cdk-local 0.156.0 → 0.158.0

package/dist/{local-studio-BhFxp-jM.js → local-studio-vhvbqvPb.js}

@@ -15492,7 +15492,7 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	const loader = new AssetManifestLoader();
 	const manifest = await loader.loadStackManifest(resolved.stack, cdkOutDir);
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
-	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey$1(fileAssets, code.codeAssetHash) : void 0;
+	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey(fileAssets, code.codeAssetHash) : void 0;
 	if (!asset) throw new CdkLocalError(`AgentCore Runtime ${displayIdent(resolved.logicalId)} code bundle (asset ${displayIdent(code.codeAssetHash)}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
 	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, {
 		assetOutdir: assetPathDirs(resolved.stack).assetOutdir,
@@ -15542,7 +15542,7 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 		await bundle.cleanup();
 	}
 }
-function findFileAssetByObjectKey$1(fileAssets, hash) {
+function findFileAssetByObjectKey(fileAssets, hash) {
 	const zip = `${hash}.zip`;
 	for (const asset of fileAssets.values()) if (Object.values(asset.destinations).some((d) => d.objectKey === zip || d.objectKey.endsWith(`/${zip}`))) return asset;
 }
@@ -22464,6 +22464,93 @@ function addAlbSpecificOptions(cmd) {
 	return cmd.addOption(new Option("--lb-port <listenerPort=hostPort...>", "Bind the local front-door on a specific host port (e.g. 80=8080); repeatable. Default: host port == ALB listener port. Use this on macOS to remap a privileged listener port (< 1024) to a non-privileged host port.")).addOption(new Option("--tls", "Terminate TLS locally for cloud-HTTPS listeners. Default: a cloud-HTTPS listener is served over plain HTTP locally (X-Forwarded-Proto: https is preserved so the upstream app still sees the deployed listener protocol). Implied by --tls-cert / --tls-key. Use this when local-dev cookies need Secure / SameSite=None, when the upstream app inspects TLS metadata, or for mTLS / SNI testing — otherwise plain HTTP is friendlier (no self-signed cert warnings in curl / browser).")).addOption(new Option("--tls-cert <path>", "PEM-encoded server certificate for HTTPS front-door listeners. Implies --tls. Must be set together with --tls-key. Pass --tls alone (without --tls-cert / --tls-key) to auto-generate a self-signed cert (cached under $XDG_CACHE_HOME/cdk-local/alb-https/, default ~/.cache/cdk-local/alb-https/); requires openssl on PATH. The deployed Listener Certificates[] are NOT fetched (ACM private keys are not retrievable by design). The auto-generated cert lists DNS:localhost,IP:127.0.0.1 as SubjectAltName, so a client validating a non-loopback --container-host will fail the SAN check — pass --tls-cert / --tls-key with a SAN covering that host instead.")).addOption(new Option("--tls-key <path>", "PEM-encoded server private key matching --tls-cert. Implies --tls. Must be set together with --tls-cert.")).addOption(new Option("--no-verify-auth", "Disable local enforcement of authenticate-cognito / authenticate-oidc actions. Every request is served as if the auth check passed. Useful for local dev where you do not want to mint a Bearer token at all.")).addOption(new Option("--bearer-token <jwt>", "Default Bearer JWT this command INJECTS only when an inbound request has none (the default-when-missing role) — `cdkl start-alb` is the local ALB front-door RECEIVING outside-in requests, so this token is the fallback the front-door slots in as Authorization: Bearer <jwt> if the caller did not already supply one. Verified against the same JWKS / OIDC discovery URL the deployed ALB would (signature + iss + aud + exp). Cookie pass-through (AWSELBAuthSessionCookie-*) also bypasses the guard. Contrast with `cdkl invoke-agentcore --bearer-token`, where the role is reversed — that command is the outbound client and ALWAYS presents this token (the supplier).")).addOption(new Option("--watch", "Hot-reload: re-synth + per-replica reload of every ECS service behind the ALB when the CDK source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). A per-firing classifier picks the per-replica primitive: source-only edits on interpreted-language handlers (Node/Python/Ruby/shell) take a bind-mount FAST PATH (`docker cp` the new source into each replica + restart it; no rebuild, its front-door pool entry is drained and re-published once it listens again). Dockerfile / dependency manifest / compiled-language source / ambiguous edits fall through to the rebuild rolling primitive — boot a shadow under a bumped generation suffix, wait for its container port to accept a TCP connection, atomically register it in the front-door pool, then drop the old entry and retire the old container. Either path rolls one replica at a time, so a continuous external request stream against the listener port sees zero connection refusals across the reload. The host front-door (TLS, JWKS cache, Lambda-target containers, listener sockets) stays up across the reload. Lambda target groups behind the ALB are a no-op on reload (the warm RIE container keeps its boot-time image). Off by default; existing replica(s) keep serving when synth fails mid-reload.").default(false));
 }
 
+//#endregion
+//#region src/local/s3-object-asset.ts
+function findFileAssetForObjectKey(manifest, key) {
+	for (const [hash, asset] of Object.entries(manifest.files ?? {})) for (const dest of Object.values(asset.destinations ?? {})) if (dest.objectKey === key || dest.objectKey.endsWith(`/${key}`)) return {
+		hash,
+		asset
+	};
+	const hash = key.replace(/^.*\//, "").replace(/\.zip$/, "");
+	const byHash = Object.hasOwn(manifest.files ?? {}, hash) ? manifest.files[hash] : void 0;
+	return byHash ? {
+		hash,
+		asset: byHash
+	} : void 0;
+}
+function isBucketDeploymentResource(resource) {
+	return resource !== void 0 && String(resource.Type).startsWith("Custom::CDKBucketDeployment");
+}
+function bucketDeploymentSourceObjectKeys(resource) {
+	const keys = resource.Properties?.["SourceObjectKeys"];
+	return Array.isArray(keys) ? keys : [];
+}
+function resolveBucketDeploymentObjectKey(template, value) {
+	const select = asObject$3(value)?.["Fn::Select"];
+	if (!Array.isArray(select) || select.length !== 2) return void 0;
+	const index = selectIndex(select[0]);
+	const deploymentLogicalId = sourceObjectKeysGetAttTarget(select[1]);
+	if (index === void 0 || deploymentLogicalId === void 0) return void 0;
+	const resources = template.Resources ?? {};
+	const deployment = Object.hasOwn(resources, deploymentLogicalId) ? resources[deploymentLogicalId] : void 0;
+	if (!deployment || !isBucketDeploymentResource(deployment)) return void 0;
+	const props = deployment.Properties ?? {};
+	if (handlerFlag(props["Extract"])) return {
+		kind: "extracts",
+		deploymentLogicalId,
+		index
+	};
+	if (!handlerFlag(props["OutputObjectKeys"])) return {
+		kind: "object-keys-not-output",
+		deploymentLogicalId,
+		index
+	};
+	const prefix = props["DestinationBucketKeyPrefix"];
+	if (prefix !== void 0 && prefix !== "" && prefix !== "/") return {
+		kind: "prefixed-destination",
+		deploymentLogicalId,
+		index
+	};
+	const keys = bucketDeploymentSourceObjectKeys(deployment);
+	if (index >= keys.length) return {
+		kind: "index-out-of-range",
+		deploymentLogicalId,
+		index,
+		sourceCount: keys.length
+	};
+	const sourceObjectKey = keys[index];
+	if (typeof sourceObjectKey !== "string" || sourceObjectKey.length === 0) return {
+		kind: "source-key-not-literal",
+		deploymentLogicalId,
+		index
+	};
+	return {
+		kind: "resolved",
+		deploymentLogicalId,
+		index,
+		sourceObjectKey
+	};
+}
+function handlerFlag(value) {
+	if (value === void 0 || value === true || value === "true") return true;
+	return typeof value === "object" && value !== null;
+}
+function selectIndex(value) {
+	const n = typeof value === "number" ? value : typeof value === "string" && /^\d+$/.test(value) ? Number(value) : NaN;
+	return Number.isSafeInteger(n) && n >= 0 ? n : void 0;
+}
+function sourceObjectKeysGetAttTarget(value) {
+	const getAtt = asObject$3(value)?.["Fn::GetAtt"];
+	if (Array.isArray(getAtt)) return getAtt.length === 2 && typeof getAtt[0] === "string" && getAtt[1] === "SourceObjectKeys" ? getAtt[0] : void 0;
+	if (typeof getAtt === "string" && getAtt.endsWith(".SourceObjectKeys")) {
+		const id = getAtt.slice(0, -17);
+		return id.length > 0 && !id.includes(".") ? id : void 0;
+	}
+}
+function asObject$3(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+
 //#endregion
 //#region src/local/cloudfront-kvs.ts
 function createCloudFrontModule(sources) {
@@ -22765,6 +22852,310 @@ function decodePart(s) {
 	}
 }
 
+//#endregion
+//#region src/local/response-headers-policy.ts
+function resolveResponseHeadersPolicyHeaders(template, responseHeadersPolicyId) {
+	const rhpId = pickRhpRefLogicalId(responseHeadersPolicyId);
+	if (!rhpId) return void 0;
+	const rhpResource = (template.Resources ?? {})[rhpId];
+	if (!rhpResource || rhpResource.Type !== "AWS::CloudFront::ResponseHeadersPolicy") return;
+	const rhpConfig = asRecord((rhpResource.Properties ?? {})["ResponseHeadersPolicyConfig"]);
+	if (!rhpConfig) return void 0;
+	const skipped = [];
+	const set = [...parseSecurityHeaders(asRecord(rhpConfig["SecurityHeadersConfig"]), skipped), ...parseCustomHeaders(asRecord(rhpConfig["CustomHeadersConfig"]), skipped)];
+	const remove = parseRemoveHeaders(asRecord(rhpConfig["RemoveHeadersConfig"]), skipped);
+	if (set.length === 0 && remove.length === 0 && skipped.length === 0) return void 0;
+	return {
+		remove,
+		set,
+		skipped
+	};
+}
+function applyResponseHeadersPolicyHeaders(res, policy, onInvalid) {
+	for (const name of policy.remove) res.removeHeader(name);
+	for (const header of policy.set) {
+		if (!header.override && res.hasHeader(header.name)) continue;
+		try {
+			res.setHeader(header.name, header.value);
+		} catch (err) {
+			onInvalid?.(header.name, err);
+		}
+	}
+}
+function parseSecurityHeaders(config, skipped) {
+	if (!config) return [];
+	const out = [];
+	const hsts = asRecord(config["StrictTransportSecurity"]);
+	const maxAge = hsts ? toNumber(hsts["AccessControlMaxAgeSec"]) : void 0;
+	if (hsts && maxAge !== void 0) {
+		let value = `max-age=${maxAge}`;
+		if (toBool(hsts["IncludeSubdomains"])) value += "; includeSubDomains";
+		if (toBool(hsts["Preload"])) value += "; preload";
+		out.push({
+			name: "strict-transport-security",
+			value,
+			override: toBool(hsts["Override"])
+		});
+	} else if (hsts) skipped.push("strict-transport-security");
+	const csp = asRecord(config["ContentSecurityPolicy"]);
+	if (csp && typeof csp["ContentSecurityPolicy"] === "string") out.push({
+		name: "content-security-policy",
+		value: csp["ContentSecurityPolicy"],
+		override: toBool(csp["Override"])
+	});
+	else if (csp) skipped.push("content-security-policy");
+	const cto = asRecord(config["ContentTypeOptions"]);
+	if (cto) out.push({
+		name: "x-content-type-options",
+		value: "nosniff",
+		override: toBool(cto["Override"])
+	});
+	const frame = asRecord(config["FrameOptions"]);
+	if (frame && typeof frame["FrameOption"] === "string") out.push({
+		name: "x-frame-options",
+		value: frame["FrameOption"],
+		override: toBool(frame["Override"])
+	});
+	else if (frame) skipped.push("x-frame-options");
+	const referrer = asRecord(config["ReferrerPolicy"]);
+	if (referrer && typeof referrer["ReferrerPolicy"] === "string") out.push({
+		name: "referrer-policy",
+		value: referrer["ReferrerPolicy"],
+		override: toBool(referrer["Override"])
+	});
+	else if (referrer) skipped.push("referrer-policy");
+	const xss = asRecord(config["XSSProtection"]);
+	const reportUri = xss?.["ReportUri"];
+	if (xss && reportUri !== void 0 && typeof reportUri !== "string") skipped.push("x-xss-protection");
+	else if (xss && xss["Protection"] !== void 0) {
+		let value = toBool(xss["Protection"]) ? "1" : "0";
+		if (value === "1") {
+			if (toBool(xss["ModeBlock"])) value += "; mode=block";
+			else if (typeof xss["ReportUri"] === "string" && xss["ReportUri"] !== "") value += `; report=${xss["ReportUri"]}`;
+		}
+		out.push({
+			name: "x-xss-protection",
+			value,
+			override: toBool(xss["Override"])
+		});
+	}
+	return out;
+}
+function parseCustomHeaders(config, skipped) {
+	const items = config?.["Items"];
+	if (!Array.isArray(items)) return [];
+	const out = [];
+	for (const item of items) {
+		const h = asRecord(item);
+		if (!h || typeof h["Header"] !== "string" || h["Header"] === "") {
+			if (h && h["Header"] !== void 0) skipped.push("(unresolved custom header name)");
+			continue;
+		}
+		if (h["Value"] !== void 0 && typeof h["Value"] !== "string") {
+			skipped.push(h["Header"].toLowerCase());
+			continue;
+		}
+		out.push({
+			name: h["Header"].toLowerCase(),
+			value: typeof h["Value"] === "string" ? h["Value"] : "",
+			override: toBool(h["Override"])
+		});
+	}
+	return out;
+}
+function parseRemoveHeaders(config, skipped) {
+	const items = config?.["Items"];
+	if (!Array.isArray(items)) return [];
+	const out = [];
+	for (const item of items) {
+		const h = asRecord(item);
+		if (h && typeof h["Header"] === "string" && h["Header"] !== "") out.push(h["Header"].toLowerCase());
+		else if (h && h["Header"] !== void 0) skipped.push("(unresolved remove header name)");
+	}
+	return out;
+}
+function asRecord(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function toBool(value) {
+	return value === true || value === "true";
+}
+function toNumber(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (typeof value === "string" && /^\d+$/.test(value)) return Number(value);
+}
+
+//#endregion
+//#region src/local/web-function-resolver.ts
+const WEB_FUNCTION_TYPE = "AWS::Lambda::WebFunction";
+const WEB_FUNCTION_REVISION_TYPE = "AWS::Lambda::WebFunctionRevision";
+const WEB_FUNCTION_ENDPOINT_TYPE = "AWS::Lambda::WebFunctionEndpoint";
+const WEB_TYPES = [
+	WEB_FUNCTION_ENDPOINT_TYPE,
+	WEB_FUNCTION_TYPE,
+	WEB_FUNCTION_REVISION_TYPE
+];
+var WebFunctionResolutionError = class WebFunctionResolutionError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WebFunctionResolutionError";
+		Object.setPrototypeOf(this, WebFunctionResolutionError.prototype);
+	}
+};
+function resolveWebFunctionTarget(target, stacks, revisionFlag) {
+	if (stacks.length === 0) throw new WebFunctionResolutionError("No stacks found in the synthesized assembly.");
+	const parsed = parseTarget(target);
+	const stack = pickStack$1(parsed, stacks, target);
+	const resources = stack.template.Resources ?? {};
+	const { logicalId, resource } = matchWebResource(parsed, target, stack, resources);
+	const functions = logicalIdsOfType(resources, WEB_FUNCTION_TYPE);
+	const linked = (value) => linkedFunctionLogicalId(value, resources, functions);
+	let functionLogicalId;
+	let endpoint;
+	let revisionLogicalId;
+	let selection;
+	if (resource.Type === "AWS::Lambda::WebFunctionRevision") {
+		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
+		revisionLogicalId = logicalId;
+		selection = "target-revision";
+	} else if (resource.Type === "AWS::Lambda::WebFunctionEndpoint") {
+		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
+		endpoint = readEndpoint(logicalId, resource, resources);
+	} else functionLogicalId = logicalId;
+	const revisionsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_REVISION_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
+	const endpointsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_ENDPOINT_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
+	if (revisionFlag !== void 0) {
+		const flagged = resources[revisionFlag];
+		if (!flagged || flagged.Type !== "AWS::Lambda::WebFunctionRevision") throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} is not an ${WEB_FUNCTION_REVISION_TYPE} logical id in ${displayStackName(stack.stackName)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
+		const owner = linked(flagged.Properties?.["FunctionName"]);
+		if (functionLogicalId !== void 0 && owner !== functionLogicalId) throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} belongs to a different web function than ${displayIdent(logicalId)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
+		functionLogicalId ??= owner;
+		revisionLogicalId = revisionFlag;
+		selection = "revision-flag";
+	}
+	if (revisionLogicalId === void 0 && endpoint !== void 0) {
+		revisionLogicalId = pickHighestWeight(endpoint);
+		if (revisionLogicalId !== void 0) selection = "endpoint-weight";
+	}
+	if (revisionLogicalId === void 0) {
+		const revisions = revisionsOfFunction();
+		if (revisions.length === 1) {
+			revisionLogicalId = revisions[0];
+			selection = "only-revision";
+		} else if (endpoint === void 0 && revisions.length > 1) {
+			const endpoints = endpointsOfFunction();
+			if (endpoints.length === 1) {
+				endpoint = readEndpoint(endpoints[0], resources[endpoints[0]], resources);
+				revisionLogicalId = pickHighestWeight(endpoint);
+				if (revisionLogicalId !== void 0) selection = "endpoint-weight";
+			}
+		}
+		if (revisionLogicalId === void 0) throw new WebFunctionResolutionError(revisions.length === 0 ? `${displayIdent(logicalId)} in ${displayStackName(stack.stackName)} resolves to no ${WEB_FUNCTION_REVISION_TYPE} in this template, so there is no code to serve. Target the revision itself, or pass --revision <logicalId>.` : `${displayIdent(logicalId)} has ${revisions.length} revisions and no single endpoint that picks one. Pass --revision <logicalId>, or target one of the function's endpoints. ${describeRevisions(revisions, stack)}`);
+	}
+	if (endpoint === void 0) {
+		const routing = endpointsOfFunction().map((id) => readEndpoint(id, resources[id], resources)).filter((e) => e.weights.some((w) => w.revisionLogicalId === revisionLogicalId));
+		if (routing.length === 1) endpoint = routing[0];
+	}
+	const fnName = (functionLogicalId !== void 0 ? resources[functionLogicalId] : void 0)?.Properties?.["FunctionName"];
+	return {
+		stack,
+		functionLogicalId,
+		functionName: typeof fnName === "string" && fnName.length > 0 ? fnName : functionLogicalId ?? revisionLogicalId,
+		revisionLogicalId,
+		revision: resources[revisionLogicalId],
+		endpoint,
+		selection: selection ?? "only-revision"
+	};
+}
+function pickStack$1(parsed, stacks, target) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new WebFunctionResolutionError(`Multiple stacks in app, target ${displayIdent(parsed.pathOrId)} is missing a stack prefix. Use StackName:<logicalId> or StackName/... (path form). Available stacks: ${describeStacks(stacks)}.`);
+		case "not-found": throw new WebFunctionResolutionError(`Stack ${displayStackName(selection.pattern)} not found. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new WebFunctionResolutionError(`Stack pattern ${displayStackName(selection.pattern)} matched ${selection.matched.length} stacks: ${describeStacks(selection.matched)}. Use a more specific pattern, or the stack's display path.`);
+	}
+}
+function matchWebResource(parsed, target, stack, resources) {
+	if (parsed.isPath) {
+		const matches = resolveCdkPathToLogicalIds(parsed.pathOrId, buildCdkPathIndex(stack.template)).filter(({ logicalId }) => WEB_TYPES.includes(resources[logicalId]?.Type ?? ""));
+		for (const type of WEB_TYPES) {
+			const ofType = matches.filter(({ logicalId }) => resources[logicalId].Type === type);
+			if (ofType.length === 1) {
+				const id = ofType[0].logicalId;
+				return {
+					logicalId: id,
+					resource: resources[id]
+				};
+			}
+			if (ofType.length > 1) throw new WebFunctionResolutionError(`Target ${displayStackName(target)} matches ${ofType.length} ${type} resources: ${ofType.map((m) => displayIdent(m.logicalId)).join(", ")}. Refine the path or use the StackName:<logicalId> form.`);
+		}
+		throw notFoundError(target, stack, resources);
+	}
+	const resource = resources[parsed.pathOrId];
+	if (!resource) throw notFoundError(target, stack, resources);
+	if (!WEB_TYPES.includes(resource.Type)) throw new WebFunctionResolutionError(`Resource ${displayIdent(parsed.pathOrId)} in ${displayStackName(stack.stackName)} is ${displayIdent(resource.Type)}, not a Lambda web function. ${getEmbedConfig().cliName} start-web-function serves ${WEB_TYPES.join(" / ")} targets.`);
+	return {
+		logicalId: parsed.pathOrId,
+		resource
+	};
+}
+function notFoundError(target, stack, resources) {
+	const available = WEB_TYPES.flatMap((t) => logicalIdsOfType(resources, t));
+	const hint = available.length > 0 ? `Web function resources in ${displayStackName(stack.stackName)}: ${available.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_TYPE} resources found in ${displayStackName(stack.stackName)}.`;
+	return new WebFunctionResolutionError(`Target ${displayStackName(target)} not found. ${hint}`);
+}
+function logicalIdsOfType(resources, type) {
+	return Object.keys(resources).filter((id) => resources[id]?.Type === type);
+}
+function linkedFunctionLogicalId(value, resources, functions) {
+	const ref = referencedLogicalId(value);
+	if (ref !== void 0) return functions.includes(ref) ? ref : void 0;
+	if (typeof value !== "string") return void 0;
+	const byName = functions.filter((id) => resources[id]?.Properties?.["FunctionName"] === value);
+	return byName.length === 1 ? byName[0] : void 0;
+}
+function referencedLogicalId(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const obj = value;
+	if (typeof obj["Ref"] === "string") return obj["Ref"];
+	const getAtt = obj["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
+	if (typeof getAtt === "string") return getAtt.split(".")[0];
+}
+function readEndpoint(logicalId, resource, resources) {
+	const props = resource.Properties ?? {};
+	const rawWeights = props["RevisionWeights"];
+	const weights = [];
+	if (Array.isArray(rawWeights)) for (const entry of rawWeights) {
+		if (!entry || typeof entry !== "object") continue;
+		const e = entry;
+		const ref = referencedLogicalId(e["RevisionId"]);
+		weights.push({
+			revisionLogicalId: ref !== void 0 && resources[ref]?.Type === "AWS::Lambda::WebFunctionRevision" ? ref : void 0,
+			weight: typeof e["Weight"] === "number" ? e["Weight"] : 0
+		});
+	}
+	const str = (v) => typeof v === "string" ? v : void 0;
+	return {
+		logicalId,
+		endpointType: str(props["EndpointType"]),
+		authType: str(props["AuthType"]),
+		weights
+	};
+}
+function pickHighestWeight(endpoint) {
+	let best;
+	for (const w of endpoint.weights) {
+		if (w.revisionLogicalId === void 0) continue;
+		if (best === void 0 || w.weight > best.weight) best = w;
+	}
+	return best?.revisionLogicalId;
+}
+function describeRevisions(revisions, stack) {
+	return revisions.length > 0 ? `Revisions: ${revisions.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_REVISION_TYPE} linked to it in ${displayStackName(stack.stackName)}.`;
+}
+
 //#endregion
 //#region src/local/cloudfront-resolver.ts
 const CLOUDFRONT_DISTRIBUTION_TYPE = "AWS::CloudFront::Distribution";
@@ -22864,6 +23255,11 @@ function resolveBehavior(behavior, pathPattern, functions, distLogicalId, templa
 	if (pathPattern !== void 0) resolved.pathPattern = pathPattern;
 	const cors = resolveResponseHeadersPolicyCors(template, behavior["ResponseHeadersPolicyId"]);
 	if (cors) resolved.cors = cors;
+	const responseHeaders = resolveResponseHeadersPolicyHeaders(template, behavior["ResponseHeadersPolicyId"]);
+	if (responseHeaders) {
+		resolved.responseHeaders = responseHeaders;
+		if (responseHeaders.skipped.length > 0) getLogger().warn(`Cache behavior ${displayIdent(pathPattern ?? "default")} of distribution ${displayIdent(distLogicalId)}: response headers policy entr(y/ies) ${responseHeaders.skipped.map((h) => displayIdent(h)).join(", ")} are not literals in the template (a CDK token); cdk-local does not apply them (the header is neither sent nor removed).`);
+	}
 	if (typeof behavior["ViewerProtocolPolicy"] === "string") resolved.viewerProtocolPolicy = behavior["ViewerProtocolPolicy"];
 	const assocs = Array.isArray(behavior["FunctionAssociations"]) ? behavior["FunctionAssociations"] : [];
 	for (const a of assocs) {
@@ -22949,6 +23345,18 @@ function resolveOrigins(dc, template, stack, overrides) {
 				out.set(originId, lambdaUrl);
 				continue;
 			}
+			const endpointLogicalId = pickWebFunctionEndpointLogicalIdFromOrigin(origin["DomainName"], template);
+			if (endpointLogicalId) {
+				const customConfig = origin["CustomOriginConfig"];
+				const readTimeout = customConfig && typeof customConfig === "object" ? customConfig["OriginReadTimeout"] : void 0;
+				out.set(originId, {
+					kind: "web-function",
+					originId,
+					endpointLogicalId,
+					...typeof readTimeout === "number" && readTimeout > 0 && { readTimeoutSeconds: readTimeout }
+				});
+				continue;
+			}
 			out.set(originId, {
 				kind: "custom",
 				originId,
@@ -23017,13 +23425,11 @@ function resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId)
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
 	const dirs = [];
 	for (const resource of Object.values(template.Resources ?? {})) {
-		if (!String(resource.Type).startsWith("Custom::CDKBucketDeployment")) continue;
-		const props = resource.Properties ?? {};
-		if (refLogicalId(props["DestinationBucketName"]) !== bucketLogicalId) continue;
-		const keys = Array.isArray(props["SourceObjectKeys"]) ? props["SourceObjectKeys"] : [];
-		for (const key of keys) {
+		if (!isBucketDeploymentResource(resource)) continue;
+		if (refLogicalId((resource.Properties ?? {})["DestinationBucketName"]) !== bucketLogicalId) continue;
+		for (const key of bucketDeploymentSourceObjectKeys(resource)) {
 			if (typeof key !== "string") continue;
-			const asset = findFileAssetByObjectKey(manifest, key);
+			const asset = findFileAssetForObjectKey(manifest, key)?.asset;
 			if (!asset) continue;
 			dirs.push(resolveAssetSourcePath({
 				manifestDir,
@@ -23040,11 +23446,6 @@ function resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId)
 	}
 	return dirs;
 }
-function findFileAssetByObjectKey(manifest, objectKey) {
-	for (const asset of Object.values(manifest.files ?? {})) for (const dest of Object.values(asset.destinations ?? {})) if (dest.objectKey === objectKey) return asset;
-	const hash = objectKey.replace(/\.zip$/, "");
-	return manifest.files?.[hash];
-}
 function pickBucketLogicalIdFromOrigin(origin, template) {
 	const candidate = getAttLogicalId(origin["DomainName"]);
 	if (!candidate) return void 0;
@@ -23072,6 +23473,11 @@ function resolveLambdaUrlOrigin(origin, template, originId) {
 		functionUrlLogicalId: urlLogicalId
 	};
 }
+function pickWebFunctionEndpointLogicalIdFromOrigin(value, template) {
+	const getAtt = asIntrinsic(value, "Fn::GetAtt");
+	if (!Array.isArray(getAtt) || getAtt.length !== 2 || typeof getAtt[0] !== "string" || getAtt[1] !== "DomainName") return;
+	return (template.Resources ?? {})[getAtt[0]]?.Type === "AWS::Lambda::WebFunctionEndpoint" ? getAtt[0] : void 0;
+}
 function pickFunctionUrlLogicalIdFromOrigin(value) {
 	const select = asIntrinsic(value, "Fn::Select");
 	if (!Array.isArray(select) || select.length !== 2 || select[0] !== 2) return void 0;
@@ -23389,11 +23795,92 @@ function normalizeHeaders(headers) {
 }
 
 //#endregion
-//#region src/local/cloudfront-static-origin.ts
-function serveFromStaticOrigin(input) {
-	const key = uriToKey(input.uri, input.defaultRootObject);
-	const containLinks = input.containLinks === true;
-	const hideIn = new Set(input.hideDotfilesIn ?? []);
+//#region src/local/cloudfront-web-function-origin.ts
+const DEFAULT_ORIGIN_READ_TIMEOUT_SECONDS = 30;
+function serveWebFunctionOrigin(args) {
+	const { target, request: request$3 } = args;
+	const timeoutMs = (args.readTimeoutSeconds ?? 30) * 1e3;
+	const headers = buildOriginRequestHeaders(request$3, target);
+	if (request$3.body.length > 0) headers["content-length"] = String(request$3.body.length);
+	const path = request$3.querystring ? `${request$3.uri}?${request$3.querystring}` : request$3.uri;
+	return new Promise((resolveResult) => {
+		let settled = false;
+		const settle = (result) => {
+			if (settled) return;
+			settled = true;
+			resolveResult(result);
+		};
+		const req = request({
+			host: target.host,
+			port: target.port,
+			method: request$3.method,
+			path,
+			headers,
+			agent: false
+		}, (res) => {
+			const chunks = [];
+			res.on("data", (c) => chunks.push(c));
+			res.on("end", () => settle({
+				statusCode: res.statusCode ?? 502,
+				...splitResponseHeaders(res.headers),
+				body: Buffer.concat(chunks)
+			}));
+			res.on("error", (err) => settle(originError(502, err.message)));
+		});
+		req.setTimeout(timeoutMs, () => {
+			settle(originError(504, `the web function server did not answer within the origin read timeout (${timeoutMs / 1e3}s)`));
+			req.destroy();
+		});
+		req.on("error", (err) => settle(originError(502, err.message)));
+		req.end(request$3.body.length > 0 ? request$3.body : void 0);
+	});
+}
+function buildOriginRequestHeaders(request, target) {
+	const headers = {};
+	for (const [name, value] of Object.entries(request.headers)) if (value !== void 0) headers[name.toLowerCase()] = value;
+	stripHopByHopHeaders(headers);
+	delete headers["content-length"];
+	headers["host"] = formatAuthority(target.host, target.port);
+	if (request.sourceIp !== void 0) {
+		const prior = headers["x-forwarded-for"];
+		const priorValue = Array.isArray(prior) ? prior.join(", ") : prior;
+		headers["x-forwarded-for"] = priorValue ? `${priorValue}, ${request.sourceIp}` : request.sourceIp;
+	}
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) if (value !== void 0) out[name] = value;
+	return out;
+}
+function splitResponseHeaders(raw) {
+	const copy = { ...raw };
+	stripHopByHopHeaders(copy);
+	delete copy["content-length"];
+	const cookies = copy["set-cookie"];
+	delete copy["set-cookie"];
+	const headers = {};
+	for (const [name, value] of Object.entries(copy)) {
+		if (value === void 0) continue;
+		headers[name] = Array.isArray(value) ? value.join(", ") : value;
+	}
+	return {
+		headers,
+		cookies: cookies === void 0 ? [] : Array.isArray(cookies) ? cookies : [cookies]
+	};
+}
+function originError(statusCode, detail) {
+	return {
+		statusCode,
+		headers: { "content-type": "text/plain; charset=utf-8" },
+		cookies: [],
+		body: Buffer.from(`${statusCode === 502 ? "Bad Gateway" : "Gateway Timeout"}: ${detail.replace(/[\r\n]+/g, " ")}\n`)
+	};
+}
+
+//#endregion
+//#region src/local/cloudfront-static-origin.ts
+function serveFromStaticOrigin(input) {
+	const key = uriToKey(input.uri, input.defaultRootObject);
+	const containLinks = input.containLinks === true;
+	const hideIn = new Set(input.hideDotfilesIn ?? []);
 	const direct = readKey(input.localDirs, key, containLinks, hideIn);
 	if (direct) return {
 		statusCode: 200,
@@ -23557,9 +24044,10 @@ async function startCloudFrontServer(options) {
 	const lambdaInvokers = options.lambdaInvokers ?? /* @__PURE__ */ new Map();
 	const edgeInvokers = options.edgeInvokers ?? /* @__PURE__ */ new Map();
 	const s3OriginReaders = options.s3OriginReaders ?? /* @__PURE__ */ new Map();
+	const webFunctionOrigins = options.webFunctionOrigins ?? /* @__PURE__ */ new Map();
 	const state = { distribution: options.distribution };
 	const handler = (req, res) => {
-		handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger).catch((err) => {
+		handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, webFunctionOrigins, logger).catch((err) => {
 			logger.warn(`Request handling failed: ${err instanceof Error ? err.message : String(err)}`);
 			if (!res.headersSent) {
 				res.statusCode = 500;
@@ -23588,7 +24076,7 @@ async function startCloudFrontServer(options) {
 		}
 	};
 }
-async function handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger) {
+async function handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, webFunctionOrigins, logger) {
 	const distribution = state.distribution;
 	const rawUrl = req.url ?? "/";
 	const queryIdx = rawUrl.indexOf("?");
@@ -23680,6 +24168,7 @@ async function handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3
 		distribution,
 		lambdaInvokers,
 		s3OriginReaders,
+		webFunctionOrigins,
 		logger
 	});
 	if (!originResult) return writePlain(res, 502, originUnavailableMessage(origin, behavior));
@@ -23737,11 +24226,15 @@ async function handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3
 	} catch (err) {
 		logger.warn(`Skipping invalid Set-Cookie header(s): ${err instanceof Error ? err.message : String(err)}`);
 	}
+	applyResponseHeadersPolicy(res, behavior, req, logger);
+	res.end(finalBody);
+}
+function applyResponseHeadersPolicy(res, behavior, req, logger) {
+	if (behavior.responseHeaders) applyResponseHeadersPolicyHeaders(res, behavior.responseHeaders, (name, err) => logger.warn(`Skipping invalid response headers policy header ${displayUntrustedValue(name)}: ${flattenToOneLine(err instanceof Error ? err.message : String(err))}`));
 	if (behavior.cors) {
 		const origin = req.headers.origin;
 		applyCorsResponseHeadersFromConfig(res, behavior.cors, typeof origin === "string" ? origin : void 0);
 	}
-	res.end(finalBody);
 }
 async function runEdgeResponseStage(assoc, eventType, ctx, edgeInvokers, logger) {
 	const invoke = edgeInvokers.get(assoc.functionLogicalId);
@@ -23769,10 +24262,7 @@ function writeEdgeResponse(res, result, behavior, req, logger) {
 	if (result.setCookies.length > 0) try {
 		res.setHeader("set-cookie", result.setCookies);
 	} catch {}
-	if (behavior.cors) {
-		const origin = req.headers.origin;
-		applyCorsResponseHeadersFromConfig(res, behavior.cors, typeof origin === "string" ? origin : void 0);
-	}
+	applyResponseHeadersPolicy(res, behavior, req, logger);
 	res.end(result.body);
 }
 function cfHeadersToRawMap(cf) {
@@ -23835,6 +24325,28 @@ async function serveFromOrigin(origin, args) {
 			...result.cookies.length > 0 && { setCookies: result.cookies }
 		};
 	}
+	if (origin.kind === "web-function") {
+		const target = args.webFunctionOrigins.get(origin.endpointLogicalId);
+		if (!target) return void 0;
+		const result = await serveWebFunctionOrigin({
+			target,
+			request: {
+				method: args.method,
+				uri: args.uri,
+				querystring: args.querystring,
+				headers: args.headers,
+				body: await args.readBody(),
+				sourceIp: args.sourceIp
+			},
+			...origin.readTimeoutSeconds !== void 0 && { readTimeoutSeconds: origin.readTimeoutSeconds }
+		});
+		return {
+			statusCode: result.statusCode,
+			headers: result.headers,
+			body: result.body,
+			...result.cookies.length > 0 && { setCookies: result.cookies }
+		};
+	}
 	if (origin.kind === "s3-deployed") {
 		const reader = args.s3OriginReaders.get(origin.originId);
 		if (!reader) return void 0;
@@ -23867,7 +24379,8 @@ async function serveFromOrigin(origin, args) {
 function originUnavailableMessage(origin, behavior) {
 	if (!origin) return `Behavior ${behavior.pathPattern === void 0 ? "(default)" : displayUntrustedValue(behavior.pathPattern)} targets unknown origin ${displayIdent(behavior.targetOriginId)}.\n`;
 	if (origin.kind === "lambda-url") return `Origin ${displayIdent(origin.originId)} is a Lambda Function URL origin whose backing function ${displayIdent(origin.functionLogicalId)} was not booted (it was added after start-up). Restart start-cloudfront.\n`;
-	if (origin.kind === "custom") return `Origin ${displayIdent(origin.originId)} is a custom (non-S3) origin (${displayUntrustedValue(String(origin.domainName))}). cdkl start-cloudfront serves S3 origins and Lambda Function URL origins only.
+	if (origin.kind === "web-function") return `Origin ${displayIdent(origin.originId)} is a Lambda Web Function endpoint origin whose endpoint ${displayIdent(origin.endpointLogicalId)} was not booted (it was added after start-up). Restart start-cloudfront.\n`;
+	if (origin.kind === "custom") return `Origin ${displayIdent(origin.originId)} is a custom (non-S3) origin (${displayUntrustedValue(String(origin.domainName))}). cdkl start-cloudfront serves S3, Lambda Function URL and Lambda Web Function endpoint origins only.
 `;
 	if (origin.kind === "s3-deployed") return `Origin ${displayIdent(origin.originId)} is a deployed-S3 origin (bucket ${displayIdent(origin.bucketName)}) whose reader was not booted (it was promoted after start-up). Restart start-cloudfront.
 `;
@@ -24161,1649 +24674,1706 @@ function idFromArn(arn) {
 }
 
 //#endregion
-//#region src/cli/commands/local-start-cloudfront.ts
-var LocalStartCloudFrontError = class extends CdkLocalError {
-	constructor(message, cause) {
-		super(message, "LOCAL_START_CLOUDFRONT_ERROR", cause);
-	}
-};
-function parseOriginOverrides(values) {
-	const out = /* @__PURE__ */ new Map();
-	for (const raw of values ?? []) {
-		const eq = raw.indexOf("=");
-		if (eq <= 0 || eq === raw.length - 1) throw new LocalStartCloudFrontError(`Invalid --origin '${raw}'. Expected <originId>=<dir> (e.g. MyOrigin=./site).`);
-		out.set(raw.slice(0, eq).trim(), raw.slice(eq + 1).trim());
-	}
-	return out;
+//#region src/local/web-function-service-config.ts
+const WEB_FUNCTION_HTTP_ENDPOINT_ENV = "AWS_LAMBDA_HTTP_ENDPOINT";
+const APPLICATION_MANAGED_AUTH = "ApplicationManaged";
+const HOME_REGION_ENDPOINT = "HomeRegion";
+function readWebFunctionServiceConfig(revision) {
+	const sc = asObject$2(revision.Properties?.["ServiceConfig"]) ?? {};
+	const envRaw = sc["EnvironmentVariables"];
+	const envObj = asObject$2(envRaw);
+	const envKeys = envObj ? Object.keys(envObj) : [];
+	const env = envKeys.length === 1 && (envKeys[0] === "Ref" || envKeys[0].startsWith("Fn::")) ? void 0 : envObj;
+	const logGroup = asObject$2(asObject$2(sc["TelemetryConfig"])?.["LoggingConfig"])?.["LogGroup"];
+	return {
+		environmentVariables: env,
+		environmentUnreadable: envRaw !== void 0 && env === void 0,
+		executionRoleArn: sc["ExecutionRoleArn"],
+		egressNetworkConnectorArn: sc["EgressNetworkConnectorArn"],
+		timeoutSeconds: typeof sc["TimeoutSeconds"] === "number" ? sc["TimeoutSeconds"] : void 0,
+		logGroup: typeof logGroup === "string" && logGroup.length > 0 ? logGroup : void 0
+	};
 }
-function parseKvsFileOverrides(values) {
-	const out = /* @__PURE__ */ new Map();
-	for (const raw of values ?? []) {
-		const eq = raw.indexOf("=");
-		if (eq <= 0 || eq === raw.length - 1) throw new LocalStartCloudFrontError(`Invalid --kvs-file '${raw}'. Expected <key>=<file.json> (e.g. RoutesKvs=./kvs.json).`);
-		out.set(raw.slice(0, eq).trim(), raw.slice(eq + 1).trim());
-	}
-	return out;
+function buildWebFunctionLambdaView(resolved, config, runtime) {
+	return {
+		kind: "zip",
+		stack: resolved.stack,
+		logicalId: resolved.revisionLogicalId,
+		resource: {
+			Type: resolved.revision.Type,
+			Properties: {
+				...config.environmentVariables !== void 0 && { Environment: { Variables: config.environmentVariables } },
+				...config.executionRoleArn !== void 0 && { Role: config.executionRoleArn }
+			},
+			...resolved.revision.Metadata !== void 0 && { Metadata: resolved.revision.Metadata }
+		},
+		memoryMb: 128,
+		timeoutSec: config.timeoutSeconds ?? 0,
+		layers: [],
+		runtime,
+		handler: "",
+		codePath: null,
+		architecture: "arm64"
+	};
 }
-function collectKvsStoreIdentities(template) {
-	const out = [];
-	for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
-		if (resource.Type !== "AWS::CloudFront::KeyValueStore") continue;
-		const cdkPath = readCdkPath(resource) || void 0;
-		const constructPath = cdkPath?.endsWith("/Resource") ? cdkPath.slice(0, -9) : cdkPath;
-		const constructId = constructPath?.split("/").pop();
-		out.push({
-			logicalId,
-			...cdkPath !== void 0 && { cdkPath },
-			...constructPath !== void 0 && { constructPath },
-			...constructId !== void 0 && constructId !== "" && { constructId }
-		});
-	}
-	return out;
+function webFunctionAssumeRole(assumeRole, config) {
+	if (assumeRole === true && isIamRoleArn(config.executionRoleArn)) return config.executionRoleArn;
+	return assumeRole;
 }
-function normalizeKvsFileKeys(kvsFiles, template) {
-	if (kvsFiles.size === 0) return kvsFiles;
-	const stores = collectKvsStoreIdentities(template);
-	const candidates = () => stores.map((s) => s.constructPath ? `${displayIdent(s.logicalId, { listMember: true })} (${displayStackName(s.constructPath)})` : displayIdent(s.logicalId, { listMember: true })).join(", ") || "(none in this distribution)";
-	const out = /* @__PURE__ */ new Map();
-	for (const [key, filePath] of kvsFiles) {
-		const matched = [
-			stores.filter((s) => s.logicalId === key),
-			stores.filter((s) => s.constructPath === key || s.cdkPath === key),
-			stores.filter((s) => s.constructId === key)
-		].find((t) => t.length > 0) ?? [];
-		if (matched.length === 0) throw new LocalStartCloudFrontError(`--kvs-file key '${key}' matched no AWS::CloudFront::KeyValueStore in the distribution. Pass a store's logical id, construct path, or bare construct id. Candidates: ${candidates()}.`);
-		if (matched.length > 1) throw new LocalStartCloudFrontError(`--kvs-file key '${key}' is ambiguous — it matched ${matched.length} KeyValueStores (${matched.map((s) => displayIdent(s.logicalId, { listMember: true })).join(", ")}). Use the logical id or full construct path.`);
-		out.set(matched[0].logicalId, filePath);
+function finalizeWebFunctionEnv(lambdaEnv, opts) {
+	const env = { ...lambdaEnv };
+	delete env["AWS_LAMBDA_FUNCTION_MEMORY_SIZE"];
+	delete env["AWS_LAMBDA_FUNCTION_VERSION"];
+	delete env["AWS_LAMBDA_FUNCTION_TIMEOUT"];
+	env["AWS_LAMBDA_FUNCTION_NAME"] = opts.functionName;
+	env["AWS_LAMBDA_LOG_GROUP_NAME"] = opts.logGroup ?? `/aws/lambda/${opts.functionName}`;
+	if (opts.timeoutSeconds !== void 0) env["AWS_LAMBDA_FUNCTION_TIMEOUT"] = String(opts.timeoutSeconds);
+	const replacedHttpEndpoint = Object.hasOwn(lambdaEnv, WEB_FUNCTION_HTTP_ENDPOINT_ENV);
+	env[WEB_FUNCTION_HTTP_ENDPOINT_ENV] = `0.0.0.0:${opts.containerPort}`;
+	return {
+		env,
+		replacedHttpEndpoint
+	};
+}
+function webFunctionFidelityWarnings(resolved, config) {
+	const out = [];
+	const rev = displayIdent(resolved.revisionLogicalId);
+	if (config.egressNetworkConnectorArn !== void 0) out.push(`Revision ${rev} sets ServiceConfig.EgressNetworkConnectorArn; the network connector is not emulated, so the container reaches the network through Docker's default bridge.`);
+	if (config.environmentUnreadable) out.push(`Revision ${rev} declares ServiceConfig.EnvironmentVariables as an intrinsic rather than a map; none of its variables reach the container. Supply them with --env-vars.`);
+	const endpoint = resolved.endpoint;
+	if (endpoint) {
+		const ep = displayIdent(endpoint.logicalId);
+		if (endpoint.endpointType !== void 0 && endpoint.endpointType !== "HomeRegion") out.push(`Endpoint ${ep} has EndpointType ${displayIdent(endpoint.endpointType)}; only a single ${HOME_REGION_ENDPOINT} endpoint is reproduced, on one local port.`);
+		if (endpoint.authType !== void 0 && endpoint.authType !== "ApplicationManaged") out.push(`Endpoint ${ep} has AuthType ${displayIdent(endpoint.authType)}; it is not enforced locally — every request reaches the server unauthenticated.`);
+		const routed = endpoint.weights.filter((w) => w.weight > 0);
+		if (routed.length > 1) out.push(`Endpoint ${ep} splits traffic across ${routed.length} revisions; weighted routing is not emulated — every request goes to revision ${rev}.`);
 	}
 	return out;
 }
-async function attachKvsModules(distribution, stacks, options, profileCredentials, logger, extraStateProviders) {
-	const stack = stacks.find((s) => s.stackName === distribution.stackName);
-	const synthRegion = stack?.region;
-	const kvsFiles = stack ? normalizeKvsFileKeys(parseKvsFileOverrides(options.kvsFile), stack.template) : parseKvsFileOverrides(options.kvsFile);
-	const resolveDeployedKvs = isStateSourceActive(options, extraStateProviders) ? async (kvsLogicalId) => {
-		const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
-		if (!provider) return void 0;
-		let record;
-		try {
-			record = await provider.load(distribution.stackName, synthRegion);
-		} finally {
-			provider.dispose();
-		}
-		const physicalId = record?.resources[kvsLogicalId]?.physicalId;
-		if (!physicalId) return void 0;
-		if (physicalId.startsWith("arn:")) {
-			const id = idFromArn(physicalId);
-			return {
-				arn: physicalId,
-				...id !== void 0 && { id }
-			};
-		}
-		return resolveDeployedKvsArnByName(physicalId, { ...profileCredentials !== void 0 && { credentials: profileCredentials } });
-	} : void 0;
-	const { warnings } = await resolveKvsModulesForDistribution(distribution, {
-		...kvsFiles.size > 0 && { kvsFiles },
-		...resolveDeployedKvs !== void 0 && { resolveDeployedKvs },
-		...profileCredentials !== void 0 && { credentials: profileCredentials }
-	});
-	for (const warning of warnings) logger.warn(warning);
+function asObject$2(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function resolveCloudFrontTarget(target, stacks) {
-	if (stacks.length === 0) throw new LocalStartCloudFrontError("No stacks found in the synthesized assembly.");
-	const parsed = parseEcsTarget(target);
-	const stack = pickStack$1(parsed, stacks, target);
-	const resources = stack.template.Resources ?? {};
-	if (parsed.isPath) {
-		const index = buildCdkPathIndex(stack.template);
-		const dists = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId }) => {
-			const r = resources[logicalId];
-			return r !== void 0 && r.Type === "AWS::CloudFront::Distribution";
-		});
-		if (dists.length === 0) throw notFound(target, stack, resources);
-		if (dists.length > 1) throw new LocalStartCloudFrontError(`Target '${target}' matches ${dists.length} distributions in ${stack.stackName}: ${dists.map((d) => d.logicalId).join(", ")}. Refine the path or use the stack:LogicalId form.`);
-		return {
-			stack,
-			logicalId: dists[0].logicalId
+
+//#endregion
+//#region src/local/web-function-artifact.ts
+const SUPPORTED_CODE_CONFIG_KEYS = ["S3Object"];
+function parseWebFunctionBuildConfig(revisionLogicalId, buildConfig, template) {
+	const subject = `Web function revision ${displayIdent(revisionLogicalId)}`;
+	const build = asObject$1(buildConfig);
+	const runtime = asObject$1(build?.["RuntimeConfig"])?.["Runtime"];
+	if (typeof runtime !== "string" || runtime.length === 0) throw new CdkLocalError(`${subject} has no literal BuildConfig.RuntimeConfig.Runtime.`, "LOCAL_START_WEB_FUNCTION_NO_RUNTIME");
+	const codeConfig = asObject$1(build?.["CodeConfig"]);
+	if (!codeConfig) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
+	const unknownKeys = Object.keys(codeConfig).filter((k) => !SUPPORTED_CODE_CONFIG_KEYS.includes(k));
+	if (unknownKeys.length > 0) throw new CdkLocalError(`${subject} uses BuildConfig.CodeConfig.${unknownKeys.map((k) => displayIdent(k)).join(", ")}, which ${getEmbedConfig().cliName} start-web-function does not support yet. Supported: ${SUPPORTED_CODE_CONFIG_KEYS.join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_CODE_CONFIG");
+	const s3 = asObject$1(codeConfig["S3Object"]);
+	if (!s3) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig.S3Object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
+	const rawKey = s3["Key"];
+	let key;
+	let deployment;
+	if (typeof rawKey === "string" && rawKey.length > 0) key = rawKey;
+	else {
+		const viaDeployment = template ? resolveBucketDeploymentObjectKey(template, rawKey) : void 0;
+		if (viaDeployment === void 0) throw new CdkLocalError(`${subject} has a CodeConfig.S3Object.Key that is not a literal string (${describeValue$1(rawKey)}). The code must come from a CDK asset in this app: an s3assets.Asset passing asset.s3BucketName / asset.s3ObjectKey, whose key synthesizes as a literal` + (template ? ", or a BucketDeployment with extract: false passing Fn.select(<i>, deployment.objectKeys), which resolves to its i-th source asset." : "."), "LOCAL_START_WEB_FUNCTION_CODE_KEY_NOT_LITERAL");
+		key = bucketDeploymentSourceKey(subject, viaDeployment);
+		deployment = {
+			logicalId: viaDeployment.deploymentLogicalId,
+			index: viaDeployment.index
 		};
 	}
-	const res = resources[parsed.pathOrId];
-	if (!res || res.Type !== "AWS::CloudFront::Distribution") throw notFound(target, stack, resources);
+	const versionId = s3["VersionId"];
 	return {
-		stack,
-		logicalId: parsed.pathOrId
+		runtime,
+		s3Object: {
+			bucket: s3["Bucket"],
+			key,
+			...typeof versionId === "string" && { versionId },
+			...deployment !== void 0 && { deployment }
+		}
 	};
 }
-function pickStack$1(parsed, stacks, target) {
-	const selection = selectTargetStack(parsed, target, stacks);
-	switch (selection.kind) {
-		case "found": return selection.stack;
-		case "no-prefix": throw new LocalStartCloudFrontError(`Target '${target}' has no stack prefix, and the assembly contains ${stacks.length} stacks: ${describeStacks(stacks)}. Pass it as 'Stack/Path' or 'Stack:LogicalId'.`);
-		case "not-found": throw new LocalStartCloudFrontError(`No stack matches '${selection.pattern}'. Available stacks: ${describeStacks(stacks)}.`);
-		case "ambiguous": throw new LocalStartCloudFrontError(`Multiple stacks match '${selection.pattern}': ${describeStacks(selection.matched)}. Refine the pattern, or use the stack's display path (path form).`);
+function bucketDeploymentSourceKey(subject, r) {
+	const named = `CodeConfig.S3Object.Key selects source ${r.index} of BucketDeployment ${displayIdent(r.deploymentLogicalId)}`;
+	switch (r.kind) {
+		case "resolved": return r.sourceObjectKey;
+		case "extracts": throw new CdkLocalError(`${subject} ${named}, which does not set extract to a literal false, so it unpacks its sources and no object in the destination bucket holds that source's zip (Lambda could not read it either). Set extract: false on the BucketDeployment so it copies the zip as-is.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_DEPLOYMENT_EXTRACTS");
+		case "prefixed-destination": throw new CdkLocalError(`${subject} ${named}, which sets a destinationKeyPrefix: the zip lands at <prefix><key> while objectKeys returns <key>, so the selected key names no object (Lambda could not read it either). Remove destinationKeyPrefix from the deployment.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_DEPLOYMENT_SOURCE_UNRESOLVED");
+		case "object-keys-not-output": throw new CdkLocalError(`${subject} ${named}, which sets outputObjectKeys: false, so its SourceObjectKeys attribute is empty and the selection has no value. Remove outputObjectKeys: false.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_DEPLOYMENT_SOURCE_UNRESOLVED");
+		case "index-out-of-range": throw new CdkLocalError(`${subject} ${named}, which has only ${r.sourceCount} source(s).`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_DEPLOYMENT_SOURCE_UNRESOLVED");
+		case "source-key-not-literal": throw new CdkLocalError(`${subject} ${named}, whose SourceObjectKeys entry is not a literal string, so it is not a CDK asset of this app. Deploy the code with s3deploy.Source.asset(...).`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_DEPLOYMENT_SOURCE_UNRESOLVED");
 	}
 }
-function notFound(target, stack, resources) {
-	const dists = Object.entries(resources).filter(([, r]) => r.Type === CLOUDFRONT_DISTRIBUTION_TYPE).map(([logicalId]) => logicalId);
-	const available = dists.length > 0 ? ` Available distributions in ${stack.stackName}: ${dists.join(", ")}.` : ` ${stack.stackName} declares no ${CLOUDFRONT_DISTRIBUTION_TYPE} resources.`;
-	return new LocalStartCloudFrontError(`Target '${target}' did not match a CloudFront distribution in ${stack.stackName}.${available}`);
-}
-async function bootLambdaUrlOrigins(distribution, stacks, opts) {
-	const logger = getLogger();
-	const invokers = /* @__PURE__ */ new Map();
-	const runners = [];
-	const functionLogicalIds = /* @__PURE__ */ new Set();
-	for (const origin of distribution.origins.values()) if (origin.kind === "lambda-url") functionLogicalIds.add(origin.functionLogicalId);
-	for (const functionLogicalId of functionLogicalIds) {
-		let runner;
-		try {
-			const lambda = resolveLambdaTarget(`${distribution.stackName}:${functionLogicalId}`, stacks);
-			const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
-			runner = createFrontDoorLambdaRunner(lambda, {
-				containerHost: opts.containerHost,
-				skipPull: opts.skipPull,
-				...opts.envOptions.region !== void 0 && { region: opts.envOptions.region },
-				containerEnv: containerEnv.env,
-				...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
-			});
-			logger.info(`Booting Lambda Function URL origin container for ${functionLogicalId} (the backing Lambda runs locally via RIE)...`);
-			await runner.start();
-		} catch (err) {
-			await Promise.all(runners.map((r) => r.stop().catch(() => void 0)));
-			throw new LocalStartCloudFrontError(`Failed to boot the Lambda Function URL origin's backing function ${displayIdent(functionLogicalId)}: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
-		}
-		runners.push(runner);
-		invokers.set(functionLogicalId, (event) => runner.invoke(event));
-	}
+async function resolveWebFunctionArtifact(stack, revisionLogicalId, code, loader = new AssetManifestLoader()) {
+	const subject = `Web function revision ${displayUntrustedValue(revisionLogicalId)} code bundle`;
+	const { deployment } = code.s3Object;
+	const keyOrigin = deployment ? ` (source ${deployment.index} of BucketDeployment ${displayIdent(deployment.logicalId)})` : "";
+	const notFound = () => new CdkLocalError(`${subject} (S3Object bucket ${describeValue$1(code.s3Object.bucket)}, key ${displayUntrustedValue(code.s3Object.key)}${keyOrigin}) matches no file asset in this app's cdk.out. ${getEmbedConfig().cliName} start-web-function runs code that comes from a CDK asset in this app (for example an s3assets.Asset of a directory); it does not download deployed code. Re-synthesize the app, or point the revision at an asset.`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NOT_FOUND");
+	const manifestPath = stack.assetManifestPath;
+	if (!manifestPath) throw notFound();
+	const manifestDir = dirname$1(manifestPath);
+	const manifest = await loader.loadStackManifest(stack, manifestDir);
+	const match = manifest ? findFileAssetForObjectKey(manifest, code.s3Object.key) : void 0;
+	if (!match) throw notFound();
+	if (typeof match.asset.source.path !== "string" || match.asset.source.path.length === 0) throw new CdkLocalError(`${subject} matches file asset ${displayIdent(match.hash)}, which has no source.path (it is produced by source.executable at publish time), so there is no staged bundle in cdk.out to mount. Give the revision an asset of a directory or a .zip file (for example s3assets.Asset with path: '<dir>').`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NO_PATH");
+	const sourcePath = resolveAssetSourcePath({
+		manifestDir,
+		value: match.asset.source.path,
+		assetOutdir: assetPathDirs(stack).assetOutdir,
+		absolute: "honour-warn",
+		field: "source.path",
+		subject,
+		action: "mount it",
+		sink: "bind-mount that directory into the web function container",
+		wrapError: (message) => new CdkLocalError(message, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	});
+	if (!existsSync$1(sourcePath)) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} does not exist. Re-synthesize the app and retry.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_MISSING");
+	if (!statSync$1(sourcePath).isDirectory() && !sourcePath.endsWith(".zip")) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} is neither a directory nor a .zip archive, so it is not a code bundle.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_NOT_BUNDLE");
+	const materialized = materializeAssetCodeDir(sourcePath);
 	return {
-		invokers,
-		runners
+		kind: "zip",
+		runtime: code.runtime,
+		codeDir: materialized.dir,
+		...materialized.tmpDir !== void 0 && { tmpDir: materialized.tmpDir },
+		assetHash: match.hash
 	};
 }
-async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
-	const logger = getLogger();
-	const invokers = /* @__PURE__ */ new Map();
-	const runners = [];
-	const functionLogicalIds = /* @__PURE__ */ new Set();
-	for (const behavior of distribution.behaviors) {
-		const edge = behavior.lambdaEdge;
-		if (!edge) continue;
-		for (const assoc of [
-			edge.viewerRequest,
-			edge.originRequest,
-			edge.originResponse,
-			edge.viewerResponse
-		]) if (assoc) functionLogicalIds.add(assoc.functionLogicalId);
-	}
-	for (const functionLogicalId of functionLogicalIds) try {
-		const lambda = resolveLambdaTarget(`${distribution.stackName}:${functionLogicalId}`, stacks);
-		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
-		const runner = createFrontDoorLambdaRunner(lambda, {
-			containerHost: opts.containerHost,
-			skipPull: opts.skipPull,
-			...opts.envOptions.region !== void 0 && { region: opts.envOptions.region },
-			containerEnv: containerEnv.env,
-			...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
+function disposeWebFunctionArtifact(artifact) {
+	if (artifact?.kind !== "zip" || artifact.tmpDir === void 0) return;
+	try {
+		if (existsSync$1(artifact.tmpDir)) rmSync$1(artifact.tmpDir, {
+			recursive: true,
+			force: true
 		});
-		logger.info(`Booting Lambda@Edge container for ${functionLogicalId} (the function runs locally via RIE)...`);
-		await runner.start();
-		runners.push(runner);
-		invokers.set(functionLogicalId, (event) => runner.invoke(event));
-	} catch (err) {
-		logger.warn(`Could not boot Lambda@Edge function ${displayIdent(functionLogicalId)}; its stage will be skipped: ${err instanceof Error ? err.message : String(err)}`);
+	} catch {}
+}
+function asObject$1(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function describeValue$1(value) {
+	if (typeof value === "string") return displayUntrustedValue(value);
+	let json;
+	try {
+		json = JSON.stringify(value);
+	} catch {
+		json = void 0;
 	}
-	return {
-		invokers,
-		runners
-	};
+	return displayUntrustedValue(json ?? String(value));
 }
-function buildLambdaEnvOptions(options, extraStateProviders) {
+
+//#endregion
+//#region src/local/web-function-runtime.ts
+const NODE_CODE_MOUNT = "/var/task";
+const NODE_ENTRYPOINT_ENV = "AWS_LAMBDA_NODEJS_ENTRYPOINT";
+const NODE_DEFAULT_ENTRY = "index.js";
+function buildNodeEntryFileStart(runtime, env, codeDir, fileExists = existsSync$1) {
+	const configured = env[NODE_ENTRYPOINT_ENV];
+	const entryFile = configured !== void 0 && configured.length > 0 ? configured : NODE_DEFAULT_ENTRY;
+	const hostPath = resolve$1(codeDir, entryFile);
+	const rel = relative$1(codeDir, hostPath);
+	if (isAbsolute$1(entryFile) || rel === "" || rel === ".." || rel.startsWith(`..${sep$1}`) || isAbsolute$1(rel)) throw new CdkLocalError(`${NODE_ENTRYPOINT_ENV}=${displayUntrustedValue(entryFile)} must name a file inside the code bundle, relative to its root.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_OUTSIDE_BUNDLE");
+	if (!fileExists(hostPath)) throw new CdkLocalError(`The ${runtime} web function entry file ${displayUntrustedValue(entryFile)} was not found in the code bundle ${displayUntrustedValue(codeDir)}. The runtime loads ${NODE_DEFAULT_ENTRY} from the package root unless ${NODE_ENTRYPOINT_ENV} names another file.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_MISSING");
+	const posixRel = sep$1 === "\\" ? rel.split("\\").join("/") : rel;
 	return {
-		...hostStateSourceFields(options, extraStateProviders),
-		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
-		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
-		...options.region !== void 0 && { region: options.region },
-		...options.profile !== void 0 && { profile: options.profile },
-		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
+		entryPoint: ["/var/lang/bin/node"],
+		cmd: [posix.join(NODE_CODE_MOUNT, posixRel)],
+		label: entryFile
 	};
 }
-function buildLambdaBootOptions(options, profileCredentials, extraStateProviders) {
-	return {
-		containerHost: options.host,
-		skipPull: options.pull === false,
-		envOptions: buildLambdaEnvOptions(options, extraStateProviders),
-		...profileCredentials !== void 0 && { profileCredentials },
-		...extraStateProviders !== void 0 && { extraStateProviders }
-	};
+const WEB_FUNCTION_RUNTIMES = { "nodejs24.x": {
+	runtime: "nodejs24.x",
+	baseImage: "public.ecr.aws/lambda/nodejs:24",
+	codeMountPath: NODE_CODE_MOUNT,
+	architectures: ["arm64"],
+	buildStart: (env, codeDir, deps) => buildNodeEntryFileStart("nodejs24.x", env, codeDir, deps?.fileExists)
+} };
+function supportedWebFunctionRuntimes(table = WEB_FUNCTION_RUNTIMES) {
+	return Object.keys(table).sort();
 }
-function warnUnsupported(distribution, extraStateProviders) {
-	const logger = getLogger();
-	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin ${displayIdent(origin.originId)} is a custom (non-S3, non-Lambda-Function-URL) origin (${displayUntrustedValue(String(origin.domainName))}); ${getEmbedConfig().cliName} start-cloudfront serves S3 origins and Lambda Function URL origins only. Requests routed to it return 502.`);
-	else if (origin.kind === "s3-unresolved") logger.warn(`Origin ${displayIdent(origin.originId)} is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass ${stateSourceFlagNames(extraStateProviders).join(" or ")} to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
+function resolveWebFunctionRuntime(runtime, table = WEB_FUNCTION_RUNTIMES) {
+	const spec = Object.hasOwn(table, runtime) ? table[runtime] : void 0;
+	if (!spec) throw new CdkLocalError(`Web function runtime ${displayIdent(runtime)} is not supported by ${getEmbedConfig().cliName} start-web-function yet. Supported: ${supportedWebFunctionRuntimes(table).join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_RUNTIME");
+	return spec;
 }
-function warnUnusedCacheOrigin(options, extraStateProviders) {
-	if (options.cacheOrigin === true && !isStateSourceActive(options, extraStateProviders)) {
-		const flags = stateSourceFlagNames(extraStateProviders).join(" or ");
-		getLogger().warn(`--cache-origin has no effect without ${flags}: it caches a deployed-S3 read-through origin, which is only built under a state source. A local BucketDeployment / --origin <id>=<dir> origin serves from disk and is not cached. Pass ${flags} to enable the deployed-S3 origin (then --cache-origin applies), or drop --cache-origin.`);
-	}
+function defaultWebFunctionPlatform(spec) {
+	return spec.architectures[0] === "x86_64" ? "linux/amd64" : "linux/arm64";
 }
-async function resolveDeployedS3Origins(distribution, stacks, options, profileCredentials, logger, extraStateProviders) {
-	const readers = /* @__PURE__ */ new Map();
-	const buckets = /* @__PURE__ */ new Map();
-	const stateFlag = activeStateSourceFlag(options, extraStateProviders);
-	if (stateFlag === void 0) return {
-		readers,
-		buckets
-	};
-	const synthRegion = stacks.find((s) => s.stackName === distribution.stackName)?.region;
-	const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
-	let record;
-	try {
-		record = provider ? await provider.load(distribution.stackName, synthRegion) : void 0;
-	} finally {
-		provider?.dispose();
-	}
-	const region = options.stackRegion ?? options.region ?? synthRegion ?? record?.region;
-	const distributionId = record?.resources[distribution.logicalId]?.physicalId;
-	for (const origin of [...distribution.origins.values()]) {
-		if (origin.kind !== "s3-unresolved") continue;
-		let bucketName;
-		let via;
-		if (origin.bucketLogicalId !== void 0) {
-			bucketName = record?.resources[origin.bucketLogicalId]?.physicalId;
-			via = "deployed state";
-		} else if (origin.bucketName !== void 0) {
-			bucketName = origin.bucketName;
-			via = "the origin's DomainName";
-		} else if (origin.deployedConfigOnly && distributionId) {
-			bucketName = await resolveDeployedOriginBucket({
-				distributionId,
-				originId: origin.originId,
-				...profileCredentials !== void 0 && { credentials: profileCredentials }
-			});
-			via = "GetDistributionConfig";
-		} else continue;
-		if (!bucketName) continue;
-		readers.set(origin.originId, createS3OriginReader(bucketName, {
-			...region !== void 0 && { region },
-			...profileCredentials !== void 0 && { credentials: profileCredentials },
-			...options.cacheOrigin === true && { cache: true }
-		}));
-		buckets.set(origin.originId, bucketName);
-		distribution.origins.set(origin.originId, {
-			kind: "s3-deployed",
-			originId: origin.originId,
-			bucketName
-		});
-		logger.info(`Origin ${displayIdent(origin.originId)}: no local BucketDeployment source; serving from deployed S3 (bucket=${bucketName}, resolved via ${via}) on demand under ${stateFlag}.`);
-	}
+
+//#endregion
+//#region src/local/web-function-runner.ts
+const execFileAsync$1 = promisify$1(execFile$1);
+const WEB_FUNCTION_CONTAINER_PORT = 8080;
+const READY_FAILURE_LOG_LINES = 20;
+const MAX_PROBE_TIMEOUT_MS = 1e4;
+function planWebFunctionContainer(artifact, spec, env, deps) {
+	if (artifact.kind !== "zip") throw new CdkLocalError("A container-image web function source is not supported yet; only a zip bundle from CodeConfig.S3Object runs locally.", "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_ARTIFACT");
+	const start = spec.buildStart(env, artifact.codeDir, deps);
 	return {
-		readers,
-		buckets
+		image: spec.baseImage,
+		mounts: [{
+			hostPath: artifact.codeDir,
+			containerPath: spec.codeMountPath,
+			readOnly: true
+		}],
+		entryPoint: start.entryPoint,
+		cmd: start.cmd,
+		workingDir: spec.codeMountPath,
+		label: start.label
 	};
 }
-function annotateDeployedS3Origins(distribution, buckets) {
-	for (const [originId, bucketName] of buckets) {
-		const origin = distribution.origins.get(originId);
-		if (origin && origin.kind === "s3-unresolved") distribution.origins.set(originId, {
-			kind: "s3-deployed",
-			originId,
-			bucketName
-		});
-	}
-}
-async function localStartCloudFrontCommand(target, options, extraStateProviders, hostSynthesizer) {
-	const logger = getLogger();
-	if (options.verbose) logger.setLevel("debug");
-	const originOverrides = parseOriginOverrides(options.origin);
-	const tlsRequested = options.tls === true || options.tlsCert !== void 0 || options.tlsKey !== void 0;
-	await applyRoleArnIfSet({
-		roleArn: options.roleArn,
-		region: options.region,
-		profile: options.profile
+async function startWebFunctionContainer(opts) {
+	const { plan } = opts;
+	return runDetached({
+		image: plan.image,
+		mounts: plan.mounts,
+		env: opts.env,
+		...opts.sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys: opts.sensitiveEnvKeys },
+		entryPoint: plan.entryPoint,
+		cmd: plan.cmd,
+		...plan.workingDir !== void 0 && { workingDir: plan.workingDir },
+		hostPort: opts.hostPort,
+		containerPort: WEB_FUNCTION_CONTAINER_PORT,
+		host: opts.host,
+		platform: opts.platform,
+		name: opts.name,
+		autoRemove: false
 	});
-	const appCmd = resolveApp(options.app);
-	if (!appCmd) throw new LocalStartCloudFrontError(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
-	const basePort = parseInt(options.port, 10);
-	if (!Number.isFinite(basePort) || basePort < 0 || basePort > 65535) throw new LocalStartCloudFrontError(`--port must be 0..65535 (got ${options.port}).`);
-	const synthAndResolve = async () => {
-		logger.info("Synthesizing CDK app...");
-		const synthesizer = hostSynthesizer ?? new Synthesizer();
-		const context = parseContextOptions(options.context);
-		const synthOpts = {
-			app: appCmd,
-			output: options.output,
-			...options.region && { region: options.region },
-			...options.profile && { profile: options.profile },
-			...Object.keys(context).length > 0 && { context }
-		};
-		const { stacks } = await synthesizer.synthesize(synthOpts);
-		const chosen = await resolveSingleTarget(target, {
-			entries: listTargets(stacks).cloudFrontDistributions,
-			message: "Select a CloudFront distribution to serve",
-			noun: "CloudFront distributions",
-			onMissing: () => new LocalStartCloudFrontError(`${getEmbedConfig().cliName} start-cloudfront requires a <target>. Pass a distribution path like 'Stack/MyDist', or run it in a TTY to pick interactively.`)
-		});
-		target = chosen;
-		const { stack, logicalId } = resolveCloudFrontTarget(chosen, stacks);
-		return {
-			distribution: resolveCloudFrontDistribution({
-				stack,
-				logicalId,
-				originOverrides
-			}),
-			stacks
-		};
-	};
-	const initial = await synthAndResolve();
-	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
-	const deployedS3 = await resolveDeployedS3Origins(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
-	warnUnsupported(initial.distribution, extraStateProviders);
-	warnUnusedCacheOrigin(options, extraStateProviders);
-	await attachKvsModules(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
-	const bootOpts = buildLambdaBootOptions(options, profileCredentials, extraStateProviders);
-	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, bootOpts);
-	const { invokers: edgeInvokers, runners: edgeRunners } = await bootLambdaEdgeFunctions(initial.distribution, initial.stacks, bootOpts);
-	let server;
-	try {
-		let tls;
-		if (tlsRequested) tls = await resolveFrontDoorTlsMaterials({
-			certPath: options.tlsCert,
-			keyPath: options.tlsKey
-		});
-		server = await startCloudFrontServer({
-			distribution: initial.distribution,
-			host: options.host,
-			port: basePort,
-			...tls && { tls },
-			...lambdaInvokers.size > 0 && { lambdaInvokers },
-			...edgeInvokers.size > 0 && { edgeInvokers },
-			...deployedS3.readers.size > 0 && { s3OriginReaders: deployedS3.readers }
-		});
-	} catch (err) {
-		await Promise.all([...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch(() => void 0)));
-		throw err;
+}
+var RecentOutput = class {
+	lines = [];
+	partial = "";
+	max;
+	constructor(max = 20) {
+		this.max = max;
 	}
-	process.stdout.write(`CloudFront distribution serving on ${server.url}  (${displayIdent(initial.distribution.logicalId)})\n`);
-	process.stdout.write("^C to stop.\n");
-	let watcher;
-	let reloadChain = Promise.resolve();
-	if (options.watch) {
-		const watchRoot = process.cwd();
-		const { ignored, shouldTrigger, excludePatterns } = createWatchPredicates({
-			watchRoot,
-			output: options.output,
-			watchConfig: resolveWatchConfig()
-		});
-		watcher = createFileWatcher({
-			paths: [watchRoot],
-			ignored,
-			shouldTrigger,
-			onChange: () => {
-				logger.info("Detected source change; reloading...");
-				reloadChain = reloadChain.then(async () => {
-					try {
-						const reloaded = await synthAndResolve();
-						annotateDeployedS3Origins(reloaded.distribution, deployedS3.buckets);
-						for (const reader of deployedS3.readers.values()) reader.clearCache();
-						warnUnsupported(reloaded.distribution, extraStateProviders);
-						await attachKvsModules(reloaded.distribution, reloaded.stacks, options, profileCredentials, logger, extraStateProviders);
-						server.update(reloaded.distribution);
-						logger.info("Reload complete.");
-					} catch (err) {
-						logger.warn(`Reload failed; keeping the previous version serving: ${err instanceof Error ? err.message : String(err)}`);
-					}
-				}).catch(() => void 0);
-			}
-		});
-		logger.info(`Watching ${watchRoot} for source changes (excluding ${excludePatterns.join(", ")}).`);
+	push(chunk) {
+		const parts = (this.partial + chunk.toString()).split("\n");
+		this.partial = parts.pop() ?? "";
+		for (const line of parts) this.add(line);
+		if (this.partial.length > 4096) {
+			this.add(this.partial);
+			this.partial = "";
+		}
 	}
-	let shuttingDown = false;
-	const shutdown = async (signal, exitCode) => {
-		if (shuttingDown) return;
-		shuttingDown = true;
-		logger.info(`Received ${signal}, shutting down...`);
-		if (watcher) try {
-			await watcher.close();
-		} catch {}
-		try {
-			await server.close();
-		} catch {}
-		await Promise.all([...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch((err) => {
-			logger.debug(`Lambda runner stop failed: ${err instanceof Error ? err.message : String(err)}`);
-		})));
-		await Promise.all([...deployedS3.readers.values()].map((reader) => reader.close()));
-		process.exit(exitCode);
-	};
-	process.on("SIGINT", () => void shutdown("SIGINT", 130));
-	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
-	await new Promise(() => void 0);
-}
-function createLocalStartCloudFrontCommand(opts = {}) {
-	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("start-cloudfront").description("Run a long-running local server that serves a CloudFront distribution: its S3 origin content (resolved from the BucketDeployment source in the cloud assembly) and its Lambda Function URL origins (the backing Lambda is run locally via RIE), plus its viewer-request / viewer-response CloudFront Functions, reproducing the distribution routing locally so a rewrite / routing change is verifiable in seconds. Serves S3 and Lambda Function URL origins, and runs Lambda@Edge functions in local RIE containers. Both Lambda kinds need Docker: a Function URL origin that fails to boot stops start-up, while a Lambda@Edge function that fails to boot is warn-and-skipped (its stage does not run). Other custom origins are not run (warn-and-skip; requests routed to one return 502). Tip: omit the target in a terminal to pick interactively.").argument("[target]", "CloudFront distribution to serve. Accepts the CDK Construct path ('MyStack/MyDist'), an ancestor prefix, or the stack-qualified logical id ('MyStack:MyDist'). When omitted in a TTY, an interactive picker opens.").action(withErrorHandling(async (target, options) => {
-		await localStartCloudFrontCommand(target, options, opts.extraStateProviders, opts.synthesizer);
-	}));
-	addStartCloudFrontSpecificOptions(cmd);
-	[
-		...commonOptions(),
-		...appOptions(),
-		...contextOptions
-	].forEach((opt) => cmd.addOption(opt));
-	cmd.addOption(regionOption);
-	return cmd;
+	tail() {
+		return this.partial.length > 0 ? [...this.lines, this.partial].slice(-this.max) : this.lines;
+	}
+	add(line) {
+		this.lines.push(line.replace(/\r$/, ""));
+		if (this.lines.length > this.max) this.lines.shift();
+	}
+};
+async function waitForWebFunctionReady(args, deps = defaultReadyDeps) {
+	const deadline = deps.now() + args.timeoutMs;
+	let attempt = 0;
+	let last = "refused";
+	while (deps.now() < deadline) {
+		const remaining = Math.max(1, deadline - deps.now());
+		last = await deps.probe(args.host, args.port, Math.min(remaining, MAX_PROBE_TIMEOUT_MS));
+		if (last === "answered") return;
+		attempt++;
+		if (attempt % 4 === 0 && !await deps.isRunning(args.containerId)) throw await containerFailure(`The web function container exited before its server listened on AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
+		if (last === "refused") await deps.sleep(250);
+	}
+	const authority = formatAuthority(args.host, args.port);
+	throw await containerFailure(last === "timeout" ? `The web function server on ${authority} accepted the connection but did not answer GET / within ${args.timeoutMs}ms — it is listening but slow to respond. Raise --timeout, or make / answer sooner (started ${args.label}).` : `The web function server never accepted an HTTP connection on ${authority} within ${args.timeoutMs}ms. It must listen on the host:port given in AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
 }
-function addStartCloudFrontSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <key=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is a KeyValueStore handle — its AWS::CloudFront::KeyValueStore resource logical id, its construct path, or its bare construct id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind to a deployed CloudFormation stack (ListStackResources). Resolves an S3 origin that has no local BucketDeployment source to its deployed bucket and serves it from real S3 on demand (the front/back-split case: files uploaded out of band), and resolves a Lambda Function URL / Lambda@Edge function's env vars to the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs.")).addOption(new Option("--cache-origin", "For a deployed-S3 origin (served from real S3 under --from-cfn-stack): keep fetched objects in memory for the session instead of re-reading on every request. Faster repeat reads / fewer S3 GETs, but an out-of-band S3 content change is not reflected until a --watch reload (which clears the cache) or a restart. Off by default (every request re-reads, always current). Not CloudFront CDN caching.").default(false)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's deployed execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
+async function containerFailure(message, containerId, recent, fetchLogs = readContainerLogTail, code = "LOCAL_START_WEB_FUNCTION_NOT_READY") {
+	let lines = [];
+	try {
+		lines = await fetchLogs(containerId, 20);
+	} catch {
+		lines = [];
+	}
+	if (lines.length === 0) lines = recent.tail();
+	return new CdkLocalError(`${message}${lines.length > 0 ? ` Last ${lines.length} line(s) of container output:\n${lines.map((l) => `  ${displayToolOutput(l)}`).join("\n")}` : " The container printed nothing."}`, code);
 }
-
-//#endregion
-//#region src/local/agentcore-ws-bridge.ts
-const DEFAULT_PATH = "/ws";
-function decodeBrowserFrame(data, isBinary) {
-	if (typeof data === "string") return data;
-	return (Buffer.isBuffer(data) ? data : Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data)).toString("utf-8");
+function watchContainerExit(containerId) {
+	let stopped = false;
+	const proc = spawn$1(getDockerCmd(), ["wait", containerId], { stdio: [
+		"ignore",
+		"pipe",
+		"ignore"
+	] });
+	let out = "";
+	proc.stdout?.on("data", (c) => out += c.toString());
+	return {
+		exited: new Promise((resolveExit) => {
+			const done = () => {
+				if (stopped) return;
+				const code = Number.parseInt(out.trim(), 10);
+				resolveExit(Number.isNaN(code) ? void 0 : code);
+			};
+			proc.on("close", done);
+			proc.on("error", done);
+		}),
+		stop: () => {
+			stopped = true;
+			if (!proc.killed) proc.kill("SIGTERM");
+		}
+	};
 }
-function attachAgentCoreWsBridge(httpServer, config) {
-	const path = config.path ?? DEFAULT_PATH;
-	const wss = new WebSocketServer({
-		server: httpServer,
-		path
-	});
-	const liveCloses = /* @__PURE__ */ new Set();
-	wss.on("connection", (browser) => {
-		const sessionId = config.sessionId ?? randomUUID();
-		const containerPort = typeof config.containerPort === "function" ? config.containerPort() : config.containerPort;
-		const handle = bridgeAgentCoreWs(config.containerHost, containerPort, {
-			sessionId,
-			...config.authorization && { authorization: config.authorization },
-			...config.webSocketImpl && { webSocketImpl: config.webSocketImpl },
-			onMessage: (text) => {
-				if (browser.readyState === browser.OPEN) browser.send(text);
-			},
-			onClose: () => {
-				try {
-					browser.close();
-				} catch {}
-			},
-			onError: (err) => {
-				if (browser.readyState === browser.OPEN) try {
-					browser.send(`[bridge error] ${err.message}`);
-				} catch {}
-				try {
-					browser.close();
-				} catch {}
-			}
-		});
-		liveCloses.add(handle.close);
-		browser.on("message", (data, isBinary) => {
-			handle.send(decodeBrowserFrame(data, isBinary));
-		});
-		browser.on("close", () => {
-			liveCloses.delete(handle.close);
-			handle.close();
-		});
-		browser.on("error", () => {
-			liveCloses.delete(handle.close);
-			handle.close();
-		});
-	});
-	return {
-		path,
-		close: () => new Promise((res) => {
-			for (const closeLeg of liveCloses) closeLeg();
-			liveCloses.clear();
-			wss.close(() => res());
-		})
-	};
-}
-function startAgentCoreWsBridge(config) {
-	const host = config.host ?? "127.0.0.1";
-	const httpServer = createServer((_req, res) => {
-		res.writeHead(426, { "Content-Type": "text/plain" });
-		res.end("Upgrade required: connect over WebSocket.\n");
-	});
-	const attached = attachAgentCoreWsBridge(httpServer, config);
-	return new Promise((resolve, reject) => {
-		httpServer.once("error", reject);
-		httpServer.listen(config.port ?? 0, host, () => {
-			httpServer.removeListener("error", reject);
-			httpServer.on("error", (err) => getLogger().debug(`agentcore-ws bridge server error: ${err.message}`));
-			const port = httpServer.address().port;
-			resolve({
-				url: `ws://${formatAuthority(host, port)}${attached.path}`,
-				port,
-				close: () => new Promise((res) => {
-					attached.close().then(() => httpServer.close(() => res()));
-				})
-			});
-		});
-	});
-}
-
-//#endregion
-//#region src/local/agentcore-http-server.ts
-const DEFAULT_ROUTES = [{
-	method: "POST",
-	path: "/invocations"
-}, {
-	method: "GET",
-	path: "/ping"
-}];
-function wireUpstreamResponse(upstream, clientRes) {
-	upstream.on("response", (upRes) => {
-		clientRes.writeHead(upRes.statusCode ?? 502, upRes.headers);
-		upRes.on("error", () => clientRes.destroy());
-		upRes.pipe(clientRes);
-	});
-	upstream.on("error", (err) => {
-		getLogger().debug(`agentcore http serve upstream error: ${err.message}`);
-		if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
-		clientRes.end(JSON.stringify({ error: `upstream error: ${err.message}` }));
-	});
-}
-function proxyToContainer(clientReq, clientRes, config, upstreamPath, perRequest) {
-	const sessionId = config.sessionId ?? randomUUID();
-	const headers = { ...clientReq.headers };
-	delete headers["host"];
-	headers[AGENTCORE_SESSION_ID_HEADER] = sessionId;
-	const authorization = perRequest?.authorization ?? config.authorization;
-	if (authorization) headers["authorization"] = authorization;
-	if (config.signRequest && clientReq.method === "POST") {
-		const signRequest = config.signRequest;
-		const chunks = [];
-		clientReq.on("data", (c) => chunks.push(c));
-		clientReq.on("error", (err) => {
-			getLogger().debug(`agentcore http serve client error: ${err.message}`);
-			if (!clientRes.headersSent) {
-				clientRes.writeHead(400, { "content-type": "application/json" });
-				clientRes.end(JSON.stringify({ error: `client error: ${err.message}` }));
-			}
-		});
-		clientReq.on("end", () => {
-			const body = Buffer.concat(chunks);
-			signRequest({
-				method: "POST",
-				path: upstreamPath,
-				body,
-				sessionId
-			}).then((signed) => {
-				const signedHeaders = {
-					...headers,
-					...signed
-				};
-				delete signedHeaders["transfer-encoding"];
-				signedHeaders["content-length"] = String(body.length);
-				const upstream = request({
-					host: config.containerHost,
-					port: config.containerPort,
-					path: upstreamPath,
-					method: "POST",
-					headers: signedHeaders
-				});
-				wireUpstreamResponse(upstream, clientRes);
-				upstream.end(body);
-			}).catch((err) => {
-				const msg = err instanceof Error ? err.message : String(err);
-				getLogger().debug(`agentcore http serve sigv4 sign error: ${msg}`);
-				if (!clientRes.headersSent) {
-					clientRes.writeHead(500, { "content-type": "application/json" });
-					clientRes.end(JSON.stringify({ error: `sigv4 signing failed: ${msg}` }));
-				}
-			});
-		});
-		return;
-	}
-	const upstream = request({
-		host: config.containerHost,
-		port: config.containerPort,
-		path: upstreamPath,
-		method: clientReq.method,
-		headers
-	});
-	wireUpstreamResponse(upstream, clientRes);
-	clientReq.on("error", (err) => {
-		getLogger().debug(`agentcore http serve client error: ${err.message}`);
-		upstream.destroy();
-	});
-	clientReq.pipe(upstream);
-}
-function startAgentCoreHttpServer(config) {
-	const host = config.host ?? "127.0.0.1";
-	const routes = config.routes ?? DEFAULT_ROUTES;
-	const attachWs = config.attachWs ?? true;
-	const notFoundHint = buildNotFoundHint(routes, attachWs);
-	const httpServer = createServer((req, res) => {
-		const path = (req.url ?? "/").split("?")[0];
-		const match = routes.find((r) => r.method === req.method && r.path === path);
-		if (!match) {
-			res.writeHead(404, { "content-type": "application/json" });
-			res.end(JSON.stringify({
-				error: "not found",
-				hint: notFoundHint
-			}));
-			return;
-		}
-		if (config.authCheck && req.method === "POST") {
-			req.on("error", (err) => getLogger().debug(`agentcore http serve client error (auth gate): ${err.message}`));
-			config.authCheck(req.headers).then((result) => {
-				if (!result.allow) {
-					req.resume();
-					res.writeHead(result.status ?? 403, { "content-type": "application/json" });
-					res.end(JSON.stringify({ error: result.message ?? "forbidden" }));
-					return;
-				}
-				proxyToContainer(req, res, config, match.path, { ...result.authorization && { authorization: result.authorization } });
-			}).catch((err) => {
-				const msg = err instanceof Error ? err.message : String(err);
-				getLogger().debug(`agentcore http serve auth-check error: ${msg}`);
-				req.resume();
-				if (!res.headersSent) {
-					res.writeHead(500, { "content-type": "application/json" });
-					res.end(JSON.stringify({ error: `auth check failed: ${msg}` }));
-				}
-			});
-			return;
-		}
-		proxyToContainer(req, res, config, match.path);
-	});
-	const bridge = attachWs ? attachAgentCoreWsBridge(httpServer, {
-		containerHost: config.containerHost,
-		containerPort: () => config.containerPort,
-		...config.sessionId && { sessionId: config.sessionId },
-		...config.authorization && { authorization: config.authorization }
-	}) : void 0;
-	return new Promise((resolve, reject) => {
-		httpServer.once("error", reject);
-		httpServer.listen(config.port ?? 0, host, () => {
-			httpServer.removeListener("error", reject);
-			httpServer.on("error", (err) => getLogger().debug(`agentcore http serve server error: ${err.message}`));
-			const port = httpServer.address().port;
-			resolve({
-				httpUrl: `http://${formatAuthority(host, port)}`,
-				...bridge && { wsUrl: `ws://${formatAuthority(host, port)}${bridge.path}` },
-				port,
-				setContainerPort: (newPort) => {
-					config.containerPort = newPort;
-				},
-				close: () => new Promise((res) => {
-					if (bridge) bridge.close().then(() => httpServer.close(() => res()));
-					else httpServer.close(() => res());
-				})
-			});
-		});
-	});
-}
-function buildNotFoundHint(routes, attachWs) {
-	const base = routes.map((r) => `${r.method} ${r.path}`).join(" or ");
-	return attachWs ? `${base} (WebSocket: connect to /ws)` : base;
-}
-
-//#endregion
-//#region src/local/agentcore-serve-auth.ts
-function buildAgentCoreServeAuthCheck(authorizer, opts = {}) {
-	const injectedBearer = opts.bearerToken ? `Bearer ${opts.bearerToken}` : void 0;
-	if (opts.noVerifyAuth === true) return async () => ({
-		allow: true,
-		...injectedBearer && { authorization: injectedBearer }
-	});
-	const jwksCache = opts.jwksCache ?? createJwksCache();
-	const warnedAt = opts.warnedAt ?? /* @__PURE__ */ new Map();
-	return async (headers) => {
-		const header = readAuthorizationHeader(headers) ?? injectedBearer;
-		if (!header) return {
-			allow: false,
-			status: 401,
-			message: "Missing Authorization: this runtime declares a customJwtAuthorizer. Send a Bearer JWT, or start the serve with --bearer-token / --no-verify-auth."
-		};
-		if (!(await verifyJwtViaDiscovery({
-			discoveryUrl: authorizer.discoveryUrl,
-			...authorizer.allowedAudience && { allowedAudience: authorizer.allowedAudience },
-			...authorizer.allowedClients && { allowedClients: authorizer.allowedClients },
-			...authorizer.allowedScopes && { allowedScopes: authorizer.allowedScopes },
-			...authorizer.customClaims && { customClaims: authorizer.customClaims }
-		}, header, jwksCache, { warnedAt })).allow) return {
-			allow: false,
-			status: 403,
-			message: `Forbidden: the inbound JWT was rejected by the runtime's customJwtAuthorizer (signature / issuer / expiry / audience / scope check failed against ${authorizer.discoveryUrl}).`
-		};
-		return {
-			allow: true,
-			authorization: header
-		};
-	};
-}
-function selectServeInboundAuth(resolved, options, sigv4Active, buildAuthCheck = buildAgentCoreServeAuthCheck) {
-	const bearerHeader = options.bearerToken ? `Bearer ${options.bearerToken}` : void 0;
-	if (resolved.jwtAuthorizer) return {
-		authCheck: buildAuthCheck(resolved.jwtAuthorizer, {
-			...options.verifyAuth === false && { noVerifyAuth: true },
-			...options.bearerToken && { bearerToken: options.bearerToken }
-		}),
-		...bearerHeader && { bridgeAuthorization: bearerHeader },
-		sign: false
-	};
-	if (sigv4Active) return { sign: true };
-	return {
-		...bearerHeader && { bridgeAuthorization: bearerHeader },
-		sign: false
-	};
-}
-function readAuthorizationHeader(headers) {
-	const raw = headers["authorization"];
-	const v = Array.isArray(raw) ? raw[0] : raw;
-	return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-
-//#endregion
-//#region src/cli/commands/local-start-agentcore.ts
-function parsePort$2(raw) {
-	const n = Number(raw);
-	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
-	return n;
-}
-function resolveAgentCoreServePlan(protocol) {
-	if (protocol === "MCP") return {
-		containerPort: MCP_CONTAINER_PORT,
-		containerPortLabel: `${MCP_CONTAINER_PORT}${MCP_PATH}`,
-		routes: [{
-			method: "POST",
-			path: MCP_PATH
-		}],
-		attachWs: false,
-		readyPath: MCP_PATH
-	};
-	if (protocol === "A2A") return {
-		containerPort: A2A_CONTAINER_PORT,
-		containerPortLabel: `${A2A_CONTAINER_PORT}${"/"}`,
-		routes: [{
-			method: "POST",
-			path: "/"
-		}],
-		attachWs: false,
-		readyPath: "/"
-	};
-	return {
-		containerPort: void 0,
-		containerPortLabel: "8080",
-		routes: [{
-			method: "POST",
-			path: "/invocations"
-		}, {
-			method: "GET",
-			path: "/ping"
-		}],
-		attachWs: true,
-		readyPath: void 0
-	};
-}
-async function localStartAgentCoreCommand(target, options, extraStateProviders, hostSynthesizer) {
-	const logger = getLogger();
-	if (options.verbose) logger.setLevel("debug");
-	let containerId;
-	let stopLogs;
-	let server;
-	let profileCredsFile;
-	let stateProvider;
-	let watcher;
-	let reloadChain = Promise.resolve();
-	let shuttingDown = false;
-	let tornDown = false;
-	const teardown = async () => {
-		if (tornDown) return;
-		tornDown = true;
-		if (watcher) try {
-			await watcher.close();
-		} catch (err) {
-			logger.debug(`watcher close failed: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		try {
-			await reloadChain;
-		} catch {}
-		if (server) try {
-			await server.close();
-		} catch (err) {
-			logger.debug(`server close failed: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		if (stopLogs) try {
-			stopLogs();
-		} catch (err) {
-			logger.debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		if (containerId) try {
-			await removeContainer(containerId);
-		} catch (err) {
-			logger.debug(`removeContainer(${containerId}) failed: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		if (stateProvider) try {
-			stateProvider.dispose();
-		} catch {}
-		if (profileCredsFile) try {
-			await profileCredsFile.dispose();
-		} catch {}
-	};
-	await applyRoleArnIfSet({
-		roleArn: options.roleArn,
-		region: options.region,
-		profile: options.profile
-	});
-	await ensureDockerAvailable();
-	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
-	if (options.profile && profileCredentials) profileCredsFile = await writeProfileCredentialsFile(options.profile, profileCredentials);
-	const appCmd = resolveApp(options.app);
-	if (!appCmd) throw new Error(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
-	logger.info("Synthesizing CDK app...");
-	const synthesizer = hostSynthesizer ?? new Synthesizer();
-	const context = parseContextOptions(options.context);
-	const synthOpts = {
-		app: appCmd,
-		output: options.output,
-		...options.region && { region: options.region },
-		...options.profile && { profile: options.profile },
-		...Object.keys(context).length > 0 && { context }
-	};
-	const { stacks } = await synthesizer.synthesize(synthOpts);
-	const resolvedTarget = await resolveSingleTarget(target, {
-		entries: listTargets(stacks).agentCoreRuntimes,
-		message: "Select an AgentCore Runtime to serve",
-		noun: "AgentCore Runtimes",
-		onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} start-agentcore requires a <target> (an AgentCore Runtime display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_START_AGENTCORE_TARGET_REQUIRED")
-	});
-	const candidate = pickAgentCoreCandidateStack(resolvedTarget, stacks);
-	stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
-	const { context: imageContext, loaded: loadedState } = stateProvider && candidate ? await buildAgentCoreImageContext(candidate, stateProvider, options) : {
-		context: void 0,
-		loaded: void 0
-	};
-	const resolved = resolveAgentCoreTarget(resolvedTarget, stacks, imageContext);
-	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.logicalId}`)} (${resolved.protocol})`);
-	const plan = resolveAgentCoreServePlan(resolved.protocol);
-	const sigv4Context = await resolveAgentCoreSigV4Context(options, resolved, loadedState, stateProvider);
-	const authPlan = selectServeInboundAuth(resolved, options, sigv4Context !== void 0);
-	if (authPlan.authCheck && resolved.jwtAuthorizer) logger.info(`Inbound JWT: each request verified per-request against ${resolved.jwtAuthorizer.discoveryUrl}${options.verifyAuth === false ? " (verification DISABLED via --no-verify-auth)" : ""}.`);
-	await resolveFromS3BucketIntrinsic(resolved, stateProvider, loadedState, imageContext);
-	const image = await resolveAgentCoreImage(resolved, options, loadedState, stateProvider);
-	const { env: dockerEnv, sensitiveEnvKeys } = await buildContainerEnv(resolved, options, profileCredentials, profileCredsFile, stateProvider, loadedState, imageContext);
-	let containerHostPort = await pickFreePort();
-	const containerHost = options.containerHost;
-	const containerName = `${getEmbedConfig().resourceNamePrefix}-agentcore-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
-	logger.info(`Starting agent container (image=${image}, port=${containerHostPort} -> ${plan.containerPortLabel})...`);
-	containerId = await runDetached({
-		image,
-		mounts: [],
-		env: dockerEnv,
-		cmd: [],
-		hostPort: containerHostPort,
-		host: containerHost,
-		platform: options.platform,
-		name: containerName,
-		...plan.containerPort !== void 0 && { containerPort: plan.containerPort },
-		...sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys }
-	});
-	stopLogs = streamLogs(containerId);
-	const shutdown = async (signal, exitCode) => {
-		if (shuttingDown) return;
-		shuttingDown = true;
-		logger.info(`Received ${signal}, shutting down...`);
-		await teardown();
-		process.exit(exitCode);
-	};
-	process.on("SIGINT", () => void shutdown("SIGINT", 130));
-	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
-	try {
-		if (plan.readyPath === void 0) await waitForAgentCorePing(containerHost, containerHostPort, options.timeout);
-		else await waitForAgentCoreHttpReady(containerHost, containerHostPort, plan.readyPath, options.timeout);
-		const signRequest = authPlan.sign && sigv4Context ? async ({ method, path, body, sessionId }) => {
-			const signed = await signAgentCoreInvocation({
-				credentials: sigv4Context.credentials,
-				region: sigv4Context.region,
-				host: containerHost,
-				port: containerHostPort,
-				path,
-				body,
-				sessionId,
-				method
-			});
-			const h = {
-				Authorization: signed.authorization,
-				"X-Amz-Date": signed.amzDate,
-				"X-Amz-Content-Sha256": signed.amzContentSha256
-			};
-			if (signed.amzSecurityToken) h["X-Amz-Security-Token"] = signed.amzSecurityToken;
-			return h;
-		} : void 0;
-		server = await startAgentCoreHttpServer({
-			containerHost,
-			containerPort: containerHostPort,
-			host: options.host,
-			port: options.port,
-			routes: plan.routes,
-			attachWs: plan.attachWs,
-			...authPlan.bridgeAuthorization && { authorization: authPlan.bridgeAuthorization },
-			...authPlan.authCheck && { authCheck: authPlan.authCheck },
-			...signRequest && { signRequest },
-			...options.sessionId && { sessionId: options.sessionId }
-		});
-	} catch (err) {
-		await teardown();
-		throw err;
-	}
-	if (server.wsUrl) {
-		logger.info(`Server listening on ${server.wsUrl}  (${displayIdent(resolved.logicalId)} (AgentCore WebSocket))`);
-		logger.info(`HTTP contract served on ${server.httpUrl} — POST ${server.httpUrl}/invocations, GET ${server.httpUrl}/ping`);
-	} else {
-		const contractPath = plan.routes[0]?.path ?? "/";
-		const contractUrl = `${server.httpUrl}${contractPath}`;
-		logger.info(`Server listening on ${server.httpUrl}  (${displayIdent(resolved.logicalId)})`);
-		logger.info(`${resolved.protocol} contract served on ${contractUrl} — POST ${contractUrl}`);
-	}
-	logger.info("Press ^C to shut down.");
-	if (options.watch) {
-		const cdkOutDir = options.output;
-		const assetLoader = new AssetManifestLoader();
-		let currentAssetHash = await deriveOldAssetHash({
-			resolvedTarget,
-			resolved,
-			stacks,
-			cdkOutDir,
-			assetLoader
+function probeHttp(host, port, timeoutMs) {
+	return new Promise((resolveProbe) => {
+		let timedOut = false;
+		let connected = false;
+		const req = request$2({
+			host,
+			port,
+			path: "/",
+			method: "GET",
+			timeout: timeoutMs,
+			headers: { connection: "close" }
+		}, (res) => {
+			res.resume();
+			resolveProbe("answered");
 		});
-		const waitReady = async (port) => {
-			if (plan.readyPath === void 0) await waitForAgentCorePing(containerHost, port, options.timeout);
-			else await waitForAgentCoreHttpReady(containerHost, port, plan.readyPath, options.timeout);
-		};
-		const watchRoot = process.cwd();
-		const { ignored, shouldTrigger, excludePatterns } = createWatchPredicates({
-			watchRoot,
-			output: options.output,
-			watchConfig: resolveWatchConfig()
+		req.on("socket", (socket) => {
+			socket.once("connect", () => {
+				connected = true;
+			});
 		});
-		logger.info(`Watching ${watchRoot} for source changes (excluding ${excludePatterns.join(", ")}). The warm container reloads in place; the serve stays up.`);
-		watcher = createFileWatcher({
-			paths: [watchRoot],
-			ignored,
-			shouldTrigger,
-			onChange: (changedPaths) => {
-				reloadChain = reloadChain.then(async () => {
-					if (tornDown || shuttingDown) return;
-					let freshStacks;
-					let freshResolved;
-					let freshLoaded;
-					let freshImageContext;
-					let verdict;
-					let nextAssetHash = currentAssetHash;
-					try {
-						freshStacks = (await synthesizer.synthesize(synthOpts)).stacks;
-						const freshCandidate = pickAgentCoreCandidateStack(resolvedTarget, freshStacks);
-						const ctx = stateProvider && freshCandidate ? await buildAgentCoreImageContext(freshCandidate, stateProvider, options) : {
-							context: void 0,
-							loaded: void 0
-						};
-						freshImageContext = ctx.context;
-						freshLoaded = ctx.loaded;
-						freshResolved = resolveAgentCoreTarget(resolvedTarget, freshStacks, freshImageContext);
-						await resolveFromS3BucketIntrinsic(freshResolved, stateProvider, freshLoaded, freshImageContext);
-						const assetCtx = await loadAgentCoreAssetContext({
-							resolvedTarget,
-							resolved: freshResolved,
-							stacks: freshStacks,
-							cdkOutDir,
-							assetLoader,
-							oldAssetHash: currentAssetHash
-						});
-						if (assetCtx?.newAssetHash !== void 0) nextAssetHash = assetCtx.newAssetHash;
-						verdict = classifySourceChange(changedPaths, assetCtx);
-						logger.info(`Detected source change (${changedPaths.length} path(s)); verdict=${verdict.kind} (${verdict.reason}).`);
-					} catch (err) {
-						logger.error(`Reload: re-synth / classify failed (${err instanceof Error ? err.message : String(err)}); skipping this change. The serve stays up against the current container.`);
-						return;
-					}
-					if (tornDown || shuttingDown) return;
-					try {
-						if (verdict.kind === "soft-reload") {
-							if (!containerId) throw new CdkLocalError("Reload: no live container to docker cp / docker restart into.", "LOCAL_START_AGENTCORE_WATCH_NO_CONTAINER");
-							await softReloadAgentContainer(containerId, verdict.newAssetSourceDir);
-							await waitReady(containerHostPort);
-							logger.info("Reload: soft-reloaded the agent container (docker cp + docker restart; container ID + host port preserved).");
-						} else {
-							if (stopLogs) {
-								try {
-									stopLogs();
-								} catch {}
-								stopLogs = void 0;
-							}
-							if (containerId) {
-								await removeContainer(containerId);
-								containerId = void 0;
-							}
-							const newImage = await resolveAgentCoreImage(freshResolved, options, freshLoaded, stateProvider);
-							const { env: newEnv, sensitiveEnvKeys: newSensitive } = await buildContainerEnv(freshResolved, options, profileCredentials, profileCredsFile, stateProvider, freshLoaded, freshImageContext);
-							const newPort = await pickFreePort();
-							const newName = `${getEmbedConfig().resourceNamePrefix}-agentcore-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
-							logger.info(`Reload: starting agent container (image=${newImage}, port=${newPort} -> ${plan.containerPortLabel})...`);
-							containerId = await runDetached({
-								image: newImage,
-								mounts: [],
-								env: newEnv,
-								cmd: [],
-								hostPort: newPort,
-								host: containerHost,
-								platform: options.platform,
-								name: newName,
-								...plan.containerPort !== void 0 && { containerPort: plan.containerPort },
-								...newSensitive.size > 0 && { sensitiveEnvKeys: newSensitive }
-							});
-							stopLogs = streamLogs(containerId);
-							containerHostPort = newPort;
-							await waitReady(newPort);
-							server?.setContainerPort(newPort);
-							logger.info(`Reload: rebuilt the agent container; serve re-pointed to port ${newPort}.`);
-						}
-						currentAssetHash = nextAssetHash;
-						logger.info("Reload complete.");
-					} catch (err) {
-						logger.error(`Reload failed: ${err instanceof Error ? err.message : String(err)}. The serve stays up; edit + save again to retry.`);
-					}
-				});
-			}
+		req.on("timeout", () => {
+			timedOut = true;
+			req.destroy();
 		});
-	}
-	await new Promise(() => void 0);
+		req.on("error", () => resolveProbe(timedOut && connected ? "timeout" : "refused"));
+		req.end();
+	});
 }
-function createLocalStartAgentCoreCommand(opts = {}) {
-	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("start-agentcore").description("Serve a Bedrock AgentCore Runtime's contract locally against a warm container. Boots the AWS::BedrockAgentCore::Runtime container ONCE (same image / env / credential resolution as invoke-agentcore) and keeps it warm, so a client can hit it repeatedly. HTTP / AGUI runtimes serve POST /invocations + GET /ping plus the bidirectional /ws endpoint behind a host bridge (injects the AgentCore session-id, and Authorization under a customJwtAuthorizer, so a header-less client like a browser can connect); MCP runtimes serve POST /mcp, A2A POST /. Target accepts a CDK display path (MyStack/MyAgent) or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C.").argument("[target]", "CDK display path or stack-qualified logical ID of the AgentCore Runtime to serve (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
-		await localStartAgentCoreCommand(target, options, opts.extraStateProviders, opts.synthesizer);
-	}));
-	addStartAgentCoreSpecificOptions(cmd);
-	[
-		...commonOptions(),
-		...appOptions(),
-		...contextOptions
-	].forEach((opt) => cmd.addOption(opt));
-	cmd.addOption(regionOption);
-	return cmd;
+async function containerIsRunning(containerId) {
+	try {
+		const { stdout } = await execFileAsync$1(getDockerCmd(), [
+			"inspect",
+			"-f",
+			"{{.State.Running}}",
+			containerId
+		]);
+		return stdout.trim() === "true";
+	} catch {
+		return false;
+	}
 }
-function addStartAgentCoreSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort$2)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--watch", "Re-synth + reload the warm container in place on a CDK source change, keeping the serve up. A per-firing classifier picks rebuild (boot a fresh container, re-point the serve) vs soft-reload (docker cp + docker restart the same container) — the same pattern as start-service / invoke-agentcore --ws --watch.")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+function readContainerLogTail(containerId, lines, spawnFn = spawn$1) {
+	return new Promise((resolveLogs, rejectLogs) => {
+		const proc = spawnFn(getDockerCmd(), [
+			"logs",
+			"--tail",
+			String(lines),
+			containerId
+		], { stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		] });
+		const chunks = [];
+		let size = 0;
+		const take = (c) => {
+			if (size > 4 * 1024 * 1024) return;
+			chunks.push(c);
+			size += c.length;
+		};
+		proc.stdout?.on("data", take);
+		proc.stderr?.on("data", take);
+		proc.on("error", rejectLogs);
+		proc.on("close", (code) => {
+			if (code !== 0) {
+				rejectLogs(/* @__PURE__ */ new Error(`docker logs exited ${code}`));
+				return;
+			}
+			resolveLogs(Buffer.concat(chunks).toString().split("\n").map((l) => l.replace(/\r$/, "")).filter((l) => l.length > 0).slice(-lines));
+		});
+	});
 }
+const defaultReadyDeps = {
+	probe: probeHttp,
+	isRunning: containerIsRunning,
+	fetchLogs: readContainerLogTail,
+	sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+	now: () => Date.now()
+};
 
 //#endregion
-//#region src/local/web-function-resolver.ts
-const WEB_FUNCTION_TYPE = "AWS::Lambda::WebFunction";
-const WEB_FUNCTION_REVISION_TYPE = "AWS::Lambda::WebFunctionRevision";
-const WEB_FUNCTION_ENDPOINT_TYPE = "AWS::Lambda::WebFunctionEndpoint";
-const WEB_TYPES = [
-	WEB_FUNCTION_ENDPOINT_TYPE,
-	WEB_FUNCTION_TYPE,
-	WEB_FUNCTION_REVISION_TYPE
-];
-var WebFunctionResolutionError = class WebFunctionResolutionError extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "WebFunctionResolutionError";
-		Object.setPrototypeOf(this, WebFunctionResolutionError.prototype);
+//#region src/cli/commands/web-function-serve.ts
+function prepareWebFunctionServe(resolved) {
+	const code = parseWebFunctionBuildConfig(resolved.revisionLogicalId, resolved.revision.Properties?.["BuildConfig"], resolved.stack.template);
+	return {
+		resolved,
+		code,
+		spec: resolveWebFunctionRuntime(code.runtime),
+		serviceConfig: readWebFunctionServiceConfig(resolved.revision)
+	};
+}
+function webFunctionConnectHost(host) {
+	if (host === "0.0.0.0") return "127.0.0.1";
+	if (host === "::" || host === "[::]") return "::1";
+	return host;
+}
+var WebFunctionServe = class {
+	artifact;
+	artifactInFlight;
+	runInFlight;
+	id;
+	name;
+	stopLogs;
+	exitWatch;
+	teardownPromise;
+	waitingOnRunFlag = false;
+	recent = new RecentOutput();
+	prepared;
+	options;
+	constructor(prepared, options) {
+		this.prepared = prepared;
+		this.options = options;
 	}
-};
-function resolveWebFunctionTarget(target, stacks, revisionFlag) {
-	if (stacks.length === 0) throw new WebFunctionResolutionError("No stacks found in the synthesized assembly.");
-	const parsed = parseTarget(target);
-	const stack = pickStack(parsed, stacks, target);
-	const resources = stack.template.Resources ?? {};
-	const { logicalId, resource } = matchWebResource(parsed, target, stack, resources);
-	const functions = logicalIdsOfType(resources, WEB_FUNCTION_TYPE);
-	const linked = (value) => linkedFunctionLogicalId(value, resources, functions);
-	let functionLogicalId;
-	let endpoint;
-	let revisionLogicalId;
-	let selection;
-	if (resource.Type === "AWS::Lambda::WebFunctionRevision") {
-		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
-		revisionLogicalId = logicalId;
-		selection = "target-revision";
-	} else if (resource.Type === "AWS::Lambda::WebFunctionEndpoint") {
-		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
-		endpoint = readEndpoint(logicalId, resource, resources);
-	} else functionLogicalId = logicalId;
-	const revisionsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_REVISION_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
-	const endpointsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_ENDPOINT_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
-	if (revisionFlag !== void 0) {
-		const flagged = resources[revisionFlag];
-		if (!flagged || flagged.Type !== "AWS::Lambda::WebFunctionRevision") throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} is not an ${WEB_FUNCTION_REVISION_TYPE} logical id in ${displayStackName(stack.stackName)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
-		const owner = linked(flagged.Properties?.["FunctionName"]);
-		if (functionLogicalId !== void 0 && owner !== functionLogicalId) throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} belongs to a different web function than ${displayIdent(logicalId)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
-		functionLogicalId ??= owner;
-		revisionLogicalId = revisionFlag;
-		selection = "revision-flag";
+	get waitingOnRun() {
+		return this.waitingOnRunFlag;
+	}
+	get containerName() {
+		return this.name;
+	}
+	get tornDown() {
+		return this.teardownPromise !== void 0;
+	}
+	get exited() {
+		return this.exitWatch?.exited;
+	}
+	async start() {
+		const logger = getLogger();
+		const { resolved, code, spec, serviceConfig } = this.prepared;
+		const opts = this.options;
+		this.artifactInFlight = resolveWebFunctionArtifact(resolved.stack, resolved.revisionLogicalId, code);
+		this.artifact = await this.artifactInFlight;
+		if (this.tornDown) return void 0;
+		const assumeRole = webFunctionAssumeRole(opts.envOptions.assumeRole, serviceConfig);
+		const containerEnv = await resolveLambdaContainerEnv(buildWebFunctionLambdaView(resolved, serviceConfig, spec.runtime), {
+			...opts.envOptions,
+			...assumeRole !== void 0 && { assumeRole },
+			deployedFunctionLookups: false
+		}, opts.profileCredentials, opts.extraStateProviders);
+		const { env, replacedHttpEndpoint } = finalizeWebFunctionEnv(containerEnv.env, {
+			functionName: resolved.functionName,
+			containerPort: WEB_FUNCTION_CONTAINER_PORT,
+			timeoutSeconds: serviceConfig.timeoutSeconds,
+			logGroup: serviceConfig.logGroup
+		});
+		if (replacedHttpEndpoint) logger.warn(`The revision's ${WEB_FUNCTION_HTTP_ENDPOINT_ENV} is replaced with 0.0.0.0:${WEB_FUNCTION_CONTAINER_PORT}: the runtime owns that variable, and the local port is published to it.`);
+		const plan = planWebFunctionContainer(this.artifact, spec, env);
+		const platform = opts.platform ?? defaultWebFunctionPlatform(spec);
+		await pullImage(plan.image, opts.skipPull, platform);
+		if (this.tornDown) return void 0;
+		const hostPort = opts.port === 0 ? await pickFreePort() : opts.port;
+		if (this.tornDown) return void 0;
+		const name = this.name = `${getEmbedConfig().resourceNamePrefix}-webfn-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+		logger.info(`Starting web function container (image=${plan.image}, start=${plan.label}, port=${hostPort} -> ${WEB_FUNCTION_CONTAINER_PORT})...`);
+		this.runInFlight = startWebFunctionContainer({
+			plan,
+			env,
+			sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys),
+			host: opts.host,
+			hostPort,
+			platform,
+			name
+		});
+		const id = await this.runInFlight;
+		if (this.tornDown) return void 0;
+		this.id = id;
+		this.stopLogs = streamLogs(id, { onOutput: (chunk) => this.recent.push(chunk) });
+		this.exitWatch = watchContainerExit(id);
+		const host = webFunctionConnectHost(opts.host);
+		await waitForWebFunctionReady({
+			containerId: id,
+			host,
+			port: hostPort,
+			timeoutMs: opts.timeoutMs,
+			recent: this.recent,
+			label: plan.label
+		});
+		if (this.tornDown) return void 0;
+		return {
+			host,
+			port: hostPort
+		};
 	}
-	if (revisionLogicalId === void 0 && endpoint !== void 0) {
-		revisionLogicalId = pickHighestWeight(endpoint);
-		if (revisionLogicalId !== void 0) selection = "endpoint-weight";
+	exitFailure(message) {
+		return containerFailure(message, this.id ?? "", this.recent, void 0, "LOCAL_START_WEB_FUNCTION_EXITED");
 	}
-	if (revisionLogicalId === void 0) {
-		const revisions = revisionsOfFunction();
-		if (revisions.length === 1) {
-			revisionLogicalId = revisions[0];
-			selection = "only-revision";
-		} else if (endpoint === void 0 && revisions.length > 1) {
-			const endpoints = endpointsOfFunction();
-			if (endpoints.length === 1) {
-				endpoint = readEndpoint(endpoints[0], resources[endpoints[0]], resources);
-				revisionLogicalId = pickHighestWeight(endpoint);
-				if (revisionLogicalId !== void 0) selection = "endpoint-weight";
+	disposeArtifactNow() {
+		disposeWebFunctionArtifact(this.artifact);
+	}
+	teardown() {
+		return this.teardownPromise ??= this.doTeardown();
+	}
+	async doTeardown() {
+		const logger = getLogger();
+		this.exitWatch?.stop();
+		if (this.artifact === void 0 && this.artifactInFlight !== void 0) try {
+			this.artifact = await this.artifactInFlight;
+		} catch {}
+		if (this.id === void 0 && this.runInFlight !== void 0) {
+			this.waitingOnRunFlag = true;
+			try {
+				this.id = await this.runInFlight;
+			} catch {} finally {
+				this.waitingOnRunFlag = false;
 			}
 		}
-		if (revisionLogicalId === void 0) throw new WebFunctionResolutionError(revisions.length === 0 ? `${displayIdent(logicalId)} in ${displayStackName(stack.stackName)} resolves to no ${WEB_FUNCTION_REVISION_TYPE} in this template, so there is no code to serve. Target the revision itself, or pass --revision <logicalId>.` : `${displayIdent(logicalId)} has ${revisions.length} revisions and no single endpoint that picks one. Pass --revision <logicalId>, or target one of the function's endpoints. ${describeRevisions(revisions, stack)}`);
+		if (this.stopLogs) try {
+			this.stopLogs();
+		} catch (err) {
+			logger.debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		if (this.id) await removeContainer(this.id);
+		disposeWebFunctionArtifact(this.artifact);
 	}
-	if (endpoint === void 0) {
-		const routing = endpointsOfFunction().map((id) => readEndpoint(id, resources[id], resources)).filter((e) => e.weights.some((w) => w.revisionLogicalId === revisionLogicalId));
-		if (routing.length === 1) endpoint = routing[0];
+};
+
+//#endregion
+//#region src/cli/commands/local-start-cloudfront.ts
+var LocalStartCloudFrontError = class extends CdkLocalError {
+	constructor(message, cause) {
+		super(message, "LOCAL_START_CLOUDFRONT_ERROR", cause);
 	}
-	const fnName = (functionLogicalId !== void 0 ? resources[functionLogicalId] : void 0)?.Properties?.["FunctionName"];
+};
+function parseOriginOverrides(values) {
+	const out = /* @__PURE__ */ new Map();
+	for (const raw of values ?? []) {
+		const eq = raw.indexOf("=");
+		if (eq <= 0 || eq === raw.length - 1) throw new LocalStartCloudFrontError(`Invalid --origin '${raw}'. Expected <originId>=<dir> (e.g. MyOrigin=./site).`);
+		out.set(raw.slice(0, eq).trim(), raw.slice(eq + 1).trim());
+	}
+	return out;
+}
+function parseKvsFileOverrides(values) {
+	const out = /* @__PURE__ */ new Map();
+	for (const raw of values ?? []) {
+		const eq = raw.indexOf("=");
+		if (eq <= 0 || eq === raw.length - 1) throw new LocalStartCloudFrontError(`Invalid --kvs-file '${raw}'. Expected <key>=<file.json> (e.g. RoutesKvs=./kvs.json).`);
+		out.set(raw.slice(0, eq).trim(), raw.slice(eq + 1).trim());
+	}
+	return out;
+}
+function collectKvsStoreIdentities(template) {
+	const out = [];
+	for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+		if (resource.Type !== "AWS::CloudFront::KeyValueStore") continue;
+		const cdkPath = readCdkPath(resource) || void 0;
+		const constructPath = cdkPath?.endsWith("/Resource") ? cdkPath.slice(0, -9) : cdkPath;
+		const constructId = constructPath?.split("/").pop();
+		out.push({
+			logicalId,
+			...cdkPath !== void 0 && { cdkPath },
+			...constructPath !== void 0 && { constructPath },
+			...constructId !== void 0 && constructId !== "" && { constructId }
+		});
+	}
+	return out;
+}
+function normalizeKvsFileKeys(kvsFiles, template) {
+	if (kvsFiles.size === 0) return kvsFiles;
+	const stores = collectKvsStoreIdentities(template);
+	const candidates = () => stores.map((s) => s.constructPath ? `${displayIdent(s.logicalId, { listMember: true })} (${displayStackName(s.constructPath)})` : displayIdent(s.logicalId, { listMember: true })).join(", ") || "(none in this distribution)";
+	const out = /* @__PURE__ */ new Map();
+	for (const [key, filePath] of kvsFiles) {
+		const matched = [
+			stores.filter((s) => s.logicalId === key),
+			stores.filter((s) => s.constructPath === key || s.cdkPath === key),
+			stores.filter((s) => s.constructId === key)
+		].find((t) => t.length > 0) ?? [];
+		if (matched.length === 0) throw new LocalStartCloudFrontError(`--kvs-file key '${key}' matched no AWS::CloudFront::KeyValueStore in the distribution. Pass a store's logical id, construct path, or bare construct id. Candidates: ${candidates()}.`);
+		if (matched.length > 1) throw new LocalStartCloudFrontError(`--kvs-file key '${key}' is ambiguous — it matched ${matched.length} KeyValueStores (${matched.map((s) => displayIdent(s.logicalId, { listMember: true })).join(", ")}). Use the logical id or full construct path.`);
+		out.set(matched[0].logicalId, filePath);
+	}
+	return out;
+}
+async function attachKvsModules(distribution, stacks, options, profileCredentials, logger, extraStateProviders) {
+	const stack = stacks.find((s) => s.stackName === distribution.stackName);
+	const synthRegion = stack?.region;
+	const kvsFiles = stack ? normalizeKvsFileKeys(parseKvsFileOverrides(options.kvsFile), stack.template) : parseKvsFileOverrides(options.kvsFile);
+	const resolveDeployedKvs = isStateSourceActive(options, extraStateProviders) ? async (kvsLogicalId) => {
+		const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
+		if (!provider) return void 0;
+		let record;
+		try {
+			record = await provider.load(distribution.stackName, synthRegion);
+		} finally {
+			provider.dispose();
+		}
+		const physicalId = record?.resources[kvsLogicalId]?.physicalId;
+		if (!physicalId) return void 0;
+		if (physicalId.startsWith("arn:")) {
+			const id = idFromArn(physicalId);
+			return {
+				arn: physicalId,
+				...id !== void 0 && { id }
+			};
+		}
+		return resolveDeployedKvsArnByName(physicalId, { ...profileCredentials !== void 0 && { credentials: profileCredentials } });
+	} : void 0;
+	const { warnings } = await resolveKvsModulesForDistribution(distribution, {
+		...kvsFiles.size > 0 && { kvsFiles },
+		...resolveDeployedKvs !== void 0 && { resolveDeployedKvs },
+		...profileCredentials !== void 0 && { credentials: profileCredentials }
+	});
+	for (const warning of warnings) logger.warn(warning);
+}
+function resolveCloudFrontTarget(target, stacks) {
+	if (stacks.length === 0) throw new LocalStartCloudFrontError("No stacks found in the synthesized assembly.");
+	const parsed = parseEcsTarget(target);
+	const stack = pickStack(parsed, stacks, target);
+	const resources = stack.template.Resources ?? {};
+	if (parsed.isPath) {
+		const index = buildCdkPathIndex(stack.template);
+		const dists = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId }) => {
+			const r = resources[logicalId];
+			return r !== void 0 && r.Type === "AWS::CloudFront::Distribution";
+		});
+		if (dists.length === 0) throw notFound(target, stack, resources);
+		if (dists.length > 1) throw new LocalStartCloudFrontError(`Target '${target}' matches ${dists.length} distributions in ${stack.stackName}: ${dists.map((d) => d.logicalId).join(", ")}. Refine the path or use the stack:LogicalId form.`);
+		return {
+			stack,
+			logicalId: dists[0].logicalId
+		};
+	}
+	const res = resources[parsed.pathOrId];
+	if (!res || res.Type !== "AWS::CloudFront::Distribution") throw notFound(target, stack, resources);
 	return {
 		stack,
-		functionLogicalId,
-		functionName: typeof fnName === "string" && fnName.length > 0 ? fnName : functionLogicalId ?? revisionLogicalId,
-		revisionLogicalId,
-		revision: resources[revisionLogicalId],
-		endpoint,
-		selection: selection ?? "only-revision"
+		logicalId: parsed.pathOrId
 	};
 }
 function pickStack(parsed, stacks, target) {
 	const selection = selectTargetStack(parsed, target, stacks);
 	switch (selection.kind) {
 		case "found": return selection.stack;
-		case "no-prefix": throw new WebFunctionResolutionError(`Multiple stacks in app, target ${displayIdent(parsed.pathOrId)} is missing a stack prefix. Use StackName:<logicalId> or StackName/... (path form). Available stacks: ${describeStacks(stacks)}.`);
-		case "not-found": throw new WebFunctionResolutionError(`Stack ${displayStackName(selection.pattern)} not found. Available stacks: ${describeStacks(stacks)}.`);
-		case "ambiguous": throw new WebFunctionResolutionError(`Stack pattern ${displayStackName(selection.pattern)} matched ${selection.matched.length} stacks: ${describeStacks(selection.matched)}. Use a more specific pattern, or the stack's display path.`);
+		case "no-prefix": throw new LocalStartCloudFrontError(`Target '${target}' has no stack prefix, and the assembly contains ${stacks.length} stacks: ${describeStacks(stacks)}. Pass it as 'Stack/Path' or 'Stack:LogicalId'.`);
+		case "not-found": throw new LocalStartCloudFrontError(`No stack matches '${selection.pattern}'. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new LocalStartCloudFrontError(`Multiple stacks match '${selection.pattern}': ${describeStacks(selection.matched)}. Refine the pattern, or use the stack's display path (path form).`);
 	}
 }
-function matchWebResource(parsed, target, stack, resources) {
-	if (parsed.isPath) {
-		const matches = resolveCdkPathToLogicalIds(parsed.pathOrId, buildCdkPathIndex(stack.template)).filter(({ logicalId }) => WEB_TYPES.includes(resources[logicalId]?.Type ?? ""));
-		for (const type of WEB_TYPES) {
-			const ofType = matches.filter(({ logicalId }) => resources[logicalId].Type === type);
-			if (ofType.length === 1) {
-				const id = ofType[0].logicalId;
-				return {
-					logicalId: id,
-					resource: resources[id]
-				};
-			}
-			if (ofType.length > 1) throw new WebFunctionResolutionError(`Target ${displayStackName(target)} matches ${ofType.length} ${type} resources: ${ofType.map((m) => displayIdent(m.logicalId)).join(", ")}. Refine the path or use the StackName:<logicalId> form.`);
+function notFound(target, stack, resources) {
+	const dists = Object.entries(resources).filter(([, r]) => r.Type === CLOUDFRONT_DISTRIBUTION_TYPE).map(([logicalId]) => logicalId);
+	const available = dists.length > 0 ? ` Available distributions in ${stack.stackName}: ${dists.join(", ")}.` : ` ${stack.stackName} declares no ${CLOUDFRONT_DISTRIBUTION_TYPE} resources.`;
+	return new LocalStartCloudFrontError(`Target '${target}' did not match a CloudFront distribution in ${stack.stackName}.${available}`);
+}
+async function bootLambdaUrlOrigins(distribution, stacks, opts) {
+	const logger = getLogger();
+	const invokers = /* @__PURE__ */ new Map();
+	const runners = [];
+	const functionLogicalIds = /* @__PURE__ */ new Set();
+	for (const origin of distribution.origins.values()) if (origin.kind === "lambda-url") functionLogicalIds.add(origin.functionLogicalId);
+	for (const functionLogicalId of functionLogicalIds) {
+		let runner;
+		try {
+			const lambda = resolveLambdaTarget(`${distribution.stackName}:${functionLogicalId}`, stacks);
+			const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
+			runner = createFrontDoorLambdaRunner(lambda, {
+				containerHost: opts.containerHost,
+				skipPull: opts.skipPull,
+				...opts.envOptions.region !== void 0 && { region: opts.envOptions.region },
+				containerEnv: containerEnv.env,
+				...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
+			});
+			logger.info(`Booting Lambda Function URL origin container for ${functionLogicalId} (the backing Lambda runs locally via RIE)...`);
+			await runner.start();
+		} catch (err) {
+			await Promise.all(runners.map((r) => r.stop().catch(() => void 0)));
+			throw new LocalStartCloudFrontError(`Failed to boot the Lambda Function URL origin's backing function ${displayIdent(functionLogicalId)}: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
 		}
-		throw notFoundError(target, stack, resources);
+		runners.push(runner);
+		invokers.set(functionLogicalId, (event) => runner.invoke(event));
+	}
+	return {
+		invokers,
+		runners
+	};
+}
+async function drainWebFunctionServes(serves) {
+	let done = 0;
+	while (done < serves.length) {
+		const batch = serves.slice(done);
+		done = serves.length;
+		await Promise.all(batch.map((s) => s.teardown().catch(() => void 0)));
+	}
+}
+const WEB_FUNCTION_ORIGIN_READY_TIMEOUT_MS = 6e4;
+async function bootWebFunctionOrigins(distribution, stacks, opts) {
+	const logger = getLogger();
+	const targets = /* @__PURE__ */ new Map();
+	const serves = opts.sink ?? [];
+	const endpointLogicalIds = /* @__PURE__ */ new Set();
+	for (const origin of distribution.origins.values()) if (origin.kind === "web-function") endpointLogicalIds.add(origin.endpointLogicalId);
+	if (endpointLogicalIds.size === 0) return {
+		targets,
+		serves
+	};
+	for (const endpointLogicalId of endpointLogicalIds) try {
+		if (serves.length === 0) await ensureDockerAvailable();
+		const resolved = resolveWebFunctionTarget(`${distribution.stackName}:${endpointLogicalId}`, stacks);
+		const prepared = prepareWebFunctionServe(resolved);
+		for (const line of webFunctionFidelityWarnings(resolved, prepared.serviceConfig)) logger.warn(line);
+		logger.info(`Booting Lambda Web Function endpoint origin server for ${displayIdent(endpointLogicalId)} (revision ${displayIdent(resolved.revisionLogicalId)}, ${prepared.spec.runtime})...`);
+		const serve = new WebFunctionServe(prepared, {
+			envOptions: opts.envOptions,
+			...opts.profileCredentials !== void 0 && { profileCredentials: opts.profileCredentials },
+			...opts.extraStateProviders !== void 0 && { extraStateProviders: opts.extraStateProviders },
+			host: opts.containerHost,
+			port: 0,
+			skipPull: opts.skipPull,
+			timeoutMs: opts.timeoutMs ?? WEB_FUNCTION_ORIGIN_READY_TIMEOUT_MS
+		});
+		serves.push(serve);
+		const address = await serve.start();
+		if (!address) throw new Error("the server was stopped while starting");
+		targets.set(endpointLogicalId, address);
+		serve.exited?.then((code) => {
+			if (serve.tornDown) return;
+			logger.warn(`The Lambda Web Function endpoint origin server for ${displayIdent(endpointLogicalId)} exited (exit code ${code ?? "unknown"}); requests routed to it return 502. Restart start-cloudfront.`);
+		});
+	} catch (err) {
+		await Promise.all(serves.map((s) => s.teardown().catch(() => void 0)));
+		throw new LocalStartCloudFrontError(`Failed to boot the Lambda Web Function endpoint origin ${displayIdent(endpointLogicalId)}: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
+	}
+	return {
+		targets,
+		serves
+	};
+}
+async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
+	const logger = getLogger();
+	const invokers = /* @__PURE__ */ new Map();
+	const runners = [];
+	const functionLogicalIds = /* @__PURE__ */ new Set();
+	for (const behavior of distribution.behaviors) {
+		const edge = behavior.lambdaEdge;
+		if (!edge) continue;
+		for (const assoc of [
+			edge.viewerRequest,
+			edge.originRequest,
+			edge.originResponse,
+			edge.viewerResponse
+		]) if (assoc) functionLogicalIds.add(assoc.functionLogicalId);
+	}
+	for (const functionLogicalId of functionLogicalIds) try {
+		const lambda = resolveLambdaTarget(`${distribution.stackName}:${functionLogicalId}`, stacks);
+		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
+		const runner = createFrontDoorLambdaRunner(lambda, {
+			containerHost: opts.containerHost,
+			skipPull: opts.skipPull,
+			...opts.envOptions.region !== void 0 && { region: opts.envOptions.region },
+			containerEnv: containerEnv.env,
+			...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
+		});
+		logger.info(`Booting Lambda@Edge container for ${functionLogicalId} (the function runs locally via RIE)...`);
+		await runner.start();
+		runners.push(runner);
+		invokers.set(functionLogicalId, (event) => runner.invoke(event));
+	} catch (err) {
+		logger.warn(`Could not boot Lambda@Edge function ${displayIdent(functionLogicalId)}; its stage will be skipped: ${err instanceof Error ? err.message : String(err)}`);
 	}
-	const resource = resources[parsed.pathOrId];
-	if (!resource) throw notFoundError(target, stack, resources);
-	if (!WEB_TYPES.includes(resource.Type)) throw new WebFunctionResolutionError(`Resource ${displayIdent(parsed.pathOrId)} in ${displayStackName(stack.stackName)} is ${displayIdent(resource.Type)}, not a Lambda web function. ${getEmbedConfig().cliName} start-web-function serves ${WEB_TYPES.join(" / ")} targets.`);
 	return {
-		logicalId: parsed.pathOrId,
-		resource
+		invokers,
+		runners
 	};
 }
-function notFoundError(target, stack, resources) {
-	const available = WEB_TYPES.flatMap((t) => logicalIdsOfType(resources, t));
-	const hint = available.length > 0 ? `Web function resources in ${displayStackName(stack.stackName)}: ${available.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_TYPE} resources found in ${displayStackName(stack.stackName)}.`;
-	return new WebFunctionResolutionError(`Target ${displayStackName(target)} not found. ${hint}`);
+function buildLambdaEnvOptions(options, extraStateProviders) {
+	return {
+		...hostStateSourceFields(options, extraStateProviders),
+		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
+		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
+		...options.region !== void 0 && { region: options.region },
+		...options.profile !== void 0 && { profile: options.profile },
+		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
+	};
 }
-function logicalIdsOfType(resources, type) {
-	return Object.keys(resources).filter((id) => resources[id]?.Type === type);
+function buildLambdaBootOptions(options, profileCredentials, extraStateProviders) {
+	return {
+		containerHost: options.host,
+		skipPull: options.pull === false,
+		envOptions: buildLambdaEnvOptions(options, extraStateProviders),
+		...profileCredentials !== void 0 && { profileCredentials },
+		...extraStateProviders !== void 0 && { extraStateProviders }
+	};
 }
-function linkedFunctionLogicalId(value, resources, functions) {
-	const ref = referencedLogicalId(value);
-	if (ref !== void 0) return functions.includes(ref) ? ref : void 0;
-	if (typeof value !== "string") return void 0;
-	const byName = functions.filter((id) => resources[id]?.Properties?.["FunctionName"] === value);
-	return byName.length === 1 ? byName[0] : void 0;
+function warnUnsupported(distribution, extraStateProviders) {
+	const logger = getLogger();
+	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin ${displayIdent(origin.originId)} is a custom (non-S3, non-Lambda) origin (${displayUntrustedValue(String(origin.domainName))}); ${getEmbedConfig().cliName} start-cloudfront serves S3, Lambda Function URL and Lambda Web Function endpoint origins only. Requests routed to it return 502.`);
+	else if (origin.kind === "s3-unresolved") logger.warn(`Origin ${displayIdent(origin.originId)} is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass ${stateSourceFlagNames(extraStateProviders).join(" or ")} to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
 }
-function referencedLogicalId(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-	const obj = value;
-	if (typeof obj["Ref"] === "string") return obj["Ref"];
-	const getAtt = obj["Fn::GetAtt"];
-	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
-	if (typeof getAtt === "string") return getAtt.split(".")[0];
+function warnUnusedCacheOrigin(options, extraStateProviders) {
+	if (options.cacheOrigin === true && !isStateSourceActive(options, extraStateProviders)) {
+		const flags = stateSourceFlagNames(extraStateProviders).join(" or ");
+		getLogger().warn(`--cache-origin has no effect without ${flags}: it caches a deployed-S3 read-through origin, which is only built under a state source. A local BucketDeployment / --origin <id>=<dir> origin serves from disk and is not cached. Pass ${flags} to enable the deployed-S3 origin (then --cache-origin applies), or drop --cache-origin.`);
+	}
 }
-function readEndpoint(logicalId, resource, resources) {
-	const props = resource.Properties ?? {};
-	const rawWeights = props["RevisionWeights"];
-	const weights = [];
-	if (Array.isArray(rawWeights)) for (const entry of rawWeights) {
-		if (!entry || typeof entry !== "object") continue;
-		const e = entry;
-		const ref = referencedLogicalId(e["RevisionId"]);
-		weights.push({
-			revisionLogicalId: ref !== void 0 && resources[ref]?.Type === "AWS::Lambda::WebFunctionRevision" ? ref : void 0,
-			weight: typeof e["Weight"] === "number" ? e["Weight"] : 0
+async function resolveDeployedS3Origins(distribution, stacks, options, profileCredentials, logger, extraStateProviders) {
+	const readers = /* @__PURE__ */ new Map();
+	const buckets = /* @__PURE__ */ new Map();
+	const stateFlag = activeStateSourceFlag(options, extraStateProviders);
+	if (stateFlag === void 0) return {
+		readers,
+		buckets
+	};
+	const synthRegion = stacks.find((s) => s.stackName === distribution.stackName)?.region;
+	const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
+	let record;
+	try {
+		record = provider ? await provider.load(distribution.stackName, synthRegion) : void 0;
+	} finally {
+		provider?.dispose();
+	}
+	const region = options.stackRegion ?? options.region ?? synthRegion ?? record?.region;
+	const distributionId = record?.resources[distribution.logicalId]?.physicalId;
+	for (const origin of [...distribution.origins.values()]) {
+		if (origin.kind !== "s3-unresolved") continue;
+		let bucketName;
+		let via;
+		if (origin.bucketLogicalId !== void 0) {
+			bucketName = record?.resources[origin.bucketLogicalId]?.physicalId;
+			via = "deployed state";
+		} else if (origin.bucketName !== void 0) {
+			bucketName = origin.bucketName;
+			via = "the origin's DomainName";
+		} else if (origin.deployedConfigOnly && distributionId) {
+			bucketName = await resolveDeployedOriginBucket({
+				distributionId,
+				originId: origin.originId,
+				...profileCredentials !== void 0 && { credentials: profileCredentials }
+			});
+			via = "GetDistributionConfig";
+		} else continue;
+		if (!bucketName) continue;
+		readers.set(origin.originId, createS3OriginReader(bucketName, {
+			...region !== void 0 && { region },
+			...profileCredentials !== void 0 && { credentials: profileCredentials },
+			...options.cacheOrigin === true && { cache: true }
+		}));
+		buckets.set(origin.originId, bucketName);
+		distribution.origins.set(origin.originId, {
+			kind: "s3-deployed",
+			originId: origin.originId,
+			bucketName
 		});
+		logger.info(`Origin ${displayIdent(origin.originId)}: no local BucketDeployment source; serving from deployed S3 (bucket=${bucketName}, resolved via ${via}) on demand under ${stateFlag}.`);
 	}
-	const str = (v) => typeof v === "string" ? v : void 0;
 	return {
-		logicalId,
-		endpointType: str(props["EndpointType"]),
-		authType: str(props["AuthType"]),
-		weights
+		readers,
+		buckets
 	};
 }
-function pickHighestWeight(endpoint) {
-	let best;
-	for (const w of endpoint.weights) {
-		if (w.revisionLogicalId === void 0) continue;
-		if (best === void 0 || w.weight > best.weight) best = w;
+function annotateDeployedS3Origins(distribution, buckets) {
+	for (const [originId, bucketName] of buckets) {
+		const origin = distribution.origins.get(originId);
+		if (origin && origin.kind === "s3-unresolved") distribution.origins.set(originId, {
+			kind: "s3-deployed",
+			originId,
+			bucketName
+		});
 	}
-	return best?.revisionLogicalId;
 }
-function describeRevisions(revisions, stack) {
-	return revisions.length > 0 ? `Revisions: ${revisions.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_REVISION_TYPE} linked to it in ${displayStackName(stack.stackName)}.`;
+async function localStartCloudFrontCommand(target, options, extraStateProviders, hostSynthesizer) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	const originOverrides = parseOriginOverrides(options.origin);
+	const tlsRequested = options.tls === true || options.tlsCert !== void 0 || options.tlsKey !== void 0;
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region,
+		profile: options.profile
+	});
+	const appCmd = resolveApp(options.app);
+	if (!appCmd) throw new LocalStartCloudFrontError(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
+	const basePort = parseInt(options.port, 10);
+	if (!Number.isFinite(basePort) || basePort < 0 || basePort > 65535) throw new LocalStartCloudFrontError(`--port must be 0..65535 (got ${options.port}).`);
+	const synthAndResolve = async () => {
+		logger.info("Synthesizing CDK app...");
+		const synthesizer = hostSynthesizer ?? new Synthesizer();
+		const context = parseContextOptions(options.context);
+		const synthOpts = {
+			app: appCmd,
+			output: options.output,
+			...options.region && { region: options.region },
+			...options.profile && { profile: options.profile },
+			...Object.keys(context).length > 0 && { context }
+		};
+		const { stacks } = await synthesizer.synthesize(synthOpts);
+		const chosen = await resolveSingleTarget(target, {
+			entries: listTargets(stacks).cloudFrontDistributions,
+			message: "Select a CloudFront distribution to serve",
+			noun: "CloudFront distributions",
+			onMissing: () => new LocalStartCloudFrontError(`${getEmbedConfig().cliName} start-cloudfront requires a <target>. Pass a distribution path like 'Stack/MyDist', or run it in a TTY to pick interactively.`)
+		});
+		target = chosen;
+		const { stack, logicalId } = resolveCloudFrontTarget(chosen, stacks);
+		return {
+			distribution: resolveCloudFrontDistribution({
+				stack,
+				logicalId,
+				originOverrides
+			}),
+			stacks
+		};
+	};
+	const initial = await synthAndResolve();
+	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
+	const deployedS3 = await resolveDeployedS3Origins(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
+	warnUnsupported(initial.distribution, extraStateProviders);
+	warnUnusedCacheOrigin(options, extraStateProviders);
+	await attachKvsModules(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
+	const bootOpts = buildLambdaBootOptions(options, profileCredentials, extraStateProviders);
+	const webFunctionServes = [];
+	let bootAborted = false;
+	const onBootSignal = (signal) => {
+		if (bootAborted) return;
+		bootAborted = true;
+		logger.info(`Received ${signal} during start-up; removing the web function containers...`);
+		drainWebFunctionServes(webFunctionServes).then(() => process.exit(signal === "SIGINT" ? 130 : 0));
+	};
+	const bootSigint = () => onBootSignal("SIGINT");
+	const bootSigterm = () => onBootSignal("SIGTERM");
+	const disarmBootSignals = () => {
+		process.off("SIGINT", bootSigint);
+		process.off("SIGTERM", bootSigterm);
+	};
+	if ([...initial.distribution.origins.values()].some((o) => o.kind === "web-function")) {
+		process.on("SIGINT", bootSigint);
+		process.on("SIGTERM", bootSigterm);
+	}
+	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, bootOpts);
+	const { invokers: edgeInvokers, runners: edgeRunners } = await bootLambdaEdgeFunctions(initial.distribution, initial.stacks, bootOpts);
+	let server;
+	try {
+		const webFunctions = await bootWebFunctionOrigins(initial.distribution, initial.stacks, {
+			...bootOpts,
+			sink: webFunctionServes
+		});
+		let tls;
+		if (tlsRequested) tls = await resolveFrontDoorTlsMaterials({
+			certPath: options.tlsCert,
+			keyPath: options.tlsKey
+		});
+		server = await startCloudFrontServer({
+			distribution: initial.distribution,
+			host: options.host,
+			port: basePort,
+			...tls && { tls },
+			...lambdaInvokers.size > 0 && { lambdaInvokers },
+			...edgeInvokers.size > 0 && { edgeInvokers },
+			...deployedS3.readers.size > 0 && { s3OriginReaders: deployedS3.readers },
+			...webFunctions.targets.size > 0 && { webFunctionOrigins: webFunctions.targets }
+		});
+	} catch (err) {
+		await Promise.all([...[...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch(() => void 0)), ...webFunctionServes.map((s) => s.teardown().catch(() => void 0))]);
+		if (bootAborted) return await new Promise(() => void 0);
+		disarmBootSignals();
+		throw err;
+	}
+	disarmBootSignals();
+	if (bootAborted) return await new Promise(() => void 0);
+	process.stdout.write(`CloudFront distribution serving on ${server.url}  (${displayIdent(initial.distribution.logicalId)})\n`);
+	process.stdout.write("^C to stop.\n");
+	let watcher;
+	let reloadChain = Promise.resolve();
+	if (options.watch) {
+		const watchRoot = process.cwd();
+		const { ignored, shouldTrigger, excludePatterns } = createWatchPredicates({
+			watchRoot,
+			output: options.output,
+			watchConfig: resolveWatchConfig()
+		});
+		watcher = createFileWatcher({
+			paths: [watchRoot],
+			ignored,
+			shouldTrigger,
+			onChange: () => {
+				logger.info("Detected source change; reloading...");
+				reloadChain = reloadChain.then(async () => {
+					try {
+						const reloaded = await synthAndResolve();
+						annotateDeployedS3Origins(reloaded.distribution, deployedS3.buckets);
+						for (const reader of deployedS3.readers.values()) reader.clearCache();
+						warnUnsupported(reloaded.distribution, extraStateProviders);
+						await attachKvsModules(reloaded.distribution, reloaded.stacks, options, profileCredentials, logger, extraStateProviders);
+						server.update(reloaded.distribution);
+						logger.info("Reload complete.");
+					} catch (err) {
+						logger.warn(`Reload failed; keeping the previous version serving: ${err instanceof Error ? err.message : String(err)}`);
+					}
+				}).catch(() => void 0);
+			}
+		});
+		logger.info(`Watching ${watchRoot} for source changes (excluding ${excludePatterns.join(", ")}).`);
+	}
+	let shuttingDown = false;
+	const shutdown = async (signal, exitCode) => {
+		if (shuttingDown) return;
+		shuttingDown = true;
+		logger.info(`Received ${signal}, shutting down...`);
+		if (watcher) try {
+			await watcher.close();
+		} catch {}
+		try {
+			await server.close();
+		} catch {}
+		await Promise.all([...[...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch((err) => {
+			logger.debug(`Lambda runner stop failed: ${err instanceof Error ? err.message : String(err)}`);
+		})), ...webFunctionServes.map((s) => s.teardown().catch((err) => {
+			logger.debug(`Web function server teardown failed: ${err instanceof Error ? err.message : String(err)}`);
+		}))]);
+		await Promise.all([...deployedS3.readers.values()].map((reader) => reader.close()));
+		process.exit(exitCode);
+	};
+	process.on("SIGINT", () => void shutdown("SIGINT", 130));
+	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
+	await new Promise(() => void 0);
+}
+function createLocalStartCloudFrontCommand(opts = {}) {
+	setEmbedConfig(opts.embedConfig);
+	const cmd = new Command("start-cloudfront").description("Run a long-running local server that serves a CloudFront distribution: its S3 origin content (resolved from the BucketDeployment source in the cloud assembly), its Lambda Function URL origins (the backing Lambda is run locally via RIE) and its Lambda Web Function endpoint origins (the revision the endpoint weights pick, run as start-web-function runs it), plus its viewer-request / viewer-response CloudFront Functions, reproducing the distribution routing locally so a rewrite / routing change is verifiable in seconds. Serves S3, Lambda Function URL and Web Function endpoint origins, and runs Lambda@Edge functions in local RIE containers. The Lambda kinds need Docker: a Function URL origin that fails to boot stops start-up (as does a Web Function origin), while a Lambda@Edge function that fails to boot is warn-and-skipped (its stage does not run). Other custom origins are not run (warn-and-skip; requests routed to one return 502). Tip: omit the target in a terminal to pick interactively.").argument("[target]", "CloudFront distribution to serve. Accepts the CDK Construct path ('MyStack/MyDist'), an ancestor prefix, or the stack-qualified logical id ('MyStack:MyDist'). When omitted in a TTY, an interactive picker opens.").action(withErrorHandling(async (target, options) => {
+		await localStartCloudFrontCommand(target, options, opts.extraStateProviders, opts.synthesizer);
+	}));
+	addStartCloudFrontSpecificOptions(cmd);
+	[
+		...commonOptions(),
+		...appOptions(),
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(regionOption);
+	return cmd;
+}
+function addStartCloudFrontSpecificOptions(cmd) {
+	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <key=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is a KeyValueStore handle — its AWS::CloudFront::KeyValueStore resource logical id, its construct path, or its bare construct id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL / Web Function origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind to a deployed CloudFormation stack (ListStackResources). Resolves an S3 origin that has no local BucketDeployment source to its deployed bucket and serves it from real S3 on demand (the front/back-split case: files uploaded out of band), and resolves a Lambda Function URL / Lambda@Edge function's or a Web Function origin revision's env vars to the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs.")).addOption(new Option("--cache-origin", "For a deployed-S3 origin (served from real S3 under --from-cfn-stack): keep fetched objects in memory for the session instead of re-reading on every request. Faster repeat reads / fewer S3 GETs, but an out-of-band S3 content change is not reflected until a --watch reload (which clears the cache) or a restart. Off by default (every request re-reads, always current). Not CloudFront CDN caching.").default(false)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's (or a Web Function origin revision's) execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
-//#region src/local/web-function-artifact.ts
-const SUPPORTED_CODE_CONFIG_KEYS = ["S3Object"];
-function parseWebFunctionBuildConfig(revisionLogicalId, buildConfig) {
-	const subject = `Web function revision ${displayIdent(revisionLogicalId)}`;
-	const build = asObject$2(buildConfig);
-	const runtime = asObject$2(build?.["RuntimeConfig"])?.["Runtime"];
-	if (typeof runtime !== "string" || runtime.length === 0) throw new CdkLocalError(`${subject} has no literal BuildConfig.RuntimeConfig.Runtime.`, "LOCAL_START_WEB_FUNCTION_NO_RUNTIME");
-	const codeConfig = asObject$2(build?.["CodeConfig"]);
-	if (!codeConfig) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
-	const unknownKeys = Object.keys(codeConfig).filter((k) => !SUPPORTED_CODE_CONFIG_KEYS.includes(k));
-	if (unknownKeys.length > 0) throw new CdkLocalError(`${subject} uses BuildConfig.CodeConfig.${unknownKeys.map((k) => displayIdent(k)).join(", ")}, which ${getEmbedConfig().cliName} start-web-function does not support yet. Supported: ${SUPPORTED_CODE_CONFIG_KEYS.join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_CODE_CONFIG");
-	const s3 = asObject$2(codeConfig["S3Object"]);
-	if (!s3) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig.S3Object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
-	const key = s3["Key"];
-	if (typeof key !== "string" || key.length === 0) throw new CdkLocalError(`${subject} has a CodeConfig.S3Object.Key that is not a literal string (${describeValue$1(key)}). The code must come from a CDK asset in this app (for example an s3assets.Asset passing asset.s3BucketName / asset.s3ObjectKey), whose key synthesizes as a literal.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_NOT_LITERAL");
-	const versionId = s3["VersionId"];
-	return {
-		runtime,
-		s3Object: {
-			bucket: s3["Bucket"],
-			key,
-			...typeof versionId === "string" && { versionId }
-		}
-	};
-}
-function findFileAssetForObjectKey(manifest, key) {
-	for (const [hash, asset] of Object.entries(manifest.files ?? {})) for (const dest of Object.values(asset.destinations ?? {})) if (dest.objectKey === key || dest.objectKey.endsWith(`/${key}`)) return {
-		hash,
-		asset
-	};
-	const hash = key.replace(/^.*\//, "").replace(/\.zip$/, "");
-	const byHash = Object.hasOwn(manifest.files ?? {}, hash) ? manifest.files[hash] : void 0;
-	return byHash ? {
-		hash,
-		asset: byHash
-	} : void 0;
+//#region src/local/agentcore-ws-bridge.ts
+const DEFAULT_PATH = "/ws";
+function decodeBrowserFrame(data, isBinary) {
+	if (typeof data === "string") return data;
+	return (Buffer.isBuffer(data) ? data : Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data)).toString("utf-8");
 }
-async function resolveWebFunctionArtifact(stack, revisionLogicalId, code, loader = new AssetManifestLoader()) {
-	const subject = `Web function revision ${displayUntrustedValue(revisionLogicalId)} code bundle`;
-	const notFound = () => new CdkLocalError(`${subject} (S3Object bucket ${describeValue$1(code.s3Object.bucket)}, key ${displayUntrustedValue(code.s3Object.key)}) matches no file asset in this app's cdk.out. ${getEmbedConfig().cliName} start-web-function runs code that comes from a CDK asset in this app (for example an s3assets.Asset of a directory); it does not download deployed code. Re-synthesize the app, or point the revision at an asset.`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NOT_FOUND");
-	const manifestPath = stack.assetManifestPath;
-	if (!manifestPath) throw notFound();
-	const manifestDir = dirname$1(manifestPath);
-	const manifest = await loader.loadStackManifest(stack, manifestDir);
-	const match = manifest ? findFileAssetForObjectKey(manifest, code.s3Object.key) : void 0;
-	if (!match) throw notFound();
-	if (typeof match.asset.source.path !== "string" || match.asset.source.path.length === 0) throw new CdkLocalError(`${subject} matches file asset ${displayIdent(match.hash)}, which has no source.path (it is produced by source.executable at publish time), so there is no staged bundle in cdk.out to mount. Give the revision an asset of a directory or a .zip file (for example s3assets.Asset with path: '<dir>').`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NO_PATH");
-	const sourcePath = resolveAssetSourcePath({
-		manifestDir,
-		value: match.asset.source.path,
-		assetOutdir: assetPathDirs(stack).assetOutdir,
-		absolute: "honour-warn",
-		field: "source.path",
-		subject,
-		action: "mount it",
-		sink: "bind-mount that directory into the web function container",
-		wrapError: (message) => new CdkLocalError(message, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_ESCAPES_ASSEMBLY")
+function attachAgentCoreWsBridge(httpServer, config) {
+	const path = config.path ?? DEFAULT_PATH;
+	const wss = new WebSocketServer({
+		server: httpServer,
+		path
+	});
+	const liveCloses = /* @__PURE__ */ new Set();
+	wss.on("connection", (browser) => {
+		const sessionId = config.sessionId ?? randomUUID();
+		const containerPort = typeof config.containerPort === "function" ? config.containerPort() : config.containerPort;
+		const handle = bridgeAgentCoreWs(config.containerHost, containerPort, {
+			sessionId,
+			...config.authorization && { authorization: config.authorization },
+			...config.webSocketImpl && { webSocketImpl: config.webSocketImpl },
+			onMessage: (text) => {
+				if (browser.readyState === browser.OPEN) browser.send(text);
+			},
+			onClose: () => {
+				try {
+					browser.close();
+				} catch {}
+			},
+			onError: (err) => {
+				if (browser.readyState === browser.OPEN) try {
+					browser.send(`[bridge error] ${err.message}`);
+				} catch {}
+				try {
+					browser.close();
+				} catch {}
+			}
+		});
+		liveCloses.add(handle.close);
+		browser.on("message", (data, isBinary) => {
+			handle.send(decodeBrowserFrame(data, isBinary));
+		});
+		browser.on("close", () => {
+			liveCloses.delete(handle.close);
+			handle.close();
+		});
+		browser.on("error", () => {
+			liveCloses.delete(handle.close);
+			handle.close();
+		});
 	});
-	if (!existsSync$1(sourcePath)) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} does not exist. Re-synthesize the app and retry.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_MISSING");
-	if (!statSync$1(sourcePath).isDirectory() && !sourcePath.endsWith(".zip")) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} is neither a directory nor a .zip archive, so it is not a code bundle.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_NOT_BUNDLE");
-	const materialized = materializeAssetCodeDir(sourcePath);
 	return {
-		kind: "zip",
-		runtime: code.runtime,
-		codeDir: materialized.dir,
-		...materialized.tmpDir !== void 0 && { tmpDir: materialized.tmpDir },
-		assetHash: match.hash
+		path,
+		close: () => new Promise((res) => {
+			for (const closeLeg of liveCloses) closeLeg();
+			liveCloses.clear();
+			wss.close(() => res());
+		})
 	};
 }
-function disposeWebFunctionArtifact(artifact) {
-	if (artifact?.kind !== "zip" || artifact.tmpDir === void 0) return;
-	try {
-		if (existsSync$1(artifact.tmpDir)) rmSync$1(artifact.tmpDir, {
-			recursive: true,
-			force: true
+function startAgentCoreWsBridge(config) {
+	const host = config.host ?? "127.0.0.1";
+	const httpServer = createServer((_req, res) => {
+		res.writeHead(426, { "Content-Type": "text/plain" });
+		res.end("Upgrade required: connect over WebSocket.\n");
+	});
+	const attached = attachAgentCoreWsBridge(httpServer, config);
+	return new Promise((resolve, reject) => {
+		httpServer.once("error", reject);
+		httpServer.listen(config.port ?? 0, host, () => {
+			httpServer.removeListener("error", reject);
+			httpServer.on("error", (err) => getLogger().debug(`agentcore-ws bridge server error: ${err.message}`));
+			const port = httpServer.address().port;
+			resolve({
+				url: `ws://${formatAuthority(host, port)}${attached.path}`,
+				port,
+				close: () => new Promise((res) => {
+					attached.close().then(() => httpServer.close(() => res()));
+				})
+			});
 		});
-	} catch {}
-}
-function asObject$2(value) {
-	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function describeValue$1(value) {
-	if (typeof value === "string") return displayUntrustedValue(value);
-	let json;
-	try {
-		json = JSON.stringify(value);
-	} catch {
-		json = void 0;
-	}
-	return displayUntrustedValue(json ?? String(value));
+	});
 }
 
 //#endregion
-//#region src/local/web-function-runtime.ts
-const NODE_CODE_MOUNT = "/var/task";
-const NODE_ENTRYPOINT_ENV = "AWS_LAMBDA_NODEJS_ENTRYPOINT";
-const NODE_DEFAULT_ENTRY = "index.js";
-function buildNodeEntryFileStart(runtime, env, codeDir, fileExists = existsSync$1) {
-	const configured = env[NODE_ENTRYPOINT_ENV];
-	const entryFile = configured !== void 0 && configured.length > 0 ? configured : NODE_DEFAULT_ENTRY;
-	const hostPath = resolve$1(codeDir, entryFile);
-	const rel = relative$1(codeDir, hostPath);
-	if (isAbsolute$1(entryFile) || rel === "" || rel === ".." || rel.startsWith(`..${sep$1}`) || isAbsolute$1(rel)) throw new CdkLocalError(`${NODE_ENTRYPOINT_ENV}=${displayUntrustedValue(entryFile)} must name a file inside the code bundle, relative to its root.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_OUTSIDE_BUNDLE");
-	if (!fileExists(hostPath)) throw new CdkLocalError(`The ${runtime} web function entry file ${displayUntrustedValue(entryFile)} was not found in the code bundle ${displayUntrustedValue(codeDir)}. The runtime loads ${NODE_DEFAULT_ENTRY} from the package root unless ${NODE_ENTRYPOINT_ENV} names another file.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_MISSING");
-	const posixRel = sep$1 === "\\" ? rel.split("\\").join("/") : rel;
-	return {
-		entryPoint: ["/var/lang/bin/node"],
-		cmd: [posix.join(NODE_CODE_MOUNT, posixRel)],
-		label: entryFile
-	};
+//#region src/local/agentcore-http-server.ts
+const DEFAULT_ROUTES = [{
+	method: "POST",
+	path: "/invocations"
+}, {
+	method: "GET",
+	path: "/ping"
+}];
+function wireUpstreamResponse(upstream, clientRes) {
+	upstream.on("response", (upRes) => {
+		clientRes.writeHead(upRes.statusCode ?? 502, upRes.headers);
+		upRes.on("error", () => clientRes.destroy());
+		upRes.pipe(clientRes);
+	});
+	upstream.on("error", (err) => {
+		getLogger().debug(`agentcore http serve upstream error: ${err.message}`);
+		if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
+		clientRes.end(JSON.stringify({ error: `upstream error: ${err.message}` }));
+	});
 }
-const WEB_FUNCTION_RUNTIMES = { "nodejs24.x": {
-	runtime: "nodejs24.x",
-	baseImage: "public.ecr.aws/lambda/nodejs:24",
-	codeMountPath: NODE_CODE_MOUNT,
-	architectures: ["arm64"],
-	buildStart: (env, codeDir, deps) => buildNodeEntryFileStart("nodejs24.x", env, codeDir, deps?.fileExists)
-} };
-function supportedWebFunctionRuntimes(table = WEB_FUNCTION_RUNTIMES) {
-	return Object.keys(table).sort();
+function proxyToContainer(clientReq, clientRes, config, upstreamPath, perRequest) {
+	const sessionId = config.sessionId ?? randomUUID();
+	const headers = { ...clientReq.headers };
+	delete headers["host"];
+	headers[AGENTCORE_SESSION_ID_HEADER] = sessionId;
+	const authorization = perRequest?.authorization ?? config.authorization;
+	if (authorization) headers["authorization"] = authorization;
+	if (config.signRequest && clientReq.method === "POST") {
+		const signRequest = config.signRequest;
+		const chunks = [];
+		clientReq.on("data", (c) => chunks.push(c));
+		clientReq.on("error", (err) => {
+			getLogger().debug(`agentcore http serve client error: ${err.message}`);
+			if (!clientRes.headersSent) {
+				clientRes.writeHead(400, { "content-type": "application/json" });
+				clientRes.end(JSON.stringify({ error: `client error: ${err.message}` }));
+			}
+		});
+		clientReq.on("end", () => {
+			const body = Buffer.concat(chunks);
+			signRequest({
+				method: "POST",
+				path: upstreamPath,
+				body,
+				sessionId
+			}).then((signed) => {
+				const signedHeaders = {
+					...headers,
+					...signed
+				};
+				delete signedHeaders["transfer-encoding"];
+				signedHeaders["content-length"] = String(body.length);
+				const upstream = request({
+					host: config.containerHost,
+					port: config.containerPort,
+					path: upstreamPath,
+					method: "POST",
+					headers: signedHeaders
+				});
+				wireUpstreamResponse(upstream, clientRes);
+				upstream.end(body);
+			}).catch((err) => {
+				const msg = err instanceof Error ? err.message : String(err);
+				getLogger().debug(`agentcore http serve sigv4 sign error: ${msg}`);
+				if (!clientRes.headersSent) {
+					clientRes.writeHead(500, { "content-type": "application/json" });
+					clientRes.end(JSON.stringify({ error: `sigv4 signing failed: ${msg}` }));
+				}
+			});
+		});
+		return;
+	}
+	const upstream = request({
+		host: config.containerHost,
+		port: config.containerPort,
+		path: upstreamPath,
+		method: clientReq.method,
+		headers
+	});
+	wireUpstreamResponse(upstream, clientRes);
+	clientReq.on("error", (err) => {
+		getLogger().debug(`agentcore http serve client error: ${err.message}`);
+		upstream.destroy();
+	});
+	clientReq.pipe(upstream);
 }
-function resolveWebFunctionRuntime(runtime, table = WEB_FUNCTION_RUNTIMES) {
-	const spec = Object.hasOwn(table, runtime) ? table[runtime] : void 0;
-	if (!spec) throw new CdkLocalError(`Web function runtime ${displayIdent(runtime)} is not supported by ${getEmbedConfig().cliName} start-web-function yet. Supported: ${supportedWebFunctionRuntimes(table).join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_RUNTIME");
-	return spec;
+function startAgentCoreHttpServer(config) {
+	const host = config.host ?? "127.0.0.1";
+	const routes = config.routes ?? DEFAULT_ROUTES;
+	const attachWs = config.attachWs ?? true;
+	const notFoundHint = buildNotFoundHint(routes, attachWs);
+	const httpServer = createServer((req, res) => {
+		const path = (req.url ?? "/").split("?")[0];
+		const match = routes.find((r) => r.method === req.method && r.path === path);
+		if (!match) {
+			res.writeHead(404, { "content-type": "application/json" });
+			res.end(JSON.stringify({
+				error: "not found",
+				hint: notFoundHint
+			}));
+			return;
+		}
+		if (config.authCheck && req.method === "POST") {
+			req.on("error", (err) => getLogger().debug(`agentcore http serve client error (auth gate): ${err.message}`));
+			config.authCheck(req.headers).then((result) => {
+				if (!result.allow) {
+					req.resume();
+					res.writeHead(result.status ?? 403, { "content-type": "application/json" });
+					res.end(JSON.stringify({ error: result.message ?? "forbidden" }));
+					return;
+				}
+				proxyToContainer(req, res, config, match.path, { ...result.authorization && { authorization: result.authorization } });
+			}).catch((err) => {
+				const msg = err instanceof Error ? err.message : String(err);
+				getLogger().debug(`agentcore http serve auth-check error: ${msg}`);
+				req.resume();
+				if (!res.headersSent) {
+					res.writeHead(500, { "content-type": "application/json" });
+					res.end(JSON.stringify({ error: `auth check failed: ${msg}` }));
+				}
+			});
+			return;
+		}
+		proxyToContainer(req, res, config, match.path);
+	});
+	const bridge = attachWs ? attachAgentCoreWsBridge(httpServer, {
+		containerHost: config.containerHost,
+		containerPort: () => config.containerPort,
+		...config.sessionId && { sessionId: config.sessionId },
+		...config.authorization && { authorization: config.authorization }
+	}) : void 0;
+	return new Promise((resolve, reject) => {
+		httpServer.once("error", reject);
+		httpServer.listen(config.port ?? 0, host, () => {
+			httpServer.removeListener("error", reject);
+			httpServer.on("error", (err) => getLogger().debug(`agentcore http serve server error: ${err.message}`));
+			const port = httpServer.address().port;
+			resolve({
+				httpUrl: `http://${formatAuthority(host, port)}`,
+				...bridge && { wsUrl: `ws://${formatAuthority(host, port)}${bridge.path}` },
+				port,
+				setContainerPort: (newPort) => {
+					config.containerPort = newPort;
+				},
+				close: () => new Promise((res) => {
+					if (bridge) bridge.close().then(() => httpServer.close(() => res()));
+					else httpServer.close(() => res());
+				})
+			});
+		});
+	});
 }
-function defaultWebFunctionPlatform(spec) {
-	return spec.architectures[0] === "x86_64" ? "linux/amd64" : "linux/arm64";
+function buildNotFoundHint(routes, attachWs) {
+	const base = routes.map((r) => `${r.method} ${r.path}`).join(" or ");
+	return attachWs ? `${base} (WebSocket: connect to /ws)` : base;
 }
 
 //#endregion
-//#region src/local/web-function-service-config.ts
-const WEB_FUNCTION_HTTP_ENDPOINT_ENV = "AWS_LAMBDA_HTTP_ENDPOINT";
-const APPLICATION_MANAGED_AUTH = "ApplicationManaged";
-const HOME_REGION_ENDPOINT = "HomeRegion";
-function readWebFunctionServiceConfig(revision) {
-	const sc = asObject$1(revision.Properties?.["ServiceConfig"]) ?? {};
-	const envRaw = sc["EnvironmentVariables"];
-	const envObj = asObject$1(envRaw);
-	const envKeys = envObj ? Object.keys(envObj) : [];
-	const env = envKeys.length === 1 && (envKeys[0] === "Ref" || envKeys[0].startsWith("Fn::")) ? void 0 : envObj;
-	const logGroup = asObject$1(asObject$1(sc["TelemetryConfig"])?.["LoggingConfig"])?.["LogGroup"];
-	return {
-		environmentVariables: env,
-		environmentUnreadable: envRaw !== void 0 && env === void 0,
-		executionRoleArn: sc["ExecutionRoleArn"],
-		egressNetworkConnectorArn: sc["EgressNetworkConnectorArn"],
-		timeoutSeconds: typeof sc["TimeoutSeconds"] === "number" ? sc["TimeoutSeconds"] : void 0,
-		logGroup: typeof logGroup === "string" && logGroup.length > 0 ? logGroup : void 0
+//#region src/local/agentcore-serve-auth.ts
+function buildAgentCoreServeAuthCheck(authorizer, opts = {}) {
+	const injectedBearer = opts.bearerToken ? `Bearer ${opts.bearerToken}` : void 0;
+	if (opts.noVerifyAuth === true) return async () => ({
+		allow: true,
+		...injectedBearer && { authorization: injectedBearer }
+	});
+	const jwksCache = opts.jwksCache ?? createJwksCache();
+	const warnedAt = opts.warnedAt ?? /* @__PURE__ */ new Map();
+	return async (headers) => {
+		const header = readAuthorizationHeader(headers) ?? injectedBearer;
+		if (!header) return {
+			allow: false,
+			status: 401,
+			message: "Missing Authorization: this runtime declares a customJwtAuthorizer. Send a Bearer JWT, or start the serve with --bearer-token / --no-verify-auth."
+		};
+		if (!(await verifyJwtViaDiscovery({
+			discoveryUrl: authorizer.discoveryUrl,
+			...authorizer.allowedAudience && { allowedAudience: authorizer.allowedAudience },
+			...authorizer.allowedClients && { allowedClients: authorizer.allowedClients },
+			...authorizer.allowedScopes && { allowedScopes: authorizer.allowedScopes },
+			...authorizer.customClaims && { customClaims: authorizer.customClaims }
+		}, header, jwksCache, { warnedAt })).allow) return {
+			allow: false,
+			status: 403,
+			message: `Forbidden: the inbound JWT was rejected by the runtime's customJwtAuthorizer (signature / issuer / expiry / audience / scope check failed against ${authorizer.discoveryUrl}).`
+		};
+		return {
+			allow: true,
+			authorization: header
+		};
 	};
 }
-function buildWebFunctionLambdaView(resolved, config, runtime) {
-	return {
-		kind: "zip",
-		stack: resolved.stack,
-		logicalId: resolved.revisionLogicalId,
-		resource: {
-			Type: resolved.revision.Type,
-			Properties: {
-				...config.environmentVariables !== void 0 && { Environment: { Variables: config.environmentVariables } },
-				...config.executionRoleArn !== void 0 && { Role: config.executionRoleArn }
-			},
-			...resolved.revision.Metadata !== void 0 && { Metadata: resolved.revision.Metadata }
-		},
-		memoryMb: 128,
-		timeoutSec: config.timeoutSeconds ?? 0,
-		layers: [],
-		runtime,
-		handler: "",
-		codePath: null,
-		architecture: "arm64"
+function selectServeInboundAuth(resolved, options, sigv4Active, buildAuthCheck = buildAgentCoreServeAuthCheck) {
+	const bearerHeader = options.bearerToken ? `Bearer ${options.bearerToken}` : void 0;
+	if (resolved.jwtAuthorizer) return {
+		authCheck: buildAuthCheck(resolved.jwtAuthorizer, {
+			...options.verifyAuth === false && { noVerifyAuth: true },
+			...options.bearerToken && { bearerToken: options.bearerToken }
+		}),
+		...bearerHeader && { bridgeAuthorization: bearerHeader },
+		sign: false
 	};
-}
-function webFunctionAssumeRole(assumeRole, config) {
-	if (assumeRole === true && isIamRoleArn(config.executionRoleArn)) return config.executionRoleArn;
-	return assumeRole;
-}
-function finalizeWebFunctionEnv(lambdaEnv, opts) {
-	const env = { ...lambdaEnv };
-	delete env["AWS_LAMBDA_FUNCTION_MEMORY_SIZE"];
-	delete env["AWS_LAMBDA_FUNCTION_VERSION"];
-	delete env["AWS_LAMBDA_FUNCTION_TIMEOUT"];
-	env["AWS_LAMBDA_FUNCTION_NAME"] = opts.functionName;
-	env["AWS_LAMBDA_LOG_GROUP_NAME"] = opts.logGroup ?? `/aws/lambda/${opts.functionName}`;
-	if (opts.timeoutSeconds !== void 0) env["AWS_LAMBDA_FUNCTION_TIMEOUT"] = String(opts.timeoutSeconds);
-	const replacedHttpEndpoint = Object.hasOwn(lambdaEnv, WEB_FUNCTION_HTTP_ENDPOINT_ENV);
-	env[WEB_FUNCTION_HTTP_ENDPOINT_ENV] = `0.0.0.0:${opts.containerPort}`;
+	if (sigv4Active) return { sign: true };
 	return {
-		env,
-		replacedHttpEndpoint
+		...bearerHeader && { bridgeAuthorization: bearerHeader },
+		sign: false
 	};
 }
-function webFunctionFidelityWarnings(resolved, config) {
-	const out = [];
-	const rev = displayIdent(resolved.revisionLogicalId);
-	if (config.egressNetworkConnectorArn !== void 0) out.push(`Revision ${rev} sets ServiceConfig.EgressNetworkConnectorArn; the network connector is not emulated, so the container reaches the network through Docker's default bridge.`);
-	if (config.environmentUnreadable) out.push(`Revision ${rev} declares ServiceConfig.EnvironmentVariables as an intrinsic rather than a map; none of its variables reach the container. Supply them with --env-vars.`);
-	const endpoint = resolved.endpoint;
-	if (endpoint) {
-		const ep = displayIdent(endpoint.logicalId);
-		if (endpoint.endpointType !== void 0 && endpoint.endpointType !== "HomeRegion") out.push(`Endpoint ${ep} has EndpointType ${displayIdent(endpoint.endpointType)}; only a single ${HOME_REGION_ENDPOINT} endpoint is reproduced, on one local port.`);
-		if (endpoint.authType !== void 0 && endpoint.authType !== "ApplicationManaged") out.push(`Endpoint ${ep} has AuthType ${displayIdent(endpoint.authType)}; it is not enforced locally — every request reaches the server unauthenticated.`);
-		const routed = endpoint.weights.filter((w) => w.weight > 0);
-		if (routed.length > 1) out.push(`Endpoint ${ep} splits traffic across ${routed.length} revisions; weighted routing is not emulated — every request goes to revision ${rev}.`);
-	}
-	return out;
-}
-function asObject$1(value) {
-	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+function readAuthorizationHeader(headers) {
+	const raw = headers["authorization"];
+	const v = Array.isArray(raw) ? raw[0] : raw;
+	return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 
 //#endregion
-//#region src/local/web-function-runner.ts
-const execFileAsync$1 = promisify$1(execFile$1);
-const WEB_FUNCTION_CONTAINER_PORT = 8080;
-const READY_FAILURE_LOG_LINES = 20;
-const MAX_PROBE_TIMEOUT_MS = 1e4;
-function planWebFunctionContainer(artifact, spec, env, deps) {
-	if (artifact.kind !== "zip") throw new CdkLocalError("A container-image web function source is not supported yet; only a zip bundle from CodeConfig.S3Object runs locally.", "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_ARTIFACT");
-	const start = spec.buildStart(env, artifact.codeDir, deps);
+//#region src/cli/commands/local-start-agentcore.ts
+function parsePort$2(raw) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
+	return n;
+}
+function resolveAgentCoreServePlan(protocol) {
+	if (protocol === "MCP") return {
+		containerPort: MCP_CONTAINER_PORT,
+		containerPortLabel: `${MCP_CONTAINER_PORT}${MCP_PATH}`,
+		routes: [{
+			method: "POST",
+			path: MCP_PATH
+		}],
+		attachWs: false,
+		readyPath: MCP_PATH
+	};
+	if (protocol === "A2A") return {
+		containerPort: A2A_CONTAINER_PORT,
+		containerPortLabel: `${A2A_CONTAINER_PORT}${"/"}`,
+		routes: [{
+			method: "POST",
+			path: "/"
+		}],
+		attachWs: false,
+		readyPath: "/"
+	};
 	return {
-		image: spec.baseImage,
-		mounts: [{
-			hostPath: artifact.codeDir,
-			containerPath: spec.codeMountPath,
-			readOnly: true
+		containerPort: void 0,
+		containerPortLabel: "8080",
+		routes: [{
+			method: "POST",
+			path: "/invocations"
+		}, {
+			method: "GET",
+			path: "/ping"
 		}],
-		entryPoint: start.entryPoint,
-		cmd: start.cmd,
-		workingDir: spec.codeMountPath,
-		label: start.label
+		attachWs: true,
+		readyPath: void 0
 	};
 }
-async function startWebFunctionContainer(opts) {
-	const { plan } = opts;
-	return runDetached({
-		image: plan.image,
-		mounts: plan.mounts,
-		env: opts.env,
-		...opts.sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys: opts.sensitiveEnvKeys },
-		entryPoint: plan.entryPoint,
-		cmd: plan.cmd,
-		...plan.workingDir !== void 0 && { workingDir: plan.workingDir },
-		hostPort: opts.hostPort,
-		containerPort: WEB_FUNCTION_CONTAINER_PORT,
-		host: opts.host,
-		platform: opts.platform,
-		name: opts.name,
-		autoRemove: false
-	});
-}
-var RecentOutput = class {
-	lines = [];
-	partial = "";
-	max;
-	constructor(max = 20) {
-		this.max = max;
-	}
-	push(chunk) {
-		const parts = (this.partial + chunk.toString()).split("\n");
-		this.partial = parts.pop() ?? "";
-		for (const line of parts) this.add(line);
-		if (this.partial.length > 4096) {
-			this.add(this.partial);
-			this.partial = "";
+async function localStartAgentCoreCommand(target, options, extraStateProviders, hostSynthesizer) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	let containerId;
+	let stopLogs;
+	let server;
+	let profileCredsFile;
+	let stateProvider;
+	let watcher;
+	let reloadChain = Promise.resolve();
+	let shuttingDown = false;
+	let tornDown = false;
+	const teardown = async () => {
+		if (tornDown) return;
+		tornDown = true;
+		if (watcher) try {
+			await watcher.close();
+		} catch (err) {
+			logger.debug(`watcher close failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
-	}
-	tail() {
-		return this.partial.length > 0 ? [...this.lines, this.partial].slice(-this.max) : this.lines;
-	}
-	add(line) {
-		this.lines.push(line.replace(/\r$/, ""));
-		if (this.lines.length > this.max) this.lines.shift();
-	}
-};
-async function waitForWebFunctionReady(args, deps = defaultReadyDeps) {
-	const deadline = deps.now() + args.timeoutMs;
-	let attempt = 0;
-	let last = "refused";
-	while (deps.now() < deadline) {
-		const remaining = Math.max(1, deadline - deps.now());
-		last = await deps.probe(args.host, args.port, Math.min(remaining, MAX_PROBE_TIMEOUT_MS));
-		if (last === "answered") return;
-		attempt++;
-		if (attempt % 4 === 0 && !await deps.isRunning(args.containerId)) throw await containerFailure(`The web function container exited before its server listened on AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
-		if (last === "refused") await deps.sleep(250);
-	}
-	const authority = formatAuthority(args.host, args.port);
-	throw await containerFailure(last === "timeout" ? `The web function server on ${authority} accepted the connection but did not answer GET / within ${args.timeoutMs}ms — it is listening but slow to respond. Raise --timeout, or make / answer sooner (started ${args.label}).` : `The web function server never accepted an HTTP connection on ${authority} within ${args.timeoutMs}ms. It must listen on the host:port given in AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
-}
-async function containerFailure(message, containerId, recent, fetchLogs = readContainerLogTail, code = "LOCAL_START_WEB_FUNCTION_NOT_READY") {
-	let lines = [];
-	try {
-		lines = await fetchLogs(containerId, 20);
-	} catch {
-		lines = [];
-	}
-	if (lines.length === 0) lines = recent.tail();
-	return new CdkLocalError(`${message}${lines.length > 0 ? ` Last ${lines.length} line(s) of container output:\n${lines.map((l) => `  ${displayToolOutput(l)}`).join("\n")}` : " The container printed nothing."}`, code);
-}
-function watchContainerExit(containerId) {
-	let stopped = false;
-	const proc = spawn$1(getDockerCmd(), ["wait", containerId], { stdio: [
-		"ignore",
-		"pipe",
-		"ignore"
-	] });
-	let out = "";
-	proc.stdout?.on("data", (c) => out += c.toString());
-	return {
-		exited: new Promise((resolveExit) => {
-			const done = () => {
-				if (stopped) return;
-				const code = Number.parseInt(out.trim(), 10);
-				resolveExit(Number.isNaN(code) ? void 0 : code);
-			};
-			proc.on("close", done);
-			proc.on("error", done);
-		}),
-		stop: () => {
-			stopped = true;
-			if (!proc.killed) proc.kill("SIGTERM");
+		try {
+			await reloadChain;
+		} catch {}
+		if (server) try {
+			await server.close();
+		} catch (err) {
+			logger.debug(`server close failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		if (stopLogs) try {
+			stopLogs();
+		} catch (err) {
+			logger.debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		if (containerId) try {
+			await removeContainer(containerId);
+		} catch (err) {
+			logger.debug(`removeContainer(${containerId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		if (stateProvider) try {
+			stateProvider.dispose();
+		} catch {}
+		if (profileCredsFile) try {
+			await profileCredsFile.dispose();
+		} catch {}
 	};
-}
-function probeHttp(host, port, timeoutMs) {
-	return new Promise((resolveProbe) => {
-		let timedOut = false;
-		let connected = false;
-		const req = request$2({
-			host,
-			port,
-			path: "/",
-			method: "GET",
-			timeout: timeoutMs,
-			headers: { connection: "close" }
-		}, (res) => {
-			res.resume();
-			resolveProbe("answered");
-		});
-		req.on("socket", (socket) => {
-			socket.once("connect", () => {
-				connected = true;
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region,
+		profile: options.profile
+	});
+	await ensureDockerAvailable();
+	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
+	if (options.profile && profileCredentials) profileCredsFile = await writeProfileCredentialsFile(options.profile, profileCredentials);
+	const appCmd = resolveApp(options.app);
+	if (!appCmd) throw new Error(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
+	logger.info("Synthesizing CDK app...");
+	const synthesizer = hostSynthesizer ?? new Synthesizer();
+	const context = parseContextOptions(options.context);
+	const synthOpts = {
+		app: appCmd,
+		output: options.output,
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile },
+		...Object.keys(context).length > 0 && { context }
+	};
+	const { stacks } = await synthesizer.synthesize(synthOpts);
+	const resolvedTarget = await resolveSingleTarget(target, {
+		entries: listTargets(stacks).agentCoreRuntimes,
+		message: "Select an AgentCore Runtime to serve",
+		noun: "AgentCore Runtimes",
+		onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} start-agentcore requires a <target> (an AgentCore Runtime display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_START_AGENTCORE_TARGET_REQUIRED")
+	});
+	const candidate = pickAgentCoreCandidateStack(resolvedTarget, stacks);
+	stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
+	const { context: imageContext, loaded: loadedState } = stateProvider && candidate ? await buildAgentCoreImageContext(candidate, stateProvider, options) : {
+		context: void 0,
+		loaded: void 0
+	};
+	const resolved = resolveAgentCoreTarget(resolvedTarget, stacks, imageContext);
+	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.logicalId}`)} (${resolved.protocol})`);
+	const plan = resolveAgentCoreServePlan(resolved.protocol);
+	const sigv4Context = await resolveAgentCoreSigV4Context(options, resolved, loadedState, stateProvider);
+	const authPlan = selectServeInboundAuth(resolved, options, sigv4Context !== void 0);
+	if (authPlan.authCheck && resolved.jwtAuthorizer) logger.info(`Inbound JWT: each request verified per-request against ${resolved.jwtAuthorizer.discoveryUrl}${options.verifyAuth === false ? " (verification DISABLED via --no-verify-auth)" : ""}.`);
+	await resolveFromS3BucketIntrinsic(resolved, stateProvider, loadedState, imageContext);
+	const image = await resolveAgentCoreImage(resolved, options, loadedState, stateProvider);
+	const { env: dockerEnv, sensitiveEnvKeys } = await buildContainerEnv(resolved, options, profileCredentials, profileCredsFile, stateProvider, loadedState, imageContext);
+	let containerHostPort = await pickFreePort();
+	const containerHost = options.containerHost;
+	const containerName = `${getEmbedConfig().resourceNamePrefix}-agentcore-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+	logger.info(`Starting agent container (image=${image}, port=${containerHostPort} -> ${plan.containerPortLabel})...`);
+	containerId = await runDetached({
+		image,
+		mounts: [],
+		env: dockerEnv,
+		cmd: [],
+		hostPort: containerHostPort,
+		host: containerHost,
+		platform: options.platform,
+		name: containerName,
+		...plan.containerPort !== void 0 && { containerPort: plan.containerPort },
+		...sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys }
+	});
+	stopLogs = streamLogs(containerId);
+	const shutdown = async (signal, exitCode) => {
+		if (shuttingDown) return;
+		shuttingDown = true;
+		logger.info(`Received ${signal}, shutting down...`);
+		await teardown();
+		process.exit(exitCode);
+	};
+	process.on("SIGINT", () => void shutdown("SIGINT", 130));
+	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
+	try {
+		if (plan.readyPath === void 0) await waitForAgentCorePing(containerHost, containerHostPort, options.timeout);
+		else await waitForAgentCoreHttpReady(containerHost, containerHostPort, plan.readyPath, options.timeout);
+		const signRequest = authPlan.sign && sigv4Context ? async ({ method, path, body, sessionId }) => {
+			const signed = await signAgentCoreInvocation({
+				credentials: sigv4Context.credentials,
+				region: sigv4Context.region,
+				host: containerHost,
+				port: containerHostPort,
+				path,
+				body,
+				sessionId,
+				method
 			});
+			const h = {
+				Authorization: signed.authorization,
+				"X-Amz-Date": signed.amzDate,
+				"X-Amz-Content-Sha256": signed.amzContentSha256
+			};
+			if (signed.amzSecurityToken) h["X-Amz-Security-Token"] = signed.amzSecurityToken;
+			return h;
+		} : void 0;
+		server = await startAgentCoreHttpServer({
+			containerHost,
+			containerPort: containerHostPort,
+			host: options.host,
+			port: options.port,
+			routes: plan.routes,
+			attachWs: plan.attachWs,
+			...authPlan.bridgeAuthorization && { authorization: authPlan.bridgeAuthorization },
+			...authPlan.authCheck && { authCheck: authPlan.authCheck },
+			...signRequest && { signRequest },
+			...options.sessionId && { sessionId: options.sessionId }
 		});
-		req.on("timeout", () => {
-			timedOut = true;
-			req.destroy();
-		});
-		req.on("error", () => resolveProbe(timedOut && connected ? "timeout" : "refused"));
-		req.end();
-	});
-}
-async function containerIsRunning(containerId) {
-	try {
-		const { stdout } = await execFileAsync$1(getDockerCmd(), [
-			"inspect",
-			"-f",
-			"{{.State.Running}}",
-			containerId
-		]);
-		return stdout.trim() === "true";
-	} catch {
-		return false;
+	} catch (err) {
+		await teardown();
+		throw err;
 	}
-}
-function readContainerLogTail(containerId, lines, spawnFn = spawn$1) {
-	return new Promise((resolveLogs, rejectLogs) => {
-		const proc = spawnFn(getDockerCmd(), [
-			"logs",
-			"--tail",
-			String(lines),
-			containerId
-		], { stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		] });
-		const chunks = [];
-		let size = 0;
-		const take = (c) => {
-			if (size > 4 * 1024 * 1024) return;
-			chunks.push(c);
-			size += c.length;
+	if (server.wsUrl) {
+		logger.info(`Server listening on ${server.wsUrl}  (${displayIdent(resolved.logicalId)} (AgentCore WebSocket))`);
+		logger.info(`HTTP contract served on ${server.httpUrl} — POST ${server.httpUrl}/invocations, GET ${server.httpUrl}/ping`);
+	} else {
+		const contractPath = plan.routes[0]?.path ?? "/";
+		const contractUrl = `${server.httpUrl}${contractPath}`;
+		logger.info(`Server listening on ${server.httpUrl}  (${displayIdent(resolved.logicalId)})`);
+		logger.info(`${resolved.protocol} contract served on ${contractUrl} — POST ${contractUrl}`);
+	}
+	logger.info("Press ^C to shut down.");
+	if (options.watch) {
+		const cdkOutDir = options.output;
+		const assetLoader = new AssetManifestLoader();
+		let currentAssetHash = await deriveOldAssetHash({
+			resolvedTarget,
+			resolved,
+			stacks,
+			cdkOutDir,
+			assetLoader
+		});
+		const waitReady = async (port) => {
+			if (plan.readyPath === void 0) await waitForAgentCorePing(containerHost, port, options.timeout);
+			else await waitForAgentCoreHttpReady(containerHost, port, plan.readyPath, options.timeout);
 		};
-		proc.stdout?.on("data", take);
-		proc.stderr?.on("data", take);
-		proc.on("error", rejectLogs);
-		proc.on("close", (code) => {
-			if (code !== 0) {
-				rejectLogs(/* @__PURE__ */ new Error(`docker logs exited ${code}`));
-				return;
+		const watchRoot = process.cwd();
+		const { ignored, shouldTrigger, excludePatterns } = createWatchPredicates({
+			watchRoot,
+			output: options.output,
+			watchConfig: resolveWatchConfig()
+		});
+		logger.info(`Watching ${watchRoot} for source changes (excluding ${excludePatterns.join(", ")}). The warm container reloads in place; the serve stays up.`);
+		watcher = createFileWatcher({
+			paths: [watchRoot],
+			ignored,
+			shouldTrigger,
+			onChange: (changedPaths) => {
+				reloadChain = reloadChain.then(async () => {
+					if (tornDown || shuttingDown) return;
+					let freshStacks;
+					let freshResolved;
+					let freshLoaded;
+					let freshImageContext;
+					let verdict;
+					let nextAssetHash = currentAssetHash;
+					try {
+						freshStacks = (await synthesizer.synthesize(synthOpts)).stacks;
+						const freshCandidate = pickAgentCoreCandidateStack(resolvedTarget, freshStacks);
+						const ctx = stateProvider && freshCandidate ? await buildAgentCoreImageContext(freshCandidate, stateProvider, options) : {
+							context: void 0,
+							loaded: void 0
+						};
+						freshImageContext = ctx.context;
+						freshLoaded = ctx.loaded;
+						freshResolved = resolveAgentCoreTarget(resolvedTarget, freshStacks, freshImageContext);
+						await resolveFromS3BucketIntrinsic(freshResolved, stateProvider, freshLoaded, freshImageContext);
+						const assetCtx = await loadAgentCoreAssetContext({
+							resolvedTarget,
+							resolved: freshResolved,
+							stacks: freshStacks,
+							cdkOutDir,
+							assetLoader,
+							oldAssetHash: currentAssetHash
+						});
+						if (assetCtx?.newAssetHash !== void 0) nextAssetHash = assetCtx.newAssetHash;
+						verdict = classifySourceChange(changedPaths, assetCtx);
+						logger.info(`Detected source change (${changedPaths.length} path(s)); verdict=${verdict.kind} (${verdict.reason}).`);
+					} catch (err) {
+						logger.error(`Reload: re-synth / classify failed (${err instanceof Error ? err.message : String(err)}); skipping this change. The serve stays up against the current container.`);
+						return;
+					}
+					if (tornDown || shuttingDown) return;
+					try {
+						if (verdict.kind === "soft-reload") {
+							if (!containerId) throw new CdkLocalError("Reload: no live container to docker cp / docker restart into.", "LOCAL_START_AGENTCORE_WATCH_NO_CONTAINER");
+							await softReloadAgentContainer(containerId, verdict.newAssetSourceDir);
+							await waitReady(containerHostPort);
+							logger.info("Reload: soft-reloaded the agent container (docker cp + docker restart; container ID + host port preserved).");
+						} else {
+							if (stopLogs) {
+								try {
+									stopLogs();
+								} catch {}
+								stopLogs = void 0;
+							}
+							if (containerId) {
+								await removeContainer(containerId);
+								containerId = void 0;
+							}
+							const newImage = await resolveAgentCoreImage(freshResolved, options, freshLoaded, stateProvider);
+							const { env: newEnv, sensitiveEnvKeys: newSensitive } = await buildContainerEnv(freshResolved, options, profileCredentials, profileCredsFile, stateProvider, freshLoaded, freshImageContext);
+							const newPort = await pickFreePort();
+							const newName = `${getEmbedConfig().resourceNamePrefix}-agentcore-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+							logger.info(`Reload: starting agent container (image=${newImage}, port=${newPort} -> ${plan.containerPortLabel})...`);
+							containerId = await runDetached({
+								image: newImage,
+								mounts: [],
+								env: newEnv,
+								cmd: [],
+								hostPort: newPort,
+								host: containerHost,
+								platform: options.platform,
+								name: newName,
+								...plan.containerPort !== void 0 && { containerPort: plan.containerPort },
+								...newSensitive.size > 0 && { sensitiveEnvKeys: newSensitive }
+							});
+							stopLogs = streamLogs(containerId);
+							containerHostPort = newPort;
+							await waitReady(newPort);
+							server?.setContainerPort(newPort);
+							logger.info(`Reload: rebuilt the agent container; serve re-pointed to port ${newPort}.`);
+						}
+						currentAssetHash = nextAssetHash;
+						logger.info("Reload complete.");
+					} catch (err) {
+						logger.error(`Reload failed: ${err instanceof Error ? err.message : String(err)}. The serve stays up; edit + save again to retry.`);
+					}
+				});
 			}
-			resolveLogs(Buffer.concat(chunks).toString().split("\n").map((l) => l.replace(/\r$/, "")).filter((l) => l.length > 0).slice(-lines));
 		});
-	});
+	}
+	await new Promise(() => void 0);
+}
+function createLocalStartAgentCoreCommand(opts = {}) {
+	setEmbedConfig(opts.embedConfig);
+	const cmd = new Command("start-agentcore").description("Serve a Bedrock AgentCore Runtime's contract locally against a warm container. Boots the AWS::BedrockAgentCore::Runtime container ONCE (same image / env / credential resolution as invoke-agentcore) and keeps it warm, so a client can hit it repeatedly. HTTP / AGUI runtimes serve POST /invocations + GET /ping plus the bidirectional /ws endpoint behind a host bridge (injects the AgentCore session-id, and Authorization under a customJwtAuthorizer, so a header-less client like a browser can connect); MCP runtimes serve POST /mcp, A2A POST /. Target accepts a CDK display path (MyStack/MyAgent) or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C.").argument("[target]", "CDK display path or stack-qualified logical ID of the AgentCore Runtime to serve (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
+		await localStartAgentCoreCommand(target, options, opts.extraStateProviders, opts.synthesizer);
+	}));
+	addStartAgentCoreSpecificOptions(cmd);
+	[
+		...commonOptions(),
+		...appOptions(),
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(regionOption);
+	return cmd;
+}
+function addStartAgentCoreSpecificOptions(cmd) {
+	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort$2)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--watch", "Re-synth + reload the warm container in place on a CDK source change, keeping the serve up. A per-firing classifier picks rebuild (boot a fresh container, re-point the serve) vs soft-reload (docker cp + docker restart the same container) — the same pattern as start-service / invoke-agentcore --ws --watch.")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
-const defaultReadyDeps = {
-	probe: probeHttp,
-	isRunning: containerIsRunning,
-	fetchLogs: readContainerLogTail,
-	sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
-	now: () => Date.now()
-};
 
 //#endregion
 //#region src/cli/commands/local-start-web-function.ts
@@ -25812,43 +26382,10 @@ function parsePort$1(raw) {
 	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
 	return n;
 }
-function connectHost$1(host) {
-	if (host === "0.0.0.0") return "127.0.0.1";
-	if (host === "::" || host === "[::]") return "::1";
-	return host;
-}
 async function localStartWebFunctionCommand(target, options, extraStateProviders, hostSynthesizer) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
-	let containerId;
-	let stopLogs;
-	let exitWatch;
-	let artifact;
-	let runInFlight;
-	let teardownPromise;
-	let shuttingDown = false;
-	let waitingOnRun = false;
-	let containerName;
 	const forever = () => new Promise(() => void 0);
-	const doTeardown = async () => {
-		exitWatch?.stop();
-		if (containerId === void 0 && runInFlight !== void 0) {
-			waitingOnRun = true;
-			try {
-				containerId = await runInFlight;
-			} catch {} finally {
-				waitingOnRun = false;
-			}
-		}
-		if (stopLogs) try {
-			stopLogs();
-		} catch (err) {
-			logger.debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		if (containerId) await removeContainer(containerId);
-		disposeWebFunctionArtifact(artifact);
-	};
-	const teardown = () => teardownPromise ??= doTeardown();
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region,
@@ -25875,93 +26412,60 @@ async function localStartWebFunctionCommand(target, options, extraStateProviders
 		noun: "Lambda web functions",
 		onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} start-web-function requires a <target> (a WebFunction, WebFunctionEndpoint or WebFunctionRevision display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_START_WEB_FUNCTION_TARGET_REQUIRED")
 	}), stacks, options.revision);
-	const code = parseWebFunctionBuildConfig(resolved.revisionLogicalId, resolved.revision.Properties?.["BuildConfig"]);
-	const spec = resolveWebFunctionRuntime(code.runtime);
+	const prepared = prepareWebFunctionServe(resolved);
 	const selectionNote = {
 		"target-revision": "the target revision",
 		"revision-flag": "--revision",
 		"endpoint-weight": `highest weight on endpoint ${displayIdent(resolved.endpoint?.logicalId ?? "")}`,
 		"only-revision": "the function's only revision"
 	};
-	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.revisionLogicalId}`)} (${spec.runtime}; revision chosen by ${selectionNote[resolved.selection]})`);
-	const serviceConfig = readWebFunctionServiceConfig(resolved.revision);
-	for (const line of webFunctionFidelityWarnings(resolved, serviceConfig)) logger.warn(line);
-	artifact = await resolveWebFunctionArtifact(resolved.stack, resolved.revisionLogicalId, code);
+	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.revisionLogicalId}`)} (${prepared.spec.runtime}; revision chosen by ${selectionNote[resolved.selection]})`);
+	for (const line of webFunctionFidelityWarnings(resolved, prepared.serviceConfig)) logger.warn(line);
+	const serve = new WebFunctionServe(prepared, {
+		envOptions: options,
+		...profileCredentials !== void 0 && { profileCredentials },
+		...extraStateProviders !== void 0 && { extraStateProviders },
+		host: options.host,
+		port: options.port,
+		...options.platform !== void 0 && { platform: options.platform },
+		skipPull: options.pull === false,
+		timeoutMs: options.timeout
+	});
+	let shuttingDown = false;
 	const shutdown = async (signal, exitCode) => {
 		if (shuttingDown) {
-			if (!waitingOnRun) {
+			if (!serve.waitingOnRun) {
 				logger.info(`Received ${signal} again; still removing the container, please wait...`);
 				return;
 			}
-			disposeWebFunctionArtifact(artifact);
-			logger.warn(`Received ${signal} again; exiting without waiting for docker run to return. The container may still be starting, and its environment holds the forwarded AWS credentials. Remove it by its name (this works even if it is created after this exit): docker rm -f ${containerName ?? "<name>"}`);
+			serve.disposeArtifactNow();
+			logger.warn(`Received ${signal} again; exiting without waiting for docker run to return. The container may still be starting, and its environment holds the forwarded AWS credentials. Remove it by its name (this works even if it is created after this exit): docker rm -f ${serve.containerName ?? "<name>"}`);
 			process.exit(signal === "SIGINT" ? 130 : 143);
 			return;
 		}
 		shuttingDown = true;
 		logger.info(`Received ${signal}, shutting down...`);
-		await teardown();
+		await serve.teardown();
 		process.exit(exitCode);
 	};
 	process.on("SIGINT", () => void shutdown("SIGINT", 130));
 	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
-	const recent = new RecentOutput();
 	try {
-		const assumeRole = webFunctionAssumeRole(options.assumeRole, serviceConfig);
-		const containerEnv = await resolveLambdaContainerEnv(buildWebFunctionLambdaView(resolved, serviceConfig, spec.runtime), {
-			...options,
-			...assumeRole !== void 0 && { assumeRole },
-			deployedFunctionLookups: false
-		}, profileCredentials, extraStateProviders);
-		const { env, replacedHttpEndpoint } = finalizeWebFunctionEnv(containerEnv.env, {
-			functionName: resolved.functionName,
-			containerPort: WEB_FUNCTION_CONTAINER_PORT,
-			timeoutSeconds: serviceConfig.timeoutSeconds,
-			logGroup: serviceConfig.logGroup
-		});
-		if (replacedHttpEndpoint) logger.warn(`The revision's ${WEB_FUNCTION_HTTP_ENDPOINT_ENV} is replaced with 0.0.0.0:${WEB_FUNCTION_CONTAINER_PORT}: the runtime owns that variable, and the local port is published to it.`);
-		const plan = planWebFunctionContainer(artifact, spec, env);
-		const platform = options.platform ?? defaultWebFunctionPlatform(spec);
-		await pullImage(plan.image, options.pull === false, platform);
-		if (teardownPromise) return await forever();
-		const hostPort = options.port === 0 ? await pickFreePort() : options.port;
-		const name = containerName = `${getEmbedConfig().resourceNamePrefix}-webfn-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
-		logger.info(`Starting web function container (image=${plan.image}, start=${plan.label}, port=${hostPort} -> ${WEB_FUNCTION_CONTAINER_PORT})...`);
-		runInFlight = startWebFunctionContainer({
-			plan,
-			env,
-			sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys),
-			host: options.host,
-			hostPort,
-			platform,
-			name
-		});
-		const id = await runInFlight;
-		if (teardownPromise) return await forever();
-		containerId = id;
-		stopLogs = streamLogs(id, { onOutput: (chunk) => recent.push(chunk) });
-		exitWatch = watchContainerExit(id);
-		const probeHost = connectHost$1(options.host);
-		await waitForWebFunctionReady({
-			containerId: id,
-			host: probeHost,
-			port: hostPort,
-			timeoutMs: options.timeout,
-			recent,
-			label: plan.label
-		});
-		logger.info(`Server listening on http://${formatAuthority(probeHost, hostPort)}  (${displayIdent(resolved.functionName)} (Lambda web function))`);
+		const address = await serve.start();
+		if (!address) return await forever();
+		logger.info(`Server listening on http://${formatAuthority(address.host, address.port)}  (${displayIdent(resolved.functionName)} (Lambda web function))`);
 		logger.info("Press ^C to shut down.");
 	} catch (err) {
 		if (shuttingDown) return await forever();
-		await teardown();
+		await serve.teardown();
 		throw err;
 	}
-	if (!exitWatch || !containerId) return await forever();
-	const exitCode = await exitWatch.exited;
-	if (shuttingDown || teardownPromise) return await forever();
-	const failure = await containerFailure(`The web function container exited (exit code ${exitCode ?? "unknown"}) while serving.`, containerId, recent, void 0, "LOCAL_START_WEB_FUNCTION_EXITED");
-	await teardown();
+	const exited = serve.exited;
+	if (!exited) return await forever();
+	const exitCode = await exited;
+	if (shuttingDown || serve.tornDown) return await forever();
+	const failure = await serve.exitFailure(`The web function container exited (exit code ${exitCode ?? "unknown"}) while serving.`);
+	await serve.teardown();
 	throw failure;
 }
 function createLocalStartWebFunctionCommand(opts = {}) {
@@ -32483,5 +32987,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { postHook as $, resolveDynamicReferencesInEnv as $a, architectureToPlatform as $i, parseRestartPolicy as $n, createAuthorizerCache as $r, resolveCloudFrontTarget as $t, microvmFidelityWarnings as A, pickRefLogicalId as Aa, matchPreflight as Ai, stripCloudFrontImport as An, MCP_PATH as Ar, supportedWebFunctionRuntimes as At, MICROVM_WS_BASE_PROTOCOL as B, derivePseudoParametersFromRegion as Ba, VtlEvaluationError as Bi, resolveAlbFrontDoor as Bn, downloadAndExtractS3Bundle as Br, addStartAgentCoreSpecificOptions as Bt, addListSpecificOptions as C, availableWebSocketApiIdentifiers as Ca, invokeRequestAuthorizer as Ci, pickKvsLogicalIdFromArn as Cn, createLocalInvokeAgentCoreCommand as Cr, readWebFunctionServiceConfig as Ct, buildMicrovmLambdaView as D, parseSelectionExpressionPath as Da, buildCorsConfigByApiId as Di, compileCloudFrontFunction as Dn, A2A_PATH as Dr, buildNodeEntryFileStart as Dt, addStartMicrovmSpecificOptions as E, filterWebSocketApisByIdentifiers as Ea, applyCorsResponseHeaders as Ei, resolveCloudFrontDistribution as En, A2A_CONTAINER_PORT as Er, WEB_FUNCTION_RUNTIMES as Et, microvmImageTag as F, AGENTCORE_MCP_PROTOCOL as Fa, buildRestV1Event as Fi, albStrategy as Fn, signAgentCoreInvocation as Fr, WEB_FUNCTION_ENDPOINT_TYPE as Ft, startMicrovmFrontDoor as G, DynamicReferenceResolutionError as Ga, bufferToBody as Gi, createLocalRunTaskCommand as Gn, toCmdArgv as Gr, attachAgentCoreWsBridge as Gt, PROXY_PORT_HEADER as H, substituteImagePlaceholders as Ha, HOST_GATEWAY_MIN_VERSION as Hi, createLocalStartServiceCommand as Hn, buildAgentCoreCodeImage as Hr, buildAgentCoreServeAuthCheck as Ht, planMicrovmPorts as I, AGENTCORE_RUNTIME_TYPE as Ia, evaluateResponseParameters as Ii, createLocalStartAlbCommand as In, AGENTCORE_SESSION_ID_HEADER as Ir, WEB_FUNCTION_REVISION_TYPE as It, MICROVM_HOOK_PATH_PREFIX as J, deployedFillMayBeSecret as Ja, handleConnectionsRequest as Ji, addEcsAssumeRoleOptions as Jn, createLocalInvokeCommand as Jr, addStartCloudFrontSpecificOptions as Jt, stripMicrovmProxyHeaders as K, DynamicReferenceResolver as Ka, ConnectionRegistry as Ki, MAX_TASKS_SUBNET_RANGE_CAP as Kn, classifySourceChange as Kr, startAgentCoreWsBridge as Kt, readExposedPorts as L, AgentCoreResolutionError as La, pickResponseTemplate as Li, parseLbPortOverrides as Ln, invokeAgentCore as Lr, WEB_FUNCTION_TYPE as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, AGENTCORE_A2A_PROTOCOL as Ma, translateLambdaResponse as Mi, createLocalFileKvsDataSource as Mn, mcpInvokeOnce as Mr, findFileAssetForObjectKey as Mt, LocalMicrovm as N, AGENTCORE_AGUI_PROTOCOL as Na, applyAuthorizerOverlay as Ni, createUnboundCloudFrontModule as Nn, parseSseForJsonRpc as Nr, parseWebFunctionBuildConfig as Nt, createLocalStartMicrovmCommand as O, webSocketApiMatchesIdentifier as Oa, buildCorsConfigFromCloudFrontChain as Oi, runViewerRequest as On, a2aInvokeOnce as Or, defaultWebFunctionPlatform as Ot, buildMicrovmImage as P, AGENTCORE_HTTP_PROTOCOL as Pa, buildHttpApiV2Event as Pi, addAlbSpecificOptions as Pn, AGENTCORE_SIGV4_SERVICE as Pr, resolveWebFunctionArtifact as Pt, pollBuildHook as Q, parseDynamicReference as Qa, buildMessageEvent as Qi, parseMaxTasks as Qn, resolveApiTargetSubset as Qr, parseOriginOverrides as Qt, setContainerPaused as R, pickAgentCoreCandidateStack as Ra, selectIntegrationResponse as Ri, resolveAlbTarget as Rn, waitForAgentCoreHttpReady as Rr, WebFunctionResolutionError as Rt, StudioEventBus as S, listTargets as Sa, evaluateCachedLambdaPolicy as Si, pickFunctionUrlLogicalIdFromOrigin as Sn, addInvokeAgentCoreSpecificOptions as Sr, finalizeWebFunctionEnv as St, formatTargetListing as T, discoverWebSocketApisOrThrow as Ta, attachAuthorizers as Ti, pickTargetFunctionLogicalId as Tn, invokeAgentCoreWs as Tr, webFunctionFidelityWarnings as Tt, rewriteUpgradeResponseHead as U, tryResolveImageFnJoin as Ua, probeHostGatewaySupport as Ui, serviceStrategy as Un, computeCodeImageTag as Ur, selectServeInboundAuth as Ut, MicrovmStateError as V, formatStateRemedy as Va, HOST_DOCKER_INTERNAL_GATEWAY as Vi, addStartServiceSpecificOptions as Vn, SUPPORTED_CODE_RUNTIMES as Vr, createLocalStartAgentCoreCommand as Vt, selectTargetPort as W, LocalInvokeBuildError as Wa, resolveHostGatewayExtraHosts as Wi, addRunTaskSpecificOptions as Wn, renderCodeDockerfile as Wr, startAgentCoreHttpServer as Wt, callRuntimeHook as X, keysNotFromTemplate as Xa, buildConnectEvent as Xi, buildEcsImageResolutionContext$1 as Xn, createLocalStartApiCommand as Xr, normalizeKvsFileKeys as Xt, MicrovmHookError as Y, firstUsableRegion as Ya, parseConnectionsPath as Yi, addImageOverrideOptions as Yn, addStartApiSpecificOptions as Yr, createLocalStartCloudFrontCommand as Yt, generateMicrovmId as Z, keysOverriddenBy as Za, buildDisconnectEvent as Zi, ecsClusterOption as Zn, createWatchPredicates as Zr, parseKvsFileOverrides as Zt, filterStudioTargetGroups as _, collectSsmParameterRefs as _a, verifyCognitoJwt as _i, httpHeadersToEdge as _n, DEFAULT_SHADOW_READY_TIMEOUT_MS as _r, startWebFunctionContainer as _t, createLocalStudioCommand as a, substituteAgainstState as aa, availableApiIdentifiers as ai, classifyS3Error as an, recordAssumedRole as ao, canonicalizeImageOverrideKeys as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, resolveSingleTarget as ba, buildMethodArn as bi, extractKvsAssociations as bn, getContainerNetworkIp as br, WEB_FUNCTION_HTTP_ENDPOINT_ENV as bt, startStudioProxy as c, substituteEnvVarsFromStateAsync as ca, groupRoutesByServer as ci, startCloudFrontServer as cn, workloadStsClientConfig as co, parseImageOverrideFlags as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, isCfnFlagPresent as da, resolveSelectionExpression as di, serveLambdaUrlOrigin as dn, buildProxyClientConfig as do, describePinnedImageUri as dr, createLocalStartWebFunctionCommand as dt, buildContainerImage as ea, createFileWatcher as ei, idFromArn as en, withoutKeys as eo, resolveEcsAssumeRoleOption as er, runHookBody as et, filterStudioCustomResources as f, rejectExplicitCfnStackWithMultipleStacks as fa, resolveServiceIntegrationParameters as fi, applyEdgeRequestResult as fn, isProxyEnvConfigured as fo, imageOverrideKeyAliases as fr, RecentOutput as ft, annotatePinnedEcsTargets as g, CfnLocalStateProvider as ga, createJwksCache as gi, edgeHeadersToHttp as gn, CloudMapRegistry as gr, readContainerLogTail as gt, annotateEcsTaskPinnedTargets as h, resolveCfnStackName as ha, buildJwksUrlFromIssuer as hi, buildEdgeResponseEvent as hn, buildCloudMapIndex as hr, planWebFunctionContainer as ht, coerceStopRequest as i, EcsTaskResolutionError as ia, resolveEnvVars$1 as ii, resolveDeployedOriginBucket as in, readEnvCallerCredentials as io, buildImageOverrideTag as ir, MicrovmResolutionError as it, readRunHookPayload as j, resolveLambdaArnIntrinsic as ja, matchRoute as ji, createCloudFrontModule as jn, MCP_PROTOCOL_VERSION as jr, disposeWebFunctionArtifact as jt, finalizeMicrovmEnv as k, discoverRoutes as ka, isFunctionUrlOacFronted as ki, runViewerResponse as kn, MCP_CONTAINER_PORT as kr, resolveWebFunctionRuntime as kt, relayServeRequest as l, LocalStateSourceError as la, readMtlsMaterialsFromDisk as li, resolveErrorResponseCandidates as ln, buildStsClientConfig as lo, resolveImageOverrides as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, resolveCfnRegion as ma, buildCognitoJwksUrl as mi, buildEdgeRequestEvent as mn, listPinnedTargets as mr, containerFailure as mt, coerceRunRequest as n, resolveRuntimeFileExtension as na, buildStageMap as ni, createDeployedKvsDataSource as nn, assumedRoleRecorded as no, runEcsServiceEmulator as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, substituteAgainstStateAsync as oa, filterRoutesByApiIdentifier as oi, createS3OriginReader as on, resetWorkloadIdentity as oo, enforceImageOverrideOrphans as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, resolveCfnFallbackRegion as pa, defaultCredentialsLoader as pi, applyEdgeResponseResult as pn, isLocalCdkAssetImage as pr, WEB_FUNCTION_CONTAINER_PORT as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, containsDynamicReference as qa, buildMgmtEndpointEnvUrl as qi, addCommonEcsServiceOptions as qn, addInvokeSpecificOptions as qr, LocalStartCloudFrontError as qt, coerceServeRequest as r, resolveRuntimeImage as ra, materializeLayerFromArn as ri, resolveDeployedKvsArnByName as rn, deployAccountStsClientConfig as ro, ImageOverrideError as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, substituteEnvVarsFromState as sa, filterRoutesByApiIdentifiers as si, matchBehavior as sn, workloadClientConfig as so, mergeForService as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, resolveRuntimeCodeMountPath as ta, attachStageContext as ti, resolveKvsModulesForDistribution as tn, SECOND_ASSUME_MESSAGE as to, resolveSharedSidecarCredentials as tr, waitForAppAnswer as tt, reinvoke as u, createLocalStateProvider as ua, startApiServer as ui, serveFromStaticOrigin as un, resolveProfileCredentials as uo, runImageOverrideBuilds as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveSsmParameters as va, verifyJwtAuthorizer as vi, CLOUDFRONT_DISTRIBUTION_TYPE as vn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as vr, waitForWebFunctionReady as vt, createLocalListCommand as w, discoverWebSocketApis as wa, invokeTokenAuthorizer as wi, pickLambdaEdgeFunctionLogicalId as wn, bridgeAgentCoreWs as wr, webFunctionAssumeRole as wt, createStudioStore as x, countTargets as xa, computeRequestIdentityHash as xi, isCloudFrontDistribution as xn, attachContainerLogStreamer as xr, buildWebFunctionLambdaView as xt, toStudioTargetGroups as y, resolveWatchConfig as ya, verifyJwtViaDiscovery as yi, describeS3OriginDomain as yn, setShadowReadyTimeoutMs as yr, watchContainerExit as yt, MICROVM_CONTROL_PATH as z, resolveAgentCoreTarget as za, tryParseStatus as zi, isApplicationLoadBalancer as zn, waitForAgentCorePing as zr, resolveWebFunctionTarget as zt };
-//# sourceMappingURL=local-studio-BhFxp-jM.js.map
+export { postHook as $, firstUsableRegion as $a, parseConnectionsPath as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, filterWebSocketApisByIdentifiers as Aa, applyCorsResponseHeaders as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AGENTCORE_RUNTIME_TYPE as Ba, evaluateResponseParameters as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveWatchConfig as Ca, verifyJwtViaDiscovery as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, availableWebSocketApiIdentifiers as Da, invokeRequestAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, listTargets as Ea, evaluateCachedLambdaPolicy as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, resolveLambdaArnIntrinsic as Fa, matchRoute as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, formatStateRemedy as Ga, HOST_DOCKER_INTERNAL_GATEWAY as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, pickAgentCoreCandidateStack as Ha, selectIntegrationResponse as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, AGENTCORE_A2A_PROTOCOL as Ia, translateLambdaResponse as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, LocalInvokeBuildError as Ja, resolveHostGatewayExtraHosts as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, substituteImagePlaceholders as Ka, HOST_GATEWAY_MIN_VERSION as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_AGUI_PROTOCOL as La, applyAuthorizerOverlay as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, webSocketApiMatchesIdentifier as Ma, buildCorsConfigFromCloudFrontChain as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, discoverRoutes as Na, isFunctionUrlOacFronted as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, discoverWebSocketApis as Oa, invokeTokenAuthorizer as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, pickRefLogicalId as Pa, matchPreflight as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, deployedFillMayBeSecret as Qa, handleConnectionsRequest as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_HTTP_PROTOCOL as Ra, buildHttpApiV2Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, resolveSsmParameters as Sa, verifyJwtAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, countTargets as Ta, computeRequestIdentityHash as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, resolveAgentCoreTarget as Ua, tryParseStatus as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, AgentCoreResolutionError as Va, pickResponseTemplate as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, derivePseudoParametersFromRegion as Wa, VtlEvaluationError as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, DynamicReferenceResolver as Xa, ConnectionRegistry as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, DynamicReferenceResolutionError as Ya, bufferToBody as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, containsDynamicReference as Za, buildMgmtEndpointEnvUrl as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveCfnFallbackRegion as _a, defaultCredentialsLoader as _i, pickKvsLogicalIdFromArn as _n, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, resolveRuntimeCodeMountPath as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, SECOND_ASSUME_MESSAGE as ao, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, CfnLocalStateProvider as ba, createJwksCache as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, EcsTaskResolutionError as ca, resolveEnvVars$1 as ci, buildEdgeRequestEvent as cn, readEnvCallerCredentials as co, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, substituteEnvVarsFromState as da, filterRoutesByApiIdentifiers as di, httpHeadersToEdge as dn, workloadClientConfig as do, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildConnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, keysNotFromTemplate as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, substituteEnvVarsFromStateAsync as fa, groupRoutesByServer as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, workloadStsClientConfig as fo, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, rejectExplicitCfnStackWithMultipleStacks as ga, resolveServiceIntegrationParameters as gi, pickFunctionUrlLogicalIdFromOrigin as gn, isProxyEnvConfigured as go, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, isCfnFlagPresent as ha, resolveSelectionExpression as hi, isCloudFrontDistribution as hn, buildProxyClientConfig as ho, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, buildContainerImage as ia, createFileWatcher as ii, serveFromStaticOrigin as in, withoutKeys as io, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, parseSelectionExpressionPath as ja, buildCorsConfigByApiId as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, discoverWebSocketApisOrThrow as ka, attachAuthorizers as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, substituteAgainstState as la, availableApiIdentifiers as li, buildEdgeResponseEvent as ln, recordAssumedRole as lo, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, createLocalStateProvider as ma, startApiServer as mi, extractKvsAssociations as mn, resolveProfileCredentials as mo, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, buildMessageEvent as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, parseDynamicReference as no, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, resolveRuntimeFileExtension as oa, buildStageMap as oi, applyEdgeRequestResult as on, assumedRoleRecorded as oo, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, LocalStateSourceError as pa, readMtlsMaterialsFromDisk as pi, describeS3OriginDomain as pn, buildStsClientConfig as po, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, tryResolveImageFnJoin as qa, probeHostGatewaySupport as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, architectureToPlatform as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, resolveDynamicReferencesInEnv as ro, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, resolveRuntimeImage as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, deployAccountStsClientConfig as so, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildDisconnectEvent as ta, createWatchPredicates as ti, matchBehavior as tn, keysOverriddenBy as to, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteAgainstStateAsync as ua, filterRoutesByApiIdentifier as ui, edgeHeadersToHttp as un, resetWorkloadIdentity as uo, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnRegion as va, buildCognitoJwksUrl as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, resolveSingleTarget as wa, buildMethodArn as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, collectSsmParameterRefs as xa, verifyCognitoJwt as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, resolveCfnStackName as ya, buildJwksUrlFromIssuer as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_MCP_PROTOCOL as za, buildRestV1Event as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
+//# sourceMappingURL=local-studio-vhvbqvPb.js.map