cdk-local 0.83.0 → 0.85.0

package/dist/{local-list-DBlBRfA-.js → local-studio-DaJ3D7co.js}

@@ -1,4 +1,4 @@
-import { a as runDockerStreaming, c as getEmbedConfig, i as runDockerForeground, n as formatDockerLoginError, o as spawnStreaming, r as getDockerCmd, s as getLogger, u as setEmbedConfig } from "./docker-cmd-Dqx2YENO.js";
+import { a as runDockerStreaming, c as resolveConfiguredLogLevel, d as setEmbedConfig, i as runDockerForeground, l as getEmbedConfig, n as formatDockerLoginError, o as spawnStreaming, r as getDockerCmd, s as getLogger } from "./docker-cmd-GcI_cqY5.js";
 import { cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path$1 from "node:path";
@@ -33,6 +33,7 @@ import { Sha256 } from "@aws-crypto/sha256-js";
 import { SignatureV4 } from "@smithy/signature-v4";
 import graphlib from "graphlib";
 import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { EventEmitter } from "node:events";
 
 //#region src/cli/options.ts
 /**
@@ -3560,14 +3561,28 @@ async function resolveMultiTarget(provided, params) {
 * command additionally writes its own `Synthesizing...` status to
 * stderr so its stdout is exactly the list. These are status lines no
 * caller parses from cdk-local's stdout.
+*
+* When `CDKL_LOG_LEVEL` resolves to `warn` / `error` (set by `cdkl studio`
+* on its single-shot `cdkl invoke` child), the synth-progress notifications
+* above — and any other non-`warn`/`error` toolkit message — are dropped
+* entirely, so cdk-local's own synth chatter never reaches the child's
+* stderr. This keeps the studio LOGS panel free of "Successfully
+* synthesized to ..." / asset-bundling noise; real synth failures still
+* surface (toolkit raises `AssemblyError` on non-zero subprocess exit, and
+* `warn` / `error` messages still pass through).
 */
 var CdklIoHost = class extends NonInteractiveIoHost {
+	suppressNonWarnings = (() => {
+		const level = resolveConfiguredLogLevel();
+		return level === "warn" || level === "error";
+	})();
 	async notify(msg) {
-		if (msg.code === "CDK_ASSEMBLY_E1002" || msg.code === "CDK_TOOLKIT_I1901" || msg.code === "CDK_TOOLKIT_I1902") return super.notify({
+		const reclassified = msg.code === "CDK_ASSEMBLY_E1002" || msg.code === "CDK_TOOLKIT_I1901" || msg.code === "CDK_TOOLKIT_I1902" ? {
 			...msg,
 			level: "info"
-		});
-		return super.notify(msg);
+		} : msg;
+		if (this.suppressNonWarnings && reclassified.level !== "warn" && reclassified.level !== "error") return;
+		return super.notify(reclassified);
 	}
 };
 
@@ -13488,7 +13503,7 @@ async function startApiServer(opts) {
 	const logger = getLogger().child("start-api");
 	let currentState = opts.state;
 	const requestHandler = (req, res) => {
-		handleRequest(req, res, currentState, opts).catch((err) => {
+		handleRequest$1(req, res, currentState, opts).catch((err) => {
 			logger.error(`Unhandled request error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
 			if (!res.headersSent) writeError$1(res, 502);
 		});
@@ -13557,7 +13572,7 @@ async function startApiServer(opts) {
 *      route handler.
 *   4. Build event, acquire container, invoke RIE, translate response.
 */
-async function handleRequest(req, res, state, opts) {
+async function handleRequest$1(req, res, state, opts) {
 	const logger = getLogger().child("start-api");
 	if (opts.preDispatch) try {
 		if (await opts.preDispatch(req, res)) return;
@@ -22207,7 +22222,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-Dqx2YENO.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GcI_cqY5.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -22226,7 +22241,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-Dqx2YENO.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GcI_cqY5.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -22241,7 +22256,7 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerRestartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-Dqx2YENO.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GcI_cqY5.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["restart", containerId]);
 };
 let dockerRestartImpl = defaultDockerRestartImpl;
@@ -22281,7 +22296,7 @@ async function disconnectOldFromSharedNetwork(oldInstance) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-Dqx2YENO.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GcI_cqY5.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -22458,7 +22473,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-Dqx2YENO.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GcI_cqY5.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -22478,7 +22493,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-Dqx2YENO.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-GcI_cqY5.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -27855,5 +27870,2007 @@ function addListSpecificOptions(cmd) {
 }
 
 //#endregion
-export { mcpInvokeOnce as $, AGENTCORE_RUNTIME_TYPE as $n, applyAuthorizerOverlay as $t, mergeForService as A, rejectExplicitCfnStackWithMultipleStacks as An, startApiServer as At, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as B, resolveSingleTarget as Bn, buildMethodArn as Bt, parseRestartPolicy as C, substituteAgainstState as Cn, materializeLayerFromArn as Ct, ImageOverrideError as D, LocalStateSourceError as Dn, filterRoutesByApiIdentifiers as Dt, runEcsServiceEmulator as E, substituteEnvVarsFromStateAsync as En, filterRoutesByApiIdentifier as Et, isLocalCdkAssetImage as F, collectSsmParameterRefs as Fn, buildJwksUrlFromIssuer as Ft, createLocalInvokeAgentCoreCommand as G, parseSelectionExpressionPath as Gn, attachAuthorizers as Gt, getContainerNetworkIp as H, listTargets as Hn, evaluateCachedLambdaPolicy as Ht, listPinnedTargets as I, resolveSsmParameters as In, createJwksCache as It, A2A_PATH as J, resolveLambdaArnIntrinsic as Jn, buildCorsConfigFromCloudFrontChain as Jt, invokeAgentCoreWs as K, discoverRoutes as Kn, applyCorsResponseHeaders as Kt, buildCloudMapIndex as L, resolveApp as Ln, verifyCognitoJwt as Lt, resolveImageOverrides as M, resolveCfnRegion as Mn, resolveServiceIntegrationParameters as Mt, runImageOverrideBuilds as N, resolveCfnStackName as Nn, defaultCredentialsLoader as Nt, buildImageOverrideTag as O, createLocalStateProvider as On, groupRoutesByServer as Ot, describePinnedImageUri as P, CfnLocalStateProvider as Pn, buildCognitoJwksUrl as Pt, MCP_PROTOCOL_VERSION as Q, AGENTCORE_MCP_PROTOCOL as Qn, translateLambdaResponse as Qt, CloudMapRegistry as R, resolveWatchConfig as Rn, verifyJwtAuthorizer as Rt, parseMaxTasks as S, EcsTaskResolutionError as Sn, buildStageMap as St, resolveSharedSidecarCredentials as T, substituteEnvVarsFromState as Tn, availableApiIdentifiers as Tt, attachContainerLogStreamer as U, discoverWebSocketApis as Un, invokeRequestAuthorizer as Ut, setShadowReadyTimeoutMs as V, countTargets as Vn, computeRequestIdentityHash as Vt, addInvokeAgentCoreSpecificOptions as W, discoverWebSocketApisOrThrow as Wn, invokeTokenAuthorizer as Wt, MCP_CONTAINER_PORT as X, AGENTCORE_AGUI_PROTOCOL as Xn, matchPreflight as Xt, a2aInvokeOnce as Y, AGENTCORE_A2A_PROTOCOL as Yn, isFunctionUrlOacFronted as Yt, MCP_PATH as Z, AGENTCORE_HTTP_PROTOCOL as Zn, matchRoute as Zt, addCommonEcsServiceOptions as _, architectureToPlatform as _n, createWatchPredicates as _t, albStrategy as a, tryParseStatus as an, substituteImagePlaceholders as ar, waitForAgentCorePing as at, buildEcsImageResolutionContext$1 as b, resolveRuntimeFileExtension as bn, createFileWatcher as bt, resolveAlbTarget as c, probeHostGatewaySupport as cn, withErrorHandling as cr, buildAgentCoreCodeImage as ct, addStartServiceSpecificOptions as d, buildMgmtEndpointEnvUrl as dn, resolveProfileCredentials as dr, toCmdArgv as dt, buildHttpApiV2Event as en, AgentCoreResolutionError as er, parseSseForJsonRpc as et, createLocalStartServiceCommand as f, handleConnectionsRequest as fn, appOptions as fr, classifySourceChange as ft, MAX_TASKS_SUBNET_RANGE_CAP as g, buildMessageEvent as gn, regionOption as gr, createLocalStartApiCommand as gt, createLocalRunTaskCommand as h, buildDisconnectEvent as hn, parseContextOptions as hr, addStartApiSpecificOptions as ht, addAlbSpecificOptions as i, selectIntegrationResponse as in, formatStateRemedy as ir, invokeAgentCore as it, parseImageOverrideFlags as j, resolveCfnFallbackRegion as jn, resolveSelectionExpression as jt, enforceImageOverrideOrphans as k, isCfnFlagPresent as kn, readMtlsMaterialsFromDisk as kt, isApplicationLoadBalancer as l, bufferToBody as ln, applyRoleArnIfSet as lr, computeCodeImageTag as lt, addRunTaskSpecificOptions as m, buildConnectEvent as mn, contextOptions as mr, createLocalInvokeCommand as mt, createLocalListCommand as n, evaluateResponseParameters as nn, resolveAgentCoreTarget as nr, signAgentCoreInvocation as nt, createLocalStartAlbCommand as o, VtlEvaluationError as on, tryResolveImageFnJoin as or, downloadAndExtractS3Bundle as ot, serviceStrategy as p, parseConnectionsPath as pn, commonOptions as pr, addInvokeSpecificOptions as pt, A2A_CONTAINER_PORT as q, pickRefLogicalId as qn, buildCorsConfigByApiId as qt, formatTargetListing as r, pickResponseTemplate as rn, derivePseudoParametersFromRegion as rr, AGENTCORE_SESSION_ID_HEADER as rt, parseLbPortOverrides as s, HOST_GATEWAY_MIN_VERSION as sn, LocalInvokeBuildError as sr, SUPPORTED_CODE_RUNTIMES as st, addListSpecificOptions as t, buildRestV1Event as tn, pickAgentCoreCandidateStack as tr, AGENTCORE_SIGV4_SERVICE as tt, resolveAlbFrontDoor as u, ConnectionRegistry as un, buildStsClientConfig as ur, renderCodeDockerfile as ut, addEcsAssumeRoleOptions as v, buildContainerImage as vn, resolveApiTargetSubset as vt, resolveEcsAssumeRoleOption as w, substituteAgainstStateAsync as wn, resolveEnvVars as wt, ecsClusterOption as x, resolveRuntimeImage as xn, attachStageContext as xt, addImageOverrideOptions as y, resolveRuntimeCodeMountPath as yn, createAuthorizerCache as yt, DEFAULT_SHADOW_READY_TIMEOUT_MS as z, Synthesizer as zn, verifyJwtViaDiscovery as zt };
-//# sourceMappingURL=local-list-DBlBRfA-.js.map
+//#region src/local/studio-events.ts
+/**
+* In-process event bus that every studio observation flows through. The
+* studio HTTP server subscribes and forwards events to the browser over
+* SSE; the dispatch / log-streaming layers emit onto it.
+*
+* A thin typed wrapper over {@link EventEmitter} so producers and the
+* server agree on the event shapes without `any`. Re-exported from
+* `cdk-local/internal` so a host CLI embedding studio can subscribe.
+*/
+var StudioEventBus = class {
+	emitter = new EventEmitter();
+	constructor() {
+		this.emitter.setMaxListeners(0);
+	}
+	emit(event, ...args) {
+		this.emitter.emit(event, ...args);
+	}
+	on(event, listener) {
+		this.emitter.on(event, listener);
+		return this;
+	}
+	off(event, listener) {
+		this.emitter.off(event, listener);
+		return this;
+	}
+	/**
+	* Number of listeners currently subscribed to `event`. Exposed so the
+	* SSE server's subscribe / unsubscribe symmetry can be asserted (a
+	* dropped client must not leak a listener).
+	*/
+	listenerCount(event) {
+		return this.emitter.listenerCount(event);
+	}
+};
+
+//#endregion
+//#region src/local/studio-store.ts
+/**
+* Build the studio store and subscribe it to `bus`. The store merges the
+* start/end pair of each invocation (keyed by id) and keeps a ring of log
+* lines; both windows evict oldest-first past their caps.
+*/
+function createStudioStore(bus, options = {}) {
+	const maxInvocations = options.maxInvocations ?? 200;
+	const maxLogs = options.maxLogs ?? 5e3;
+	const bindGraceMs = options.bindGraceMs ?? 250;
+	const invocations = /* @__PURE__ */ new Map();
+	const logs = [];
+	const onInvocation = (ev) => {
+		invocations.set(ev.id, {
+			...invocations.get(ev.id),
+			...ev
+		});
+		if (invocations.size > maxInvocations) {
+			const oldest = invocations.keys().next().value;
+			if (oldest !== void 0) invocations.delete(oldest);
+		}
+	};
+	const onLog = (ev) => {
+		logs.push(ev);
+		if (logs.length > maxLogs) logs.shift();
+	};
+	bus.on("invocation", onInvocation);
+	bus.on("log", onLog);
+	let disposed = false;
+	return {
+		history: () => ({
+			invocations: [...invocations.values()],
+			logs: [...logs]
+		}),
+		searchLogs: (query, opts = {}) => {
+			const needle = query.toLowerCase();
+			const limit = opts.limit ?? 200;
+			const matches = [];
+			for (let i = logs.length - 1; i >= 0 && matches.length < limit; i -= 1) {
+				const log = logs[i];
+				if (!log) continue;
+				if (opts.target !== void 0 && log.target !== opts.target) continue;
+				if (needle === "" || log.line.toLowerCase().includes(needle)) matches.push(log);
+			}
+			return matches;
+		},
+		logsForInvocation: (id) => {
+			const inv = invocations.get(id);
+			if (!inv) return [];
+			if (inv.kind === "lambda") return logs.filter((l) => l.containerId === id);
+			const from = inv.ts;
+			const to = inv.ts + (inv.durationMs ?? 0) + bindGraceMs;
+			return logs.filter((l) => l.target === inv.target && l.ts >= from && l.ts <= to);
+		},
+		invocation: (id) => invocations.get(id),
+		dispose: () => {
+			if (disposed) return;
+			disposed = true;
+			bus.off("invocation", onInvocation);
+			bus.off("log", onLog);
+		}
+	};
+}
+
+//#endregion
+//#region src/local/studio-ui.ts
+/**
+* The studio web UI, embedded as a string so it ships inside the
+* `cdk-local` npm package (decision D9) with no asset-copy build step —
+* `tsdown` bundles this module like any other source file. Served by
+* the studio HTTP server (`startStudioServer`) at `GET /`.
+*
+* 3-pane shell (decision D6), framework-free vanilla JS (decision D7):
+*   - left   = target list (from `GET /api/targets`); each Lambda has an
+*     [Invoke] button, each API a [Start] / [Stop] serve control with a
+*     `running ● :port` indicator (slice C1), plus a selected-highlight.
+*   - center = the WORKSPACE for the selected target: for a Lambda, an
+*     event composer (textarea + Invoke button) with the latest run's
+*     Request / Response / Logs shown below; for an API, a Start/Stop
+*     control with the served endpoints + streaming logs.
+*   - right  = the timeline (history) of every invocation AND every
+*     captured serve request (slice C2); clicking a Lambda row reloads
+*     it into the composer, clicking a captured request row opens a
+*     read-only Request / Response detail.
+*
+* The center workspace is deliberately adjacent to the left target list
+* (short eye-travel: pick a target -> compose right next to it), and is
+* the primary surface — the timeline is secondary history.
+*/
+const STUDIO_CSS = `
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; font: 13px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace;
+    color: #e6e6e6; background: #1a1a1a; height: 100vh; overflow: hidden;
+  }
+  header {
+    padding: 8px 14px; background: #111; border-bottom: 1px solid #333;
+    display: flex; align-items: center; gap: 10px;
+  }
+  header .brand { font-weight: 700; color: #fff; }
+  header .meta { color: #888; font-size: 12px; }
+  main {
+    display: grid; grid-template-columns: 280px 5px 1fr 5px 320px;
+    height: calc(100vh - 38px);
+  }
+  .pane { overflow: auto; }
+  .splitter { background: #2a2a2a; cursor: col-resize; }
+  .splitter:hover, .splitter.dragging { background: #4ec97a; }
+  .pane h2 {
+    margin: 0; padding: 8px 12px; font-size: 11px; text-transform: uppercase;
+    letter-spacing: 0.5px; color: #888; background: #151515;
+    position: sticky; top: 0; border-bottom: 1px solid #2a2a2a; z-index: 1;
+  }
+  .group-title { padding: 8px 12px 2px; color: #6aa9ff; font-size: 11px; }
+  .target {
+    padding: 6px 12px; border-bottom: 1px solid #222; display: flex;
+    align-items: center; gap: 8px;
+  }
+  .target.runnable { cursor: pointer; }
+  .target.runnable:hover { background: #202020; }
+  .target.sel { background: #2a3550; }
+  .target .name { color: #ddd; flex: 1; overflow: hidden; text-overflow: ellipsis; }
+  .target .kind { color: #777; font-size: 11px; }
+  .target .invoke-btn {
+    padding: 2px 10px; font: 11px ui-monospace, Menlo, monospace; font-weight: 700;
+    color: #0d1f12; background: #4ec97a; border: 0; border-radius: 3px; cursor: pointer;
+  }
+  .target .invoke-btn:hover { background: #6fe097; }
+  .target.sel .invoke-btn { background: #6fe097; }
+  .target .stop-btn {
+    padding: 2px 10px; font: 11px ui-monospace, Menlo, monospace; font-weight: 700;
+    color: #2a0d0d; background: #e0707a; border: 0; border-radius: 3px; cursor: pointer;
+  }
+  .target .stop-btn:hover { background: #ec8a92; }
+  .target .run-dot { color: #7bd88f; font-size: 11px; white-space: nowrap; }
+  .target .run-dot.starting { color: #e0b54e; }
+  .empty { padding: 16px 12px; color: #666; }
+  .row {
+    padding: 5px 12px; border-bottom: 1px solid #222; cursor: pointer;
+    display: flex; gap: 8px; white-space: nowrap;
+  }
+  .row:hover { background: #222; }
+  .row.sel { background: #2a3550; }
+  .row .ts { color: #777; }
+  .row .label { color: #ddd; flex: 1; overflow: hidden; text-overflow: ellipsis; }
+  .row .status { color: #7bd88f; }
+  .row .status.err { color: #e0707a; }
+  #workspace { padding: 0 0 24px; }
+  .composer { padding: 10px 12px; border-bottom: 1px solid #2a2a2a; }
+  .composer .target-name { color: #fff; font-weight: 700; margin-bottom: 6px; }
+  .composer textarea {
+    width: 100%; min-height: 130px; resize: vertical; background: #111; color: #ddd;
+    border: 1px solid #333; border-radius: 3px; padding: 6px;
+    font: 12px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace;
+  }
+  .composer button {
+    margin-top: 8px; padding: 6px 18px; background: #2a7d46; color: #fff;
+    border: 0; border-radius: 3px; cursor: pointer; font: inherit; font-weight: 700;
+  }
+  .composer button:hover { background: #339152; }
+  .composer button:disabled { background: #333; color: #888; cursor: default; }
+  .composer .err { color: #e0707a; margin-top: 6px; min-height: 18px; }
+  .section { padding: 8px 12px; border-bottom: 1px solid #222; }
+  .section h3 { margin: 0 0 6px; font-size: 11px; color: #888; text-transform: uppercase; }
+  .section h3 .ok { color: #7bd88f; }
+  .section h3 .bad { color: #e0707a; }
+  .section pre { margin: 0; white-space: pre-wrap; word-break: break-word; color: #cfcfcf; }
+  .endpoint { display: block; color: #6aa9ff; text-decoration: none; padding: 2px 0; }
+  .endpoint:hover { text-decoration: underline; }
+  .searchbar { padding: 6px 10px; border-bottom: 1px solid #2a2a2a; background: #151515;
+    position: sticky; top: 28px; z-index: 1; }
+  .searchbar input {
+    width: 100%; background: #111; color: #ddd; border: 1px solid #333; border-radius: 3px;
+    padding: 5px 8px; font: 12px ui-monospace, Menlo, monospace;
+  }
+  .searchbar input:focus { outline: none; border-color: #4ec97a; }
+  #log-results { display: none; }
+  #log-results.active { display: block; }
+  .log-hit { padding: 4px 12px; border-bottom: 1px solid #222; white-space: pre-wrap;
+    word-break: break-word; }
+  .log-hit .lt { color: #777; }
+  .log-hit .lg { color: #6aa9ff; }
+  .log-hits-meta { padding: 6px 12px; color: #888; font-size: 11px; }
+  #conn { font-size: 11px; }
+  #conn.up { color: #7bd88f; }
+  #conn.down { color: #e0707a; }
+`;
+const STUDIO_SCRIPT = `
+  const KIND_LABEL = { lambda: 'Lambda', api: 'API', alb: 'ALB', ecs: 'ECS', agentcore: 'AgentCore' };
+  const SERVE_KINDS = ['api', 'alb', 'ecs']; // long-running serve targets
+  const rowsById = new Map();      // invocationId -> timeline row element
+  const invById = new Map();       // invocationId -> latest invocation event
+  const logsById = new Map();      // invocationId / serve targetId -> [log lines]
+  const targetEls = new Map();     // targetId -> left-pane element
+  const serveMeta = new Map();     // serve targetId -> { dot, btnSlot } row controls
+  const serveState = new Map();    // serve targetId -> { status, endpoints }
+  let active = null;               // { id, kind, ta, btn, msg, result }
+  let shownInvId = null;           // lambda invocation whose result is in the workspace
+  let shownServeId = null;         // serve target whose workspace is shown
+  let shownDetailId = null;        // captured request whose read-only detail is shown
+
+  function el(tag, cls, text) {
+    const e = document.createElement(tag);
+    if (cls) e.className = cls;
+    if (text != null) e.textContent = text;
+    return e;
+  }
+
+  async function loadTargets() {
+    const pane = document.getElementById('targets');
+    try {
+      const res = await fetch('/api/targets');
+      const data = await res.json();
+      pane.querySelectorAll('.group-title,.target,.empty').forEach((n) => n.remove());
+      let total = 0;
+      for (const group of data.groups) {
+        if (!group.entries.length) continue;
+        pane.appendChild(el('div', 'group-title', group.title));
+        for (const entry of group.entries) {
+          total += 1;
+          // Lambda targets are single-shot invokes; api / alb / ecs are
+          // long-running serves. Other kinds list but are not yet runnable.
+          // Within ecs, only services are servable (task defs are run-task).
+          const isServe = SERVE_KINDS.includes(group.kind) && (group.kind !== 'ecs' || entry.servable === true);
+          const runnable = group.kind === 'lambda' || isServe;
+          const t = el('div', runnable ? 'target runnable' : 'target');
+          const name = el('span', 'name', entry.id);
+          name.title = entry.id; // full path on hover even when truncated
+          t.appendChild(name);
+          t.appendChild(el('span', 'kind', '(' + (KIND_LABEL[group.kind] || group.kind) + ')'));
+          if (group.kind === 'lambda') {
+            const btn = el('button', 'invoke-btn', 'Invoke');
+            btn.onclick = (e) => { e.stopPropagation(); selectTarget(entry.id, 'lambda'); };
+            t.appendChild(btn);
+            t.onclick = () => selectTarget(entry.id, 'lambda');
+            targetEls.set(entry.id, t);
+          } else if (isServe) {
+            // A serve target: a running-state dot + a Start/Stop button
+            // slot, both refreshed by updateServeRow on serve events.
+            const dot = el('span', 'run-dot');
+            const btnSlot = el('span', 'btn-slot');
+            t.appendChild(dot);
+            t.appendChild(btnSlot);
+            t.onclick = () => selectTarget(entry.id, group.kind);
+            targetEls.set(entry.id, t);
+            serveMeta.set(entry.id, { dot, btnSlot, kind: group.kind });
+            updateServeRow(entry.id);
+          }
+          pane.appendChild(t);
+        }
+      }
+      if (!total) pane.appendChild(el('div', 'empty', 'No runnable targets found.'));
+    } catch (err) {
+      pane.appendChild(el('div', 'empty', 'Failed to load targets: ' + err));
+    }
+  }
+
+  // Pull any already-running serves (e.g. after a UI reload) so the rows
+  // and workspace reflect them without waiting for a fresh serve event.
+  async function loadRunning() {
+    try {
+      const res = await fetch('/api/running');
+      const data = await res.json();
+      for (const s of (data.running || [])) {
+        serveState.set(s.targetId, { status: s.status, endpoints: s.endpoints || [] });
+        updateServeRow(s.targetId);
+      }
+    } catch (err) {
+      /* best-effort; the serve SSE stream still drives live updates */
+    }
+  }
+
+  function firstPort(endpoints) {
+    const u = (endpoints || [])[0];
+    if (!u) return '';
+    const m = /:(\\d+)/.exec(u);
+    return m ? ':' + m[1] : '';
+  }
+
+  function updateServeRow(id) {
+    const meta = serveMeta.get(id);
+    if (!meta) return;
+    const st = serveState.get(id);
+    const status = st ? st.status : 'stopped';
+    const running = status === 'running';
+    const starting = status === 'starting';
+    // A serve with a host endpoint shows the dot + :port; a pure-compute
+    // ecs service has no endpoint, so just the dot + running.
+    const port = running ? firstPort(st.endpoints) : '';
+    meta.dot.textContent = running ? (port ? '● ' + port : '● running') : starting ? '○ starting' : '';
+    meta.dot.className = 'run-dot' + (starting ? ' starting' : '');
+    meta.btnSlot.innerHTML = '';
+    const btn = running || starting
+      ? el('button', 'stop-btn', 'Stop')
+      : el('button', 'invoke-btn', 'Start');
+    btn.onclick = (e) => {
+      e.stopPropagation();
+      if (running || starting) stopServe(id); else startServe(id);
+    };
+    meta.btnSlot.appendChild(btn);
+    // Refresh the workspace if it is showing this serve.
+    if (shownServeId === id) renderServeWorkspace(id);
+  }
+
+  function highlightTarget(id) {
+    document.querySelectorAll('.target.sel').forEach((n) => n.classList.remove('sel'));
+    const t = targetEls.get(id);
+    if (t) t.classList.add('sel');
+  }
+
+  function selectTarget(id, kind) {
+    highlightTarget(id);
+    shownDetailId = null;
+    if (SERVE_KINDS.includes(kind)) {
+      shownServeId = id;
+      shownInvId = null;
+      active = null;
+      renderServeWorkspace(id);
+    } else {
+      shownServeId = null;
+      renderComposer(id, kind, '{}');
+    }
+  }
+
+  async function startServe(id) {
+    // The serve kind (api / alb / ecs) drives which headless command the
+    // server spawns; it is recorded on the row when the target list loads.
+    const meta = serveMeta.get(id);
+    const kind = meta ? meta.kind : 'api';
+    serveState.set(id, { status: 'starting', endpoints: [] });
+    updateServeRow(id);
+    try {
+      const res = await fetch('/api/run', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ targetId: id, kind }),
+      });
+      const data = await res.json();
+      if (!res.ok) {
+        // Roll back the optimistic 'starting' on a rejected start.
+        serveState.set(id, { status: 'error', endpoints: [] });
+        updateServeRow(id);
+        if (shownServeId === id) renderServeWorkspace(id, data.error || ('HTTP ' + res.status));
+      }
+      // On success the serve SSE 'running' event fills in the endpoints.
+    } catch (err) {
+      serveState.set(id, { status: 'error', endpoints: [] });
+      updateServeRow(id);
+      if (shownServeId === id) renderServeWorkspace(id, String(err));
+    }
+  }
+
+  async function stopServe(id) {
+    try {
+      await fetch('/api/stop', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ targetId: id }),
+      });
+      // The serve SSE 'stopped' event clears the running state.
+    } catch (err) {
+      /* the stop SSE event (or a later refresh) reconciles state */
+    }
+  }
+
+  function renderServeWorkspace(id, errMsg) {
+    const ws = document.getElementById('workspace');
+    ws.innerHTML = '';
+    const st = serveState.get(id) || { status: 'stopped', endpoints: [] };
+    const running = st.status === 'running';
+    const starting = st.status === 'starting';
+
+    const head = el('div', 'composer');
+    head.appendChild(el('div', 'target-name', 'Serve ' + id));
+    const btn = running || starting
+      ? el('button', null, 'Stop')
+      : el('button', null, starting ? 'Starting…' : 'Start');
+    btn.onclick = () => { if (running || starting) stopServe(id); else startServe(id); };
+    head.appendChild(btn);
+    if (errMsg) {
+      const m = el('div', 'err', errMsg);
+      head.appendChild(m);
+    }
+    ws.appendChild(head);
+
+    const meta = serveMeta.get(id);
+    const isEcs = meta && meta.kind === 'ecs';
+    const epSec = el('div', 'section');
+    epSec.appendChild(el('h3', null, 'Endpoints'));
+    if (running && st.endpoints.length) {
+      for (const url of st.endpoints) {
+        const link = href(url);
+        epSec.appendChild(link);
+      }
+    } else if (running && isEcs) {
+      // A pure-compute ECS service has no host endpoint — it just runs the
+      // replicas (reach them container-to-container via Cloud Map).
+      epSec.appendChild(el('pre', null, '(running — pure compute service, no host endpoint)'));
+    } else {
+      epSec.appendChild(el('pre', null, starting ? '(starting…)' : '(not running)'));
+    }
+    ws.appendChild(epSec);
+
+    const logs = logsById.get(id) || [];
+    const logSec = el('div', 'section');
+    logSec.appendChild(el('h3', null, 'Logs'));
+    logSec.appendChild(el('pre', null, logs.length ? logs.join('\\n') : '(none)'));
+    ws.appendChild(logSec);
+  }
+
+  // Build an <a> that opens an http(s) endpoint in a new tab; ws:// URLs
+  // are shown as plain text (not navigable in a browser tab).
+  function href(url) {
+    if (/^https?:/.test(url)) {
+      const a = el('a', 'endpoint', url);
+      a.href = url;
+      a.target = '_blank';
+      a.rel = 'noopener';
+      return a;
+    }
+    return el('div', 'endpoint', url);
+  }
+
+  function renderComposer(id, kind, eventText) {
+    const ws = document.getElementById('workspace');
+    ws.innerHTML = '';
+
+    const composer = el('div', 'composer');
+    composer.appendChild(el('div', 'target-name', 'Invoke ' + id));
+    const ta = el('textarea');
+    ta.value = eventText;
+    ta.spellcheck = false;
+    composer.appendChild(ta);
+    composer.appendChild(document.createElement('br'));
+    const btn = el('button', null, 'Invoke');
+    const msg = el('div', 'err');
+    composer.appendChild(btn);
+    composer.appendChild(msg);
+
+    const result = el('div', 'result');
+
+    ws.appendChild(composer);
+    ws.appendChild(result);
+
+    active = { id, kind, ta, btn, msg, result };
+    btn.onclick = () => runInvoke();
+    shownInvId = null;
+    shownDetailId = null;
+    ta.focus();
+  }
+
+  async function runInvoke() {
+    if (!active) return;
+    const { id, kind, ta, btn, msg, result } = active;
+    let event;
+    try {
+      event = ta.value.trim() === '' ? {} : JSON.parse(ta.value);
+    } catch (err) {
+      msg.textContent = 'Invalid JSON: ' + err.message;
+      return;
+    }
+    msg.textContent = '';
+    btn.disabled = true;
+    btn.textContent = 'Invoking...';
+    result.innerHTML = '';
+    try {
+      const res = await fetch('/api/run', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ targetId: id, kind, event }),
+      });
+      const data = await res.json();
+      if (data.invocationId) {
+        shownInvId = data.invocationId;
+        renderResult(shownInvId);
+      }
+      if (!res.ok || data.ok === false) {
+        msg.textContent = 'Invoke failed: ' + (data.error || ('HTTP ' + res.status));
+      }
+    } catch (err) {
+      msg.textContent = 'Request failed: ' + err;
+    } finally {
+      btn.disabled = false;
+      btn.textContent = 'Invoke';
+    }
+  }
+
+  function fmt(body) {
+    return typeof body === 'string' ? body : JSON.stringify(body, null, 2);
+  }
+
+  function renderResult(invId) {
+    if (!active) return;
+    const result = active.result;
+    result.innerHTML = '';
+    const ev = invById.get(invId);
+    if (!ev) return;
+
+    const reqSec = el('div', 'section');
+    reqSec.appendChild(el('h3', null, 'Request'));
+    reqSec.appendChild(el('pre', null, ev.request != null ? fmt(ev.request) : '(none)'));
+    result.appendChild(reqSec);
+
+    const respSec = el('div', 'section');
+    const h = el('h3', null, 'Response');
+    if (ev.status != null) {
+      const cls = ev.status >= 200 && ev.status < 300 ? 'ok' : 'bad';
+      const meta = el('span', cls, '  ' + ev.status + (ev.durationMs != null ? ' · ' + ev.durationMs + 'ms' : ''));
+      h.appendChild(meta);
+    }
+    respSec.appendChild(h);
+    respSec.appendChild(el('pre', null, ev.response != null ? fmt(ev.response) : '(pending…)'));
+    result.appendChild(respSec);
+
+    const logs = logsById.get(invId) || [];
+    const logSec = el('div', 'section');
+    logSec.appendChild(el('h3', null, 'Logs'));
+    logSec.appendChild(el('pre', null, logs.length ? logs.join('\\n') : '(none)'));
+    result.appendChild(logSec);
+  }
+
+  function addInvocation(ev) {
+    invById.set(ev.id, Object.assign(invById.get(ev.id) || {}, ev));
+    const timeline = document.getElementById('timeline-rows');
+    const placeholder = timeline.querySelector('.empty');
+    if (placeholder) placeholder.remove();
+
+    let row = rowsById.get(ev.id);
+    if (!row) {
+      row = el('div', 'row');
+      row.appendChild(el('span', 'ts'));
+      row.appendChild(el('span', 'label'));
+      row.appendChild(el('span', 'status'));
+      row.onclick = () => loadInvocation(ev.id);
+      rowsById.set(ev.id, row);
+      timeline.insertBefore(row, timeline.querySelector('.row')); // newest on top
+    }
+    const merged = invById.get(ev.id);
+    const d = new Date(merged.ts);
+    row.querySelector('.ts').textContent = d.toLocaleTimeString();
+    row.querySelector('.label').textContent = (merged.target || '') + '  ' + (merged.label || '');
+    const statusEl = row.querySelector('.status');
+    statusEl.textContent =
+      merged.status != null
+        ? merged.status + (merged.durationMs != null ? '  ' + merged.durationMs + 'ms' : '')
+        : '…';
+    statusEl.className = 'status' + (merged.status != null && (merged.status < 200 || merged.status >= 300) ? ' err' : '');
+
+    // Live-refresh the workspace if it is showing this invocation.
+    if (shownInvId === ev.id) renderResult(ev.id);
+    if (shownDetailId === ev.id) renderCapturedDetail(ev.id);
+  }
+
+  function loadInvocation(id) {
+    const ev = invById.get(id);
+    if (!ev) return;
+    document.querySelectorAll('.row.sel').forEach((n) => n.classList.remove('sel'));
+    const row = rowsById.get(id);
+    if (row) row.classList.add('sel');
+    highlightTarget(ev.target);
+    if (ev.kind === 'lambda') {
+      // A Lambda invocation row reloads into the re-invokable composer.
+      shownDetailId = null;
+      shownServeId = null;
+      renderComposer(ev.target, ev.kind, ev.request != null ? fmt(ev.request) : '{}');
+      shownInvId = id;
+      renderResult(id);
+    } else {
+      // A captured serve request (slice C2) opens a READ-ONLY detail —
+      // re-invoking a captured request is Phase 3.
+      shownInvId = null;
+      shownServeId = null;
+      active = null;
+      renderCapturedDetail(id);
+    }
+  }
+
+  // Read-only Request / Response detail for a captured serve request.
+  function renderCapturedDetail(id) {
+    shownDetailId = id;
+    const ev = invById.get(id);
+    const ws = document.getElementById('workspace');
+    ws.innerHTML = '';
+    if (!ev) return;
+
+    const head = el('div', 'composer');
+    head.appendChild(el('div', 'target-name', (ev.label || 'request') + '  —  ' + (ev.target || '')));
+    ws.appendChild(head);
+
+    const reqSec = el('div', 'section');
+    reqSec.appendChild(el('h3', null, 'Request'));
+    reqSec.appendChild(el('pre', null, ev.request != null ? fmt(ev.request) : '(none)'));
+    ws.appendChild(reqSec);
+
+    const respSec = el('div', 'section');
+    const h = el('h3', null, 'Response');
+    if (ev.status != null) {
+      const cls = ev.status >= 200 && ev.status < 300 ? 'ok' : 'bad';
+      h.appendChild(el('span', cls, '  ' + ev.status + (ev.durationMs != null ? ' · ' + ev.durationMs + 'ms' : '')));
+    }
+    respSec.appendChild(h);
+    respSec.appendChild(el('pre', null, ev.response != null ? fmt(ev.response) : '(pending…)'));
+    ws.appendChild(respSec);
+
+    // Logs bound to THIS request at CloudWatch granularity (D5), fetched
+    // from the server store.
+    const logSec = el('div', 'section');
+    logSec.appendChild(el('h3', null, 'Logs'));
+    const logPre = el('pre', null, '(loading…)');
+    logSec.appendChild(logPre);
+    ws.appendChild(logSec);
+    fetchInvocationLogs(id, logPre);
+  }
+
+  async function fetchInvocationLogs(id, pre) {
+    try {
+      const res = await fetch('/api/invocations/' + encodeURIComponent(id) + '/logs');
+      const data = await res.json();
+      const lines = (data.logs || []).map((l) => l.line);
+      if (shownDetailId === id) pre.textContent = lines.length ? lines.join('\\n') : '(none)';
+    } catch (err) {
+      if (shownDetailId === id) pre.textContent = '(failed to load logs)';
+    }
+  }
+
+  // Full-text log search over the server store. A non-empty query shows
+  // matching log lines INSTEAD of the timeline rows; clearing restores them.
+  let searchTimer = null;
+  function wireLogSearch() {
+    const input = document.getElementById('log-search');
+    const rows = document.getElementById('timeline-rows');
+    const results = document.getElementById('log-results');
+    input.addEventListener('input', () => {
+      if (searchTimer) clearTimeout(searchTimer);
+      searchTimer = setTimeout(() => runLogSearch(input.value.trim(), rows, results), 180);
+    });
+  }
+
+  async function runLogSearch(query, rows, results) {
+    if (query === '') {
+      results.classList.remove('active');
+      rows.style.display = '';
+      results.innerHTML = '';
+      return;
+    }
+    rows.style.display = 'none';
+    results.classList.add('active');
+    try {
+      const res = await fetch('/api/logs?q=' + encodeURIComponent(query));
+      const data = await res.json();
+      const hits = data.logs || [];
+      results.innerHTML = '';
+      results.appendChild(el('div', 'log-hits-meta', hits.length + ' match' + (hits.length === 1 ? '' : 'es')));
+      for (const h of hits) {
+        const row = el('div', 'log-hit');
+        row.appendChild(el('span', 'lt', new Date(h.ts).toLocaleTimeString() + '  '));
+        row.appendChild(el('span', 'lg', (h.target || '') + '  '));
+        row.appendChild(document.createTextNode(h.line));
+        results.appendChild(row);
+      }
+    } catch (err) {
+      results.innerHTML = '';
+      results.appendChild(el('div', 'log-hits-meta', 'Search failed: ' + err));
+    }
+  }
+
+  // Pull retained history on (re)connect so the timeline + logs reflect the
+  // whole session, not just events since this page loaded.
+  async function loadHistory() {
+    try {
+      const res = await fetch('/api/history');
+      const data = await res.json();
+      for (const log of (data.logs || [])) {
+        const arr = logsById.get(log.containerId) || [];
+        arr.push(log.line);
+        logsById.set(log.containerId, arr);
+      }
+      for (const inv of (data.invocations || [])) addInvocation(inv);
+    } catch (err) {
+      /* live SSE still drives the timeline; history is best-effort */
+    }
+  }
+
+  function connect() {
+    const conn = document.getElementById('conn');
+    const es = new EventSource('/api/events');
+    es.addEventListener('open', () => { conn.textContent = '● live'; conn.className = 'up'; });
+    es.addEventListener('error', () => { conn.textContent = '● disconnected'; conn.className = 'down'; });
+    es.addEventListener('invocation', (e) => addInvocation(JSON.parse(e.data)));
+    es.addEventListener('serve', (e) => onServeEvent(JSON.parse(e.data)));
+    es.addEventListener('log', (e) => {
+      const ev = JSON.parse(e.data);
+      const arr = logsById.get(ev.containerId) || [];
+      arr.push(ev.line);
+      logsById.set(ev.containerId, arr);
+      if (shownInvId === ev.containerId) renderResult(ev.containerId);
+      if (shownServeId === ev.containerId) renderServeWorkspace(ev.containerId);
+    });
+  }
+
+  function onServeEvent(ev) {
+    // A 'stopped' / 'error' transition clears the running state; otherwise
+    // record the latest status + endpoints for the row + workspace.
+    if (ev.status === 'stopped' || ev.status === 'error') {
+      serveState.set(ev.target, { status: ev.status, endpoints: [] });
+    } else {
+      serveState.set(ev.target, { status: ev.status, endpoints: ev.endpoints || [] });
+    }
+    updateServeRow(ev.target);
+  }
+
+  function initSplitters() {
+    const main = document.querySelector('main');
+    let left = 280, right = 320;
+    const apply = () => {
+      main.style.gridTemplateColumns = left + 'px 5px 1fr 5px ' + right + 'px';
+    };
+    const wire = (splitterId, onMove) => {
+      const s = document.getElementById(splitterId);
+      s.addEventListener('mousedown', (e) => {
+        e.preventDefault();
+        const startX = e.clientX;
+        const l0 = left, r0 = right;
+        s.classList.add('dragging');
+        document.body.style.userSelect = 'none';
+        const move = (ev) => { onMove(ev.clientX - startX, l0, r0); apply(); };
+        const up = () => {
+          s.classList.remove('dragging');
+          document.body.style.userSelect = '';
+          document.removeEventListener('mousemove', move);
+          document.removeEventListener('mouseup', up);
+        };
+        document.addEventListener('mousemove', move);
+        document.addEventListener('mouseup', up);
+      });
+    };
+    const clamp = (v) => Math.max(160, Math.min(760, v));
+    wire('split-left', (dx, l0) => { left = clamp(l0 + dx); });
+    wire('split-right', (dx, l0, r0) => { right = clamp(r0 - dx); });
+  }
+
+  loadTargets().then(loadRunning);
+  loadHistory();
+  connect();
+  initSplitters();
+  wireLogSearch();
+`;
+/**
+* Render the full studio HTML document. `appLabel` is shown in the
+* header (the CDK app / stack context); `cliName` brands the title for
+* host CLIs that rebrand `cdkl`.
+*/
+function renderStudioHtml(appLabel, cliName) {
+	const safeApp = escapeHtml(appLabel);
+	const safeCli = escapeHtml(cliName);
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>${safeCli} studio</title>
+<style>${STUDIO_CSS}</style>
+</head>
+<body>
+<header>
+  <span class="brand">${safeCli} studio</span>
+  <span class="meta">${safeApp}</span>
+  <span id="conn" class="down">● connecting</span>
+</header>
+<main>
+  <section class="pane" id="targets"><h2>Targets</h2></section>
+  <div class="splitter" id="split-left"></div>
+  <section class="pane" id="workspace"><div class="empty">Pick a Lambda to invoke, or an API to serve, on the left.</div></section>
+  <div class="splitter" id="split-right"></div>
+  <section class="pane" id="timeline">
+    <h2>Timeline</h2>
+    <div class="searchbar"><input id="log-search" type="search" placeholder="Search logs…" autocomplete="off" spellcheck="false" /></div>
+    <div id="timeline-rows"><div class="empty">No requests yet.</div></div>
+    <div id="log-results"></div>
+  </section>
+</main>
+<script>${STUDIO_SCRIPT}<\/script>
+</body>
+</html>`;
+}
+/** Minimal HTML-escape for the few interpolated text values. */
+function escapeHtml(s) {
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+
+//#endregion
+//#region src/local/studio-server.ts
+/**
+* Project a {@link TargetListing} (the same enumeration `cdkl list`
+* prints) into the grouped shape the studio UI renders. ECS services and
+* task definitions are folded into one `ecs` group; everything else maps
+* one category to one group. Exported so a unit test can assert the
+* projection without booting the server.
+*/
+function toStudioTargetGroups(listing) {
+	const map = (entries, opts = {}) => entries.map((e) => {
+		const t = {
+			id: e.displayPath ?? e.qualifiedId,
+			qualifiedId: e.qualifiedId
+		};
+		if (e.kind) t.surface = e.kind;
+		if (opts.servable !== void 0) t.servable = opts.servable;
+		return t;
+	});
+	return [
+		{
+			kind: "lambda",
+			title: "Lambda Functions",
+			entries: map(listing.lambdas)
+		},
+		{
+			kind: "api",
+			title: "APIs",
+			entries: map(listing.apis)
+		},
+		{
+			kind: "ecs",
+			title: "ECS Services / Tasks",
+			entries: [...map(listing.ecsServices, { servable: true }), ...map(listing.ecsTaskDefinitions, { servable: false })]
+		},
+		{
+			kind: "agentcore",
+			title: "AgentCore Runtimes",
+			entries: map(listing.agentCoreRuntimes)
+		},
+		{
+			kind: "alb",
+			title: "Load Balancers",
+			entries: map(listing.loadBalancers)
+		}
+	];
+}
+const SSE_HEARTBEAT_MS = 15e3;
+/**
+* Boot the studio HTTP server: serves the embedded UI at `/`, the target
+* list at `/api/targets`, and a Server-Sent-Events stream of the bus's
+* `invocation` / `log` events at `/api/events`. Localhost-only by
+* default. Resolves once the socket is listening.
+*/
+async function startStudioServer(options) {
+	const host = options.host ?? "127.0.0.1";
+	const maxBump = options.maxPortBump ?? 20;
+	const html = renderStudioHtml(options.appLabel, options.cliName);
+	const targetsJson = JSON.stringify({ groups: options.targetGroups });
+	const server = createServer$1((req, res) => handleRequest(req, res, options.bus, html, targetsJson, options));
+	const boundPort = await listenWithBump(server, host, options.port, maxBump);
+	return {
+		url: `http://${host}:${boundPort}`,
+		port: boundPort,
+		close: () => new Promise((resolveClose, reject) => {
+			server.close((err) => err ? reject(err) : resolveClose());
+			server.closeAllConnections?.();
+		})
+	};
+}
+function handleRequest(req, res, bus, html, targetsJson, options) {
+	const url = req.url ?? "/";
+	const path = url.split("?")[0];
+	if (req.method === "GET" && (path === "/" || path === "/index.html")) {
+		res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+		res.end(html);
+		return;
+	}
+	if (req.method === "GET" && path === "/api/targets") {
+		res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+		res.end(targetsJson);
+		return;
+	}
+	if (req.method === "GET" && path === "/api/running") {
+		const running = options.getRunning ? options.getRunning() : { running: [] };
+		res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+		res.end(JSON.stringify(running));
+		return;
+	}
+	if (req.method === "GET" && path === "/api/history") {
+		const history = options.store ? options.store.history() : {
+			invocations: [],
+			logs: []
+		};
+		res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+		res.end(JSON.stringify(history));
+		return;
+	}
+	if (req.method === "GET" && path === "/api/logs") {
+		const params = new URLSearchParams(url.split("?")[1] ?? "");
+		const query = params.get("q") ?? "";
+		const target = params.get("target") || void 0;
+		const logs = options.store ? options.store.searchLogs(query, target !== void 0 ? { target } : {}) : [];
+		res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+		res.end(JSON.stringify({ logs }));
+		return;
+	}
+	const invLogsMatch = /^\/api\/invocations\/([^/]+)\/logs$/.exec(path ?? "");
+	if (req.method === "GET" && invLogsMatch) {
+		const id = decodeURIComponent(invLogsMatch[1] ?? "");
+		const logs = options.store ? options.store.logsForInvocation(id) : [];
+		res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+		res.end(JSON.stringify({ logs }));
+		return;
+	}
+	if (req.method === "GET" && path === "/api/events") {
+		serveSse(req, res, bus);
+		return;
+	}
+	if (req.method === "POST" && path === "/api/run") {
+		handleDispatch(req, res, options.onRun);
+		return;
+	}
+	if (req.method === "POST" && path === "/api/stop") {
+		handleDispatch(req, res, options.onStop);
+		return;
+	}
+	res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+	res.end("Not found");
+}
+const MAX_RUN_BODY_BYTES = 5 * 1024 * 1024;
+/**
+* Reply to a JSON POST endpoint (`/api/run` / `/api/stop`): parse the
+* bounded JSON body and dispatch via `handler`. 501 when no handler is
+* wired (the observe-only shell), 400 on a malformed body, 500 when the
+* handler throws.
+*/
+async function handleDispatch(req, res, handler) {
+	const sendJson = (statusCode, payload) => {
+		res.writeHead(statusCode, { "content-type": "application/json; charset=utf-8" });
+		res.end(JSON.stringify(payload));
+	};
+	if (!handler) {
+		sendJson(501, { error: "Running targets is not supported by this studio server." });
+		return;
+	}
+	let body;
+	try {
+		body = await readJsonBody(req);
+	} catch (err) {
+		sendJson(400, { error: err instanceof Error ? err.message : String(err) });
+		return;
+	}
+	try {
+		sendJson(200, await handler(body));
+	} catch (err) {
+		sendJson(500, { error: err instanceof Error ? err.message : String(err) });
+	}
+}
+/** Read + JSON-parse a request body, bounded to {@link MAX_RUN_BODY_BYTES}. */
+function readJsonBody(req) {
+	return new Promise((resolveBody, reject) => {
+		let raw = "";
+		let bytes = 0;
+		let done = false;
+		const settle = (fn) => {
+			if (done) return;
+			done = true;
+			fn();
+		};
+		req.setEncoding("utf8");
+		req.on("data", (chunk) => {
+			if (done) return;
+			bytes += Buffer.byteLength(chunk);
+			if (bytes > MAX_RUN_BODY_BYTES) {
+				settle(() => reject(/* @__PURE__ */ new Error("Request body too large.")));
+				req.destroy();
+				return;
+			}
+			raw += chunk;
+		});
+		req.on("end", () => {
+			settle(() => {
+				if (raw.trim() === "") {
+					resolveBody(void 0);
+					return;
+				}
+				try {
+					resolveBody(JSON.parse(raw));
+				} catch {
+					reject(/* @__PURE__ */ new Error("Invalid JSON body."));
+				}
+			});
+		});
+		req.on("error", (err) => settle(() => reject(err)));
+	});
+}
+function serveSse(req, res, bus) {
+	res.writeHead(200, {
+		"content-type": "text/event-stream; charset=utf-8",
+		"cache-control": "no-cache, no-transform",
+		connection: "keep-alive"
+	});
+	let closed = false;
+	const heartbeat = setInterval(() => safeWrite(":hb\n\n"), SSE_HEARTBEAT_MS);
+	heartbeat.unref?.();
+	const onInvocation = (ev) => {
+		safeWrite(`event: invocation\ndata: ${JSON.stringify(ev)}\n\n`);
+	};
+	const onLog = (ev) => {
+		safeWrite(`event: log\ndata: ${JSON.stringify(ev)}\n\n`);
+	};
+	const onServe = (ev) => {
+		safeWrite(`event: serve\ndata: ${JSON.stringify(ev)}\n\n`);
+	};
+	function cleanup() {
+		if (closed) return;
+		closed = true;
+		clearInterval(heartbeat);
+		bus.off("invocation", onInvocation);
+		bus.off("log", onLog);
+		bus.off("serve", onServe);
+	}
+	function safeWrite(chunk) {
+		if (closed || res.writableEnded || res.destroyed) {
+			cleanup();
+			return;
+		}
+		res.write(chunk);
+	}
+	bus.on("invocation", onInvocation);
+	bus.on("log", onLog);
+	bus.on("serve", onServe);
+	req.on("close", cleanup);
+	res.on("close", cleanup);
+	res.on("error", cleanup);
+	safeWrite(":ok\n\n");
+}
+/**
+* Listen on `port`, retrying `port+1`, `port+2`, ... on `EADDRINUSE` up
+* to `maxBump` extra attempts. Resolves with the bound port.
+*/
+function listenWithBump(server, host, port, maxBump) {
+	return new Promise((resolveListen, reject) => {
+		let attempt = 0;
+		const tryListen = (p) => {
+			const onError = (err) => {
+				if (err.code === "EADDRINUSE" && attempt < maxBump) {
+					attempt += 1;
+					server.removeListener("error", onError);
+					tryListen(p + 1);
+					return;
+				}
+				reject(err);
+			};
+			server.once("error", onError);
+			server.listen(p, host, () => {
+				server.removeListener("error", onError);
+				resolveListen(server.address().port);
+			});
+		};
+		tryListen(port);
+	});
+}
+
+//#endregion
+//#region src/local/studio-child-args.ts
+/**
+* Build the shared `--app` / `--profile` / `--region` / `-c` /
+* `--from-cfn-stack` / `--assume-role` args for a studio child command.
+* Returns a flat argv fragment to spread after the subcommand + target.
+*/
+function buildSharedChildArgs(config) {
+	const args = [];
+	if (config.app) args.push("--app", config.app);
+	if (config.profile) args.push("--profile", config.profile);
+	if (config.region) args.push("--region", config.region);
+	for (const [k, v] of Object.entries(config.context ?? {})) args.push("-c", `${k}=${v}`);
+	if (config.fromCfnStack === true) args.push("--from-cfn-stack");
+	else if (typeof config.fromCfnStack === "string" && config.fromCfnStack !== "") args.push("--from-cfn-stack", config.fromCfnStack);
+	if (typeof config.assumeRole === "string" && config.assumeRole !== "") args.push("--assume-role", config.assumeRole);
+	return args;
+}
+
+//#endregion
+//#region src/local/studio-dispatch.ts
+let idCounter = 0;
+/**
+* Build the studio run dispatcher. Slice B drives a single-shot Lambda
+* invoke by spawning the SAME `cdkl invoke` the headless command runs —
+* studio is a control plane over the CLI, so re-using the whole command
+* (rather than re-wiring its internals) guarantees byte-for-byte parity
+* and keeps all of `cdkl invoke`'s process-global behavior
+* (`process.exit`, env mutation, stdin) isolated in a child process.
+*
+* The child's stdout is the Lambda response payload; its stderr (status
+* + container logs) is streamed line-by-line onto the bus as `log`
+* events. An `invocation` start event is emitted before spawn and an end
+* event (with response + status + duration) after exit, both keyed by
+* the same correlation id so the UI threads them into one timeline row.
+*/
+function createStudioDispatcher(config) {
+	const spawnFn = config.spawnFn ?? spawn;
+	const nodeBin = config.nodeBin ?? process.execPath;
+	const clock = config.clock ?? Date.now;
+	const idFactory = config.idFactory ?? (() => {
+		idCounter += 1;
+		return `inv-${clock()}-${idCounter}`;
+	});
+	async function run(req) {
+		const invocationId = idFactory();
+		const startedAt = clock();
+		if (req.kind !== "lambda") {
+			const error = `Running '${req.kind}' targets from studio is not supported yet (Lambda only).`;
+			config.bus.emit("invocation", {
+				id: invocationId,
+				ts: startedAt,
+				target: req.targetId,
+				kind: req.kind,
+				label: "invoke",
+				request: req.event,
+				response: error,
+				status: 501,
+				durationMs: clock() - startedAt
+			});
+			return {
+				invocationId,
+				ok: false,
+				status: 501,
+				error,
+				durationMs: clock() - startedAt
+			};
+		}
+		config.bus.emit("invocation", {
+			id: invocationId,
+			ts: startedAt,
+			target: req.targetId,
+			kind: req.kind,
+			label: "invoke",
+			request: req.event
+		});
+		let dir;
+		try {
+			dir = mkdtempSync(join(tmpdir(), "cdkl-studio-run-"));
+			const eventFile = join(dir, "event.json");
+			writeFileSync(eventFile, JSON.stringify(req.event ?? {}));
+			const args = [
+				"invoke",
+				req.targetId,
+				"--event",
+				eventFile,
+				...buildSharedChildArgs(config)
+			];
+			const { code, stdout, stderr } = await runChild(spawnFn, nodeBin, [config.cliEntry, ...args], config.cwd ?? process.cwd(), invocationId, req.targetId, config.bus, clock);
+			const durationMs = clock() - startedAt;
+			const ok = code === 0;
+			const failure = stderr.trim() || `cdkl invoke exited ${code}`;
+			const stdoutLines = stdout.split("\n").map((l) => l.replace(/\r$/, "").trimEnd()).filter((l) => l.trim().length > 0);
+			let responseIdx = -1;
+			let response;
+			if (ok) {
+				for (let i = stdoutLines.length - 1; i >= 0; i -= 1) {
+					const parsed = tryParseJson(stdoutLines[i] ?? "");
+					if (parsed.ok) {
+						responseIdx = i;
+						response = parsed.value;
+						break;
+					}
+				}
+				if (responseIdx === -1 && stdoutLines.length > 0) {
+					responseIdx = stdoutLines.length - 1;
+					response = stdoutLines[responseIdx];
+				}
+			} else response = failure;
+			stdoutLines.forEach((line, i) => {
+				if (i === responseIdx) return;
+				config.bus.emit("log", {
+					ts: clock(),
+					containerId: invocationId,
+					target: req.targetId,
+					line,
+					stream: "stdout"
+				});
+			});
+			const raw = responseIdx >= 0 ? stdoutLines[responseIdx] ?? "" : "";
+			const status = ok ? 200 : 500;
+			config.bus.emit("invocation", {
+				id: invocationId,
+				ts: startedAt,
+				target: req.targetId,
+				kind: req.kind,
+				label: "invoke",
+				request: req.event,
+				response,
+				status,
+				durationMs
+			});
+			const result = {
+				invocationId,
+				ok,
+				status,
+				durationMs
+			};
+			if (raw) result.raw = raw;
+			if (response !== void 0) result.response = response;
+			if (!ok) result.error = failure;
+			return result;
+		} finally {
+			if (dir) rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	return { run };
+}
+/**
+* Spawn the child invoke, accumulate stdout, and stream stderr to the
+* bus line-by-line as `log` events. Resolves on process close.
+*/
+function runChild(spawnFn, nodeBin, argv, cwd, invocationId, target, bus, clock) {
+	return new Promise((resolve, reject) => {
+		let child;
+		try {
+			child = spawnFn(nodeBin, argv, {
+				cwd,
+				env: {
+					...process.env,
+					CDKL_LOG_LEVEL: "warn"
+				}
+			});
+		} catch (err) {
+			reject(err instanceof Error ? err : new Error(String(err)));
+			return;
+		}
+		let stdout = "";
+		let stderr = "";
+		let lineBuf = "";
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk;
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk;
+			lineBuf += chunk;
+			let nl = lineBuf.indexOf("\n");
+			while (nl !== -1) {
+				const line = lineBuf.slice(0, nl);
+				lineBuf = lineBuf.slice(nl + 1);
+				if (line.length > 0) bus.emit("log", {
+					ts: clock(),
+					containerId: invocationId,
+					target,
+					line,
+					stream: "stderr"
+				});
+				nl = lineBuf.indexOf("\n");
+			}
+		});
+		child.on("error", (err) => reject(err));
+		child.on("close", (code) => {
+			if (lineBuf.length > 0) bus.emit("log", {
+				ts: clock(),
+				containerId: invocationId,
+				target,
+				line: lineBuf,
+				stream: "stderr"
+			});
+			resolve({
+				code,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+/** Try to JSON-parse `raw`; `ok` distinguishes a parsed value from a failure. */
+function tryParseJson(raw) {
+	if (raw === "") return {
+		ok: false,
+		value: void 0
+	};
+	try {
+		return {
+			ok: true,
+			value: JSON.parse(raw)
+		};
+	} catch {
+		return {
+			ok: false,
+			value: void 0
+		};
+	}
+}
+
+//#endregion
+//#region src/local/studio-proxy.ts
+let proxyIdCounter = 0;
+/**
+* Start a capturing reverse proxy in front of a studio serve target
+* (decision D4a: because every request to the served port flows through
+* `cdkl studio`, the timeline observes them regardless of source —
+* browser, curl, or the in-UI pad alike).
+*
+* Each HTTP request is forwarded to `upstream` and, in parallel,
+* captured (method / path / headers / bounded body) and emitted as an
+* `invocation` start event; when the upstream response completes, an end
+* event carries the status / headers / bounded body / duration. The full
+* bodies stream through untouched — only the captured copies are bounded.
+* `Upgrade` (WebSocket) requests are bridged raw to the upstream without
+* capture so they keep working.
+*
+* Studio is a control plane over the CLI, so this proxy sits in front of
+* the long-running `cdkl start-api` child the serve manager spawned; it
+* does NOT re-implement any routing — it forwards verbatim.
+*/
+function startStudioProxy(config) {
+	const host = config.host ?? "127.0.0.1";
+	const clock = config.clock ?? Date.now;
+	const maxCapture = config.maxCaptureBytes ?? 64 * 1024;
+	const idFactory = config.idFactory ?? (() => {
+		proxyIdCounter += 1;
+		return `req-${clock()}-${proxyIdCounter}`;
+	});
+	const upstreamUrl = new URL(config.upstream);
+	const upstreamHost = upstreamUrl.hostname;
+	const upstreamPort = Number(upstreamUrl.port) || 80;
+	const server = createServer$1((clientReq, clientRes) => {
+		const id = idFactory();
+		const startedAt = clock();
+		const path = clientReq.url ?? "/";
+		const method = clientReq.method ?? "GET";
+		const label = `${method} ${path.split("?")[0]}`;
+		const reqBody = boundedCollector(maxCapture);
+		config.bus.emit("invocation", {
+			id,
+			ts: startedAt,
+			target: config.target,
+			kind: config.kind,
+			label,
+			request: {
+				method,
+				path,
+				headers: { ...clientReq.headers }
+			}
+		});
+		let ended = false;
+		const emitEnd = (status, response) => {
+			if (ended) return;
+			ended = true;
+			config.bus.emit("invocation", {
+				id,
+				ts: startedAt,
+				target: config.target,
+				kind: config.kind,
+				label,
+				request: {
+					method,
+					path,
+					headers: { ...clientReq.headers },
+					body: reqBody.text()
+				},
+				response,
+				status,
+				durationMs: clock() - startedAt
+			});
+		};
+		const upstreamReq = request({
+			host: upstreamHost,
+			port: upstreamPort,
+			method,
+			path,
+			headers: clientReq.headers
+		}, (upstreamRes) => {
+			const respBody = boundedCollector(maxCapture);
+			clientRes.writeHead(upstreamRes.statusCode ?? 502, stripHopByHop(upstreamRes.headers));
+			upstreamRes.on("data", (chunk) => respBody.push(chunk));
+			upstreamRes.pipe(clientRes);
+			upstreamRes.on("end", () => emitEnd(upstreamRes.statusCode ?? 502, {
+				status: upstreamRes.statusCode,
+				headers: { ...upstreamRes.headers },
+				body: respBody.text()
+			}));
+			upstreamRes.on("error", () => {
+				if (!clientRes.writableEnded) clientRes.destroy();
+				emitEnd(502, "upstream response stream error");
+			});
+		});
+		upstreamReq.on("error", (err) => {
+			if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "text/plain" });
+			clientRes.end(`studio proxy: upstream error: ${err.message}`);
+			emitEnd(502, `upstream error: ${err.message}`);
+		});
+		clientReq.on("data", (chunk) => reqBody.push(chunk));
+		clientReq.on("error", () => {
+			upstreamReq.destroy();
+			emitEnd(499, "client aborted the request");
+		});
+		clientReq.pipe(upstreamReq);
+	});
+	const upgradeSockets = /* @__PURE__ */ new Set();
+	server.on("upgrade", (req, clientSocket, head) => {
+		const sock = clientSocket;
+		upgradeSockets.add(sock);
+		sock.on("close", () => upgradeSockets.delete(sock));
+		bridgeUpgrade(req, sock, head, upstreamHost, upstreamPort);
+	});
+	return new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, host, () => {
+			server.removeListener("error", reject);
+			const port = server.address().port;
+			resolve({
+				url: `http://${host}:${port}`,
+				port,
+				close: () => new Promise((resolveClose, rejectClose) => {
+					for (const sock of upgradeSockets) sock.destroy();
+					upgradeSockets.clear();
+					server.close((err) => err ? rejectClose(err) : resolveClose());
+					server.closeAllConnections?.();
+				})
+			});
+		});
+	});
+}
+/** RFC 7230 hop-by-hop headers — never forwarded across a proxy. */
+const HOP_BY_HOP = new Set([
+	"connection",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+/** Copy `headers` without the hop-by-hop ones (which describe one connection). */
+function stripHopByHop(headers) {
+	const out = {};
+	for (const [k, v] of Object.entries(headers)) if (!HOP_BY_HOP.has(k.toLowerCase())) out[k] = v;
+	return out;
+}
+/** A bounded byte collector that decodes to a (possibly truncated) utf8 string. */
+function boundedCollector(maxBytes) {
+	const chunks = [];
+	let size = 0;
+	let truncated = false;
+	return {
+		push: (c) => {
+			if (size >= maxBytes) {
+				truncated = true;
+				return;
+			}
+			const room = maxBytes - size;
+			if (c.length > room) {
+				chunks.push(c.subarray(0, room));
+				size = maxBytes;
+				truncated = true;
+			} else {
+				chunks.push(c);
+				size += c.length;
+			}
+		},
+		text: () => {
+			const s = Buffer.concat(chunks).toString("utf8");
+			return truncated ? `${s}… (truncated)` : s;
+		}
+	};
+}
+/** Raw-bridge an `Upgrade` request (e.g. WebSocket) to the upstream. */
+function bridgeUpgrade(req, clientSocket, head, upstreamHost, upstreamPort) {
+	const upstream = connect(upstreamPort, upstreamHost, () => {
+		let raw = `${req.method} ${req.url} HTTP/1.1\r\n`;
+		for (let i = 0; i < req.rawHeaders.length; i += 2) raw += `${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}\r\n`;
+		raw += "\r\n";
+		upstream.write(raw);
+		if (head && head.length > 0) upstream.write(head);
+		clientSocket.pipe(upstream);
+		upstream.pipe(clientSocket);
+	});
+	const teardown = () => {
+		clientSocket.destroy();
+		upstream.destroy();
+	};
+	upstream.on("error", teardown);
+	upstream.on("close", teardown);
+	clientSocket.on("error", teardown);
+	clientSocket.on("close", teardown);
+}
+
+//#endregion
+//#region src/local/studio-serve-manager.ts
+/**
+* The serve lifecycle per kind. `api` + `alb` expose host HTTP endpoints
+* the studio capture proxy fronts; `ecs` (start-service) is pure compute
+* with no host port, so it has no endpoint and no capture — studio just
+* runs the replicas + streams their logs.
+*/
+const SERVE_SPECS = {
+	api: {
+		command: "start-api",
+		portArgs: [
+			"--port",
+			"0",
+			"--host",
+			"127.0.0.1"
+		],
+		readyRe: /Server listening on (\S+)/,
+		capturesHttp: true
+	},
+	alb: {
+		command: "start-alb",
+		portArgs: [],
+		readyRe: /ALB front-door: (https?:\/\/\S+)/,
+		capturesHttp: true
+	},
+	ecs: {
+		command: "start-service",
+		portArgs: [],
+		readyRe: /Service\(s\) running:/,
+		capturesHttp: false
+	}
+};
+/**
+* Build the studio serve manager. Slice C1 drives a long-running
+* `cdkl start-api <target>` child — studio is a control plane over the
+* CLI (the same pattern as the single-shot invoke dispatcher), so it
+* spawns the SAME headless serve command rather than re-wiring its
+* internals. This preserves byte-for-byte parity and isolates the
+* server's process-global behavior in a child.
+*
+* `start()` spawns the child with `--port 0` (OS-assigned, collision
+* free), streams its stdout/stderr onto the bus as `log` events keyed by
+* the target id, and resolves once the child prints its first
+* `Server listening on <url>` line — emitting a `serve` `running` event
+* with the discovered endpoints. `stop()` SIGTERMs the child (SIGKILL
+* after a grace window) and emits `stopped`.
+*
+* Slice C2 fronts each HTTP serve endpoint with a capture proxy
+* ({@link startStudioProxy}) so every request to the served port lands
+* on the studio timeline (decision D4a); the `endpoints` the UI is
+* handed are the proxy URLs. The serve-kinds slice generalized this to a
+* per-kind {@link ServeKindSpec}: `api` (`start-api`) + `alb`
+* (`start-alb`) expose host HTTP endpoints the proxy captures, while
+* `ecs` (`start-service`) is pure compute — no host port, no capture,
+* just the running replicas + their streamed logs.
+*/
+function createStudioServeManager(config) {
+	const spawnFn = config.spawnFn ?? spawn;
+	const nodeBin = config.nodeBin ?? process.execPath;
+	const clock = config.clock ?? Date.now;
+	const readyTimeoutMs = config.readyTimeoutMs ?? 12e4;
+	const stopGraceMs = config.stopGraceMs ?? 45e3;
+	const setTimeoutFn = config.setTimeoutFn ?? setTimeout;
+	const clearTimeoutFn = config.clearTimeoutFn ?? clearTimeout;
+	const cwd = config.cwd ?? process.cwd();
+	const proxyFactory = config.proxyFactory ?? startStudioProxy;
+	const captureRequests = config.captureRequests ?? true;
+	const entries = /* @__PURE__ */ new Map();
+	/** Close every capture proxy fronting `e` (best-effort; idempotent). */
+	async function closeProxies(e) {
+		const proxies = e.proxies.splice(0);
+		await Promise.all(proxies.map((p) => p.close().catch(() => void 0)));
+	}
+	function publicState(e) {
+		const s = {
+			targetId: e.targetId,
+			kind: e.kind,
+			status: e.status,
+			endpoints: [...e.endpoints],
+			startedAt: e.startedAt
+		};
+		if (e.pid !== void 0) s.pid = e.pid;
+		return s;
+	}
+	function emitServe(e, message) {
+		const ev = {
+			ts: clock(),
+			target: e.targetId,
+			kind: e.kind,
+			status: e.status,
+			endpoints: [...e.endpoints]
+		};
+		if (e.pid !== void 0) ev.pid = e.pid;
+		if (message !== void 0) ev.message = message;
+		config.bus.emit("serve", ev);
+	}
+	function buildArgs(targetId, spec) {
+		return [
+			spec.command,
+			targetId,
+			...spec.portArgs,
+			...buildSharedChildArgs(config)
+		];
+	}
+	async function start(req) {
+		const spec = SERVE_SPECS[req.kind];
+		if (!spec) throw new Error(`Serving '${req.kind}' targets from studio is not supported (serve kinds: ${Object.keys(SERVE_SPECS).join(", ")}).`);
+		const existing = entries.get(req.targetId);
+		if (existing && existing.status !== "stopped" && existing.status !== "error") throw new Error(`'${req.targetId}' is already running.`);
+		const startedAt = clock();
+		let child;
+		try {
+			child = spawnFn(nodeBin, [config.cliEntry, ...buildArgs(req.targetId, spec)], { cwd });
+		} catch (err) {
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+		const entry = {
+			targetId: req.targetId,
+			kind: req.kind,
+			status: "starting",
+			endpoints: [],
+			startedAt,
+			child,
+			proxies: []
+		};
+		if (child.pid !== void 0) entry.pid = child.pid;
+		entries.set(req.targetId, entry);
+		emitServe(entry);
+		return new Promise((resolve, reject) => {
+			let settled = false;
+			child.stdout.setEncoding("utf8");
+			child.stderr.setEncoding("utf8");
+			const timer = setTimeoutFn(() => {
+				if (settled) return;
+				settled = true;
+				entry.status = "error";
+				emitServe(entry, `Timed out after ${readyTimeoutMs}ms waiting for the serve to be ready.`);
+				stopChild(child, stopGraceMs, setTimeoutFn, clearTimeoutFn);
+				closeProxies(entry);
+				entries.delete(req.targetId);
+				reject(/* @__PURE__ */ new Error(`'${req.targetId}' did not start within ${readyTimeoutMs}ms.`));
+			}, readyTimeoutMs);
+			timer.unref?.();
+			const becomeRunning = () => {
+				if (settled) return;
+				settled = true;
+				clearTimeoutFn(timer);
+				entry.status = "running";
+				emitServe(entry);
+				resolve(publicState(entry));
+			};
+			const onReady = async (childUrl) => {
+				let endpoint = childUrl;
+				if (childUrl && spec.capturesHttp && captureRequests && /^https?:/i.test(childUrl)) try {
+					const proxy = await proxyFactory({
+						bus: config.bus,
+						target: req.targetId,
+						kind: req.kind,
+						upstream: childUrl
+					});
+					entry.proxies.push(proxy);
+					endpoint = proxy.url;
+				} catch {
+					endpoint = childUrl;
+				}
+				if (entry.stopping || settled && !entries.has(req.targetId)) {
+					await closeProxies(entry);
+					return;
+				}
+				if (endpoint && !entry.endpoints.includes(endpoint)) entry.endpoints.push(endpoint);
+				if (settled) emitServe(entry);
+				else becomeRunning();
+			};
+			streamLines(child.stdout, (line) => {
+				const m = spec.readyRe.exec(line);
+				if (m) onReady(m[1]);
+				emitLog(config.bus, clock, req.targetId, line, "stdout");
+			});
+			streamLines(child.stderr, (line) => {
+				emitLog(config.bus, clock, req.targetId, line, "stderr");
+			});
+			child.on("error", (err) => {
+				if (settled) {
+					entry.status = "error";
+					emitServe(entry, err.message);
+					closeProxies(entry);
+					entries.delete(req.targetId);
+					return;
+				}
+				settled = true;
+				clearTimeoutFn(timer);
+				entry.status = "error";
+				emitServe(entry, err.message);
+				closeProxies(entry);
+				entries.delete(req.targetId);
+				reject(err);
+			});
+			child.on("close", (code) => {
+				if (!settled) {
+					settled = true;
+					clearTimeoutFn(timer);
+					if (entry.stopping) {
+						reject(/* @__PURE__ */ new Error(`'${req.targetId}' was stopped before it finished starting.`));
+						return;
+					}
+					entry.status = "error";
+					const msg = `Server exited before listening (code ${code ?? "null"}).`;
+					emitServe(entry, msg);
+					closeProxies(entry);
+					entries.delete(req.targetId);
+					reject(new Error(msg));
+					return;
+				}
+				if (entries.get(req.targetId) === entry && entry.status === "running") {
+					entry.status = "stopped";
+					emitServe(entry, `Server process exited (code ${code ?? "null"}).`);
+					closeProxies(entry);
+					entries.delete(req.targetId);
+				}
+			});
+		});
+	}
+	async function stop(req) {
+		const entry = entries.get(req.targetId);
+		if (!entry) throw new Error(`'${req.targetId}' is not running.`);
+		entry.stopping = true;
+		entries.delete(req.targetId);
+		await Promise.all([closeProxies(entry), stopChild(entry.child, stopGraceMs, setTimeoutFn, clearTimeoutFn)]);
+		entry.status = "stopped";
+		emitServe(entry);
+	}
+	function list() {
+		return [...entries.values()].map(publicState);
+	}
+	async function stopAll() {
+		const targets = [...entries.keys()];
+		await Promise.all(targets.map((targetId) => stop({ targetId }).catch(() => void 0)));
+	}
+	return {
+		start,
+		stop,
+		list,
+		stopAll
+	};
+}
+/** Emit one container log line onto the bus, keyed by the serve target id. */
+function emitLog(bus, clock, target, line, stream) {
+	bus.emit("log", {
+		ts: clock(),
+		containerId: target,
+		target,
+		line,
+		stream
+	});
+}
+/**
+* Line-buffer a child stream and invoke `onLine` per complete line
+* (trailing newline stripped, blank lines dropped). Flushes any partial
+* final line on stream end.
+*/
+function streamLines(stream, onLine) {
+	let buf = "";
+	stream.on("data", (chunk) => {
+		buf += chunk;
+		let nl = buf.indexOf("\n");
+		while (nl !== -1) {
+			const line = buf.slice(0, nl).replace(/\r$/, "");
+			buf = buf.slice(nl + 1);
+			if (line.length > 0) onLine(line);
+			nl = buf.indexOf("\n");
+		}
+	});
+	stream.on("end", () => {
+		const line = buf.replace(/\r$/, "");
+		if (line.length > 0) onLine(line);
+		buf = "";
+	});
+}
+/**
+* SIGTERM a child and resolve once it exits, escalating to SIGKILL after
+* `graceMs`. Resolves immediately if the child has already exited.
+*/
+function stopChild(child, graceMs, setTimeoutFn, clearTimeoutFn) {
+	return new Promise((resolve) => {
+		let done = false;
+		let kill;
+		const finish = () => {
+			if (done) return;
+			done = true;
+			if (kill) clearTimeoutFn(kill);
+			resolve();
+		};
+		child.once("close", finish);
+		if (child.exitCode !== null || child.signalCode !== null) {
+			finish();
+			return;
+		}
+		kill = setTimeoutFn(() => {
+			if (!done) child.kill("SIGKILL");
+		}, graceMs);
+		kill.unref?.();
+		child.kill("SIGTERM");
+	});
+}
+
+//#endregion
+//#region src/cli/commands/local-studio.ts
+const STUDIO_TARGET_KINDS = [
+	"lambda",
+	"api",
+	"alb",
+	"ecs",
+	"agentcore"
+];
+/**
+* Validate + narrow the untyped `POST /api/run` body into a
+* {@link StudioRunRequest}. Throws (→ 400 from the server) on a malformed
+* body so a bad UI / curl payload fails loudly rather than spawning an
+* `invoke` for an empty target.
+*/
+function coerceRunRequest(body) {
+	if (typeof body !== "object" || body === null) throw new Error("Request body must be a JSON object.");
+	const { targetId, kind, event } = body;
+	if (typeof targetId !== "string" || targetId.trim() === "") throw new Error("Request body must include a non-empty \"targetId\" string.");
+	if (typeof kind !== "string" || !STUDIO_TARGET_KINDS.includes(kind)) throw new Error(`Request body "kind" must be one of: ${STUDIO_TARGET_KINDS.join(", ")}.`);
+	return {
+		targetId,
+		kind,
+		event
+	};
+}
+/**
+* Validate + narrow the untyped `POST /api/stop` body into a
+* {@link StudioStopRequest}. Throws (→ 400 from the server) on a missing
+* / empty target id.
+*/
+function coerceStopRequest(body) {
+	if (typeof body !== "object" || body === null) throw new Error("Request body must be a JSON object.");
+	const { targetId } = body;
+	if (typeof targetId !== "string" || targetId.trim() === "") throw new Error("Request body must include a non-empty \"targetId\" string.");
+	return { targetId };
+}
+const DEFAULT_STUDIO_PORT = 9999;
+/**
+* Parse + validate the `--studio-port` value. Accepts `0` (OS-assigned)
+* through `65535`. Exported so a unit test can assert the bounds without
+* driving the full command. Throws on anything out of range / non-numeric.
+*/
+function parseStudioPort(raw) {
+	const port = raw.trim() === "" ? NaN : Number(raw);
+	if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error(`--studio-port must be 0..65535 (got ${raw}).`);
+	return port;
+}
+async function localStudioCommand(options) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	const port = parseStudioPort(options.studioPort);
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: void 0,
+		profile: options.profile
+	});
+	const appCmd = resolveApp(options.app);
+	if (!appCmd) throw new Error(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
+	logger.info("Synthesizing CDK app...");
+	const synthesizer = new Synthesizer();
+	const context = parseContextOptions(options.context);
+	const synthOpts = {
+		app: appCmd,
+		output: options.output,
+		...options.profile && { profile: options.profile },
+		...Object.keys(context).length > 0 && { context }
+	};
+	const { stacks } = await synthesizer.synthesize(synthOpts);
+	const targetGroups = toStudioTargetGroups(listTargets(stacks));
+	const appLabel = stacks.map((s) => s.stackName).join(", ") || appCmd;
+	const servableEcs = new Set(targetGroups.filter((g) => g.kind === "ecs").flatMap((g) => g.entries.filter((e) => e.servable).map((e) => e.id)));
+	const bus = new StudioEventBus();
+	const childConfig = {
+		cliEntry: process.argv[1] ?? "",
+		bus,
+		cwd: process.cwd(),
+		...appCmd ? { app: appCmd } : {},
+		...options.profile ? { profile: options.profile } : {},
+		...options.region ? { region: options.region } : {},
+		...Object.keys(context).length > 0 ? { context } : {},
+		...options.fromCfnStack !== void 0 ? { fromCfnStack: options.fromCfnStack } : {},
+		...options.assumeRole ? { assumeRole: options.assumeRole } : {}
+	};
+	const dispatcher = createStudioDispatcher(childConfig);
+	const serveManager = createStudioServeManager(childConfig);
+	const store = createStudioStore(bus);
+	const server = await startStudioServer({
+		port,
+		bus,
+		targetGroups,
+		appLabel,
+		cliName: getEmbedConfig().cliName,
+		store,
+		onRun: (body) => {
+			const req = coerceRunRequest(body);
+			if (req.kind === "lambda") return dispatcher.run(req);
+			if (req.kind === "ecs" && !servableEcs.has(req.targetId)) return Promise.reject(/* @__PURE__ */ new Error(`'${req.targetId}' is not a servable ECS service (an ECS task definition runs via run-task, not start-service).`));
+			return serveManager.start(req);
+		},
+		onStop: async (body) => {
+			const req = coerceStopRequest(body);
+			await serveManager.stop(req);
+			return { stopped: req.targetId };
+		},
+		getRunning: () => ({ running: serveManager.list() })
+	});
+	const cliName = getEmbedConfig().cliName;
+	logger.info(`${cliName} studio is running at ${server.url}`);
+	logger.info("Press Ctrl-C to stop.");
+	if (options.open && process.stdout.isTTY) openBrowser(server.url);
+	await blockUntilShutdown(server, serveManager, store, cliName);
+}
+/** Best-effort cross-platform browser open. Failures are non-fatal. */
+function openBrowser(url) {
+	const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+	try {
+		const child = spawn(cmd, [url], {
+			stdio: "ignore",
+			detached: true,
+			shell: process.platform === "win32"
+		});
+		child.on("error", () => void 0);
+		child.unref();
+	} catch {}
+}
+/**
+* Block until SIGINT / SIGTERM, then stop every running serve child,
+* close the studio server, and resolve. Mirrors the long-running serve
+* commands' graceful-shutdown contract — the serve children are killed
+* BEFORE the server closes so their RIE containers are torn down rather
+* than orphaned.
+*/
+function blockUntilShutdown(server, serveManager, store, cliName) {
+	return new Promise((resolveShutdown) => {
+		let shuttingDown = false;
+		const shutdown = (signal) => {
+			if (shuttingDown) return;
+			shuttingDown = true;
+			getLogger().info(`Received ${signal}; stopping ${cliName} studio...`);
+			store.dispose();
+			serveManager.stopAll().catch((err) => getLogger().warn(`Error stopping serve targets: ${String(err)}`)).then(() => server.close()).catch((err) => getLogger().warn(`Error stopping studio server: ${String(err)}`)).finally(() => resolveShutdown());
+		};
+		process.on("SIGINT", () => shutdown("SIGINT"));
+		process.on("SIGTERM", () => shutdown("SIGTERM"));
+	});
+}
+function createLocalStudioCommand(opts = {}) {
+	setEmbedConfig(opts.embedConfig);
+	const cmd = new Command("studio").description("Open the local studio: a web console that lists the synthesized CDK app's runnable targets and lets you invoke / serve them from the browser while watching all activity in one timeline. The interactive counterpart to the headless invoke / start-* commands.").action(withErrorHandling(async (options) => {
+		await localStudioCommand(options);
+	}));
+	addStudioSpecificOptions(cmd);
+	[
+		...commonOptions(),
+		...appOptions(),
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(regionOption);
+	return cmd;
+}
+/**
+* Register the option block `cdkl studio` adds on top of the shared
+* common / app / context option helpers. Kept in a named helper (not
+* inline in {@link createLocalStudioCommand}) so a host CLI embedding
+* this factory inherits new studio flags without a duplicate
+* `.addOption(...)` block, matching every other `add<Cmd>SpecificOptions`
+* extraction. Chainable: returns `cmd`.
+*/
+function addStudioSpecificOptions(cmd) {
+	cmd.addOption(new Option("--studio-port <port>", "Preferred port for the studio web server (bumps to the next free port on collision)").default(String(DEFAULT_STUDIO_PORT)));
+	cmd.addOption(new Option("--no-open", "Do not auto-open the browser when studio starts (TTY only)"));
+	cmd.addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind the whole studio session to a deployed CloudFormation stack: every invoke / serve started from the UI runs against the deployed stack real ARNs / Secret values. Bare flag auto-resolves a single-stack app; pass a name to pick the stack. Forwarded to each child command."));
+	cmd.addOption(new Option("--assume-role <arn>", "IAM role ARN to assume for every invoke / serve started from the UI (temp credentials forwarded into the containers). Forwarded to each child command."));
+	return cmd;
+}
+
+//#endregion
+export { setShadowReadyTimeoutMs as $, discoverWebSocketApis as $n, computeRequestIdentityHash as $t, addEcsAssumeRoleOptions as A, buildContainerImage as An, resolveApiTargetSubset as At, buildImageOverrideTag as B, createLocalStateProvider as Bn, groupRoutesByServer as Bt, addStartServiceSpecificOptions as C, buildMgmtEndpointEnvUrl as Cn, toCmdArgv as Ct, createLocalRunTaskCommand as D, buildDisconnectEvent as Dn, addStartApiSpecificOptions as Dt, addRunTaskSpecificOptions as E, buildConnectEvent as En, createLocalInvokeCommand as Et, parseRestartPolicy as F, substituteAgainstState as Fn, materializeLayerFromArn as Ft, runImageOverrideBuilds as G, resolveCfnStackName as Gn, defaultCredentialsLoader as Gt, mergeForService as H, rejectExplicitCfnStackWithMultipleStacks as Hn, startApiServer as Ht, resolveEcsAssumeRoleOption as I, substituteAgainstStateAsync as In, resolveEnvVars as It, listPinnedTargets as J, resolveSsmParameters as Jn, createJwksCache as Jt, describePinnedImageUri as K, CfnLocalStateProvider as Kn, buildCognitoJwksUrl as Kt, resolveSharedSidecarCredentials as L, substituteEnvVarsFromState as Ln, availableApiIdentifiers as Lt, buildEcsImageResolutionContext$1 as M, resolveRuntimeFileExtension as Mn, createFileWatcher as Mt, ecsClusterOption as N, resolveRuntimeImage as Nn, attachStageContext as Nt, MAX_TASKS_SUBNET_RANGE_CAP as O, buildMessageEvent as On, createLocalStartApiCommand as Ot, parseMaxTasks as P, EcsTaskResolutionError as Pn, buildStageMap as Pt, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Q, listTargets as Qn, buildMethodArn as Qt, runEcsServiceEmulator as R, substituteEnvVarsFromStateAsync as Rn, filterRoutesByApiIdentifier as Rt, resolveAlbFrontDoor as S, ConnectionRegistry as Sn, renderCodeDockerfile as St, serviceStrategy as T, parseConnectionsPath as Tn, addInvokeSpecificOptions as Tt, parseImageOverrideFlags as U, resolveCfnFallbackRegion as Un, resolveSelectionExpression as Ut, enforceImageOverrideOrphans as V, isCfnFlagPresent as Vn, readMtlsMaterialsFromDisk as Vt, resolveImageOverrides as W, resolveCfnRegion as Wn, resolveServiceIntegrationParameters as Wt, CloudMapRegistry as X, resolveSingleTarget as Xn, verifyJwtAuthorizer as Xt, buildCloudMapIndex as Y, resolveWatchConfig as Yn, verifyCognitoJwt as Yt, DEFAULT_SHADOW_READY_TIMEOUT_MS as Z, countTargets as Zn, verifyJwtViaDiscovery as Zt, albStrategy as _, tryParseStatus as _n, LocalInvokeBuildError as _r, waitForAgentCorePing as _t, createStudioServeManager as a, buildCorsConfigByApiId as an, AGENTCORE_A2A_PROTOCOL as ar, A2A_CONTAINER_PORT as at, resolveAlbTarget as b, probeHostGatewaySupport as bn, buildAgentCoreCodeImage as bt, startStudioServer as c, matchPreflight as cn, AGENTCORE_MCP_PROTOCOL as cr, MCP_CONTAINER_PORT as ct, createStudioStore as d, applyAuthorizerOverlay as dn, pickAgentCoreCandidateStack as dr, mcpInvokeOnce as dt, evaluateCachedLambdaPolicy as en, discoverWebSocketApisOrThrow as er, getContainerNetworkIp as et, StudioEventBus as f, buildHttpApiV2Event as fn, resolveAgentCoreTarget as fr, parseSseForJsonRpc as ft, addAlbSpecificOptions as g, selectIntegrationResponse as gn, tryResolveImageFnJoin as gr, invokeAgentCore as gt, formatTargetListing as h, pickResponseTemplate as hn, substituteImagePlaceholders as hr, AGENTCORE_SESSION_ID_HEADER as ht, createLocalStudioCommand as i, applyCorsResponseHeaders as in, resolveLambdaArnIntrinsic as ir, invokeAgentCoreWs as it, addImageOverrideOptions as j, resolveRuntimeCodeMountPath as jn, createAuthorizerCache as jt, addCommonEcsServiceOptions as k, architectureToPlatform as kn, createWatchPredicates as kt, toStudioTargetGroups as l, matchRoute as ln, AGENTCORE_RUNTIME_TYPE as lr, MCP_PATH as lt, createLocalListCommand as m, evaluateResponseParameters as mn, formatStateRemedy as mr, signAgentCoreInvocation as mt, coerceRunRequest as n, invokeTokenAuthorizer as nn, discoverRoutes as nr, addInvokeAgentCoreSpecificOptions as nt, startStudioProxy as o, buildCorsConfigFromCloudFrontChain as on, AGENTCORE_AGUI_PROTOCOL as or, A2A_PATH as ot, addListSpecificOptions as p, buildRestV1Event as pn, derivePseudoParametersFromRegion as pr, AGENTCORE_SIGV4_SERVICE as pt, isLocalCdkAssetImage as q, collectSsmParameterRefs as qn, buildJwksUrlFromIssuer as qt, coerceStopRequest as r, attachAuthorizers as rn, pickRefLogicalId as rr, createLocalInvokeAgentCoreCommand as rt, createStudioDispatcher as s, isFunctionUrlOacFronted as sn, AGENTCORE_HTTP_PROTOCOL as sr, a2aInvokeOnce as st, addStudioSpecificOptions as t, invokeRequestAuthorizer as tn, parseSelectionExpressionPath as tr, attachContainerLogStreamer as tt, renderStudioHtml as u, translateLambdaResponse as un, AgentCoreResolutionError as ur, MCP_PROTOCOL_VERSION as ut, createLocalStartAlbCommand as v, VtlEvaluationError as vn, buildStsClientConfig as vr, downloadAndExtractS3Bundle as vt, createLocalStartServiceCommand as w, handleConnectionsRequest as wn, classifySourceChange as wt, isApplicationLoadBalancer as x, bufferToBody as xn, computeCodeImageTag as xt, parseLbPortOverrides as y, HOST_GATEWAY_MIN_VERSION as yn, resolveProfileCredentials as yr, SUPPORTED_CODE_RUNTIMES as yt, ImageOverrideError as z, LocalStateSourceError as zn, filterRoutesByApiIdentifiers as zt };
+//# sourceMappingURL=local-studio-DaJ3D7co.js.map