bug: agentcore package fails for TypeScript because esbuild is bundled

[Ryuta1005]

Description

agentcore package fails when packaging a TypeScript CodeZip project because the CLI bundle includes esbuild's JavaScript API.

I encountered this with @aws/agentcore versions 0.27.1 and 0.28.0.

Steps to Reproduce

1. Use an unmodified npm installation of @aws/agentcore@0.28.0.
2. Create a minimal project with the following files.

agentcore/agentcore.json:

{
 "name": "PackageTest",
 "version": 1,
 "runtimes": [
 {
 "name": "TestRuntime",
 "build": "CodeZip",
 "entrypoint": "main.ts",
 "codeLocation": "./app/TestRuntime",
 "runtimeVersion": "NODE_22",
 "protocol": "HTTP"
 }
 ]
}

app/TestRuntime/main.ts:

export {};

app/TestRuntime/package.json:

{
 "name": "typescript-package-fixture",
 "version": "1.0.0",
 "private": true
}

3. From the project root, run:

agentcore package

Expected Behavior

The command successfully bundles the TypeScript entry point and creates agentcore/TestRuntime.zip.

Actual Behavior

Packaging fails with:

The esbuild JavaScript API cannot be bundled.
Please mark the "esbuild" package as external so it's not included in the bundle.

CLI Version

0.28.0

Operating System

macOS

Additional Context

The original environment used Node.js v24.15.0.

In esbuild.config.mjs, esbuild is not listed as an external dependency, so its JavaScript API is bundled into the CLI. TypeScript CodeZip packaging invokes that API at runtime.

Marking esbuild as external alone is insufficient: it is currently a development dependency, so an npm installation of the published CLI does not install it as a direct runtime dependency.

I have prepared a patch that:

• Marks esbuild as external in the CLI build.
• Moves esbuild from devDependencies to dependencies, retaining the existing version range and updating npm-shrinkwrap.json.
• Extends the existing installed-tarball smoke test to package a minimal TypeScript fixture and check that the ZIP is generated.

In a separate clean installation from an npm-packed tarball, the unpatched CLI failed with the error above, while the patched CLI successfully generated the ZIP.

This report concerns local packaging; no AWS deployment is required to reproduce it.