cdk-local 0.75.0 → 0.76.0

package/dist/{local-list-CFINvNxo.js → local-list-Dh6xjxGf.js}

@@ -6483,7 +6483,7 @@ function resolveRuntimeCodeMountPath(runtime) {
 
 //#endregion
 //#region src/local/docker-runner.ts
-const execFileAsync$4 = promisify(execFile);
+const execFileAsync$5 = promisify(execFile);
 /**
 * Wraps `docker pull` / `docker run` / `docker rm` for `cdkl invoke`.
 *
@@ -6580,7 +6580,7 @@ async function runDetached(opts) {
 	args.push(opts.image, ...entryPointTail, ...opts.cmd);
 	getLogger().child("docker").debug(`${getDockerCmd()} ${redactAwsCredentialsInArgs(args).join(" ")}`);
 	try {
-		const { stdout } = await execFileAsync$4(getDockerCmd(), args, {
+		const { stdout } = await execFileAsync$5(getDockerCmd(), args, {
 			maxBuffer: 10 * 1024 * 1024,
 			...execEnvForSecrets(passthroughEnv)
 		});
@@ -6620,7 +6620,7 @@ async function removeContainer(containerId) {
 	if (!containerId) return;
 	const logger = getLogger().child("docker");
 	try {
-		await execFileAsync$4(getDockerCmd(), [
+		await execFileAsync$5(getDockerCmd(), [
 			"rm",
 			"-f",
 			containerId
@@ -6639,7 +6639,7 @@ async function removeContainer(containerId) {
 async function ensureDockerAvailable() {
 	const cmd = getDockerCmd();
 	try {
-		await execFileAsync$4(cmd, [
+		await execFileAsync$5(cmd, [
 			"version",
 			"--format",
 			"{{.Server.Version}}"
@@ -17666,6 +17666,167 @@ function addInvokeSpecificOptions(cmd) {
 	return cmd.addOption(new Option("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option("--event-stdin", "Read event JSON from stdin").default(false)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--no-pull", "Skip docker pull. Semantics differ by code path: ZIP Lambdas skip pulling the public Lambda base image; Container Lambdas on the local-build path are a no-op (docker build does not refresh the FROM cache by default); Container Lambdas on the ECR-pull fallback skip docker pull AND error if the image is not in the local cache (re-run without --no-pull or pre-pull manually).")).addOption(new Option("--no-build", "Skip docker build on the IMAGE local-build path (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ZIP Lambdas and the IMAGE ECR-pull path. Compatible with --no-pull.")).addOption(new Option("--debug-port <port>", "Node --inspect-brk port (default: off)")).addOption(new Option("--container-host <host>", "Host IP the host uses to bind the RIE port to. Must be a numeric IP (Docker rejects hostnames here). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--assume-role [arn]", "Assume the Lambda's deployed execution role and forward STS-issued temp credentials to the container so the handler runs with the deployed function's narrow permissions. Three forms: (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) auto-resolves the function's execution role ARN from state (requires an active state source); (3) `--no-assume-role` explicitly opts out. Off by default — when omitted, the developer's shell credentials are forwarded unchanged (SAM-compatible default). STS failures degrade to a warn + dev-creds fallback.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers. Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass an explicit value when CFn stack name differs. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
+//#endregion
+//#region src/local/source-change-classifier.ts
+/**
+* Dependency-manifest basenames recognized by the classifier. A change
+* to any of these forces a rebuild because the running container's
+* pre-built dependency layer is no longer in sync with the source.
+*
+* Coverage: the package managers commonly used inside a Lambda /
+* container image — Node (pnpm / npm / yarn), Python (pip / poetry /
+* pipenv), Ruby (bundler), Go (modules), Rust (cargo), Java / Kotlin
+* (Maven, Gradle). Adding a new ecosystem? Append its lockfile +
+* manifest here and add a classifier test row.
+*/
+const REBUILD_TRIGGER_BASENAMES = new Set([
+	"package.json",
+	"package-lock.json",
+	"pnpm-lock.yaml",
+	"yarn.lock",
+	"npm-shrinkwrap.json",
+	"requirements.txt",
+	"requirements-dev.txt",
+	"pyproject.toml",
+	"poetry.lock",
+	"Pipfile",
+	"Pipfile.lock",
+	"uv.lock",
+	"Gemfile",
+	"Gemfile.lock",
+	"go.mod",
+	"go.sum",
+	"Cargo.toml",
+	"Cargo.lock",
+	"pom.xml",
+	"build.gradle",
+	"build.gradle.kts",
+	"settings.gradle",
+	"settings.gradle.kts",
+	"Makefile",
+	"CMakeLists.txt"
+]);
+/**
+* Compiled-language source extensions that require a build step
+* inside `docker build` (typically a `RUN go build` / `cargo build` /
+* `mvn package` etc.). A copy of the source alone would leave the
+* running binary stale, so the user's intent must be a rebuild.
+*
+* TypeScript source (`.ts` / `.tsx` / `.mts` / `.cts`) is treated as
+* compiled because the dominant production-container pattern is to
+* pre-compile the source via a Dockerfile `RUN tsc` / `RUN yarn build`
+* step, with the runtime executing the emitted `dist/*.js`. Soft-reload
+* would `docker cp` the new `.ts` into the container's WORKDIR while
+* the running process keeps reading the OLD `dist/` — a silent
+* stale-code failure that violates the file's "slow-but-correct beats
+* fast-but-stale" default policy (lines 14-22). Setups that transpile
+* at runtime lose the soft-reload fast path under this default; an
+* opt-in flag to restore it is a possible follow-up but is not in
+* scope here.
+*
+* Interpreted-language runtimes (Node — `.js` / `.mjs` / `.cjs`,
+* Python — `.py`, Ruby — `.rb`, shell — `.sh`) read source at process
+* start, so a `docker cp` + `docker restart` cycle picks them up.
+* Those extensions are NOT in this set.
+*/
+const COMPILED_LANGUAGE_EXTENSIONS = new Set([
+	".go",
+	".rs",
+	".java",
+	".kt",
+	".kts",
+	".scala",
+	".cs",
+	".swift",
+	".fs",
+	".fsx",
+	".c",
+	".cc",
+	".cpp",
+	".cxx",
+	".h",
+	".hpp",
+	".zig",
+	".ml",
+	".mli",
+	".elm",
+	".hs",
+	".dart",
+	".ts",
+	".tsx",
+	".mts",
+	".cts"
+]);
+/**
+* Classify a single watcher firing into rebuild vs soft-reload. Pure
+* + synchronous. The caller (emulator's reload pathway) invokes this
+* once per target per firing AFTER `cdk synth` has run and the new
+* asset manifest is on disk.
+*
+* Branching:
+*   1. No asset context (image isn't a CDK asset, or asset lookup
+*      failed) → `rebuild`.
+*   2. The asset hash didn't change between old and new synths
+*      (`oldAssetHash === newAssetHash`, or `oldAssetHash` missing)
+*      → `rebuild`. Load-bearing guard for "user edited a CDK
+*      construct file (e.g. `lib/stack.ts`) that flipped the task
+*      spec but didn't touch the asset content". Soft-reload would
+*      `docker cp` identical files and `docker restart` the
+*      container with the OLD task spec (env / memory / mounts /
+*      added sidecars are set at `docker create` time, not on
+*      restart) — the user's intent would silently NOT apply.
+*      Forcing rebuild keeps Phase 1-3 semantics exactly for this
+*      case: the rolling primitive boots a shadow with the new task
+*      spec, the user sees their construct edit take effect.
+*   3. No changed paths (the watcher fired on a debounce flush with
+*      an empty pending set — shouldn't happen in practice, but
+*      defensive) → `rebuild`.
+*   4. Any changed path's basename matches the Dockerfile or a
+*      dependency manifest → `rebuild`.
+*   5. Any changed path's extension is a compiled-language source →
+*      `rebuild`.
+*   6. Else → `soft-reload`.
+*/
+function classifySourceChange(changedPaths, ctx) {
+	if (!ctx) return {
+		kind: "rebuild",
+		reason: "target image is not a CDK docker-image asset"
+	};
+	if (!ctx.oldAssetHash || ctx.oldAssetHash === ctx.newAssetHash) return {
+		kind: "rebuild",
+		reason: "asset hash unchanged across the synth (CDK construct edit or unrelated file) — task-spec changes need a fresh `docker create`, which only the rebuild path runs"
+	};
+	if (changedPaths.length === 0) return {
+		kind: "rebuild",
+		reason: "no changed paths reported (defensive default)"
+	};
+	for (const p of changedPaths) {
+		const basename = path.basename(p);
+		if (basename === ctx.dockerFile) return {
+			kind: "rebuild",
+			reason: `Dockerfile edit (${basename})`
+		};
+		if (basename.startsWith("Dockerfile.")) return {
+			kind: "rebuild",
+			reason: `Dockerfile.* edit (${basename})`
+		};
+		if (REBUILD_TRIGGER_BASENAMES.has(basename)) return {
+			kind: "rebuild",
+			reason: `dependency manifest edit (${basename})`
+		};
+		const ext = path.extname(p).toLowerCase();
+		if (COMPILED_LANGUAGE_EXTENSIONS.has(ext)) return {
+			kind: "rebuild",
+			reason: `compiled-language source edit (${basename}) — soft-reload would leave the built binary stale`
+		};
+	}
+	return {
+		kind: "soft-reload",
+		reason: `${changedPaths.length} source-only path(s) — skipping rebuild`,
+		newAssetSourceDir: ctx.newAssetSourceDir
+	};
+}
+
 //#endregion
 //#region src/local/agentcore-code-build.ts
 /**
@@ -18434,6 +18595,17 @@ async function invokeAgentCoreWs(host, port, event, options) {
 				reject(/* @__PURE__ */ new Error(`AgentCore /ws at ${url} timed out after ${options.timeoutMs}ms. The agent may be hung or may not close the stream; check container logs.`));
 			});
 		}, options.timeoutMs);
+		const onAbort = () => {
+			finish(() => {
+				stopIterator();
+				try {
+					ws.close();
+				} catch {}
+				resolve({ frames });
+			});
+		};
+		if (options.abortSignal) if (options.abortSignal.aborted) onAbort();
+		else options.abortSignal.addEventListener("abort", onAbort, { once: true });
 		let iterator;
 		const stopIterator = () => {
 			if (iterator?.return) try {
@@ -18580,6 +18752,12 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 		if ((isMcp || isA2a) && options.ws) logger.warn(`--ws applies only to the HTTP / AGUI protocols; ignoring it for this ${resolved.protocol} runtime.`);
 		if (options.wsInteractive && !options.ws) logger.warn("--ws-interactive is meaningful only with --ws; ignoring.");
 		if (options.sigv4 && (isMcp || isA2a || options.ws)) logger.warn("--sigv4 signs the HTTP /invocations request only; ignoring it for the " + (isMcp ? "MCP" : isA2a ? "A2A" : "/ws WebSocket") + " path.");
+		const watchEligible = options.ws === true && !isMcp && !isA2a;
+		const watchActive = options.watch === true && watchEligible;
+		if (options.watch === true && !watchEligible) {
+			const ignoredFor = isMcp ? "MCP" : isA2a ? "A2A" : "single-shot HTTP POST /invocations";
+			logger.warn(`--watch is meaningful only with the long-running --ws / --ws-interactive session paths; ignoring it for the ${ignoredFor} path (single-shot invocations run once and exit).`);
+		}
 		const sessionId = options.sessionId ?? randomUUID();
 		const event = await readEvent(options);
 		const mcpRequest = isMcp ? buildMcpRequest(event) : void 0;
@@ -18627,7 +18805,70 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 			const a2a = await a2aInvokeOnce(containerHost, hostPort, a2aRequest, { requestTimeoutMs: options.timeout });
 			await new Promise((r) => setTimeout(r, 250));
 			emitA2aResult(a2a);
-		} else if (options.ws) {
+		} else if (options.ws) if (watchActive) await runAgentCoreWatchLoop({
+			containerHost,
+			hostPort,
+			event,
+			sessionId,
+			timeoutMs: options.timeout,
+			wsInteractive: options.wsInteractive === true,
+			options,
+			resolvedTarget,
+			resolved,
+			synthesizer,
+			synthOpts,
+			stacks,
+			...authorization && { authorization },
+			rebuild: async () => {
+				if (stopLogs) {
+					try {
+						stopLogs();
+					} catch {}
+					stopLogs = void 0;
+				}
+				if (containerId) {
+					await removeContainer(containerId);
+					containerId = void 0;
+				}
+				const { stacks: newStacks } = await synthesizer.synthesize(synthOpts);
+				const newCandidate = pickAgentCoreCandidateStack(resolvedTarget, newStacks);
+				const { context: newImageContext, loaded: newLoaded } = stateProvider && newCandidate ? await buildAgentCoreImageContext(newCandidate, stateProvider, options) : {
+					context: void 0,
+					loaded: void 0
+				};
+				const newResolved = resolveAgentCoreTarget(resolvedTarget, newStacks, newImageContext);
+				await resolveFromS3BucketIntrinsic(newResolved, stateProvider, newLoaded, newImageContext);
+				const newImage = await resolveAgentCoreImage(newResolved, options, newLoaded, stateProvider);
+				const { env: newEnv, sensitiveEnvKeys: newSensitive } = await buildContainerEnv(newResolved, options, profileCredentials, profileCredsFile, stateProvider, newLoaded, newImageContext);
+				const newHostPort = await pickFreePort();
+				const newName = `${getEmbedConfig().resourceNamePrefix}-agentcore-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+				logger.info(`Reload: starting agent container (image=${newImage}, port=${newHostPort} -> 8080)...`);
+				containerId = await runDetached({
+					image: newImage,
+					mounts: [],
+					env: newEnv,
+					cmd: [],
+					hostPort: newHostPort,
+					host: containerHost,
+					platform: options.platform,
+					name: newName,
+					...newSensitive.size > 0 && { sensitiveEnvKeys: newSensitive }
+				});
+				stopLogs = streamLogs(containerId);
+				return {
+					containerId,
+					hostPort: newHostPort,
+					stacks: newStacks
+				};
+			},
+			softReload: async (newSourceDir) => {
+				if (!containerId) throw new CdkLocalError("softReload: no live container to docker cp / docker restart into.", "LOCAL_INVOKE_AGENTCORE_WATCH_NO_CONTAINER");
+				await softReloadAgentContainer(containerId, newSourceDir);
+				const { stacks: newStacks } = await synthesizer.synthesize(synthOpts);
+				return { stacks: newStacks };
+			}
+		});
+		else {
 			await waitForAgentCorePing(containerHost, hostPort);
 			const frameSource = options.wsInteractive ? readStdinLines() : void 0;
 			logger.info(options.wsInteractive ? "Opening the agent /ws WebSocket (interactive — stdin lines = follow-up frames; Ctrl-D to end)..." : "Opening the agent /ws WebSocket and streaming frames...");
@@ -18640,7 +18881,8 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 			});
 			await new Promise((r) => setTimeout(r, 250));
 			emitWsResult(wsResult);
-		} else {
+		}
+		else {
 			await waitForAgentCorePing(containerHost, hostPort);
 			const additionalHeaders = await buildSigV4HeadersIfRequested(options, resolved, loadedState, containerHost, hostPort, event, sessionId, stateProvider);
 			const result = await invokeAgentCore(containerHost, hostPort, event, {
@@ -19298,6 +19540,309 @@ function readEnvOverridesFile$2(filePath) {
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`--env-vars file '${filePath}' must contain a JSON object at the top level.`);
 	return parsed;
 }
+/**
+* Issue #255 — `cdkl invoke-agentcore --watch` main loop. Wraps the
+* `/ws` dispatch in a reload-driven loop:
+*
+*   1. Open the WebSocket against the current container; stream frames
+*      to stdout. The connection is bound to an abort signal the
+*      watcher fires when a source change is detected.
+*   2. When the agent closes the stream naturally (no reload pending),
+*      the loop exits — `--watch` does NOT auto-reconnect on a benign
+*      close (the user can `^C` to leave or just re-run the command).
+*   3. When a reload fires, the abort signal closes the WS cleanly
+*      (resolves with the current frame count, not a reject), then the
+*      classifier picks `'rebuild'` vs `'soft-reload'` and the
+*      corresponding container-swap helper runs. After the swap, the
+*      loop re-opens the WS against the new / restarted container with
+*      the same `--event` first frame + a fresh stdin reader (for
+*      `--ws-interactive`).
+*
+* Active `/ws` socket handling: the AgentCore `/ws` protocol does not
+* define mid-session container handoff, so the only honest local-dev
+* semantic is "close the socket cleanly and let the client reconnect."
+* The reload firing logs that loudly so the user sees it.
+*
+* `softReload` and `rebuild` are passed as callbacks so the watch loop
+* itself stays uncoupled from the boot pipeline + the docker helpers
+* the outer command owns. The host-side teardown (state provider
+* dispose, container removal, profile creds-file dispose) is the
+* outer command's `finally` cleanup — the watch loop only swaps the
+* one agent container.
+*
+* @internal — exported so a unit test can drive the loop without the
+* full Docker + chokidar pipeline.
+*/
+async function runAgentCoreWatchLoop(args) {
+	const logger = getLogger();
+	const wsInvoker = args.__wsInvoker ?? invokeAgentCoreWs;
+	const waitForPing = args.__waitForPing ?? waitForAgentCorePing;
+	let currentHostPort = args.hostPort;
+	let currentStacks = args.stacks;
+	let reloadChain = Promise.resolve();
+	let currentAbort;
+	let pendingReload = false;
+	let reloadFailed = false;
+	const watcherFactory = args.__watcherFactory ?? ((onChange) => {
+		const watchRoot = process.cwd();
+		const { ignored, shouldTrigger, excludePatterns } = createWatchPredicates({
+			watchRoot,
+			output: args.options.output,
+			watchConfig: resolveWatchConfig()
+		});
+		logger.info(`Watching ${watchRoot} for source changes (excluding ${excludePatterns.join(", ")}).`);
+		return createFileWatcher({
+			paths: [watchRoot],
+			ignored,
+			shouldTrigger,
+			onChange
+		});
+	});
+	const cdkOutDir = args.options.output;
+	const assetLoader = new AssetManifestLoader();
+	const watcher = watcherFactory((changedPaths) => {
+		reloadChain = reloadChain.then(async () => {
+			let verdict = {
+				kind: "rebuild",
+				reason: "classifier not consulted"
+			};
+			let assetCtx;
+			try {
+				if (args.__classifierContext) assetCtx = await args.__classifierContext(changedPaths);
+				else {
+					const { stacks: freshStacks } = await args.synthesizer.synthesize(args.synthOpts);
+					const oldAssetHash = await deriveOldAssetHash({
+						resolvedTarget: args.resolvedTarget,
+						resolved: args.resolved,
+						stacks: currentStacks,
+						cdkOutDir,
+						assetLoader
+					});
+					assetCtx = await loadAgentCoreAssetContext({
+						resolvedTarget: args.resolvedTarget,
+						resolved: args.resolved,
+						stacks: freshStacks,
+						cdkOutDir,
+						assetLoader,
+						oldAssetHash
+					});
+				}
+				verdict = classifySourceChange(changedPaths, assetCtx);
+				logger.info(`Detected source change (${changedPaths.length} path(s)); verdict=${verdict.kind} (${verdict.reason}).`);
+			} catch (err) {
+				logger.warn(`Reload: classifier context unavailable (${err instanceof Error ? err.message : String(err)}); falling back to rebuild.`);
+				verdict = {
+					kind: "rebuild",
+					reason: "classifier context unavailable; falling back to rebuild"
+				};
+			}
+			pendingReload = true;
+			logger.warn("cdkl invoke-agentcore --watch: source change detected; closing the active /ws socket so the client can reconnect to the rebuilt container.");
+			currentAbort?.abort();
+			try {
+				if (verdict.kind === "soft-reload") {
+					const { stacks: newStacks } = await args.softReload(verdict.newAssetSourceDir);
+					currentStacks = newStacks;
+					logger.info("Reload: soft-reloaded the agent container (docker cp + docker restart; container ID + host port preserved).");
+				} else {
+					const { containerId: _newId, hostPort: newHostPort, stacks: newStacks } = await args.rebuild();
+					currentHostPort = newHostPort;
+					currentStacks = newStacks;
+					logger.info(`Reload: rebuilt the agent container.`);
+				}
+			} catch (err) {
+				logger.error(`Reload failed: ${err instanceof Error ? err.message : String(err)}. The previous container may already be torn down; exiting --watch loop. Re-run cdkl invoke-agentcore --watch to recover.`);
+				reloadFailed = true;
+				currentAbort?.abort();
+			}
+		}).catch((err) => {
+			logger.error(`Reload chain threw: ${err instanceof Error ? err.message : String(err)}`);
+		});
+	});
+	try {
+		let firstIteration = true;
+		while (true) {
+			if (reloadFailed) break;
+			await waitForPing(args.containerHost, currentHostPort);
+			if (firstIteration) {
+				logger.info(args.wsInteractive ? "Opening the agent /ws WebSocket (interactive — stdin lines = follow-up frames; Ctrl-D to end)..." : "Opening the agent /ws WebSocket and streaming frames...");
+				firstIteration = false;
+			} else logger.info(args.wsInteractive ? "Re-opening the agent /ws WebSocket (interactive) against the rebuilt container..." : "Re-opening the agent /ws WebSocket against the rebuilt container...");
+			const abort = new AbortController();
+			currentAbort = abort;
+			pendingReload = false;
+			const frameSource = args.wsInteractive ? readStdinLines() : void 0;
+			try {
+				const result = await wsInvoker(args.containerHost, currentHostPort, args.event, {
+					sessionId: args.sessionId,
+					timeoutMs: args.timeoutMs,
+					onMessage: (text) => process.stdout.write(text),
+					abortSignal: abort.signal,
+					...args.authorization && { authorization: args.authorization },
+					...frameSource && { frameSource }
+				});
+				await new Promise((r) => setTimeout(r, 250));
+				emitWsResult(result);
+			} finally {
+				currentAbort = void 0;
+			}
+			if (!pendingReload) {
+				await reloadChain.catch(() => void 0);
+				if (!pendingReload) break;
+			}
+			await reloadChain.catch(() => void 0);
+		}
+	} finally {
+		try {
+			await watcher.close();
+		} catch (err) {
+			logger.warn(`Watcher close failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	}
+}
+/**
+* Issue #255 — soft-reload the agent container in place. `docker cp`
+* the freshly-synthed asset directory contents into the running
+* container's WORKDIR + `docker restart` the container.
+*
+* - WORKDIR is resolved from the live container's image config via
+*   `docker inspect --format '{{.Config.WorkingDir}}'`. An empty
+*   WORKDIR (Docker runtime default) maps to `/`. For
+*   CodeConfiguration runtimes the generated Dockerfile sets
+*   `WORKDIR /app`, so the copy lands there.
+* - The trailing `/.` on the source ensures CONTENTS are copied
+*   (not the directory itself); the trailing `/` on the dest forces
+*   docker cp to treat it as a directory.
+* - `docker restart` cycles PID 1 — the new source is picked up by
+*   the interpreted-language runtime on its next startup. The
+*   container ID + host port + network are preserved across the
+*   restart, so the surrounding watch loop's host-port reference
+*   stays valid.
+*
+* @internal — exported for unit tests of the docker-cp + docker-restart
+* shape without standing up a real container.
+*/
+const execFileAsync$4 = promisify(execFile);
+function describeExecError(err) {
+	if (!(err instanceof Error)) return String(err);
+	const stderr = err.stderr;
+	const stderrText = typeof stderr === "string" ? stderr.trim() : stderr instanceof Buffer ? stderr.toString("utf8").trim() : "";
+	return stderrText ? `${err.message}\n${stderrText}` : err.message;
+}
+async function softReloadAgentContainer(containerId, newAssetSourceDir) {
+	const logger = getLogger();
+	const dockerCmd = getDockerCmd();
+	let workdir;
+	try {
+		const { stdout } = await execFileAsync$4(dockerCmd, [
+			"inspect",
+			"--format",
+			"{{.Config.WorkingDir}}",
+			containerId
+		]);
+		workdir = stdout.trim() || "/";
+	} catch (err) {
+		throw new CdkLocalError(`softReloadAgentContainer: docker inspect of container '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_INSPECT_FAILED");
+	}
+	const workdirDest = workdir.endsWith("/") ? workdir : `${workdir}/`;
+	logger.info(`Soft-reload: docker cp ${newAssetSourceDir} -> ${containerId}:${workdirDest}; restart.`);
+	try {
+		await execFileAsync$4(dockerCmd, [
+			"cp",
+			`${newAssetSourceDir}/.`,
+			`${containerId}:${workdirDest}`
+		], { maxBuffer: 64 * 1024 * 1024 });
+	} catch (err) {
+		throw new CdkLocalError(`softReloadAgentContainer: docker cp into '${containerId}:${workdir}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_CP_FAILED");
+	}
+	try {
+		await execFileAsync$4(dockerCmd, ["restart", containerId]);
+	} catch (err) {
+		throw new CdkLocalError(`softReloadAgentContainer: docker restart of '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_RESTART_FAILED");
+	}
+}
+/**
+* Issue #255 — build the per-firing classifier context for the agent
+* container. Mirrors the ECS service emulator's `loadAssetContextForTarget`
+* shape: returns `undefined` (and the classifier defaults to `'rebuild'`)
+* when the runtime's image is not a CDK docker-image asset, or when the
+* asset manifest lookup misses for either the OLD or NEW synth.
+*
+* For a CodeConfiguration (`fromCodeAsset`) runtime we treat the bundle's
+* `codeAssetHash` as the asset hash + the staged source directory as
+* `newAssetSourceDir`, and synthesize a `Dockerfile` basename that never
+* matches a real file (the generated Dockerfile lives in a build tmpdir,
+* not the source tree, so chokidar can't observe an edit to it). A
+* `fromS3` bundle has no local source tree, so it returns `undefined` and
+* the classifier defaults to rebuild.
+*
+* Container artifacts go through the same `AssetManifestLoader` lookup
+* the ECS path uses, then read `source.directory` + `source.dockerFile`
+* off the matched docker-image entry.
+*
+* @internal — exported for the watch loop's classifier dispatch test.
+*/
+async function loadAgentCoreAssetContext(args) {
+	const { resolvedTarget, resolved, stacks, cdkOutDir, assetLoader, oldAssetHash } = args;
+	const newCandidate = pickAgentCoreCandidateStack(resolvedTarget, stacks);
+	if (!newCandidate) return void 0;
+	if (resolved.codeArtifact) {
+		if (resolved.codeArtifact.s3Source) return void 0;
+		const manifest = await assetLoader.loadManifest(cdkOutDir, newCandidate.stackName);
+		if (!manifest) return void 0;
+		const asset = assetLoader.getFileAssets(manifest).get(resolved.codeArtifact.codeAssetHash);
+		if (!asset) return void 0;
+		const sourceDir = assetLoader.getAssetSourcePath(cdkOutDir, asset);
+		return {
+			...oldAssetHash !== void 0 && { oldAssetHash },
+			newAssetHash: resolved.codeArtifact.codeAssetHash,
+			newAssetSourceDir: sourceDir,
+			dockerFile: ".cdkl-agentcore-generated-Dockerfile"
+		};
+	}
+	if (resolved.containerUri === void 0) return void 0;
+	const manifest = await assetLoader.loadManifest(cdkOutDir, newCandidate.stackName);
+	if (!manifest) return void 0;
+	const dockerImageEntry = getDockerImageBySourceHash(manifest, resolved.containerUri);
+	if (!dockerImageEntry) return void 0;
+	const newAssetHash = dockerImageEntry.hash;
+	const newDockerImage = dockerImageEntry.asset;
+	if (!newDockerImage.source.directory) return void 0;
+	const newAssetSourceDir = path.resolve(cdkOutDir, newDockerImage.source.directory);
+	return {
+		...oldAssetHash !== void 0 && { oldAssetHash },
+		newAssetHash,
+		newAssetSourceDir,
+		dockerFile: path.basename(newDockerImage.source.dockerFile ?? "Dockerfile")
+	};
+}
+/**
+* Helper: derive the current asset hash from the live (pre-reload)
+* stacks for the classifier's `oldAssetHash` field. Returns `undefined`
+* when the runtime's image is not resolvable as a CDK asset against the
+* old stacks — the classifier defaults to rebuild in that case, which
+* is the right answer.
+*/
+/**
+* Async helper: derive the OLD (pre-reload) asset hash for the
+* classifier's `oldAssetHash` field. Code-artifact runtimes carry the
+* hash on the boot-time `resolved.codeArtifact.codeAssetHash`; container
+* runtimes need a manifest lookup against the previous-synth stacks to
+* extract it. Returns `undefined` when the OLD hash can't be derived
+* (image is not a CDK asset, manifest unreadable, no candidate stack) —
+* the classifier treats `undefined` as "force rebuild", which is the
+* conservative default.
+*/
+async function deriveOldAssetHash(args) {
+	const { resolvedTarget, resolved, stacks, cdkOutDir, assetLoader } = args;
+	if (resolved.codeArtifact) return resolved.codeArtifact.codeAssetHash;
+	if (resolved.containerUri === void 0) return void 0;
+	const candidate = pickAgentCoreCandidateStack(resolvedTarget, stacks);
+	if (!candidate) return void 0;
+	const manifest = await assetLoader.loadManifest(cdkOutDir, candidate.stackName);
+	if (!manifest) return void 0;
+	return getDockerImageBySourceHash(manifest, resolved.containerUri)?.hash;
+}
 function createLocalInvokeAgentCoreCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
 	const cmd = new Command("invoke-agentcore").description("Run a Bedrock AgentCore Runtime container locally and invoke it once over its protocol contract: HTTP (POST /invocations + GET /ping on 8080; SSE / WebSocket are HTTP wire-shape variants on the same port), MCP (POST /mcp Streamable HTTP on 8000), A2A, or AGUI. Resolves the AWS::BedrockAgentCore::Runtime, pulls/builds its container, injects env vars + AWS credentials, and prints the response. For an MCP runtime, runs the session handshake then sends one JSON-RPC request (tools/list by default, or the method/params from --event). Target accepts a CDK display path (MyStack/MyAgent) or stack-qualified logical ID (MyStack:MyAgentRuntime1234). Single-stack apps may omit the stack prefix. Omit <target> in an interactive terminal to pick from a list. Supports the container artifact and the CodeConfiguration managed-runtime artifact (fromCodeAsset, built from source) on all four protocols; the agent calls real AWS for managed services.").argument("[target]", "CDK display path or stack-qualified logical ID of the AgentCore Runtime to invoke (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
@@ -19328,7 +19873,7 @@ function createLocalInvokeAgentCoreCommand(opts = {}) {
 * in three `--help` clusters. Chainable: returns `cmd`.
 */
 function addInvokeAgentCoreSpecificOptions(cmd) {
-	return cmd.addOption(new Option("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option("--event-stdin", "Read event JSON from stdin").default(false)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--session-id <id>", "AgentCore runtime session id header value (default: a random UUID)")).addOption(new Option("--ws", "Stream over the HTTP-protocol agent's bidirectional /ws WebSocket endpoint (on 8080) instead of POST /invocations: send --event as the first frame and print every received frame to stdout until the agent closes. Ignored for an MCP runtime.").default(false)).addOption(new Option("--ws-interactive", "REPL mode for --ws: after the initial --event frame, read additional frames from stdin (one frame per line, trailing newline stripped) and send each as a text frame until stdin EOFs (Ctrl-D) or the agent closes. Only meaningful with --ws.").default(false)).addOption(new Option("--bearer-token <jwt>", "Bearer JWT this command SUPPLIES (the supplier role) when the runtime declares a customJwtAuthorizer — `cdkl invoke-agentcore` is the local-dev client making the outbound call, so it always presents this token to its own invocation. Verified against the runtime's OIDC discovery URL (signature / issuer / expiry / audience) before the container starts, then forwarded to /invocations as Authorization: Bearer <jwt>. Contrast with `cdkl start-alb --bearer-token`, where the role is reversed — the ALB front-door RECEIVES inbound requests and injects this token only as a default when an inbound request has none (default-when-missing).")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign the /invocations POST with AWS SigV4 (service bedrock-agentcore) using the resolved credentials, matching the cloud default when the runtime declares no customJwtAuthorizer. Opt-in: default unsigned. Mutually exclusive with --bearer-token; ignored on a JWT-protected runtime.").default(false)).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64. Override to linux/amd64 only when iterating against an amd64 dev container locally; note the image will not run on the cloud runtime as-is.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP the host uses to bind the agent port to. Must be a numeric IP (Docker rejects hostnames here). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Per-request timeout in milliseconds. Applied to POST /invocations, POST /mcp, and the /ws open-to-close window. Raise this for long-running agent calls that exceed the default.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container so the agent runs with the deployed role. Three forms: (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's RoleArn when it is a literal ARN; (3) `--no-assume-role` opts out. Off by default — the developer's shell credentials are forwarded unchanged.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name; pass an explicit value when the CFn stack name differs.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+	return cmd.addOption(new Option("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option("--event-stdin", "Read event JSON from stdin").default(false)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--session-id <id>", "AgentCore runtime session id header value (default: a random UUID)")).addOption(new Option("--ws", "Stream over the HTTP-protocol agent's bidirectional /ws WebSocket endpoint (on 8080) instead of POST /invocations: send --event as the first frame and print every received frame to stdout until the agent closes. Ignored for an MCP runtime.").default(false)).addOption(new Option("--ws-interactive", "REPL mode for --ws: after the initial --event frame, read additional frames from stdin (one frame per line, trailing newline stripped) and send each as a text frame until stdin EOFs (Ctrl-D) or the agent closes. Only meaningful with --ws.").default(false)).addOption(new Option("--bearer-token <jwt>", "Bearer JWT this command SUPPLIES (the supplier role) when the runtime declares a customJwtAuthorizer — `cdkl invoke-agentcore` is the local-dev client making the outbound call, so it always presents this token to its own invocation. Verified against the runtime's OIDC discovery URL (signature / issuer / expiry / audience) before the container starts, then forwarded to /invocations as Authorization: Bearer <jwt>. Contrast with `cdkl start-alb --bearer-token`, where the role is reversed — the ALB front-door RECEIVES inbound requests and injects this token only as a default when an inbound request has none (default-when-missing).")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign the /invocations POST with AWS SigV4 (service bedrock-agentcore) using the resolved credentials, matching the cloud default when the runtime declares no customJwtAuthorizer. Opt-in: default unsigned. Mutually exclusive with --bearer-token; ignored on a JWT-protected runtime.").default(false)).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64. Override to linux/amd64 only when iterating against an amd64 dev container locally; note the image will not run on the cloud runtime as-is.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP the host uses to bind the agent port to. Must be a numeric IP (Docker rejects hostnames here). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Per-request timeout in milliseconds. Applied to POST /invocations, POST /mcp, and the /ws open-to-close window. Raise this for long-running agent calls that exceed the default.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container so the agent runs with the deployed role. Three forms: (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's RoleArn when it is a literal ARN; (3) `--no-assume-role` opts out. Off by default — the developer's shell credentials are forwarded unchanged.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name; pass an explicit value when the CFn stack name differs.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--watch", "Re-synth and reload the agent container on CDK source changes. Only meaningful with the long-running /ws session paths (--ws / --ws-interactive); single-shot POST /invocations, MCP, and A2A invocations run once and exit, so --watch is logged as a no-op WARN for them and the single shot proceeds. The active /ws socket is closed cleanly on every reload firing so the next session connects to the rebuilt container — the honest local-dev semantic.").default(false));
 }
 
 //#endregion
@@ -21939,167 +22484,6 @@ function sleep(ms) {
 	return sleepImpl(ms);
 }
 
-//#endregion
-//#region src/local/source-change-classifier.ts
-/**
-* Dependency-manifest basenames recognized by the classifier. A change
-* to any of these forces a rebuild because the running container's
-* pre-built dependency layer is no longer in sync with the source.
-*
-* Coverage: the package managers commonly used inside a Lambda /
-* container image — Node (pnpm / npm / yarn), Python (pip / poetry /
-* pipenv), Ruby (bundler), Go (modules), Rust (cargo), Java / Kotlin
-* (Maven, Gradle). Adding a new ecosystem? Append its lockfile +
-* manifest here and add a classifier test row.
-*/
-const REBUILD_TRIGGER_BASENAMES = new Set([
-	"package.json",
-	"package-lock.json",
-	"pnpm-lock.yaml",
-	"yarn.lock",
-	"npm-shrinkwrap.json",
-	"requirements.txt",
-	"requirements-dev.txt",
-	"pyproject.toml",
-	"poetry.lock",
-	"Pipfile",
-	"Pipfile.lock",
-	"uv.lock",
-	"Gemfile",
-	"Gemfile.lock",
-	"go.mod",
-	"go.sum",
-	"Cargo.toml",
-	"Cargo.lock",
-	"pom.xml",
-	"build.gradle",
-	"build.gradle.kts",
-	"settings.gradle",
-	"settings.gradle.kts",
-	"Makefile",
-	"CMakeLists.txt"
-]);
-/**
-* Compiled-language source extensions that require a build step
-* inside `docker build` (typically a `RUN go build` / `cargo build` /
-* `mvn package` etc.). A copy of the source alone would leave the
-* running binary stale, so the user's intent must be a rebuild.
-*
-* TypeScript source (`.ts` / `.tsx` / `.mts` / `.cts`) is treated as
-* compiled because the dominant production-container pattern is to
-* pre-compile the source via a Dockerfile `RUN tsc` / `RUN yarn build`
-* step, with the runtime executing the emitted `dist/*.js`. Soft-reload
-* would `docker cp` the new `.ts` into the container's WORKDIR while
-* the running process keeps reading the OLD `dist/` — a silent
-* stale-code failure that violates the file's "slow-but-correct beats
-* fast-but-stale" default policy (lines 14-22). Setups that transpile
-* at runtime lose the soft-reload fast path under this default; an
-* opt-in flag to restore it is a possible follow-up but is not in
-* scope here.
-*
-* Interpreted-language runtimes (Node — `.js` / `.mjs` / `.cjs`,
-* Python — `.py`, Ruby — `.rb`, shell — `.sh`) read source at process
-* start, so a `docker cp` + `docker restart` cycle picks them up.
-* Those extensions are NOT in this set.
-*/
-const COMPILED_LANGUAGE_EXTENSIONS = new Set([
-	".go",
-	".rs",
-	".java",
-	".kt",
-	".kts",
-	".scala",
-	".cs",
-	".swift",
-	".fs",
-	".fsx",
-	".c",
-	".cc",
-	".cpp",
-	".cxx",
-	".h",
-	".hpp",
-	".zig",
-	".ml",
-	".mli",
-	".elm",
-	".hs",
-	".dart",
-	".ts",
-	".tsx",
-	".mts",
-	".cts"
-]);
-/**
-* Classify a single watcher firing into rebuild vs soft-reload. Pure
-* + synchronous. The caller (emulator's reload pathway) invokes this
-* once per target per firing AFTER `cdk synth` has run and the new
-* asset manifest is on disk.
-*
-* Branching:
-*   1. No asset context (image isn't a CDK asset, or asset lookup
-*      failed) → `rebuild`.
-*   2. The asset hash didn't change between old and new synths
-*      (`oldAssetHash === newAssetHash`, or `oldAssetHash` missing)
-*      → `rebuild`. Load-bearing guard for "user edited a CDK
-*      construct file (e.g. `lib/stack.ts`) that flipped the task
-*      spec but didn't touch the asset content". Soft-reload would
-*      `docker cp` identical files and `docker restart` the
-*      container with the OLD task spec (env / memory / mounts /
-*      added sidecars are set at `docker create` time, not on
-*      restart) — the user's intent would silently NOT apply.
-*      Forcing rebuild keeps Phase 1-3 semantics exactly for this
-*      case: the rolling primitive boots a shadow with the new task
-*      spec, the user sees their construct edit take effect.
-*   3. No changed paths (the watcher fired on a debounce flush with
-*      an empty pending set — shouldn't happen in practice, but
-*      defensive) → `rebuild`.
-*   4. Any changed path's basename matches the Dockerfile or a
-*      dependency manifest → `rebuild`.
-*   5. Any changed path's extension is a compiled-language source →
-*      `rebuild`.
-*   6. Else → `soft-reload`.
-*/
-function classifySourceChange(changedPaths, ctx) {
-	if (!ctx) return {
-		kind: "rebuild",
-		reason: "target image is not a CDK docker-image asset"
-	};
-	if (!ctx.oldAssetHash || ctx.oldAssetHash === ctx.newAssetHash) return {
-		kind: "rebuild",
-		reason: "asset hash unchanged across the synth (CDK construct edit or unrelated file) — task-spec changes need a fresh `docker create`, which only the rebuild path runs"
-	};
-	if (changedPaths.length === 0) return {
-		kind: "rebuild",
-		reason: "no changed paths reported (defensive default)"
-	};
-	for (const p of changedPaths) {
-		const basename = path.basename(p);
-		if (basename === ctx.dockerFile) return {
-			kind: "rebuild",
-			reason: `Dockerfile edit (${basename})`
-		};
-		if (basename.startsWith("Dockerfile.")) return {
-			kind: "rebuild",
-			reason: `Dockerfile.* edit (${basename})`
-		};
-		if (REBUILD_TRIGGER_BASENAMES.has(basename)) return {
-			kind: "rebuild",
-			reason: `dependency manifest edit (${basename})`
-		};
-		const ext = path.extname(p).toLowerCase();
-		if (COMPILED_LANGUAGE_EXTENSIONS.has(ext)) return {
-			kind: "rebuild",
-			reason: `compiled-language source edit (${basename}) — soft-reload would leave the built binary stale`
-		};
-	}
-	return {
-		kind: "soft-reload",
-		reason: `${changedPaths.length} source-only path(s) — skipping rebuild`,
-		newAssetSourceDir: ctx.newAssetSourceDir
-	};
-}
-
 //#endregion
 //#region src/local/cloud-map-registry.ts
 /**
@@ -27439,5 +27823,5 @@ function addListSpecificOptions(cmd) {
 }
 
 //#endregion
-export { MCP_PROTOCOL_VERSION as $, pickAgentCoreCandidateStack as $n, applyAuthorizerOverlay as $t, mergeForService as A, rejectExplicitCfnStackWithMultipleStacks as An, startApiServer as At, DEFAULT_SHADOW_READY_TIMEOUT_MS as B, listTargets as Bn, buildMethodArn as Bt, parseRestartPolicy as C, substituteAgainstState as Cn, materializeLayerFromArn as Ct, ImageOverrideError as D, LocalStateSourceError as Dn, filterRoutesByApiIdentifiers as Dt, runEcsServiceEmulator as E, substituteEnvVarsFromStateAsync as En, filterRoutesByApiIdentifier as Et, isLocalCdkAssetImage as F, collectSsmParameterRefs as Fn, buildJwksUrlFromIssuer as Ft, addInvokeAgentCoreSpecificOptions as G, pickRefLogicalId as Gn, attachAuthorizers as Gt, setShadowReadyTimeoutMs as H, discoverWebSocketApisOrThrow as Hn, evaluateCachedLambdaPolicy as Ht, listPinnedTargets as I, resolveSsmParameters as In, createJwksCache as It, A2A_CONTAINER_PORT as J, AGENTCORE_AGUI_PROTOCOL as Jn, buildCorsConfigFromCloudFrontChain as Jt, createLocalInvokeAgentCoreCommand as K, resolveLambdaArnIntrinsic as Kn, applyCorsResponseHeaders as Kt, buildCloudMapIndex as L, resolveWatchConfig as Ln, verifyCognitoJwt as Lt, resolveImageOverrides as M, resolveCfnRegion as Mn, resolveServiceIntegrationParameters as Mt, runImageOverrideBuilds as N, resolveCfnStackName as Nn, defaultCredentialsLoader as Nt, buildImageOverrideTag as O, createLocalStateProvider as On, groupRoutesByServer as Ot, describePinnedImageUri as P, CfnLocalStateProvider as Pn, buildCognitoJwksUrl as Pt, MCP_PATH as Q, AgentCoreResolutionError as Qn, translateLambdaResponse as Qt, CloudMapRegistry as R, resolveSingleTarget as Rn, verifyJwtAuthorizer as Rt, parseMaxTasks as S, EcsTaskResolutionError as Sn, buildStageMap as St, resolveSharedSidecarCredentials as T, substituteEnvVarsFromState as Tn, availableApiIdentifiers as Tt, getContainerNetworkIp as U, parseSelectionExpressionPath as Un, invokeRequestAuthorizer as Ut, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as V, discoverWebSocketApis as Vn, computeRequestIdentityHash as Vt, attachContainerLogStreamer as W, discoverRoutes as Wn, invokeTokenAuthorizer as Wt, a2aInvokeOnce as X, AGENTCORE_MCP_PROTOCOL as Xn, matchPreflight as Xt, A2A_PATH as Y, AGENTCORE_HTTP_PROTOCOL as Yn, isFunctionUrlOacFronted as Yt, MCP_CONTAINER_PORT as Z, AGENTCORE_RUNTIME_TYPE as Zn, matchRoute as Zt, addCommonEcsServiceOptions as _, architectureToPlatform as _n, createWatchPredicates as _t, albStrategy as a, tryParseStatus as an, LocalInvokeBuildError as ar, invokeAgentCore as at, buildEcsImageResolutionContext$1 as b, resolveRuntimeFileExtension as bn, createFileWatcher as bt, resolveAlbTarget as c, probeHostGatewaySupport as cn, SUPPORTED_CODE_RUNTIMES as ct, addStartServiceSpecificOptions as d, buildMgmtEndpointEnvUrl as dn, renderCodeDockerfile as dt, buildHttpApiV2Event as en, resolveAgentCoreTarget as er, mcpInvokeOnce as et, createLocalStartServiceCommand as f, handleConnectionsRequest as fn, toCmdArgv as ft, MAX_TASKS_SUBNET_RANGE_CAP as g, buildMessageEvent as gn, createLocalStartApiCommand as gt, createLocalRunTaskCommand as h, buildDisconnectEvent as hn, addStartApiSpecificOptions as ht, addAlbSpecificOptions as i, selectIntegrationResponse as in, tryResolveImageFnJoin as ir, AGENTCORE_SESSION_ID_HEADER as it, parseImageOverrideFlags as j, resolveCfnFallbackRegion as jn, resolveSelectionExpression as jt, enforceImageOverrideOrphans as k, isCfnFlagPresent as kn, readMtlsMaterialsFromDisk as kt, isApplicationLoadBalancer as l, bufferToBody as ln, buildAgentCoreCodeImage as lt, addRunTaskSpecificOptions as m, buildConnectEvent as mn, createLocalInvokeCommand as mt, createLocalListCommand as n, evaluateResponseParameters as nn, formatStateRemedy as nr, AGENTCORE_SIGV4_SERVICE as nt, createLocalStartAlbCommand as o, VtlEvaluationError as on, buildStsClientConfig as or, waitForAgentCorePing as ot, serviceStrategy as p, parseConnectionsPath as pn, addInvokeSpecificOptions as pt, invokeAgentCoreWs as q, AGENTCORE_A2A_PROTOCOL as qn, buildCorsConfigByApiId as qt, formatTargetListing as r, pickResponseTemplate as rn, substituteImagePlaceholders as rr, signAgentCoreInvocation as rt, parseLbPortOverrides as s, HOST_GATEWAY_MIN_VERSION as sn, resolveProfileCredentials as sr, downloadAndExtractS3Bundle as st, addListSpecificOptions as t, buildRestV1Event as tn, derivePseudoParametersFromRegion as tr, parseSseForJsonRpc as tt, resolveAlbFrontDoor as u, ConnectionRegistry as un, computeCodeImageTag as ut, addEcsAssumeRoleOptions as v, buildContainerImage as vn, resolveApiTargetSubset as vt, resolveEcsAssumeRoleOption as w, substituteAgainstStateAsync as wn, resolveEnvVars as wt, ecsClusterOption as x, resolveRuntimeImage as xn, attachStageContext as xt, addImageOverrideOptions as y, resolveRuntimeCodeMountPath as yn, createAuthorizerCache as yt, classifySourceChange as z, countTargets as zn, verifyJwtViaDiscovery as zt };
-//# sourceMappingURL=local-list-CFINvNxo.js.map
+export { mcpInvokeOnce as $, pickAgentCoreCandidateStack as $n, applyAuthorizerOverlay as $t, mergeForService as A, rejectExplicitCfnStackWithMultipleStacks as An, startApiServer as At, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as B, listTargets as Bn, buildMethodArn as Bt, parseRestartPolicy as C, substituteAgainstState as Cn, materializeLayerFromArn as Ct, ImageOverrideError as D, LocalStateSourceError as Dn, filterRoutesByApiIdentifiers as Dt, runEcsServiceEmulator as E, substituteEnvVarsFromStateAsync as En, filterRoutesByApiIdentifier as Et, isLocalCdkAssetImage as F, collectSsmParameterRefs as Fn, buildJwksUrlFromIssuer as Ft, createLocalInvokeAgentCoreCommand as G, pickRefLogicalId as Gn, attachAuthorizers as Gt, getContainerNetworkIp as H, discoverWebSocketApisOrThrow as Hn, evaluateCachedLambdaPolicy as Ht, listPinnedTargets as I, resolveSsmParameters as In, createJwksCache as It, A2A_PATH as J, AGENTCORE_AGUI_PROTOCOL as Jn, buildCorsConfigFromCloudFrontChain as Jt, invokeAgentCoreWs as K, resolveLambdaArnIntrinsic as Kn, applyCorsResponseHeaders as Kt, buildCloudMapIndex as L, resolveWatchConfig as Ln, verifyCognitoJwt as Lt, resolveImageOverrides as M, resolveCfnRegion as Mn, resolveServiceIntegrationParameters as Mt, runImageOverrideBuilds as N, resolveCfnStackName as Nn, defaultCredentialsLoader as Nt, buildImageOverrideTag as O, createLocalStateProvider as On, groupRoutesByServer as Ot, describePinnedImageUri as P, CfnLocalStateProvider as Pn, buildCognitoJwksUrl as Pt, MCP_PROTOCOL_VERSION as Q, AgentCoreResolutionError as Qn, translateLambdaResponse as Qt, CloudMapRegistry as R, resolveSingleTarget as Rn, verifyJwtAuthorizer as Rt, parseMaxTasks as S, EcsTaskResolutionError as Sn, buildStageMap as St, resolveSharedSidecarCredentials as T, substituteEnvVarsFromState as Tn, availableApiIdentifiers as Tt, attachContainerLogStreamer as U, parseSelectionExpressionPath as Un, invokeRequestAuthorizer as Ut, setShadowReadyTimeoutMs as V, discoverWebSocketApis as Vn, computeRequestIdentityHash as Vt, addInvokeAgentCoreSpecificOptions as W, discoverRoutes as Wn, invokeTokenAuthorizer as Wt, MCP_CONTAINER_PORT as X, AGENTCORE_MCP_PROTOCOL as Xn, matchPreflight as Xt, a2aInvokeOnce as Y, AGENTCORE_HTTP_PROTOCOL as Yn, isFunctionUrlOacFronted as Yt, MCP_PATH as Z, AGENTCORE_RUNTIME_TYPE as Zn, matchRoute as Zt, addCommonEcsServiceOptions as _, architectureToPlatform as _n, createWatchPredicates as _t, albStrategy as a, tryParseStatus as an, LocalInvokeBuildError as ar, waitForAgentCorePing as at, buildEcsImageResolutionContext$1 as b, resolveRuntimeFileExtension as bn, createFileWatcher as bt, resolveAlbTarget as c, probeHostGatewaySupport as cn, buildAgentCoreCodeImage as ct, addStartServiceSpecificOptions as d, buildMgmtEndpointEnvUrl as dn, toCmdArgv as dt, buildHttpApiV2Event as en, resolveAgentCoreTarget as er, parseSseForJsonRpc as et, createLocalStartServiceCommand as f, handleConnectionsRequest as fn, classifySourceChange as ft, MAX_TASKS_SUBNET_RANGE_CAP as g, buildMessageEvent as gn, createLocalStartApiCommand as gt, createLocalRunTaskCommand as h, buildDisconnectEvent as hn, addStartApiSpecificOptions as ht, addAlbSpecificOptions as i, selectIntegrationResponse as in, tryResolveImageFnJoin as ir, invokeAgentCore as it, parseImageOverrideFlags as j, resolveCfnFallbackRegion as jn, resolveSelectionExpression as jt, enforceImageOverrideOrphans as k, isCfnFlagPresent as kn, readMtlsMaterialsFromDisk as kt, isApplicationLoadBalancer as l, bufferToBody as ln, computeCodeImageTag as lt, addRunTaskSpecificOptions as m, buildConnectEvent as mn, createLocalInvokeCommand as mt, createLocalListCommand as n, evaluateResponseParameters as nn, formatStateRemedy as nr, signAgentCoreInvocation as nt, createLocalStartAlbCommand as o, VtlEvaluationError as on, buildStsClientConfig as or, downloadAndExtractS3Bundle as ot, serviceStrategy as p, parseConnectionsPath as pn, addInvokeSpecificOptions as pt, A2A_CONTAINER_PORT as q, AGENTCORE_A2A_PROTOCOL as qn, buildCorsConfigByApiId as qt, formatTargetListing as r, pickResponseTemplate as rn, substituteImagePlaceholders as rr, AGENTCORE_SESSION_ID_HEADER as rt, parseLbPortOverrides as s, HOST_GATEWAY_MIN_VERSION as sn, resolveProfileCredentials as sr, SUPPORTED_CODE_RUNTIMES as st, addListSpecificOptions as t, buildRestV1Event as tn, derivePseudoParametersFromRegion as tr, AGENTCORE_SIGV4_SERVICE as tt, resolveAlbFrontDoor as u, ConnectionRegistry as un, renderCodeDockerfile as ut, addEcsAssumeRoleOptions as v, buildContainerImage as vn, resolveApiTargetSubset as vt, resolveEcsAssumeRoleOption as w, substituteAgainstStateAsync as wn, resolveEnvVars as wt, ecsClusterOption as x, resolveRuntimeImage as xn, attachStageContext as xt, addImageOverrideOptions as y, resolveRuntimeCodeMountPath as yn, createAuthorizerCache as yt, DEFAULT_SHADOW_READY_TIMEOUT_MS as z, countTargets as zn, verifyJwtViaDiscovery as zt };
+//# sourceMappingURL=local-list-Dh6xjxGf.js.map