {
+			socket.once("connect", () => {
+				connected = true;
+			});
+		});
+		req.on("timeout", () => {
+			timedOut = true;
+			req.destroy();
+		});
+		req.on("error", () => resolveProbe(timedOut && connected ? "timeout" : "refused"));
+		req.end();
+	});
+}
+async function containerIsRunning(containerId) {
+	try {
+		const { stdout } = await execFileAsync$1(getDockerCmd(), [
+			"inspect",
+			"-f",
+			"{{.State.Running}}",
+			containerId
+		]);
+		return stdout.trim() === "true";
+	} catch {
+		return false;
+	}
+}
+function readContainerLogTail(containerId, lines, spawnFn = spawn$1) {
+	return new Promise((resolveLogs, rejectLogs) => {
+		const proc = spawnFn(getDockerCmd(), [
+			"logs",
+			"--tail",
+			String(lines),
+			containerId
+		], { stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		] });
+		const chunks = [];
+		let size = 0;
+		const take = (c) => {
+			if (size > 4 * 1024 * 1024) return;
+			chunks.push(c);
+			size += c.length;
+		};
+		proc.stdout?.on("data", take);
+		proc.stderr?.on("data", take);
+		proc.on("error", rejectLogs);
+		proc.on("close", (code) => {
+			if (code !== 0) {
+				rejectLogs(/* @__PURE__ */ new Error(`docker logs exited ${code}`));
+				return;
+			}
+			resolveLogs(Buffer.concat(chunks).toString().split("\n").map((l) => l.replace(/\r$/, "")).filter((l) => l.length > 0).slice(-lines));
+		});
+	});
+}
+const defaultReadyDeps = {
+	probe: probeHttp,
+	isRunning: containerIsRunning,
+	fetchLogs: readContainerLogTail,
+	sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+	now: () => Date.now()
+};
+
+//#endregion
+//#region src/cli/commands/local-start-web-function.ts
+function parsePort$1(raw) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
+	return n;
+}
+function connectHost$1(host) {
+	if (host === "0.0.0.0") return "127.0.0.1";
+	if (host === "::" || host === "[::]") return "::1";
+	return host;
+}
+async function localStartWebFunctionCommand(target, options, extraStateProviders, hostSynthesizer) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	let containerId;
+	let stopLogs;
+	let exitWatch;
+	let artifact;
+	let runInFlight;
+	let teardownPromise;
+	let shuttingDown = false;
+	let waitingOnRun = false;
+	let containerName;
+	const forever = () => new Promise(() => void 0);
+	const doTeardown = async () => {
+		exitWatch?.stop();
+		if (containerId === void 0 && runInFlight !== void 0) {
+			waitingOnRun = true;
+			try {
+				containerId = await runInFlight;
+			} catch {} finally {
+				waitingOnRun = false;
+			}
+		}
+		if (stopLogs) try {
+			stopLogs();
+		} catch (err) {
+			logger.debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		if (containerId) await removeContainer(containerId);
+		disposeWebFunctionArtifact(artifact);
+	};
+	const teardown = () => teardownPromise ??= doTeardown();
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region,
+		profile: options.profile
+	});
+	await ensureDockerAvailable();
+	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
+	const appCmd = resolveApp(options.app);
+	if (!appCmd) throw new Error(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
+	logger.info("Synthesizing CDK app...");
+	const synthesizer = hostSynthesizer ?? new Synthesizer();
+	const context = parseContextOptions(options.context);
+	const synthOpts = {
+		app: appCmd,
+		output: options.output,
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile },
+		...Object.keys(context).length > 0 && { context }
+	};
+	const { stacks } = await synthesizer.synthesize(synthOpts);
+	const resolved = resolveWebFunctionTarget(await resolveSingleTarget(target, {
+		entries: listTargets(stacks).webFunctions,
+		message: "Select a Lambda web function to serve",
+		noun: "Lambda web functions",
+		onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} start-web-function requires a <target> (a WebFunction, WebFunctionEndpoint or WebFunctionRevision display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_START_WEB_FUNCTION_TARGET_REQUIRED")
+	}), stacks, options.revision);
+	const code = parseWebFunctionBuildConfig(resolved.revisionLogicalId, resolved.revision.Properties?.["BuildConfig"]);
+	const spec = resolveWebFunctionRuntime(code.runtime);
+	const selectionNote = {
+		"target-revision": "the target revision",
+		"revision-flag": "--revision",
+		"endpoint-weight": `highest weight on endpoint ${displayIdent(resolved.endpoint?.logicalId ?? "")}`,
+		"only-revision": "the function's only revision"
+	};
+	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.revisionLogicalId}`)} (${spec.runtime}; revision chosen by ${selectionNote[resolved.selection]})`);
+	const serviceConfig = readWebFunctionServiceConfig(resolved.revision);
+	for (const line of webFunctionFidelityWarnings(resolved, serviceConfig)) logger.warn(line);
+	artifact = await resolveWebFunctionArtifact(resolved.stack, resolved.revisionLogicalId, code);
+	const shutdown = async (signal, exitCode) => {
+		if (shuttingDown) {
+			if (!waitingOnRun) {
+				logger.info(`Received ${signal} again; still removing the container, please wait...`);
+				return;
+			}
+			disposeWebFunctionArtifact(artifact);
+			logger.warn(`Received ${signal} again; exiting without waiting for docker run to return. The container may still be starting, and its environment holds the forwarded AWS credentials. Remove it by its name (this works even if it is created after this exit): docker rm -f ${containerName ?? "<name>"}`);
+			process.exit(signal === "SIGINT" ? 130 : 143);
+			return;
+		}
+		shuttingDown = true;
+		logger.info(`Received ${signal}, shutting down...`);
+		await teardown();
+		process.exit(exitCode);
+	};
+	process.on("SIGINT", () => void shutdown("SIGINT", 130));
+	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
+	const recent = new RecentOutput();
+	try {
+		const assumeRole = webFunctionAssumeRole(options.assumeRole, serviceConfig);
+		const containerEnv = await resolveLambdaContainerEnv(buildWebFunctionLambdaView(resolved, serviceConfig, spec.runtime), {
+			...options,
+			...assumeRole !== void 0 && { assumeRole },
+			deployedFunctionLookups: false
+		}, profileCredentials, extraStateProviders);
+		const { env, replacedHttpEndpoint } = finalizeWebFunctionEnv(containerEnv.env, {
+			functionName: resolved.functionName,
+			containerPort: WEB_FUNCTION_CONTAINER_PORT,
+			timeoutSeconds: serviceConfig.timeoutSeconds,
+			logGroup: serviceConfig.logGroup
+		});
+		if (replacedHttpEndpoint) logger.warn(`The revision's ${WEB_FUNCTION_HTTP_ENDPOINT_ENV} is replaced with 0.0.0.0:${WEB_FUNCTION_CONTAINER_PORT}: the runtime owns that variable, and the local port is published to it.`);
+		const plan = planWebFunctionContainer(artifact, spec, env);
+		const platform = options.platform ?? defaultWebFunctionPlatform(spec);
+		await pullImage(plan.image, options.pull === false, platform);
+		if (teardownPromise) return await forever();
+		const hostPort = options.port === 0 ? await pickFreePort() : options.port;
+		const name = containerName = `${getEmbedConfig().resourceNamePrefix}-webfn-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+		logger.info(`Starting web function container (image=${plan.image}, start=${plan.label}, port=${hostPort} -> ${WEB_FUNCTION_CONTAINER_PORT})...`);
+		runInFlight = startWebFunctionContainer({
+			plan,
+			env,
+			sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys),
+			host: options.host,
+			hostPort,
+			platform,
+			name
+		});
+		const id = await runInFlight;
+		if (teardownPromise) return await forever();
+		containerId = id;
+		stopLogs = streamLogs(id, { onOutput: (chunk) => recent.push(chunk) });
+		exitWatch = watchContainerExit(id);
+		const probeHost = connectHost$1(options.host);
+		await waitForWebFunctionReady({
+			containerId: id,
+			host: probeHost,
+			port: hostPort,
+			timeoutMs: options.timeout,
+			recent,
+			label: plan.label
+		});
+		logger.info(`Server listening on http://${formatAuthority(probeHost, hostPort)}  (${displayIdent(resolved.functionName)} (Lambda web function))`);
+		logger.info("Press ^C to shut down.");
+	} catch (err) {
+		if (shuttingDown) return await forever();
+		await teardown();
+		throw err;
+	}
+	if (!exitWatch || !containerId) return await forever();
+	const exitCode = await exitWatch.exited;
+	if (shuttingDown || teardownPromise) return await forever();
+	const failure = await containerFailure(`The web function container exited (exit code ${exitCode ?? "unknown"}) while serving.`, containerId, recent, void 0, "LOCAL_START_WEB_FUNCTION_EXITED");
+	await teardown();
+	throw failure;
+}
+function createLocalStartWebFunctionCommand(opts = {}) {
+	setEmbedConfig(opts.embedConfig);
+	const cmd = new Command("start-web-function").description("Serve an AWS Lambda Web Function locally. Resolves a WebFunction, WebFunctionEndpoint or WebFunctionRevision target to one revision (an endpoint serves its highest-weight revision; --revision overrides), runs its code bundle from cdk.out in a container whose server listens on AWS_LAMBDA_HTTP_ENDPOINT, and publishes it on a local port with the revision's ServiceConfig environment. Target accepts a CDK display path or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C.").argument("[target]", "CDK display path or stack-qualified logical ID of the WebFunction / WebFunctionEndpoint / WebFunctionRevision (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
+		await localStartWebFunctionCommand(target, options, opts.extraStateProviders, opts.synthesizer);
+	}));
+	addStartWebFunctionSpecificOptions(cmd);
+	[
+		...commonOptions(),
+		...appOptions(),
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(regionOption);
+	return cmd;
+}
+function addStartWebFunctionSpecificOptions(cmd) {
+	return cmd.addOption(new Option("--revision <logicalId>", "Serve this WebFunctionRevision (logical ID) instead of the one the endpoint weights pick.")).addOption(new Option("--port <n>", "Local port to serve on. Default 0 (OS-assigned).").default(0).argParser(parsePort$1)).addOption(new Option("--host <ip>", "Address to publish the port on.").default("127.0.0.1")).addOption(new Option("--platform <platform>", "docker --platform for the server container. Defaults to the runtime's cloud architecture (linux/arm64 for nodejs24.x).").choices(["linux/amd64", "linux/arm64"])).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"RevisionLogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--no-pull", "Skip docker pull of the runtime base image (use the cached image)")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the server to answer HTTP. Default 60000.").default(6e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the revision's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the revision's ServiceConfig.ExecutionRoleArn: a literal ARN as written, or the Fn::GetAtt / Ref CDK synthesizes resolved against --from-cfn-stack deployed state; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+}
+
+//#endregion
+//#region src/local/microvm-image.ts
+const MICROVM_IMAGE_TYPE = "AWS::Lambda::MicrovmImage";
+const MICROVM_DEFAULT_INGRESS_PORT = 8080;
+var MicrovmResolutionError = class MicrovmResolutionError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MicrovmResolutionError";
+		Object.setPrototypeOf(this, MicrovmResolutionError.prototype);
+	}
+};
+function resolveMicrovmImageTarget(target, stacks) {
+	if (stacks.length === 0) throw new MicrovmResolutionError("No stacks found in the synthesized assembly.");
+	const parsed = parseTarget(target);
+	const selection = selectTargetStack(parsed, target, stacks);
+	let stack;
+	switch (selection.kind) {
+		case "found":
+			stack = selection.stack;
+			break;
+		case "no-prefix": throw new MicrovmResolutionError(`Multiple stacks in app, target ${displayIdent(parsed.pathOrId)} is missing a stack prefix. Use StackName:<logicalId> or StackName/... (path form). Available stacks: ${describeStacks(stacks)}.`);
+		case "not-found": throw new MicrovmResolutionError(`Stack ${displayStackName(selection.pattern)} not found. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new MicrovmResolutionError(`Stack pattern ${displayStackName(selection.pattern)} matched ${selection.matched.length} stacks: ${describeStacks(selection.matched)}. Use a more specific pattern, or the stack's display path.`);
+	}
+	const resources = stack.template.Resources ?? {};
+	const images = Object.keys(resources).filter((id) => resources[id]?.Type === MICROVM_IMAGE_TYPE);
+	const notFound = () => new MicrovmResolutionError(`Target ${displayStackName(target)} not found. ` + (images.length > 0 ? `MicroVM images in ${displayStackName(stack.stackName)}: ${images.map((id) => displayIdent(id)).join(", ")}.` : `No ${MICROVM_IMAGE_TYPE} resources found in ${displayStackName(stack.stackName)}.`));
+	if (parsed.isPath) {
+		const matches = resolveCdkPathToLogicalIds(parsed.pathOrId, buildCdkPathIndex(stack.template)).filter(({ logicalId }) => resources[logicalId]?.Type === MICROVM_IMAGE_TYPE);
+		if (matches.length === 1) {
+			const id = matches[0].logicalId;
+			return {
+				stack,
+				logicalId: id,
+				resource: resources[id]
+			};
+		}
+		if (matches.length > 1) throw new MicrovmResolutionError(`Target ${displayStackName(target)} matches ${matches.length} ${MICROVM_IMAGE_TYPE} resources: ${matches.map((m) => displayIdent(m.logicalId)).join(", ")}. Refine the path or use the StackName:<logicalId> form.`);
+		throw notFound();
+	}
+	const resource = resources[parsed.pathOrId];
+	if (!resource) throw notFound();
+	if (resource.Type !== "AWS::Lambda::MicrovmImage") throw new MicrovmResolutionError(`Resource ${displayIdent(parsed.pathOrId)} in ${displayStackName(stack.stackName)} is ${displayIdent(resource.Type)}, not a MicroVM image. ${getEmbedConfig().cliName} start-microvm runs ${MICROVM_IMAGE_TYPE} targets.`);
+	return {
+		stack,
+		logicalId: parsed.pathOrId,
+		resource
+	};
+}
+const HOOK_KEYS = {
+	ready: {
+		group: "MicrovmImageHooks",
+		key: "Ready"
+	},
+	validate: {
+		group: "MicrovmImageHooks",
+		key: "Validate"
+	},
+	run: {
+		group: "MicrovmHooks",
+		key: "Run"
+	},
+	suspend: {
+		group: "MicrovmHooks",
+		key: "Suspend"
+	},
+	resume: {
+		group: "MicrovmHooks",
+		key: "Resume"
+	},
+	terminate: {
+		group: "MicrovmHooks",
+		key: "Terminate"
+	}
+};
+function readMicrovmImageConfig(logicalId, resource) {
+	const subject = `MicroVM image ${displayIdent(logicalId)}`;
+	const props = resource.Properties ?? {};
+	const name = typeof props["Name"] === "string" && props["Name"].length > 0 ? props["Name"] : logicalId;
+	const uri = asObject(props["CodeArtifact"])?.["Uri"];
+	const codeKey = s3KeyOfUri(uri);
+	if (codeKey === void 0) throw new CdkLocalError(`${subject} has a CodeArtifact.Uri whose object key is not a literal (${describeValue(uri)}). The code must come from a CDK asset in this app (for example an s3assets.Asset of a directory holding the Dockerfile, passing asset.s3ObjectUrl), whose key synthesizes as a literal.`, "LOCAL_START_MICROVM_CODE_URI_NOT_LITERAL");
+	const cpu = props["CpuConfigurations"];
+	const archRaw = Array.isArray(cpu) ? asObject(cpu[0])?.["Architecture"] : void 0;
+	const architecture = typeof archRaw === "string" ? normalizeArchitecture(archRaw) : void 0;
+	const environment = {};
+	const envRaw = props["EnvironmentVariables"];
+	const unemulated = [];
+	if (Array.isArray(envRaw)) for (const entry of envRaw) {
+		const e = asObject(entry);
+		if (e && typeof e["Key"] === "string") environment[e["Key"]] = e["Value"];
+	}
+	else if (envRaw !== void 0) unemulated.push("EnvironmentVariables is an intrinsic rather than a list, so none of its variables reach the container (supply them with --env-vars)");
+	const hooksObj = asObject(props["Hooks"]);
+	const hooks = {};
+	for (const [hook, where] of Object.entries(HOOK_KEYS)) {
+		const group = asObject(hooksObj?.[where.group]);
+		const value = group?.[where.key];
+		if (value === void 0 || value === "DISABLED") continue;
+		if (value !== "ENABLED") throw new CdkLocalError(`${subject} has Hooks.${where.group}.${where.key} ${describeValue(value)}; only the literal ENABLED or DISABLED can run locally.`, "LOCAL_START_MICROVM_HOOK_VALUE");
+		const timeout = group?.[`${where.key}TimeoutInSeconds`];
+		hooks[hook] = { timeoutSeconds: typeof timeout === "number" && timeout > 0 ? timeout : void 0 };
+	}
+	const port = hooksObj?.["Port"];
+	const hooksPort = typeof port === "number" && Number.isInteger(port) && port > 0 && port < 65536 ? port : void 0;
+	if (Object.keys(hooks).length > 0 && hooksPort === void 0) throw new CdkLocalError(`${subject} enables lifecycle hooks (${Object.keys(hooks).join(", ")}) but has no literal Hooks.Port. Lambda requires the hooks port whenever a hook is configured; set Hooks.Port to the port the application serves /aws/lambda-microvms/runtime/v1/ on.`, "LOCAL_START_MICROVM_NO_HOOKS_PORT");
+	const present = (key) => {
+		const v = props[key];
+		if (v === void 0 || v === null) return false;
+		if (Array.isArray(v)) return v.length > 0;
+		if (typeof v === "object") return Object.keys(v).length > 0;
+		return true;
+	};
+	if (present("EgressNetworkConnectors")) unemulated.push("EgressNetworkConnectors (the container uses Docker's default network egress)");
+	if (present("AdditionalOsCapabilities")) unemulated.push("AdditionalOsCapabilities (the container runs with Docker's default capabilities)");
+	if (present("Resources")) unemulated.push("Resources sizing (the container gets no memory limit)");
+	if (present("BaseImageVersion")) unemulated.push("BaseImageVersion (the local build uses whatever the Dockerfile names)");
+	if (present("Logging")) unemulated.push("Logging (container output is printed here instead of sent to CloudWatch Logs)");
+	return {
+		logicalId,
+		name,
+		codeKey,
+		architecture,
+		environment,
+		hooksPort,
+		hooks,
+		unemulated
+	};
+}
+function normalizeArchitecture(raw) {
+	const s = raw.toLowerCase().replace(/_/g, "");
+	if (s === "arm64") return "arm64";
+	if (s === "x8664") return "x86_64";
+}
+function s3KeyOfUri(value) {
+	const flat = flattenTemplateString(value);
+	if (flat === void 0) return void 0;
+	const m = /^s3:\/\/[^/]*\/(.+)$/.exec(flat);
+	if (!m) return void 0;
+	const key = m[1];
+	return key.includes("\0") || key.includes("${") ? void 0 : key;
+}
+function flattenTemplateString(value) {
+	if (typeof value === "string") return value;
+	const obj = asObject(value);
+	if (!obj) return void 0;
+	const join = obj["Fn::Join"];
+	if (Array.isArray(join) && typeof join[0] === "string" && Array.isArray(join[1])) return join[1].map((p) => flattenTemplateString(p) ?? "\0").join(join[0]);
+	const sub = obj["Fn::Sub"];
+	if (typeof sub === "string") return sub.replace(/\$\{[^}]*\}/g, "\0");
+	if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0].replace(/\$\{[^}]*\}/g, "\0");
+	return "\0";
+}
+async function resolveMicrovmCodeArtifact(stack, config, loader = new AssetManifestLoader()) {
+	const subject = `MicroVM image ${displayUntrustedValue(config.logicalId)} code artifact`;
+	const notFound = () => new CdkLocalError(`${subject} (key ${displayUntrustedValue(config.codeKey)}) matches no file asset in this app's cdk.out. ${getEmbedConfig().cliName} start-microvm builds code that comes from a CDK asset in this app (for example an s3assets.Asset of a directory holding the Dockerfile); it does not download deployed code. Re-synthesize the app, or point CodeArtifact.Uri at an asset.`, "LOCAL_START_MICROVM_CODE_ASSET_NOT_FOUND");
+	const manifestPath = stack.assetManifestPath;
+	if (!manifestPath) throw notFound();
+	const manifestDir = dirname$1(manifestPath);
+	const manifest = await loader.loadStackManifest(stack, manifestDir);
+	const match = manifest ? findFileAssetForObjectKey(manifest, config.codeKey) : void 0;
+	if (!match) throw notFound();
+	if (typeof match.asset.source.path !== "string" || match.asset.source.path.length === 0) throw new CdkLocalError(`${subject} matches file asset ${displayIdent(match.hash)}, which has no source.path (it is produced by source.executable at publish time), so there is no staged bundle in cdk.out to build. Give the image an asset of a directory or a .zip file.`, "LOCAL_START_MICROVM_CODE_ASSET_NO_PATH");
+	const sourcePath = resolveAssetSourcePath({
+		manifestDir,
+		value: match.asset.source.path,
+		assetOutdir: assetPathDirs(stack).assetOutdir,
+		absolute: "honour-warn",
+		field: "source.path",
+		subject,
+		action: "build it",
+		sink: "send that directory to docker build as the MicroVM image context",
+		wrapError: (message) => new CdkLocalError(message, "LOCAL_START_MICROVM_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	});
+	if (!existsSync$1(sourcePath)) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} does not exist. Re-synthesize the app and retry.`, "LOCAL_START_MICROVM_CODE_SOURCE_MISSING");
+	if (!statSync$1(sourcePath).isDirectory() && !sourcePath.endsWith(".zip")) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} is neither a directory nor a .zip archive, so it is not a code bundle.`, "LOCAL_START_MICROVM_CODE_SOURCE_NOT_BUNDLE");
+	const materialized = materializeAssetCodeDir(sourcePath);
+	const artifact = {
+		contextDir: materialized.dir,
+		...materialized.tmpDir !== void 0 && { tmpDir: materialized.tmpDir },
+		assetHash: match.hash
+	};
+	if (!existsSync$1(join$1(materialized.dir, "Dockerfile"))) {
+		disposeMicrovmCodeArtifact(artifact);
+		throw new CdkLocalError(`${subject} has no Dockerfile at its root. A MicroVM image's code artifact is a zip with a Dockerfile at the root plus the application files.`, "LOCAL_START_MICROVM_NO_DOCKERFILE");
+	}
+	return artifact;
+}
+function disposeMicrovmCodeArtifact(artifact) {
+	if (artifact?.tmpDir === void 0) return;
+	try {
+		if (existsSync$1(artifact.tmpDir)) rmSync$1(artifact.tmpDir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
+}
+function asObject(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function describeValue(value) {
+	if (typeof value === "string") return displayUntrustedValue(value);
+	let json;
+	try {
+		json = JSON.stringify(value);
+	} catch {
+		json = void 0;
+	}
+	return displayUntrustedValue(json ?? String(value));
+}
+
+//#endregion
+//#region src/local/microvm-hooks.ts
+const MICROVM_HOOK_PATH_PREFIX = "/aws/lambda-microvms/runtime/v1/";
+const MAX_RUN_HOOK_PAYLOAD_BYTES = 16 * 1024;
+const HOOK_RETRY_INTERVAL_MS = 250;
+var MicrovmHookError = class MicrovmHookError extends CdkLocalError {
+	constructor(message, code = "LOCAL_START_MICROVM_HOOK_FAILED") {
+		super(message, code);
+		this.name = "MicrovmHookError";
+		Object.setPrototypeOf(this, MicrovmHookError.prototype);
+	}
+};
+function generateMicrovmId() {
+	return `mvm-${randomUUID$1()}`;
+}
+function runHookBody(microvmId, runHookPayload) {
+	return JSON.stringify({
+		microvmId,
+		...runHookPayload !== void 0 && { runHookPayload }
+	});
+}
+async function pollBuildHook(hook, endpoint, timeoutMs, deps = defaultHookDeps) {
+	const path = `${MICROVM_HOOK_PATH_PREFIX}${hook}`;
+	const deadline = deps.now() + timeoutMs;
+	let attempts = 0;
+	let last = { kind: "refused" };
+	while (deps.now() < deadline) {
+		const remaining = Math.max(1, deadline - deps.now());
+		last = await deps.post(endpoint.host, endpoint.port, path, void 0, remaining);
+		attempts++;
+		if (last.kind === "status" && last.status === 200) return attempts;
+		if (last.kind === "timeout") throw new MicrovmHookError(`The /${hook} hook held the request open for ${timeoutMs}ms without answering. Answer 503 immediately while not ready (the cloud ends the image build when a held request reaches the timeout), or raise ${timeoutField(hook)}.`, "LOCAL_START_MICROVM_HOOK_TIMEOUT");
+		if (last.kind === "status" && last.status !== 503) throw new MicrovmHookError(`The /${hook} hook answered HTTP ${last.status}; it must answer 200 when done or 503 to be retried.${bodySuffix(last.body)}`);
+		if (deps.isAlive && attempts % 4 === 0 && !await deps.isAlive()) throw new MicrovmHookError(`The MicroVM container exited while cdk-local polled its /${hook} hook.`, "LOCAL_START_MICROVM_EXITED");
+		await deps.sleep(250);
+	}
+	const lastSeen = last.kind === "status" ? `its last answer was HTTP ${last.status}` : `nothing answered on ${formatAuthority(endpoint.host, endpoint.port)} (the hooks port)`;
+	throw new MicrovmHookError(`The /${hook} hook did not answer 200 within ${timeoutMs}ms (${timeoutField(hook)}); ${lastSeen}.`, "LOCAL_START_MICROVM_HOOK_TIMEOUT");
+}
+async function callRuntimeHook(hook, endpoint, timeoutMs, body, deps = defaultHookDeps) {
+	const path = `${MICROVM_HOOK_PATH_PREFIX}${hook}`;
+	const result = await deps.post(endpoint.host, endpoint.port, path, body, timeoutMs);
+	if (result.kind === "status" && result.status === 200) return;
+	if (result.kind === "timeout") throw new MicrovmHookError(`The /${hook} hook did not answer within ${timeoutMs}ms (${timeoutField(hook)}).`, "LOCAL_START_MICROVM_HOOK_TIMEOUT");
+	if (result.kind === "refused") throw new MicrovmHookError(`The /${hook} hook could not be reached: nothing answered on the hooks port (${formatAuthority(endpoint.host, endpoint.port)}).`);
+	throw new MicrovmHookError(`The /${hook} hook answered HTTP ${result.status}; it must answer 200.${bodySuffix(result.body)}`);
+}
+async function waitForAppAnswer(endpoint, timeoutMs, deps = {
+	probe: probeHttp,
+	sleep: defaultHookDeps.sleep,
+	now: defaultHookDeps.now
+}) {
+	const deadline = deps.now() + timeoutMs;
+	let attempt = 0;
+	while (deps.now() < deadline) {
+		const remaining = Math.max(1, deadline - deps.now());
+		const outcome = await deps.probe(endpoint.host, endpoint.port, Math.min(remaining, 1e4));
+		if (outcome === "answered") return;
+		attempt++;
+		if (deps.isAlive && attempt % 4 === 0 && !await deps.isAlive()) throw new MicrovmHookError("The MicroVM container exited before its application answered HTTP.", "LOCAL_START_MICROVM_EXITED");
+		if (outcome === "refused") await deps.sleep(250);
+	}
+	throw new MicrovmHookError(`The MicroVM application never answered HTTP on ${formatAuthority(endpoint.host, endpoint.port)} within ${timeoutMs}ms. With no /ready hook, cdk-local waits for the app to answer before driving the next hook; raise --timeout, or enable the /ready hook.`, "LOCAL_START_MICROVM_NOT_READY");
+}
+function timeoutField(hook) {
+	return `${hook.charAt(0).toUpperCase() + hook.slice(1)}TimeoutInSeconds, or --timeout when it is unset`;
+}
+function bodySuffix(body) {
+	const trimmed = body.trim();
+	if (trimmed.length === 0) return "";
+	return ` Body: ${displayToolOutput(trimmed.length > 500 ? `${trimmed.slice(0, 500)}...` : trimmed)}`;
+}
+function postHook(host, port, path, body, timeoutMs) {
+	return new Promise((resolvePost) => {
+		let settled = false;
+		const settle = (r) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			resolvePost(r);
+		};
+		const payload = body ?? "";
+		const req = request$2({
+			host,
+			port,
+			path,
+			method: "POST",
+			headers: {
+				connection: "close",
+				"content-length": Buffer.byteLength(payload),
+				...body !== void 0 && { "content-type": "application/json" }
+			}
+		}, (res) => {
+			const chunks = [];
+			let size = 0;
+			res.on("data", (c) => {
+				if (size < 64 * 1024) chunks.push(c);
+				size += c.length;
+			});
+			res.on("end", () => settle({
+				kind: "status",
+				status: res.statusCode ?? 0,
+				body: Buffer.concat(chunks).toString("utf-8")
+			}));
+			res.on("error", () => settle({
+				kind: "status",
+				status: res.statusCode ?? 0,
+				body: ""
+			}));
+		});
+		const timer = setTimeout(() => {
+			settle({ kind: "timeout" });
+			req.destroy();
+		}, timeoutMs);
+		req.on("error", () => settle({ kind: "refused" }));
+		req.end(payload);
+	});
+}
+const defaultHookDeps = {
+	post: postHook,
+	sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+	now: () => Date.now()
+};
+
+//#endregion
+//#region src/local/microvm-front-door.ts
+const MICROVM_CONTROL_PATH = "/_cdkl/microvm";
+const PROXY_PORT_HEADER = "x-aws-proxy-port";
+const MICROVM_WS_BASE_PROTOCOL = "lambda-microvms";
+const CLOSE_GRACE_MS = 1e3;
+function selectTargetPort(headers) {
+	const fromHeader = firstHeader(headers[PROXY_PORT_HEADER]);
+	const fromProtocol = fromHeader === void 0 ? subprotocols(headers).find((p) => p.startsWith(`${MICROVM_WS_BASE_PROTOCOL}.port.`)) : void 0;
+	const raw = fromHeader ?? (fromProtocol !== void 0 ? fromProtocol.slice(`${"lambda-microvms"}.port.`.length) : void 0);
+	if (raw === void 0) return {
+		ok: true,
+		port: MICROVM_DEFAULT_INGRESS_PORT
+	};
+	const trimmed = raw.trim();
+	const n = /^\d{1,5}$/.test(trimmed) ? Number(trimmed) : NaN;
+	if (!Number.isInteger(n) || n < 1 || n > 65535) return {
+		ok: false,
+		status: 400,
+		message: `Invalid ${fromHeader === void 0 ? "WebSocket subprotocol lambda-microvms.port." : "X-aws-proxy-port"} value '${trimmed.slice(0, 32)}': it must be a port number 1-65535.`
+	};
+	return {
+		ok: true,
+		port: n
+	};
+}
+function stripMicrovmProxyHeaders(headers) {
+	for (const name of Object.keys(headers)) if (name.toLowerCase().startsWith("x-aws-proxy-")) delete headers[name];
+	const offered = subprotocols(headers);
+	if (offered.length === 0) return false;
+	const kept = offered.filter((p) => !isMicrovmProtocol(p));
+	if (kept.length > 0) headers["sec-websocket-protocol"] = kept.join(", ");
+	else delete headers["sec-websocket-protocol"];
+	return offered.includes(MICROVM_WS_BASE_PROTOCOL);
+}
+function isMicrovmProtocol(p) {
+	return p === "lambda-microvms" || p.startsWith(`${"lambda-microvms"}.`);
+}
+function subprotocols(headers) {
+	const raw = headers["sec-websocket-protocol"];
+	const joined = Array.isArray(raw) ? raw.join(",") : raw;
+	if (!joined) return [];
+	return joined.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
+}
+function firstHeader(value) {
+	if (Array.isArray(value)) return value[0];
+	if (typeof value === "string") return value.split(",")[0];
+}
+function startMicrovmFrontDoor(opts) {
+	const logger = getLogger().child("microvm");
+	const bound = { port: opts.port };
+	const server = createServer((req, res) => {
+		handleRequest$1(req, res, opts, bound.port).catch((err) => {
+			logger.debug(`microvm front door error: ${err instanceof Error ? err.message : String(err)}`);
+			if (!res.headersSent) writeText(res, 502, "The MicroVM front door failed to forward the request.");
+			else res.destroy();
+		});
+	});
+	const upgraded = /* @__PURE__ */ new Set();
+	const track = (sock) => {
+		upgraded.add(sock);
+		sock.once("close", () => upgraded.delete(sock));
+	};
+	server.on("upgrade", (req, socket, head) => {
+		track(socket);
+		handleUpgrade(req, socket, head, opts, track).catch((err) => {
+			logger.debug(`microvm upgrade error: ${err instanceof Error ? err.message : String(err)}`);
+			writeRawHttpError(socket, 502, "The MicroVM front door failed to forward the upgrade.");
+		});
+	});
+	return new Promise((resolveStart, rejectStart) => {
+		server.once("error", rejectStart);
+		server.listen(opts.port, opts.host, () => {
+			server.off("error", rejectStart);
+			const address = server.address();
+			const port = typeof address === "object" && address !== null ? address.port : opts.port;
+			bound.port = port;
+			resolveStart({
+				port,
+				close: () => new Promise((resolveClose) => {
+					server.close(() => resolveClose());
+					server.closeIdleConnections();
+					for (const sock of upgraded) sock.end();
+					setTimeout(() => {
+						server.closeAllConnections();
+						for (const sock of upgraded) sock.destroy();
+					}, CLOSE_GRACE_MS).unref();
+				})
+			});
+		});
+	});
+}
+async function admit(opts) {
+	const id = opts.target.microvmId;
+	let state = opts.target.state();
+	if ((state === "suspended" || state === "suspending" || state === "resuming") && opts.autoResume) {
+		try {
+			await opts.target.resume();
+		} catch (err) {
+			const now = opts.target.state();
+			if (err instanceof MicrovmStateError && (now === "terminating" || now === "terminated")) return {
+				status: 503,
+				message: `MicroVM ${id} is ${now}.`
+			};
+			return {
+				status: 502,
+				message: `MicroVM ${id} could not be resumed for this request: ${err instanceof Error ? err.message : String(err)}`
+			};
+		}
+		state = opts.target.state();
+	}
+	if (state === "running") return void 0;
+	if (state === "terminating" || state === "terminated") return {
+		status: 503,
+		message: `MicroVM ${id} is ${state}.`
+	};
+	return {
+		status: 503,
+		message: `MicroVM ${id} is ${state}. Resume it with POST ${MICROVM_CONTROL_PATH}/resume (or start with --auto-resume to resume on the first request).`
+	};
+}
+async function handleRequest$1(req, res, opts, boundPort) {
+	const path = (req.url ?? "/").split("?")[0];
+	if (path === "/_cdkl/microvm" || path.startsWith(`${"/_cdkl/microvm"}/`)) {
+		const refusal = controlRequestRefusal(req.headers, opts.host, boundPort);
+		if (refusal !== void 0) {
+			req.resume();
+			writeText(res, 403, refusal);
+			return;
+		}
+		await handleControl(req, res, path, opts);
+		return;
+	}
+	const selection = selectTargetPort(req.headers);
+	if (!selection.ok) {
+		req.resume();
+		writeText(res, selection.status, selection.message);
+		return;
+	}
+	const upstream = opts.target.upstreamFor(selection.port);
+	if (!upstream) {
+		req.resume();
+		writeText(res, 403, notRoutableMessage(selection.port, opts.target));
+		return;
+	}
+	const refusal = await admit(opts);
+	if (refusal) {
+		req.resume();
+		writeText(res, refusal.status, refusal.message);
+		return;
+	}
+	const headers = { ...req.headers };
+	stripHopByHopHeaders(headers);
+	stripMicrovmProxyHeaders(headers);
+	await new Promise((resolveForward) => {
+		const proxyReq = request({
+			host: upstream.host,
+			port: upstream.port,
+			method: req.method,
+			path: req.url,
+			headers
+		}, (proxyRes) => {
+			const resHeaders = { ...proxyRes.headers };
+			stripHopByHopHeaders(resHeaders);
+			res.writeHead(proxyRes.statusCode ?? 502, resHeaders);
+			proxyRes.pipe(res);
+			proxyRes.on("end", resolveForward);
+			proxyRes.on("error", () => {
+				if (!res.writableEnded) res.destroy();
+				resolveForward();
+			});
+		});
+		proxyReq.on("error", () => {
+			if (!res.headersSent) writeText(res, 502, `The application in MicroVM ${opts.target.microvmId} is not responding on port ${selection.port}.`);
+			else if (!res.writableEnded) res.destroy();
+			resolveForward();
+		});
+		res.on("close", () => {
+			if (!res.writableEnded) proxyReq.destroy();
+			resolveForward();
+		});
+		req.pipe(proxyReq);
+	});
+}
+async function handleControl(req, res, path, opts) {
+	req.resume();
+	const target = opts.target;
+	const action = path.slice(14).replace(/^\//, "");
+	if (action === "") {
+		if (req.method !== "GET" && req.method !== "HEAD") {
+			writeText(res, 405, `Use GET ${MICROVM_CONTROL_PATH}.`);
+			return;
+		}
+		writeJson(res, 200, {
+			microvmId: target.microvmId,
+			state: target.state(),
+			ports: target.routablePorts()
+		});
+		return;
+	}
+	if (action !== "suspend" && action !== "resume" && action !== "terminate") {
+		writeText(res, 404, `Unknown control action '${action.slice(0, 32)}'. Use POST ${MICROVM_CONTROL_PATH}/suspend, /resume or /terminate.`);
+		return;
+	}
+	if (req.method !== "POST") {
+		writeText(res, 405, `Use POST ${MICROVM_CONTROL_PATH}/${action}.`);
+		return;
+	}
+	try {
+		await (action === "suspend" ? target.suspend() : action === "resume" ? target.resume() : target.terminate());
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		writeText(res, err instanceof MicrovmStateError ? 409 : 502, message);
+		return;
+	}
+	writeJson(res, 200, {
+		microvmId: target.microvmId,
+		state: target.state()
+	});
+}
+const LOOPBACK_NAMES = [
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+];
+function isWildcard(host) {
+	return host === "0.0.0.0" || host === "::" || host === "[::]";
+}
+function isIpLiteral(name) {
+	return /^\d{1,3}(\.\d{1,3}){3}$/.test(name) || /^\[[0-9a-f:.]+\]$/i.test(name);
+}
+function controlRequestRefusal(headers, boundHost, boundPort) {
+	const fetchSite = firstHeader(headers["sec-fetch-site"])?.trim().toLowerCase();
+	if (fetchSite !== void 0 && fetchSite !== "same-origin" && fetchSite !== "none") return `Refusing a ${fetchSite} request to the MicroVM control endpoint: it accepts requests from this origin only (curl, or a page this front door served).`;
+	const host = (Array.isArray(headers.host) ? headers.host[0] : headers.host)?.trim().toLowerCase();
+	const m = host === void 0 ? null : /^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(host);
+	const name = m?.[1];
+	const port = m ? m[2] !== void 0 ? Number(m[2]) : 80 : NaN;
+	const bindName = boundHost.includes(":") && !boundHost.startsWith("[") ? `[${boundHost}]` : boundHost;
+	const loopbackBind = isWildcard(boundHost) || LOOPBACK_NAMES.includes(bindName.toLowerCase());
+	if (!(name !== void 0 && (name === bindName.toLowerCase() || loopbackBind && LOOPBACK_NAMES.includes(name) || isWildcard(boundHost) && isIpLiteral(name))) || port !== boundPort) return `Refusing a MicroVM control request whose Host header (${(host ?? "<none>").slice(0, 64)}) is not this front door's address.`;
+	const origin = firstHeader(headers.origin)?.trim().toLowerCase();
+	if (origin !== void 0 && origin !== `http://${host}`) return `Refusing a MicroVM control request from origin ${origin.slice(0, 64)}: it accepts requests from this origin only.`;
+}
+var MicrovmStateError = class MicrovmStateError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MicrovmStateError";
+		Object.setPrototypeOf(this, MicrovmStateError.prototype);
+	}
+};
+async function handleUpgrade(req, clientSocket, head, opts, track) {
+	const selection = selectTargetPort(req.headers);
+	if (!selection.ok) {
+		writeRawHttpError(clientSocket, selection.status, selection.message);
+		return;
+	}
+	const upstream = opts.target.upstreamFor(selection.port);
+	if (!upstream) {
+		writeRawHttpError(clientSocket, 403, notRoutableMessage(selection.port, opts.target));
+		return;
+	}
+	const refusal = await admit(opts);
+	if (refusal) {
+		writeRawHttpError(clientSocket, refusal.status, refusal.message);
+		return;
+	}
+	const headers = { ...req.headers };
+	const offeredBase = stripMicrovmProxyHeaders(headers);
+	const appProtocolsLeft = headers["sec-websocket-protocol"] !== void 0;
+	const upstreamSocket = connect({
+		host: upstream.host,
+		port: upstream.port
+	});
+	track(upstreamSocket);
+	upstreamSocket.setNoDelay(true);
+	let connected = false;
+	let responseHead = Buffer.alloc(0);
+	upstreamSocket.on("connect", () => {
+		connected = true;
+		const lines = [`${req.method ?? "GET"} ${req.url ?? "/"} HTTP/${req.httpVersion}`];
+		for (const [name, value] of Object.entries(headers)) {
+			if (value === void 0) continue;
+			for (const v of Array.isArray(value) ? value : [value]) lines.push(`${name}: ${v}`);
+		}
+		upstreamSocket.write(`${lines.join("\r\n")}\r\n\r\n`);
+		if (head.length > 0) upstreamSocket.write(head);
+		clientSocket.pipe(upstreamSocket, { end: false });
+	});
+	const onHead = (chunk) => {
+		responseHead = Buffer.concat([responseHead, chunk]);
+		const end = responseHead.indexOf("\r\n\r\n");
+		if (end === -1 && responseHead.length < 64 * 1024) return;
+		upstreamSocket.pause();
+		upstreamSocket.off("data", onHead);
+		const out = end === -1 ? responseHead : Buffer.concat([Buffer.from(rewriteUpgradeResponseHead(responseHead.subarray(0, end).toString("latin1"), offeredBase && !appProtocolsLeft) + "\r\n\r\n", "latin1"), responseHead.subarray(end + 4)]);
+		responseHead = void 0;
+		clientSocket.write(out);
+		upstreamSocket.pipe(clientSocket);
+	};
+	upstreamSocket.on("data", onHead);
+	const closeBoth = () => {
+		if (!clientSocket.destroyed) clientSocket.destroy();
+		if (!upstreamSocket.destroyed) upstreamSocket.destroy();
+	};
+	let answered = false;
+	const answer502 = (why) => {
+		if (answered || clientSocket.destroyed) return;
+		answered = true;
+		writeRawHttpError(clientSocket, 502, `The application in MicroVM ${opts.target.microvmId} ${why} on port ${selection.port}.`);
+	};
+	upstreamSocket.on("end", () => clientSocket.unpipe(upstreamSocket));
+	upstreamSocket.on("error", () => {
+		if (!connected) return answer502("is not responding");
+		if (responseHead === void 0) closeBoth();
+	});
+	upstreamSocket.on("close", (hadError) => {
+		if (responseHead !== void 0) return answer502("closed the connection before answering the upgrade");
+		if (hadError) closeBoth();
+		else if (!clientSocket.writableEnded) clientSocket.end();
+	});
+	clientSocket.on("error", closeBoth);
+	clientSocket.on("end", () => {
+		if (!upstreamSocket.destroyed && !upstreamSocket.writableEnded) upstreamSocket.end();
+	});
+	clientSocket.on("close", () => {
+		if (!upstreamSocket.destroyed) upstreamSocket.destroy();
+	});
+}
+function rewriteUpgradeResponseHead(head, addBase) {
+	if (!addBase) return head;
+	const lines = head.split("\r\n");
+	if (!/^HTTP\/1\.[01] 101\b/.test(lines[0] ?? "")) return head;
+	if (lines.some((l) => /^sec-websocket-protocol\s*:/i.test(l))) return head;
+	return [...lines, `Sec-WebSocket-Protocol: ${MICROVM_WS_BASE_PROTOCOL}`].join("\r\n");
+}
+function notRoutableMessage(port, target) {
+	return `Port ${port} of MicroVM ${target.microvmId} is not reachable locally. cdk-local publishes 8080, Hooks.Port, the image's EXPOSE ports and every --proxy-port; published: ${target.routablePorts().join(", ")}.`;
+}
+function writeText(res, status, message) {
+	res.writeHead(status, { "content-type": "text/plain; charset=utf-8" });
+	res.end(`${message}\n`);
+}
+function writeJson(res, status, body) {
+	res.writeHead(status, { "content-type": "application/json" });
+	res.end(JSON.stringify(body));
+}
+
+//#endregion
+//#region src/local/microvm-runner.ts
+const execFileAsync = promisify$1(execFile$1);
+const DEFAULT_TERMINATE_HOOK_TIMEOUT_MS = 1e4;
+function microvmImageTag(artifact) {
+	return `${getEmbedConfig().resourceNamePrefix}-microvm-${artifact.assetHash.slice(0, 16).toLowerCase()}`;
+}
+async function buildMicrovmImage(opts) {
+	const tag = microvmImageTag(opts.artifact);
+	const parent = dirname$1(opts.artifact.contextDir);
+	getLogger().info(`Building MicroVM image ${tag}${opts.platform ? ` (platform=${opts.platform})` : ""}...`);
+	await buildDockerImage({ source: {
+		directory: basename$1(opts.artifact.contextDir),
+		...opts.noCache && { cacheDisabled: true }
+	} }, parent, {
+		tag,
+		...opts.platform !== void 0 && { platform: opts.platform },
+		assetOutdir: parent,
+		progressLabel: "Building MicroVM image",
+		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for the MicroVM image's Dockerfile: ${stderr}`)
+	});
+	return tag;
+}
+async function readExposedPorts(image) {
+	try {
+		const { stdout } = await execFileAsync(getDockerCmd(), [
+			"image",
+			"inspect",
+			"-f",
+			"{{json .Config.ExposedPorts}}",
+			image
+		]);
+		const parsed = JSON.parse(stdout.trim() || "null");
+		if (!parsed) return [];
+		return Object.keys(parsed).filter((k) => k.endsWith("/tcp") || !k.includes("/")).map((k) => Number(k.split("/")[0])).filter((n) => Number.isInteger(n) && n > 0 && n < 65536);
+	} catch {
+		return [];
+	}
+}
+function planMicrovmPorts(hooksPort, exposed, extra) {
+	const out = [MICROVM_DEFAULT_INGRESS_PORT];
+	for (const p of [
+		...hooksPort !== void 0 ? [hooksPort] : [],
+		...exposed,
+		...extra
+	]) if (!out.includes(p)) out.push(p);
+	return out;
+}
+async function setContainerPaused(containerId, paused) {
+	try {
+		await execFileAsync(getDockerCmd(), [paused ? "pause" : "unpause", containerId]);
+	} catch (error) {
+		const err = error;
+		throw new CdkLocalError(`docker ${paused ? "pause" : "unpause"} failed: ${displayToolOutput(err.stderr?.trim() || err.message || String(error))}`, "LOCAL_START_MICROVM_PAUSE_FAILED");
+	}
+}
+const defaultDeps = {
+	setPaused: setContainerPaused,
+	remove: removeContainer
+};
+var LocalMicrovm = class {
+	microvmId;
+	containerId;
+	current = "booting";
+	resuming;
+	suspending;
+	paused = false;
+	terminating;
+	opts;
+	deps;
+	constructor(opts, deps = {}) {
+		this.opts = opts;
+		this.deps = {
+			...defaultDeps,
+			...deps
+		};
+		this.microvmId = opts.microvmId;
+		this.containerId = opts.containerId;
+	}
+	state() {
+		return this.current === "booting" ? "resuming" : this.current;
+	}
+	upstreamFor(containerPort) {
+		return this.opts.ports.get(containerPort);
+	}
+	routablePorts() {
+		return [...this.opts.ports.keys()];
+	}
+	log(message) {
+		getLogger().info(`MicroVM ${this.microvmId}: ${message}`);
+	}
+	hookEndpoint() {
+		const port = this.opts.config.hooksPort;
+		const endpoint = port !== void 0 ? this.opts.ports.get(port) : void 0;
+		if (!endpoint) throw new CdkLocalError("The hooks port is not published.", "LOCAL_START_MICROVM_HOOK_FAILED");
+		return endpoint;
+	}
+	hookTimeoutMs(hook) {
+		const seconds = this.opts.config.hooks[hook]?.timeoutSeconds;
+		if (seconds !== void 0) return seconds * 1e3;
+		return hook === "terminate" ? DEFAULT_TERMINATE_HOOK_TIMEOUT_MS : this.opts.timeoutMs;
+	}
+	hookDeps() {
+		return {
+			...this.deps.hooks ?? defaultHookDeps,
+			...this.deps.isAlive && { isAlive: this.deps.isAlive }
+		};
+	}
+	async runtimeHook(hook, body) {
+		if (!this.opts.config.hooks[hook]) return false;
+		await callRuntimeHook(hook, this.hookEndpoint(), this.hookTimeoutMs(hook), body, this.hookDeps());
+		this.log(`/${hook} hook answered 200`);
+		return true;
+	}
+	async boot(runHookPayload) {
+		const { hooks } = this.opts.config;
+		const deps = this.hookDeps();
+		if (hooks.ready) {
+			const attempts = await pollBuildHook("ready", this.hookEndpoint(), this.hookTimeoutMs("ready"), deps);
+			this.log(`/ready hook answered 200 after ${attempts} attempt(s)`);
+		} else {
+			const port = this.opts.config.hooksPort ?? 8080;
+			const endpoint = this.opts.ports.get(port);
+			await (this.deps.waitForAnswer ?? waitForAppAnswer)(endpoint, this.opts.timeoutMs, {
+				probe: probeHttp,
+				sleep: deps.sleep,
+				now: deps.now,
+				...this.deps.isAlive && { isAlive: this.deps.isAlive }
+			});
+			this.log("application answered HTTP (no /ready hook)");
+		}
+		if (hooks.validate) {
+			const attempts = await pollBuildHook("validate", this.hookEndpoint(), this.hookTimeoutMs("validate"), deps);
+			this.log(`/validate hook answered 200 after ${attempts} attempt(s)`);
+		}
+		await this.runtimeHook("run", runHookBody(this.microvmId, runHookPayload));
+		if (this.current === "booting") this.current = "running";
+	}
+	async setPaused(paused) {
+		await this.deps.setPaused(this.containerId, paused);
+		this.paused = paused;
+	}
+	suspend() {
+		if (this.current !== "running") return Promise.reject(new MicrovmStateError(`MicroVM ${this.microvmId} is ${this.state()}; only a running MicroVM can be suspended.`));
+		this.current = "suspending";
+		this.suspending = (async () => {
+			try {
+				await this.runtimeHook("suspend");
+				await this.setPaused(true);
+			} catch (err) {
+				if (this.current === "suspending") this.current = "running";
+				throw err;
+			} finally {
+				this.suspending = void 0;
+			}
+			if (this.current === "suspending") {
+				this.current = "suspended";
+				this.log("suspended (container paused)");
+			}
+		})();
+		return this.suspending;
+	}
+	resume() {
+		if (this.current === "resuming" && this.resuming) return this.resuming;
+		if (this.current === "suspending" && this.suspending) return this.suspending.then(() => this.resume(), () => void 0);
+		if (this.current !== "suspended") return Promise.reject(new MicrovmStateError(`MicroVM ${this.microvmId} is ${this.state()}; only a suspended MicroVM can be resumed.`));
+		this.current = "resuming";
+		this.resuming = (async () => {
+			try {
+				await this.setPaused(false);
+				try {
+					await this.runtimeHook("resume");
+				} catch (err) {
+					if (this.current === "resuming") await this.setPaused(true).catch(() => void 0);
+					throw err;
+				}
+			} catch (err) {
+				if (this.current === "resuming") this.current = "suspended";
+				throw err;
+			} finally {
+				this.resuming = void 0;
+			}
+			if (this.current === "resuming") {
+				this.current = "running";
+				this.log("resumed");
+			}
+		})();
+		return this.resuming;
+	}
+	terminate() {
+		this.terminating ??= (async () => {
+			const wasBooting = this.current === "booting";
+			this.current = "terminating";
+			await Promise.allSettled([this.suspending, this.resuming].filter((p) => p !== void 0));
+			try {
+				if (this.paused) await this.setPaused(false).catch(() => void 0);
+				if (!wasBooting) await this.runtimeHook("terminate");
+			} catch (err) {
+				getLogger().warn(`MicroVM ${this.microvmId}: ${err instanceof Error ? err.message : String(err)} Removing its container anyway.`);
+			}
+			await this.deps.remove(this.containerId);
+			this.current = "terminated";
+			this.log("terminated (container removed)");
+			this.opts.onTerminated?.(this);
+		})();
+		return this.terminating;
+	}
+};
+
+//#endregion
+//#region src/cli/commands/local-start-microvm.ts
+function parsePort(raw) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
+	return n;
+}
+function parseCount(raw) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 1 || n > 64) throw new InvalidArgumentError(`--count must be an integer 1-64, got '${raw}'.`);
+	return n;
+}
+function parseProxyPort(raw, previous) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 1 || n > 65535) throw new InvalidArgumentError(`--proxy-port must be an integer 1-65535, got '${raw}'.`);
+	return [...previous ?? [], n];
+}
+function connectHost(host) {
+	if (host === "0.0.0.0") return "127.0.0.1";
+	if (host === "::" || host === "[::]") return "::1";
+	return host;
+}
+function readRunHookPayload(options, readFile = (p) => readFileSync$1(p, "utf-8")) {
+	if (options.runHookPayload !== void 0 && options.runHookPayloadFile !== void 0) throw new CdkLocalError("--run-hook-payload and --run-hook-payload-file are mutually exclusive.", "LOCAL_START_MICROVM_PAYLOAD_CONFLICT");
+	let payload = options.runHookPayload;
+	if (options.runHookPayloadFile !== void 0) try {
+		payload = readFile(options.runHookPayloadFile);
+	} catch (err) {
+		throw new CdkLocalError(`Cannot read --run-hook-payload-file ${displayUntrustedValue(options.runHookPayloadFile)}: ${err instanceof Error ? err.message : String(err)}`, "LOCAL_START_MICROVM_PAYLOAD_UNREADABLE");
+	}
+	if (payload !== void 0 && Buffer.byteLength(payload) > 16384) throw new CdkLocalError(`The run hook payload is ${Buffer.byteLength(payload)} bytes; run-microvm accepts at most ${MAX_RUN_HOOK_PAYLOAD_BYTES} (16 KB).`, "LOCAL_START_MICROVM_PAYLOAD_TOO_LARGE");
+	return payload;
+}
+function buildMicrovmLambdaView(resolved, config) {
+	return {
+		kind: "zip",
+		stack: resolved.stack,
+		logicalId: resolved.logicalId,
+		resource: {
+			Type: resolved.resource.Type,
+			Properties: { Environment: { Variables: config.environment } },
+			...resolved.resource.Metadata !== void 0 && { Metadata: resolved.resource.Metadata }
+		},
+		memoryMb: 128,
+		timeoutSec: 0,
+		layers: [],
+		runtime: "",
+		handler: "",
+		codePath: null,
+		architecture: config.architecture ?? "arm64"
+	};
+}
+const LAMBDA_RUNTIME_ENV_KEYS = [
+	"AWS_LAMBDA_FUNCTION_NAME",
+	"AWS_LAMBDA_FUNCTION_MEMORY_SIZE",
+	"AWS_LAMBDA_FUNCTION_TIMEOUT",
+	"AWS_LAMBDA_FUNCTION_VERSION",
+	"AWS_LAMBDA_LOG_GROUP_NAME",
+	"AWS_LAMBDA_LOG_STREAM_NAME"
+];
+function finalizeMicrovmEnv(lambdaEnv, declared) {
+	const env = { ...lambdaEnv };
+	for (const key of LAMBDA_RUNTIME_ENV_KEYS) if (!Object.hasOwn(declared, key)) delete env[key];
+	return env;
+}
+function microvmFidelityWarnings(config) {
+	const image = displayIdent(config.logicalId);
+	const out = [
+		`MicroVM image ${image}: each MicroVM is a Docker container started fresh from the built image, not a MicroVM restored from a snapshot — state the app initializes before /ready answers 200 is NOT shared across MicroVMs (each one runs its own startup), and there is no VM isolation or memory checkpoint (suspend is docker pause).`,
+		`MicroVM image ${image}: requests are accepted without X-aws-proxy-auth — the JWE token the cloud endpoint requires is not checked locally (the header is still stripped).`,
+		`MicroVM image ${image}: the idle policy is not emulated — a MicroVM suspends, resumes and terminates only through ${MICROVM_CONTROL_PATH}/suspend|resume|terminate (and --auto-resume).`,
+		`MicroVM image ${image}: the Dockerfile is built by the local Docker engine, not on the Lambda-managed MicroVM base OS (BaseImageArn).`
+	];
+	if (config.hooks.validate) out.push(`MicroVM image ${image}: /validate is called on the same container as /ready (the cloud calls it on a fresh MicroVM started from the built snapshot).`);
+	for (const what of config.unemulated) out.push(`MicroVM image ${image}: ${what} is not emulated.`);
+	return out;
+}
+async function localStartMicrovmCommand(target, options, extraStateProviders, hostSynthesizer) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	const runHookPayload = readRunHookPayload(options);
+	const vms = [];
+	const frontDoors = /* @__PURE__ */ new Map();
+	const logStops = [];
+	const exitWatches = [];
+	const bareContainers = /* @__PURE__ */ new Set();
+	let runInFlight;
+	let containerName;
+	let artifact;
+	let teardownPromise;
+	let shuttingDown = false;
+	let waitingOnRun = false;
+	const forever = () => new Promise(() => void 0);
+	const doTeardown = async () => {
+		for (const w of exitWatches) w.stop();
+		if (runInFlight !== void 0) {
+			waitingOnRun = true;
+			try {
+				bareContainers.add(await runInFlight);
+			} catch {} finally {
+				waitingOnRun = false;
+			}
+		}
+		await Promise.allSettled(vms.map((vm) => vm.terminate()));
+		for (const vm of vms) bareContainers.delete(vm.containerId);
+		await Promise.allSettled([...bareContainers].map((id) => removeContainer(id)));
+		await Promise.allSettled([...frontDoors.values()].map((fd) => fd.close()));
+		for (const stop of logStops) try {
+			stop();
+		} catch (err) {
+			logger.debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		disposeMicrovmCodeArtifact(artifact);
+	};
+	const teardown = () => teardownPromise ??= doTeardown();
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region,
+		profile: options.profile
+	});
+	await ensureDockerAvailable();
+	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
+	const appCmd = resolveApp(options.app);
+	if (!appCmd) throw new Error(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
+	logger.info("Synthesizing CDK app...");
+	const synthesizer = hostSynthesizer ?? new Synthesizer();
+	const context = parseContextOptions(options.context);
+	const synthOpts = {
+		app: appCmd,
+		output: options.output,
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile },
+		...Object.keys(context).length > 0 && { context }
+	};
+	const { stacks } = await synthesizer.synthesize(synthOpts);
+	const resolved = resolveMicrovmImageTarget(await resolveSingleTarget(target, {
+		entries: listTargets(stacks).microvmImages,
+		message: "Select a Lambda MicroVM image to run",
+		noun: "Lambda MicroVM images",
+		onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} start-microvm requires a <target> (a MicrovmImage display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_START_MICROVM_TARGET_REQUIRED")
+	}), stacks);
+	const config = readMicrovmImageConfig(resolved.logicalId, resolved.resource);
+	const platform = options.platform ?? (config.architecture !== void 0 ? architectureToPlatform(config.architecture) : void 0);
+	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.logicalId}`)} (MicroVM image ${displayIdent(config.name)}; hooks: ${Object.keys(config.hooks).join(", ") || "none"}${platform ? `; ${platform}` : ""})`);
+	for (const line of microvmFidelityWarnings(config)) logger.warn(line);
+	artifact = await resolveMicrovmCodeArtifact(resolved.stack, config);
+	const shutdown = async (signal, exitCode) => {
+		if (shuttingDown) {
+			if (!waitingOnRun) {
+				logger.info(`Received ${signal} again; still terminating the MicroVMs, please wait...`);
+				return;
+			}
+			disposeMicrovmCodeArtifact(artifact);
+			logger.warn(`Received ${signal} again; exiting without waiting for docker run to return. The container may still be starting, and its environment holds the forwarded AWS credentials. Remove it by its name (this works even if it is created after this exit): docker rm -f ${containerName ?? "<name>"}`);
+			process.exit(signal === "SIGINT" ? 130 : 143);
+			return;
+		}
+		shuttingDown = true;
+		logger.info(`Received ${signal}, terminating ${vms.length} MicroVM(s)...`);
+		await teardown();
+		process.exit(exitCode);
+	};
+	process.on("SIGINT", () => void shutdown("SIGINT", 130));
+	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
+	const recents = /* @__PURE__ */ new Map();
+	let allTerminated;
+	const everyVmTerminated = new Promise((r) => allTerminated = r);
+	const checkAllTerminated = () => {
+		if (vms.length === options.count && vms.every((v) => v.state() === "terminated")) allTerminated();
+	};
+	let unexpectedExit;
+	const anyUnexpectedExit = new Promise((r) => unexpectedExit = r);
+	const probeHost = connectHost(options.host);
+	try {
+		const containerEnv = await resolveLambdaContainerEnv(buildMicrovmLambdaView(resolved, config), {
+			...options,
+			deployedFunctionLookups: false
+		}, profileCredentials, extraStateProviders);
+		const env = finalizeMicrovmEnv(containerEnv.env, config.environment);
+		const image = await buildMicrovmImage({
+			artifact,
+			platform,
+			noCache: options.buildCache === false
+		});
+		if (teardownPromise) return await forever();
+		const containerPorts = planMicrovmPorts(config.hooksPort, await readExposedPorts(image), options.proxyPort ?? []);
+		logger.info(`Publishing container ports ${containerPorts.join(", ")} to the front door(s).`);
+		for (let i = 0; i < options.count; i++) {
+			const microvmId = generateMicrovmId();
+			const hostPorts = /* @__PURE__ */ new Map();
+			for (const cp of containerPorts) hostPorts.set(cp, {
+				host: "127.0.0.1",
+				port: await pickFreePort()
+			});
+			const [first, ...rest] = containerPorts;
+			const name = containerName = `${getEmbedConfig().resourceNamePrefix}-microvm-${process.pid}-${i}-${Math.random().toString(36).slice(2, 8)}`;
+			logger.info(`Starting MicroVM ${microvmId} (container ${name})...`);
+			runInFlight = runDetached({
+				image,
+				mounts: [],
+				env,
+				...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) },
+				cmd: [],
+				hostPort: hostPorts.get(first).port,
+				containerPort: first,
+				extraPorts: rest.map((cp) => ({
+					hostPort: hostPorts.get(cp).port,
+					containerPort: cp
+				})),
+				host: "127.0.0.1",
+				...platform !== void 0 && { platform },
+				name,
+				autoRemove: false
+			});
+			const containerId = await runInFlight;
+			runInFlight = void 0;
+			bareContainers.add(containerId);
+			if (teardownPromise) return await forever();
+			const recent = new RecentOutput();
+			recents.set(containerId, recent);
+			logStops.push(streamLogs(containerId, {
+				onOutput: (chunk) => recent.push(chunk),
+				...options.count > 1 && { prefix: `[${microvmId.slice(0, 12)}] ` }
+			}));
+			const watch = watchContainerExit(containerId);
+			exitWatches.push(watch);
+			let exited = false;
+			const vm = new LocalMicrovm({
+				microvmId,
+				containerId,
+				ports: hostPorts,
+				config,
+				timeoutMs: options.timeout,
+				onTerminated: checkAllTerminated
+			}, { isAlive: async () => !exited });
+			vms.push(vm);
+			bareContainers.delete(containerId);
+			watch.exited.then((code) => {
+				exited = true;
+				const s = vm.state();
+				if (s !== "terminating" && s !== "terminated") unexpectedExit({
+					vm,
+					code
+				});
+			});
+			await vm.boot(runHookPayload);
+			if (teardownPromise) return await forever();
+			const fd = await startMicrovmFrontDoor({
+				host: options.host,
+				port: options.port === 0 ? 0 : options.port + i,
+				target: vm,
+				autoResume: options.autoResume === true
+			});
+			frontDoors.set(vm, fd);
+			const base = `http://${formatAuthority(probeHost, fd.port)}`;
+			logger.info(`MicroVM ${microvmId} listening on ${base}  (control: ${base}${MICROVM_CONTROL_PATH})`);
+		}
+		logger.info("Press ^C to terminate the MicroVM(s).");
+		checkAllTerminated();
+	} catch (err) {
+		if (shuttingDown) return await forever();
+		const failed = vms.at(-1);
+		const wrapped = err instanceof MicrovmHookError && failed ? await containerFailure(err.message, failed.containerId, recents.get(failed.containerId) ?? new RecentOutput()).then((f) => new CdkLocalError(f.message, err.code)) : err;
+		await teardown();
+		throw wrapped;
+	}
+	const outcome = await Promise.race([everyVmTerminated.then(() => void 0), anyUnexpectedExit]);
+	if (shuttingDown) return await forever();
+	if (outcome === void 0) {
+		logger.info("Every MicroVM is terminated; shutting down.");
+		await teardown();
+		return;
+	}
+	if (teardownPromise) return await forever();
+	const failure = await containerFailure(`MicroVM ${outcome.vm.microvmId}'s container exited (exit code ${outcome.code ?? "unknown"}) while running.`, outcome.vm.containerId, recents.get(outcome.vm.containerId) ?? new RecentOutput());
+	await teardown();
+	throw new CdkLocalError(failure.message, "LOCAL_START_MICROVM_EXITED");
+}
+function createLocalStartMicrovmCommand(opts = {}) {
+	setEmbedConfig(opts.embedConfig);
+	const cmd = new Command("start-microvm").description("Run AWS Lambda MicroVMs locally. Builds a MicrovmImage code artifact (a Dockerfile plus the app, from cdk.out) once, starts --count containers with its EnvironmentVariables, drives the /ready, /validate and /run lifecycle hooks in the cloud order, and serves each MicroVM on its own local URL: X-aws-proxy-port / lambda-microvms.port.N routing (default 8080), X-aws-proxy-* stripping, and a control endpoint for suspend / resume / terminate. Target accepts a CDK display path or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C, which calls /terminate.").argument("[target]", "CDK display path or stack-qualified logical ID of the MicrovmImage (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
+		await localStartMicrovmCommand(target, options, opts.extraStateProviders, opts.synthesizer);
+	}));
+	addStartMicrovmSpecificOptions(cmd);
+	[
+		...commonOptions(),
+		...appOptions(),
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(regionOption);
+	return cmd;
+}
+function addStartMicrovmSpecificOptions(cmd) {
+	return cmd.addOption(new Option("--count <n>", "Number of independent MicroVMs to run, each with its own URL.").default(1).argParser(parseCount)).addOption(new Option("--run-hook-payload <string>", "The runHookPayload string delivered to each MicroVM's /run hook (max 16 KB).")).addOption(new Option("--run-hook-payload-file <path>", "Read the runHookPayload from a file (mutually exclusive with --run-hook-payload).")).addOption(new Option("--port <n>", "Local port of the first MicroVM; MicroVM i listens on <n>+i. Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Address the MicroVM URLs listen on.").default("127.0.0.1")).addOption(new Option("--platform <platform>", "docker --platform for the build and the containers. Defaults to the image's CpuConfigurations architecture.").choices(["linux/amd64", "linux/arm64"])).addOption(new Option("--proxy-port <port>", "An extra container port X-aws-proxy-port may route to (repeatable). 8080, Hooks.Port and the image's EXPOSE ports are always routable.").argParser(parseProxyPort)).addOption(new Option("--auto-resume", "Resume a suspended MicroVM on its next request instead of answering 503 (autoResumeEnabled).")).addOption(new Option("--no-build-cache", "Build the image with docker build --no-cache.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"MicrovmImageLogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--timeout <ms>", "Default deadline in milliseconds for each hook without its own <Hook>TimeoutInSeconds (/terminate defaults to 10000), and for the app to answer HTTP when there is no /ready hook. Default 60000.").default(6e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role <arn>", "Assume this role (the MicroVM's execution role, a run-microvm parameter rather than part of the template) and forward STS-issued temp credentials to the containers. Off by default: the shell credentials are forwarded.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
 //#endregion
@@ -25215,7 +27196,7 @@ async function localListCommand(options) {
 	process.stdout.write(`${formatTargetListing(listing, getEmbedConfig().cliName, { long: options.long })}\n`);
 }
 function formatTargetListing(listing, cliName, options = {}) {
-	if (countTargets(listing) === 0) return `No runnable targets (Lambda functions, APIs, ECS services / tasks, AgentCore Runtimes, load balancers, CloudFront distributions) found in this CDK app.`;
+	if (countTargets(listing) === 0) return `No runnable targets (Lambda functions, APIs, ECS services / tasks, AgentCore Runtimes, load balancers, CloudFront distributions, Lambda web functions, Lambda MicroVM images) found in this CDK app.`;
 	const long = options.long ?? false;
 	return "\n" + [
 		formatSection("Lambda Functions", `${cliName} invoke <target>`, listing.lambdas, long),
@@ -25224,7 +27205,9 @@ function formatTargetListing(listing, cliName, options = {}) {
 		formatSection("ECS Task Definitions", `${cliName} run-task <target>`, listing.ecsTaskDefinitions, long),
 		formatSection("AgentCore Runtimes", `${cliName} invoke-agentcore <target>`, listing.agentCoreRuntimes, long),
 		formatSection("Application Load Balancers", `${cliName} start-alb <target...>`, listing.loadBalancers, long),
-		formatSection("CloudFront Distributions", `${cliName} start-cloudfront <target>`, listing.cloudFrontDistributions, long)
+		formatSection("CloudFront Distributions", `${cliName} start-cloudfront <target>`, listing.cloudFrontDistributions, long),
+		formatSection("Lambda Web Functions", `${cliName} start-web-function <target>`, listing.webFunctions, long),
+		formatSection("Lambda MicroVM Images", `${cliName} start-microvm <target>`, listing.microvmImages, long)
 	].filter((lines) => lines.length > 0).map((lines) => lines.join("\n")).join("\n\n");
 }
 function formatSection(title, command, entries, long) {
@@ -30500,5 +32483,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { applyEdgeResponseResult as $, defaultCredentialsLoader as $n, resolveCfnFallbackRegion as $r, isLocalCdkAssetImage as $t, startAgentCoreHttpServer as A, LocalInvokeBuildError as Ai, renderCodeDockerfile as An, resolveHostGatewayExtraHosts as Ar, addRunTaskSpecificOptions as At, idFromArn as B, withoutKeys as Bi, createFileWatcher as Bn, buildContainerImage as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, AgentCoreResolutionError as Ci, invokeAgentCore as Cn, pickResponseTemplate as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, formatStateRemedy as Di, SUPPORTED_CODE_RUNTIMES as Dn, HOST_DOCKER_INTERNAL_GATEWAY as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, derivePseudoParametersFromRegion as Ei, downloadAndExtractS3Bundle as En, VtlEvaluationError as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, firstUsableRegion as Fi, addStartApiSpecificOptions as Fn, parseConnectionsPath as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, recordAssumedRole as Gi, availableApiIdentifiers as Gn, substituteAgainstState as Gr, canonicalizeImageOverrideKeys as Gt, createDeployedKvsDataSource as H, assumedRoleRecorded as Hi, buildStageMap as Hn, resolveRuntimeFileExtension as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, keysNotFromTemplate as Ii, createLocalStartApiCommand as In, buildConnectEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, workloadStsClientConfig as Ji, groupRoutesByServer as Jn, substituteEnvVarsFromStateAsync as Jr, parseImageOverrideFlags as Jt, createS3OriginReader as K, resetWorkloadIdentity as Ki, filterRoutesByApiIdentifier as Kn, substituteAgainstStateAsync as Kr, enforceImageOverrideOrphans as Kt, parseKvsFileOverrides as L, keysOverriddenBy as Li, createWatchPredicates as Ln, buildDisconnectEvent as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, DynamicReferenceResolver as Mi, classifySourceChange as Mn, ConnectionRegistry as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, containsDynamicReference as Ni, addInvokeSpecificOptions as Nn, buildMgmtEndpointEnvUrl as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, substituteImagePlaceholders as Oi, buildAgentCoreCodeImage as On, HOST_GATEWAY_MIN_VERSION as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, deployedFillMayBeSecret as Pi, createLocalInvokeCommand as Pn, handleConnectionsRequest as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, isProxyEnvConfigured as Qi, resolveServiceIntegrationParameters as Qn, rejectExplicitCfnStackWithMultipleStacks as Qr, imageOverrideKeyAliases as Qt, parseOriginOverrides as R, parseDynamicReference as Ri, resolveApiTargetSubset as Rn, buildMessageEvent as Rr, parseMaxTasks as Rt, StudioEventBus as S, AGENTCORE_RUNTIME_TYPE as Si, AGENTCORE_SESSION_ID_HEADER as Sn, evaluateResponseParameters as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, resolveAgentCoreTarget as Ti, waitForAgentCorePing as Tn, tryParseStatus as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, deployAccountStsClientConfig as Ui, materializeLayerFromArn as Un, resolveRuntimeImage as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, SECOND_ASSUME_MESSAGE as Vi, attachStageContext as Vn, resolveRuntimeCodeMountPath as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, readEnvCallerCredentials as Wi, resolveEnvVars$1 as Wn, EcsTaskResolutionError as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveProfileCredentials as Xi, startApiServer as Xn, createLocalStateProvider as Xr, runImageOverrideBuilds as Xt, resolveErrorResponseCandidates as Y, buildStsClientConfig as Yi, readMtlsMaterialsFromDisk as Yn, LocalStateSourceError as Yr, resolveImageOverrides as Yt, serveLambdaUrlOrigin as Z, buildProxyClientConfig as Zi, resolveSelectionExpression as Zn, isCfnFlagPresent as Zr, describePinnedImageUri as Zt, filterStudioTargetGroups as _, resolveLambdaArnIntrinsic as _i, MCP_PROTOCOL_VERSION as _n, matchRoute as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, resolveWatchConfig as ai, setShadowReadyTimeoutMs as an, verifyJwtViaDiscovery as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_HTTP_PROTOCOL as bi, AGENTCORE_SIGV4_SERVICE as bn, buildHttpApiV2Event as br, addAlbSpecificOptions as bt, startStudioProxy as c, listTargets as ci, addInvokeAgentCoreSpecificOptions as cn, evaluateCachedLambdaPolicy as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, discoverWebSocketApisOrThrow as di, invokeAgentCoreWs as dn, attachAuthorizers as dr, pickTargetFunctionLogicalId as dt, resolveCfnRegion as ei, listPinnedTargets as en, buildCognitoJwksUrl as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, filterWebSocketApisByIdentifiers as fi, A2A_CONTAINER_PORT as fn, applyCorsResponseHeaders as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, pickRefLogicalId as gi, MCP_PATH as gn, matchPreflight as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, discoverRoutes as hi, MCP_CONTAINER_PORT as hn, isFunctionUrlOacFronted as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSsmParameters as ii, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as in, verifyJwtAuthorizer as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, DynamicReferenceResolutionError as ji, toCmdArgv as jn, bufferToBody as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, tryResolveImageFnJoin as ki, computeCodeImageTag as kn, probeHostGatewaySupport as kr, serviceStrategy as kt, relayServeRequest as l, availableWebSocketApiIdentifiers as li, createLocalInvokeAgentCoreCommand as ln, invokeRequestAuthorizer as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, webSocketApiMatchesIdentifier as mi, a2aInvokeOnce as mn, buildCorsConfigFromCloudFrontChain as mr, runViewerRequest as mt, coerceRunRequest as n, CfnLocalStateProvider as ni, CloudMapRegistry as nn, createJwksCache as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, resolveSingleTarget as oi, getContainerNetworkIp as on, buildMethodArn as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, parseSelectionExpressionPath as pi, A2A_PATH as pn, buildCorsConfigByApiId as pr, compileCloudFrontFunction as pt, matchBehavior as q, workloadClientConfig as qi, filterRoutesByApiIdentifiers as qn, substituteEnvVarsFromState as qr, mergeForService as qt, coerceServeRequest as r, collectSsmParameterRefs as ri, DEFAULT_SHADOW_READY_TIMEOUT_MS as rn, verifyCognitoJwt as rr, httpHeadersToEdge as rt, createStudioServeManager as s, countTargets as si, attachContainerLogStreamer as sn, computeRequestIdentityHash as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, resolveCfnStackName as ti, buildCloudMapIndex as tn, buildJwksUrlFromIssuer as tr, buildEdgeResponseEvent as tt, reinvoke as u, discoverWebSocketApis as ui, bridgeAgentCoreWs as un, invokeTokenAuthorizer as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_A2A_PROTOCOL as vi, mcpInvokeOnce as vn, translateLambdaResponse as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, pickAgentCoreCandidateStack as wi, waitForAgentCoreHttpReady as wn, selectIntegrationResponse as wr, resolveAlbTarget as wt, createStudioStore as x, AGENTCORE_MCP_PROTOCOL as xi, signAgentCoreInvocation as xn, buildRestV1Event as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_AGUI_PROTOCOL as yi, parseSseForJsonRpc as yn, applyAuthorizerOverlay as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, resolveDynamicReferencesInEnv as zi, createAuthorizerCache as zn, architectureToPlatform as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-CJfNARFz.js.map
+export { postHook as $, resolveDynamicReferencesInEnv as $a, architectureToPlatform as $i, parseRestartPolicy as $n, createAuthorizerCache as $r, resolveCloudFrontTarget as $t, microvmFidelityWarnings as A, pickRefLogicalId as Aa, matchPreflight as Ai, stripCloudFrontImport as An, MCP_PATH as Ar, supportedWebFunctionRuntimes as At, MICROVM_WS_BASE_PROTOCOL as B, derivePseudoParametersFromRegion as Ba, VtlEvaluationError as Bi, resolveAlbFrontDoor as Bn, downloadAndExtractS3Bundle as Br, addStartAgentCoreSpecificOptions as Bt, addListSpecificOptions as C, availableWebSocketApiIdentifiers as Ca, invokeRequestAuthorizer as Ci, pickKvsLogicalIdFromArn as Cn, createLocalInvokeAgentCoreCommand as Cr, readWebFunctionServiceConfig as Ct, buildMicrovmLambdaView as D, parseSelectionExpressionPath as Da, buildCorsConfigByApiId as Di, compileCloudFrontFunction as Dn, A2A_PATH as Dr, buildNodeEntryFileStart as Dt, addStartMicrovmSpecificOptions as E, filterWebSocketApisByIdentifiers as Ea, applyCorsResponseHeaders as Ei, resolveCloudFrontDistribution as En, A2A_CONTAINER_PORT as Er, WEB_FUNCTION_RUNTIMES as Et, microvmImageTag as F, AGENTCORE_MCP_PROTOCOL as Fa, buildRestV1Event as Fi, albStrategy as Fn, signAgentCoreInvocation as Fr, WEB_FUNCTION_ENDPOINT_TYPE as Ft, startMicrovmFrontDoor as G, DynamicReferenceResolutionError as Ga, bufferToBody as Gi, createLocalRunTaskCommand as Gn, toCmdArgv as Gr, attachAgentCoreWsBridge as Gt, PROXY_PORT_HEADER as H, substituteImagePlaceholders as Ha, HOST_GATEWAY_MIN_VERSION as Hi, createLocalStartServiceCommand as Hn, buildAgentCoreCodeImage as Hr, buildAgentCoreServeAuthCheck as Ht, planMicrovmPorts as I, AGENTCORE_RUNTIME_TYPE as Ia, evaluateResponseParameters as Ii, createLocalStartAlbCommand as In, AGENTCORE_SESSION_ID_HEADER as Ir, WEB_FUNCTION_REVISION_TYPE as It, MICROVM_HOOK_PATH_PREFIX as J, deployedFillMayBeSecret as Ja, handleConnectionsRequest as Ji, addEcsAssumeRoleOptions as Jn, createLocalInvokeCommand as Jr, addStartCloudFrontSpecificOptions as Jt, stripMicrovmProxyHeaders as K, DynamicReferenceResolver as Ka, ConnectionRegistry as Ki, MAX_TASKS_SUBNET_RANGE_CAP as Kn, classifySourceChange as Kr, startAgentCoreWsBridge as Kt, readExposedPorts as L, AgentCoreResolutionError as La, pickResponseTemplate as Li, parseLbPortOverrides as Ln, invokeAgentCore as Lr, WEB_FUNCTION_TYPE as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, AGENTCORE_A2A_PROTOCOL as Ma, translateLambdaResponse as Mi, createLocalFileKvsDataSource as Mn, mcpInvokeOnce as Mr, findFileAssetForObjectKey as Mt, LocalMicrovm as N, AGENTCORE_AGUI_PROTOCOL as Na, applyAuthorizerOverlay as Ni, createUnboundCloudFrontModule as Nn, parseSseForJsonRpc as Nr, parseWebFunctionBuildConfig as Nt, createLocalStartMicrovmCommand as O, webSocketApiMatchesIdentifier as Oa, buildCorsConfigFromCloudFrontChain as Oi, runViewerRequest as On, a2aInvokeOnce as Or, defaultWebFunctionPlatform as Ot, buildMicrovmImage as P, AGENTCORE_HTTP_PROTOCOL as Pa, buildHttpApiV2Event as Pi, addAlbSpecificOptions as Pn, AGENTCORE_SIGV4_SERVICE as Pr, resolveWebFunctionArtifact as Pt, pollBuildHook as Q, parseDynamicReference as Qa, buildMessageEvent as Qi, parseMaxTasks as Qn, resolveApiTargetSubset as Qr, parseOriginOverrides as Qt, setContainerPaused as R, pickAgentCoreCandidateStack as Ra, selectIntegrationResponse as Ri, resolveAlbTarget as Rn, waitForAgentCoreHttpReady as Rr, WebFunctionResolutionError as Rt, StudioEventBus as S, listTargets as Sa, evaluateCachedLambdaPolicy as Si, pickFunctionUrlLogicalIdFromOrigin as Sn, addInvokeAgentCoreSpecificOptions as Sr, finalizeWebFunctionEnv as St, formatTargetListing as T, discoverWebSocketApisOrThrow as Ta, attachAuthorizers as Ti, pickTargetFunctionLogicalId as Tn, invokeAgentCoreWs as Tr, webFunctionFidelityWarnings as Tt, rewriteUpgradeResponseHead as U, tryResolveImageFnJoin as Ua, probeHostGatewaySupport as Ui, serviceStrategy as Un, computeCodeImageTag as Ur, selectServeInboundAuth as Ut, MicrovmStateError as V, formatStateRemedy as Va, HOST_DOCKER_INTERNAL_GATEWAY as Vi, addStartServiceSpecificOptions as Vn, SUPPORTED_CODE_RUNTIMES as Vr, createLocalStartAgentCoreCommand as Vt, selectTargetPort as W, LocalInvokeBuildError as Wa, resolveHostGatewayExtraHosts as Wi, addRunTaskSpecificOptions as Wn, renderCodeDockerfile as Wr, startAgentCoreHttpServer as Wt, callRuntimeHook as X, keysNotFromTemplate as Xa, buildConnectEvent as Xi, buildEcsImageResolutionContext$1 as Xn, createLocalStartApiCommand as Xr, normalizeKvsFileKeys as Xt, MicrovmHookError as Y, firstUsableRegion as Ya, parseConnectionsPath as Yi, addImageOverrideOptions as Yn, addStartApiSpecificOptions as Yr, createLocalStartCloudFrontCommand as Yt, generateMicrovmId as Z, keysOverriddenBy as Za, buildDisconnectEvent as Zi, ecsClusterOption as Zn, createWatchPredicates as Zr, parseKvsFileOverrides as Zt, filterStudioTargetGroups as _, collectSsmParameterRefs as _a, verifyCognitoJwt as _i, httpHeadersToEdge as _n, DEFAULT_SHADOW_READY_TIMEOUT_MS as _r, startWebFunctionContainer as _t, createLocalStudioCommand as a, substituteAgainstState as aa, availableApiIdentifiers as ai, classifyS3Error as an, recordAssumedRole as ao, canonicalizeImageOverrideKeys as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, resolveSingleTarget as ba, buildMethodArn as bi, extractKvsAssociations as bn, getContainerNetworkIp as br, WEB_FUNCTION_HTTP_ENDPOINT_ENV as bt, startStudioProxy as c, substituteEnvVarsFromStateAsync as ca, groupRoutesByServer as ci, startCloudFrontServer as cn, workloadStsClientConfig as co, parseImageOverrideFlags as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, isCfnFlagPresent as da, resolveSelectionExpression as di, serveLambdaUrlOrigin as dn, buildProxyClientConfig as do, describePinnedImageUri as dr, createLocalStartWebFunctionCommand as dt, buildContainerImage as ea, createFileWatcher as ei, idFromArn as en, withoutKeys as eo, resolveEcsAssumeRoleOption as er, runHookBody as et, filterStudioCustomResources as f, rejectExplicitCfnStackWithMultipleStacks as fa, resolveServiceIntegrationParameters as fi, applyEdgeRequestResult as fn, isProxyEnvConfigured as fo, imageOverrideKeyAliases as fr, RecentOutput as ft, annotatePinnedEcsTargets as g, CfnLocalStateProvider as ga, createJwksCache as gi, edgeHeadersToHttp as gn, CloudMapRegistry as gr, readContainerLogTail as gt, annotateEcsTaskPinnedTargets as h, resolveCfnStackName as ha, buildJwksUrlFromIssuer as hi, buildEdgeResponseEvent as hn, buildCloudMapIndex as hr, planWebFunctionContainer as ht, coerceStopRequest as i, EcsTaskResolutionError as ia, resolveEnvVars$1 as ii, resolveDeployedOriginBucket as in, readEnvCallerCredentials as io, buildImageOverrideTag as ir, MicrovmResolutionError as it, readRunHookPayload as j, resolveLambdaArnIntrinsic as ja, matchRoute as ji, createCloudFrontModule as jn, MCP_PROTOCOL_VERSION as jr, disposeWebFunctionArtifact as jt, finalizeMicrovmEnv as k, discoverRoutes as ka, isFunctionUrlOacFronted as ki, runViewerResponse as kn, MCP_CONTAINER_PORT as kr, resolveWebFunctionRuntime as kt, relayServeRequest as l, LocalStateSourceError as la, readMtlsMaterialsFromDisk as li, resolveErrorResponseCandidates as ln, buildStsClientConfig as lo, resolveImageOverrides as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, resolveCfnRegion as ma, buildCognitoJwksUrl as mi, buildEdgeRequestEvent as mn, listPinnedTargets as mr, containerFailure as mt, coerceRunRequest as n, resolveRuntimeFileExtension as na, buildStageMap as ni, createDeployedKvsDataSource as nn, assumedRoleRecorded as no, runEcsServiceEmulator as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, substituteAgainstStateAsync as oa, filterRoutesByApiIdentifier as oi, createS3OriginReader as on, resetWorkloadIdentity as oo, enforceImageOverrideOrphans as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, resolveCfnFallbackRegion as pa, defaultCredentialsLoader as pi, applyEdgeResponseResult as pn, isLocalCdkAssetImage as pr, WEB_FUNCTION_CONTAINER_PORT as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, containsDynamicReference as qa, buildMgmtEndpointEnvUrl as qi, addCommonEcsServiceOptions as qn, addInvokeSpecificOptions as qr, LocalStartCloudFrontError as qt, coerceServeRequest as r, resolveRuntimeImage as ra, materializeLayerFromArn as ri, resolveDeployedKvsArnByName as rn, deployAccountStsClientConfig as ro, ImageOverrideError as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, substituteEnvVarsFromState as sa, filterRoutesByApiIdentifiers as si, matchBehavior as sn, workloadClientConfig as so, mergeForService as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, resolveRuntimeCodeMountPath as ta, attachStageContext as ti, resolveKvsModulesForDistribution as tn, SECOND_ASSUME_MESSAGE as to, resolveSharedSidecarCredentials as tr, waitForAppAnswer as tt, reinvoke as u, createLocalStateProvider as ua, startApiServer as ui, serveFromStaticOrigin as un, resolveProfileCredentials as uo, runImageOverrideBuilds as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveSsmParameters as va, verifyJwtAuthorizer as vi, CLOUDFRONT_DISTRIBUTION_TYPE as vn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as vr, waitForWebFunctionReady as vt, createLocalListCommand as w, discoverWebSocketApis as wa, invokeTokenAuthorizer as wi, pickLambdaEdgeFunctionLogicalId as wn, bridgeAgentCoreWs as wr, webFunctionAssumeRole as wt, createStudioStore as x, countTargets as xa, computeRequestIdentityHash as xi, isCloudFrontDistribution as xn, attachContainerLogStreamer as xr, buildWebFunctionLambdaView as xt, toStudioTargetGroups as y, resolveWatchConfig as ya, verifyJwtViaDiscovery as yi, describeS3OriginDomain as yn, setShadowReadyTimeoutMs as yr, watchContainerExit as yt, MICROVM_CONTROL_PATH as z, resolveAgentCoreTarget as za, tryParseStatus as zi, isApplicationLoadBalancer as zn, waitForAgentCorePing as zr, resolveWebFunctionTarget as zt };
+//# sourceMappingURL=local-studio-BhFxp-jM.js.map