@go-to-k/cdkd 0.158.0 → 0.159.0

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { _ as withSkipPrefix, a as runDockerStreaming, c as getLogger, d as getLiveRenderer, f as PATTERN_B_NAME_PROPERTIES, g as generateResourceNameWithFallback, h as generateResourceName, i as runDockerForeground, n as formatDockerLoginError, p as PATTERN_B_RESOURCE_TYPES, r as getDockerCmd, u as runStackBuffered, v as withStackName } from "./docker-cmd-iDMcWcre.js";
-import { $ as CdkdError, A as shouldRetainResource, B as resolveSkipPrefix, C as IntrinsicFunctionResolver, D as TemplateParser, E as DagBuilder, F as Synthesizer, G as CFN_TEMPLATE_URL_LIMIT, H as resolveStateBucketWithDefaultAndSource, I as getDefaultStateBucketName, J as uploadCfnTemplate, K as MIGRATE_TMP_PREFIX, L as getLegacyStateBucketName, M as stringifyValue, N as WorkGraph, O as LockManager, P as buildDockerImage, R as resolveApp, S as assertRegionMatch, T as DiffCalculator, U as warnDeprecatedNoPrefixCliFlag, V as resolveStateBucketWithDefault, W as CFN_TEMPLATE_BODY_LIMIT, Y as AssemblyReader, Z as resolveBucketRegion, _ as matchesCdkPath, a as withRetry, b as ProviderRegistry, bt as withErrorHandling, c as bold, ct as PartialFailureError, d as green, dt as ResourceUpdateNotSupportedError, f as red, ft as RouteDiscoveryError, g as CDK_PATH_TAG, h as collectInlinePolicyNamesManagedBySiblings, i as withResourceDeadline, it as LocalStartServiceError, j as AssetPublisher, k as S3StateBackend, l as cyan, lt as ProvisioningError, m as IAMRoleProvider, mt as StackTerminationProtectionError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LocalInvokeBuildError, o as IMPLICIT_DELETE_DEPENDENCIES, ot as MissingCdkCliError, p as yellow, pt as StackHasActiveImportsError, q as findLargeInlineResources, r as DeployEngine, rt as LocalMigrateError, s as formatResourceLine, st as NestedStackChildDirectDestroyError, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as gray, ut as ResourceTimeoutError, v as normalizeAwsTagsToCfn, w as applyRoleArnIfSet, x as CloudControlProvider, y as resolveExplicitPhysicalId, yt as normalizeAwsError, z as resolveCaptureObservedState } from "./deploy-engine-UmoqjtWH.js";
+import { $ as CdkdError, A as shouldRetainResource, B as resolveSkipPrefix, C as IntrinsicFunctionResolver, D as TemplateParser, E as DagBuilder, F as Synthesizer, G as CFN_TEMPLATE_URL_LIMIT, H as resolveStateBucketWithDefaultAndSource, I as getDefaultStateBucketName, J as uploadCfnTemplate, K as MIGRATE_TMP_PREFIX, L as getLegacyStateBucketName, M as stringifyValue, N as WorkGraph, O as LockManager, P as buildDockerImage, R as resolveApp, S as assertRegionMatch, T as DiffCalculator, U as warnDeprecatedNoPrefixCliFlag, V as resolveStateBucketWithDefault, W as CFN_TEMPLATE_BODY_LIMIT, Y as AssemblyReader, Z as resolveBucketRegion, _ as matchesCdkPath, a as withRetry, b as ProviderRegistry, bt as withErrorHandling, c as bold, ct as PartialFailureError, d as green, dt as ResourceUpdateNotSupportedError, f as red, ft as RouteDiscoveryError, g as CDK_PATH_TAG, h as collectInlinePolicyNamesManagedBySiblings, i as withResourceDeadline, it as LocalStartServiceError, j as AssetPublisher, k as S3StateBackend, l as cyan, lt as ProvisioningError, m as IAMRoleProvider, mt as StackTerminationProtectionError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LocalInvokeBuildError, o as IMPLICIT_DELETE_DEPENDENCIES, ot as MissingCdkCliError, p as yellow, pt as StackHasActiveImportsError, q as findLargeInlineResources, r as DeployEngine, rt as LocalMigrateError, s as formatResourceLine, st as NestedStackChildDirectDestroyError, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as gray, ut as ResourceTimeoutError, v as normalizeAwsTagsToCfn, w as applyRoleArnIfSet, x as CloudControlProvider, y as resolveExplicitPhysicalId, yt as normalizeAwsError, z as resolveCaptureObservedState } from "./deploy-engine-BzrECC3i.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, createHmac, createPublicKey, createVerify, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -3225,6 +3225,7 @@ var S3BucketProvider = class {
 		"ObjectLockConfiguration",
 		"ObjectLockEnabled"
 	])]]);
+	unhandledByDesign = new Map([["AWS::S3::Bucket", new Map([["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.s3Client = awsClients.s3;
@@ -5997,6 +5998,7 @@ var SNSSubscriptionProvider = class {
 		"Endpoint",
 		"FilterPolicy"
 	])]]);
+	unhandledByDesign = new Map([["AWS::SNS::Subscription", new Map([["Region", "CFn-only cross-region subscription hint; cdkd uses the SDK client region directly and has no per-resource region override"]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.snsClient = awsClients.sns;
@@ -11700,9 +11702,11 @@ var EC2Provider = class {
 			"FromPort",
 			"ToPort",
 			"CidrIp",
+			"CidrIpv6",
 			"Description",
 			"SourceSecurityGroupId",
-			"SourceSecurityGroupOwnerId"
+			"SourceSecurityGroupOwnerId",
+			"SourcePrefixListId"
 		])],
 		["AWS::EC2::Instance", new Set([
 			"ImageId",
@@ -11726,10 +11730,15 @@ var EC2Provider = class {
 			"CidrBlock",
 			"Ipv6CidrBlock",
 			"PortRange",
-			"IcmpTypeCode"
+			"Icmp"
 		])],
 		["AWS::EC2::SubnetNetworkAclAssociation", new Set(["SubnetId", "NetworkAclId"])]
 	]);
+	unhandledByDesign = new Map([
+		["AWS::EC2::Instance", new Map([["ElasticGpuSpecifications", "AWS Elastic GPU end-of-life (announced 2023-11); no replacement API"], ["ElasticInferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])],
+		["AWS::EC2::SecurityGroupIngress", new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]])],
+		["AWS::EC2::NatGateway", new Map([["VpcId", "AWS derives the VPC from SubnetId; the ec2:CreateNatGateway API has no VpcId parameter"]])]
+	]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.ec2Client = awsClients.ec2;
@@ -12864,7 +12873,7 @@ var EC2Provider = class {
 			const cidrBlock = properties["CidrBlock"];
 			const ipv6CidrBlock = properties["Ipv6CidrBlock"];
 			const portRange = properties["PortRange"];
-			const icmpTypeCode = properties["IcmpTypeCode"];
+			const icmpTypeCode = properties["Icmp"] ?? properties["IcmpTypeCode"];
 			await this.ec2Client.send(new CreateNetworkAclEntryCommand({
 				NetworkAclId: networkAclId,
 				RuleNumber: ruleNumber,
@@ -13614,7 +13623,10 @@ var EC2Provider = class {
 			const icmp = {};
 			if (entry.IcmpTypeCode.Type !== void 0) icmp["Type"] = entry.IcmpTypeCode.Type;
 			if (entry.IcmpTypeCode.Code !== void 0) icmp["Code"] = entry.IcmpTypeCode.Code;
-			if (Object.keys(icmp).length > 0) result["IcmpTypeCode"] = icmp;
+			if (Object.keys(icmp).length > 0) {
+				result["Icmp"] = icmp;
+				result["IcmpTypeCode"] = icmp;
+			}
 		}
 		return result;
 	}
@@ -13861,6 +13873,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			"MethodResponses"
 		])]
 	]);
+	unhandledByDesign = new Map([["AWS::ApiGateway::Deployment", new Map([["StageName", "CFn-only convenience for inline-creating a Stage from a Deployment; declare AWS::ApiGateway::Stage explicitly to attach to this Deployment"], ["StageDescription", "CFn-only convenience for inline-creating a Stage; declare AWS::ApiGateway::Stage with the Description property instead"]])]]);
 	/** Maximum number of retries for IAM propagation delays */
 	static MAX_IAM_RETRIES = 3;
 	/** Delay between IAM propagation retries (ms) - exponential backoff */
@@ -17003,7 +17016,7 @@ var ECSProvider = class {
 			"CapacityProviderStrategy",
 			"DeploymentConfiguration",
 			"PlacementConstraints",
-			"PlacementStrategy",
+			"PlacementStrategies",
 			"PlatformVersion",
 			"HealthCheckGracePeriodSeconds",
 			"SchedulingStrategy",
@@ -17014,6 +17027,7 @@ var ECSProvider = class {
 			"Tags"
 		])]
 	]);
+	unhandledByDesign = new Map([["AWS::ECS::Service", new Map([["Role", "Legacy classic-ELB service-linked-role override; AWS uses the AWSServiceRoleForECS service-linked role automatically since 2017"]])], ["AWS::ECS::TaskDefinition", new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])]]);
 	getClient() {
 		if (!this.ecsClient) this.ecsClient = new ECSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.ecsClient;
@@ -17215,7 +17229,7 @@ var ECSProvider = class {
 				capacityProviderStrategy: properties["CapacityProviderStrategy"],
 				deploymentConfiguration: properties["DeploymentConfiguration"],
 				placementConstraints: properties["PlacementConstraints"],
-				placementStrategy: properties["PlacementStrategy"],
+				placementStrategy: properties["PlacementStrategies"] ?? properties["PlacementStrategy"],
 				platformVersion: properties["PlatformVersion"],
 				healthCheckGracePeriodSeconds: properties["HealthCheckGracePeriodSeconds"],
 				schedulingStrategy: properties["SchedulingStrategy"],
@@ -17255,7 +17269,7 @@ var ECSProvider = class {
 				capacityProviderStrategy: properties["CapacityProviderStrategy"],
 				deploymentConfiguration: properties["DeploymentConfiguration"],
 				placementConstraints: properties["PlacementConstraints"],
-				placementStrategy: properties["PlacementStrategy"],
+				placementStrategy: properties["PlacementStrategies"] ?? properties["PlacementStrategy"],
 				platformVersion: properties["PlatformVersion"],
 				healthCheckGracePeriodSeconds: properties["HealthCheckGracePeriodSeconds"],
 				enableExecuteCommand: properties["EnableExecuteCommand"]
@@ -17664,8 +17678,14 @@ var ECSProvider = class {
 		else if (!s.launchType) result["CapacityProviderStrategy"] = [];
 		if (s.deploymentConfiguration) result["DeploymentConfiguration"] = s.deploymentConfiguration;
 		result["PlacementConstraints"] = s.placementConstraints ?? [];
-		if (s.launchType === "EC2" || s.launchType === "EXTERNAL") result["PlacementStrategy"] = s.placementStrategy ?? [];
-		else if (s.placementStrategy && s.placementStrategy.length > 0) result["PlacementStrategy"] = s.placementStrategy;
+		if (s.launchType === "EC2" || s.launchType === "EXTERNAL") {
+			const strategy = s.placementStrategy ?? [];
+			result["PlacementStrategy"] = strategy;
+			result["PlacementStrategies"] = strategy;
+		} else if (s.placementStrategy && s.placementStrategy.length > 0) {
+			result["PlacementStrategy"] = s.placementStrategy;
+			result["PlacementStrategies"] = s.placementStrategy;
+		}
 		result["ServiceRegistries"] = s.serviceRegistries ?? [];
 		result["Tags"] = normalizeAwsTagsToCfn(s.tags);
 		return result;
@@ -18530,6 +18550,11 @@ var RDSProvider = class {
 			"Tags"
 		])]
 	]);
+	unhandledByDesign = new Map([["AWS::RDS::DBCluster", new Map([["DeleteAutomatedBackups", "cdkd hardcodes SkipFinalSnapshot=true on destroy; this CFn lifecycle flag has no equivalent on the runtime path"]])], ["AWS::RDS::DBInstance", new Map([
+		["DBSecurityGroups", "EC2-Classic-only feature retired by AWS (2022-08-15); new accounts cannot use this — use VPCSecurityGroups instead"],
+		["ApplyImmediately", "cdkd always applies modifications immediately (rds:ModifyDBInstance.ApplyImmediately=true is hardcoded); users wanting maintenance-window deferral should run aws rds modify-db-instance directly"],
+		["DeleteAutomatedBackups", "cdkd hardcodes SkipFinalSnapshot=true on destroy; this CFn lifecycle flag has no equivalent on the runtime path"]
+	])]]);
 	getClient() {
 		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.rdsClient;
@@ -20868,6 +20893,7 @@ var NeptuneProvider = class {
 		["AWS::Neptune::DBCluster", new Set([
 			"DBClusterIdentifier",
 			"EngineVersion",
+			"DBPort",
 			"Port",
 			"VpcSecurityGroupIds",
 			"DBSubnetGroupName",
@@ -20997,7 +21023,7 @@ var NeptuneProvider = class {
 				DBClusterIdentifier: dbClusterIdentifier,
 				Engine: "neptune",
 				EngineVersion: properties["EngineVersion"],
-				Port: properties["Port"] != null ? Number(properties["Port"]) : void 0,
+				Port: properties["DBPort"] != null ? Number(properties["DBPort"]) : properties["Port"] != null ? Number(properties["Port"]) : void 0,
 				VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
 				DBSubnetGroupName: properties["DBSubnetGroupName"],
 				StorageEncrypted: properties["StorageEncrypted"],
@@ -21043,7 +21069,7 @@ var NeptuneProvider = class {
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
 				EnableIAMDatabaseAuthentication: properties["IamAuthEnabled"],
 				...sendVpcSgIds && { VpcSecurityGroupIds: vpcSgIds },
-				Port: properties["Port"] != null ? Number(properties["Port"]) : void 0,
+				Port: properties["DBPort"] != null ? Number(properties["DBPort"]) : properties["Port"] != null ? Number(properties["Port"]) : void 0,
 				ApplyImmediately: true
 			}));
 			this.logger.debug(`Successfully updated Neptune DBCluster ${logicalId}`);
@@ -21370,7 +21396,10 @@ var NeptuneProvider = class {
 		const result = {};
 		if (cluster.DBClusterIdentifier !== void 0) result["DBClusterIdentifier"] = cluster.DBClusterIdentifier;
 		if (cluster.EngineVersion !== void 0) result["EngineVersion"] = cluster.EngineVersion;
-		if (cluster.Port !== void 0) result["Port"] = cluster.Port;
+		if (cluster.Port !== void 0) {
+			result["Port"] = cluster.Port;
+			result["DBPort"] = cluster.Port;
+		}
 		result["VpcSecurityGroupIds"] = (cluster.VpcSecurityGroups ?? []).map((sg) => sg.VpcSecurityGroupId).filter((id) => !!id);
 		if (cluster.DBSubnetGroup !== void 0) result["DBSubnetGroupName"] = cluster.DBSubnetGroup;
 		if (cluster.StorageEncrypted !== void 0) result["StorageEncrypted"] = cluster.StorageEncrypted;
@@ -22810,6 +22839,7 @@ var ElastiCacheProvider = class {
 	handledProperties = new Map([["AWS::ElastiCache::SubnetGroup", new Set([
 		"CacheSubnetGroupName",
 		"CacheSubnetGroupDescription",
+		"Description",
 		"SubnetIds",
 		"Tags"
 	])], ["AWS::ElastiCache::CacheCluster", new Set([
@@ -22837,6 +22867,7 @@ var ElastiCacheProvider = class {
 		"IpDiscovery",
 		"TransitEncryptionEnabled"
 	])]]);
+	unhandledByDesign = new Map([["AWS::ElastiCache::CacheCluster", new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"]])]]);
 	getClient() {
 		if (!this.client) this.client = new ElastiCacheClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -22871,7 +22902,7 @@ var ElastiCacheProvider = class {
 		try {
 			await this.getClient().send(new CreateCacheSubnetGroupCommand({
 				CacheSubnetGroupName: cacheSubnetGroupName,
-				CacheSubnetGroupDescription: properties["CacheSubnetGroupDescription"] || `Subnet group for ${logicalId}`,
+				CacheSubnetGroupDescription: properties["Description"] ?? properties["CacheSubnetGroupDescription"] ?? `Subnet group for ${logicalId}`,
 				SubnetIds: properties["SubnetIds"]
 			}));
 			this.logger.debug(`Successfully created CacheSubnetGroup ${logicalId}: ${cacheSubnetGroupName}`);
@@ -22889,7 +22920,7 @@ var ElastiCacheProvider = class {
 		try {
 			await this.getClient().send(new ModifyCacheSubnetGroupCommand({
 				CacheSubnetGroupName: physicalId,
-				CacheSubnetGroupDescription: properties["CacheSubnetGroupDescription"],
+				CacheSubnetGroupDescription: properties["Description"] ?? properties["CacheSubnetGroupDescription"],
 				SubnetIds: properties["SubnetIds"]
 			}));
 			this.logger.debug(`Successfully updated CacheSubnetGroup ${logicalId}`);
@@ -23199,7 +23230,10 @@ var ElastiCacheProvider = class {
 		if (!group) return void 0;
 		const result = {};
 		if (group.CacheSubnetGroupName !== void 0) result["CacheSubnetGroupName"] = group.CacheSubnetGroupName;
-		if (group.CacheSubnetGroupDescription !== void 0) result["CacheSubnetGroupDescription"] = group.CacheSubnetGroupDescription;
+		if (group.CacheSubnetGroupDescription !== void 0) {
+			result["CacheSubnetGroupDescription"] = group.CacheSubnetGroupDescription;
+			result["Description"] = group.CacheSubnetGroupDescription;
+		}
 		result["SubnetIds"] = (group.Subnets ?? []).map((s) => s.SubnetIdentifier).filter((id) => !!id);
 		if (group.ARN) await this.attachTags(result, group.ARN);
 		return result;
@@ -23853,6 +23887,7 @@ var AppSyncProvider = class {
 			"Expires"
 		])]
 	]);
+	unhandledByDesign = new Map([["AWS::AppSync::DataSource", new Map([["ElasticsearchConfig", "Legacy Elasticsearch alias; use OpenSearchServiceConfig (AppSync deprecated the Elasticsearch DataSource type in favor of OpenSearch)"]])]]);
 	getClient() {
 		if (!this.client) this.client = new AppSyncClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -24718,9 +24753,14 @@ var GlueProvider = class {
 	cachedAccountId;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("GlueProvider");
-	handledProperties = new Map([["AWS::Glue::Database", new Set(["DatabaseInput", "CatalogId"])], ["AWS::Glue::Table", new Set([
+	handledProperties = new Map([["AWS::Glue::Database", new Set([
+		"DatabaseInput",
+		"DatabaseName",
+		"CatalogId"
+	])], ["AWS::Glue::Table", new Set([
 		"DatabaseName",
 		"TableInput",
+		"Name",
 		"CatalogId"
 	])]]);
 	getClient() {
@@ -24752,8 +24792,8 @@ var GlueProvider = class {
 		this.logger.debug(`Creating Glue Database ${logicalId}`);
 		const databaseInput = properties["DatabaseInput"];
 		if (!databaseInput) throw new ProvisioningError(`DatabaseInput is required for Glue Database ${logicalId}`, resourceType, logicalId);
-		const databaseName = databaseInput["Name"];
-		if (!databaseName) throw new ProvisioningError(`DatabaseInput.Name is required for Glue Database ${logicalId}`, resourceType, logicalId);
+		const databaseName = databaseInput["Name"] ?? properties["DatabaseName"];
+		if (!databaseName) throw new ProvisioningError(`DatabaseInput.Name or top-level DatabaseName is required for Glue Database ${logicalId}`, resourceType, logicalId);
 		const catalogId = properties["CatalogId"];
 		try {
 			await this.getClient().send(new CreateDatabaseCommand({
@@ -24816,14 +24856,14 @@ var GlueProvider = class {
 		if (!databaseName) throw new ProvisioningError(`DatabaseName is required for Glue Table ${logicalId}`, resourceType, logicalId);
 		const tableInput = properties["TableInput"];
 		if (!tableInput) throw new ProvisioningError(`TableInput is required for Glue Table ${logicalId}`, resourceType, logicalId);
-		const tableName = tableInput["Name"];
-		if (!tableName) throw new ProvisioningError(`TableInput.Name is required for Glue Table ${logicalId}`, resourceType, logicalId);
+		const tableName = tableInput["Name"] ?? properties["Name"];
+		if (!tableName) throw new ProvisioningError(`TableInput.Name or top-level Name is required for Glue Table ${logicalId}`, resourceType, logicalId);
 		const catalogId = properties["CatalogId"];
 		try {
 			await this.getClient().send(new CreateTableCommand$1({
 				CatalogId: catalogId,
 				DatabaseName: databaseName,
-				TableInput: this.buildTableInput(tableInput)
+				TableInput: this.buildTableInput(tableInput, tableName)
 			}));
 			const physicalId = `${databaseName}|${tableName}`;
 			this.logger.debug(`Successfully created Glue Table ${logicalId}: ${physicalId}`);
@@ -24838,8 +24878,8 @@ var GlueProvider = class {
 	}
 	async updateTable(logicalId, physicalId, resourceType, properties) {
 		this.logger.debug(`Updating Glue Table ${logicalId}: ${physicalId}`);
-		const [databaseName] = physicalId.split("|");
-		if (!databaseName) throw new ProvisioningError(`Invalid Glue Table physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		const [databaseName, tableName] = physicalId.split("|");
+		if (!databaseName || !tableName) throw new ProvisioningError(`Invalid Glue Table physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
 		const tableInput = properties["TableInput"];
 		if (!tableInput) throw new ProvisioningError(`TableInput is required for Glue Table update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
@@ -24847,7 +24887,7 @@ var GlueProvider = class {
 			await this.getClient().send(new UpdateTableCommand$1({
 				CatalogId: catalogId,
 				DatabaseName: databaseName,
-				TableInput: this.buildTableInput(tableInput)
+				TableInput: this.buildTableInput(tableInput, tableName)
 			}));
 			this.logger.debug(`Successfully updated Glue Table ${logicalId}`);
 			return {
@@ -24902,8 +24942,8 @@ var GlueProvider = class {
 	/**
 	* Build TableInput for Glue API from CFn template properties
 	*/
-	buildTableInput(tableInput) {
-		const result = { Name: tableInput["Name"] };
+	buildTableInput(tableInput, fallbackName) {
+		const result = { Name: tableInput["Name"] ?? fallbackName };
 		if (tableInput["Description"] !== void 0) result.Description = tableInput["Description"];
 		if (tableInput["TableType"] !== void 0) result.TableType = tableInput["TableType"];
 		if (tableInput["Parameters"] !== void 0) {
@@ -25009,7 +25049,9 @@ var GlueProvider = class {
 		dbInput["Description"] = db.Description ?? "";
 		if (db.LocationUri !== void 0) dbInput["LocationUri"] = db.LocationUri;
 		dbInput["Parameters"] = db.Parameters ?? {};
-		return { DatabaseInput: dbInput };
+		const result = { DatabaseInput: dbInput };
+		if (db.Name !== void 0) result["DatabaseName"] = db.Name;
+		return result;
 	}
 	async readTable(physicalId) {
 		const [databaseName, tableName] = physicalId.split("|");
@@ -25037,10 +25079,12 @@ var GlueProvider = class {
 		if (table.ViewOriginalText !== void 0) tableInput["ViewOriginalText"] = table.ViewOriginalText;
 		if (table.ViewExpandedText !== void 0) tableInput["ViewExpandedText"] = table.ViewExpandedText;
 		if (table.TargetTable) tableInput["TargetTable"] = table.TargetTable;
-		return {
+		const result = {
 			DatabaseName: databaseName,
 			TableInput: tableInput
 		};
+		if (table.Name !== void 0) result["Name"] = table.Name;
+		return result;
 	}
 	async import(input) {
 		switch (input.resourceType) {
@@ -27455,6 +27499,7 @@ var EFSProvider = class {
 			"AccessPointTags"
 		])]
 	]);
+	unhandledByDesign = new Map([["AWS::EFS::AccessPoint", new Map([["ClientToken", "AWS SDK manages this idempotency token internally on CreateAccessPoint; no user-supplied value is honored"]])]]);
 	getClient() {
 		if (!this.client) this.client = new EFSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -30466,6 +30511,7 @@ var S3TablesProvider = class {
 		["AWS::S3Tables::Table", new Set([
 			"TableBucketARN",
 			"Namespace",
+			"TableName",
 			"Name",
 			"Format"
 		])]
@@ -30628,8 +30674,8 @@ var S3TablesProvider = class {
 		if (!tableBucketARN) throw new ProvisioningError(`TableBucketARN is required for S3 Tables Table ${logicalId}`, resourceType, logicalId);
 		const namespace = properties["Namespace"];
 		if (!namespace) throw new ProvisioningError(`Namespace is required for S3 Tables Table ${logicalId}`, resourceType, logicalId);
-		const name = properties["Name"];
-		if (!name) throw new ProvisioningError(`Name is required for S3 Tables Table ${logicalId}`, resourceType, logicalId);
+		const name = properties["TableName"] ?? properties["Name"];
+		if (!name) throw new ProvisioningError(`TableName is required for S3 Tables Table ${logicalId}`, resourceType, logicalId);
 		const format = properties["Format"];
 		if (!format) throw new ProvisioningError(`Format is required for S3 Tables Table ${logicalId}`, resourceType, logicalId);
 		try {
@@ -30714,10 +30760,12 @@ var S3TablesProvider = class {
 			if (err instanceof NotFoundException$5) return void 0;
 			throw err;
 		}
+		const tableNameValue = resp.name ?? name;
 		const result = {
 			TableBucketARN: tableBucketARN,
 			Namespace: namespace,
-			Name: resp.name ?? name
+			Name: tableNameValue,
+			TableName: tableNameValue
 		};
 		if (resp.format !== void 0) result["Format"] = resp.format;
 		return result;
@@ -31258,6 +31306,7 @@ var ASGProvider = class ASGProvider {
 		"InstanceMaintenancePolicy",
 		"DeletionProtection"
 	])]]);
+	unhandledByDesign = new Map([["AWS::AutoScaling::AutoScalingGroup", new Map([["LaunchConfigurationName", "AWS Launch Configurations end-of-life 2024-10; use LaunchTemplate instead"], ["NotificationConfiguration", "Legacy singular form; use NotificationConfigurations (plural) which cdkd already wires"]])]]);
 	getClient() {
 		if (!this.asgClient) this.asgClient = new AutoScalingClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.asgClient;
@@ -41608,6 +41657,7 @@ var CfnLocalStateProvider = class {
 	region;
 	client;
 	clientOptions;
+	disposed = false;
 	constructor(opts) {
 		this.cfnStackName = opts.cfnStackName;
 		this.region = opts.region;
@@ -41615,6 +41665,7 @@ var CfnLocalStateProvider = class {
 		if (opts.profile !== void 0) this.clientOptions.profile = opts.profile;
 	}
 	getClient() {
+		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		if (!this.client) this.client = new CloudFormationClient({ region: this.region });
 		return this.client;
 	}
@@ -41631,13 +41682,14 @@ var CfnLocalStateProvider = class {
 	* behavior on every intrinsic-valued env var.
 	*/
 	async load(_stackName, _synthRegion) {
+		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		const logger = getLogger();
 		const client = this.getClient();
 		let resourceMap;
 		try {
 			resourceMap = buildResourceStateMap((await client.send(new DescribeStackResourcesCommand({ StackName: this.cfnStackName }))).StackResources ?? []);
 		} catch (err) {
-			logger.warn(`${this.label}: DescribeStackResources(${this.cfnStackName}) failed: ${err instanceof Error ? err.message : String(err)}. Was the stack deployed in region '${this.region}'? Falling back.`);
+			logger.warn(`${this.label}: DescribeStackResources(${this.cfnStackName}) failed: ${formatAwsErrorForWarn(err)}. Was the stack deployed in region '${this.region}'? Falling back.`);
 			return;
 		}
 		let outputs;
@@ -41648,7 +41700,7 @@ var CfnLocalStateProvider = class {
 				outputs = {};
 			} else outputs = buildOutputsMap(stack.Outputs ?? []);
 		} catch (err) {
-			logger.warn(`${this.label}: DescribeStacks(${this.cfnStackName}) failed: ${err instanceof Error ? err.message : String(err)}. Outputs will be empty (Fn::GetStackOutput cannot resolve).`);
+			logger.warn(`${this.label}: DescribeStacks(${this.cfnStackName}) failed: ${formatAwsErrorForWarn(err)}. Outputs will be empty (Fn::GetStackOutput cannot resolve).`);
 			outputs = {};
 		}
 		return {
@@ -41672,18 +41724,18 @@ var CfnLocalStateProvider = class {
 	* partition-aware region list.
 	*/
 	async buildCrossStackResolver(_consumerRegion) {
+		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
 		const logger = getLogger();
 		const client = this.getClient();
 		const label = this.label;
 		const region = this.region;
-		let cachedExports;
-		const ensureExports = async () => {
-			if (cachedExports) return cachedExports;
-			const result = await fetchAllExports(client).catch((err) => {
-				logger.warn(`${label}: ListExports (${region}) failed: ${err instanceof Error ? err.message : String(err)}. Fn::ImportValue intrinsics will warn-and-drop.`);
+		let exportsPromise;
+		const ensureExports = () => {
+			if (exportsPromise) return exportsPromise;
+			exportsPromise = fetchAllExports(client).catch((err) => {
+				logger.warn(`${label}: ListExports (${region}) failed: ${formatAwsErrorForWarn(err)}. Fn::ImportValue intrinsics will warn-and-drop.`);
 			});
-			if (result) cachedExports = result;
-			return result;
+			return exportsPromise;
 		};
 		return {
 			async resolveImport(exportName) {
@@ -41697,6 +41749,7 @@ var CfnLocalStateProvider = class {
 		};
 	}
 	dispose() {
+		this.disposed = true;
 		if (this.client) {
 			this.client.destroy();
 			this.client = void 0;
@@ -41764,9 +41817,32 @@ async function fetchAllExports(client) {
 		nextToken = resp.NextToken;
 		pages += 1;
 		if (pages > 50) throw new Error("ListExports pagination exceeded 50 pages — likely a malformed NextToken loop.");
-	} while (nextToken !== void 0);
+	} while (nextToken !== void 0 && nextToken !== "");
 	return out;
 }
+/**
+* Format an AWS SDK error as `<name> (HTTP <status>): <message>` so the
+* surfaced warn name the error class (e.g. `ThrottlingException`,
+* `AccessDeniedException`, `ValidationError`) and HTTP status alongside
+* the human-readable message. Falls back to the bare message for
+* non-SDK errors (the existing pre-issue-#611 behavior) so non-AWS
+* thrown values still surface meaningfully. Exported for unit testing.
+*
+* Issue #611 NIT 4 — `normalizeAwsError` in `utils/error-handler.ts` is
+* S3-bucket-specific (it rewrites the synthetic `Unknown`/`UnknownError`
+* with bucket / region context), so the CFn provider extracts the
+* pieces directly here.
+*/
+function formatAwsErrorForWarn(err) {
+	if (!(err instanceof Error)) return String(err);
+	const name = err.name && err.name !== "Error" ? err.name : void 0;
+	const status = err.$metadata?.httpStatusCode;
+	const prefixParts = [];
+	if (name !== void 0) prefixParts.push(name);
+	if (status !== void 0) prefixParts.push(`HTTP ${status}`);
+	if (prefixParts.length === 0) return err.message;
+	return `${prefixParts.join(" ")}: ${err.message}`;
+}
 
 //#endregion
 //#region src/cli/commands/local-state-source.ts
@@ -41811,6 +41887,22 @@ function resolveCfnStackName(fromCfnStack, cdkdStackName) {
 	return cdkdStackName;
 }
 /**
+* Single source of truth for "is the user asking for `--from-cfn-stack`?".
+* Commander maps the flag to one of `undefined` (absent) / `true` (bare) /
+* `'<name>'` (explicit). Everything except `undefined` / `false` means the
+* flag is present. Extracted so the `local-start-api` "state source
+* active" check (the parent call site that decides whether to load any
+* state at all) and `createLocalStateProvider`'s own branch logic stay
+* in lock-step — a previous duplication of this predicate motivated the
+* extraction (issue #611 NIT 5).
+*
+* Exported for use by `local-start-api` and unit testing.
+*/
+function isCfnFlagPresent(opts) {
+	const v = opts.fromCfnStack;
+	return v !== void 0 && v !== false;
+}
+/**
 * Resolve the region used for the CFn client. The CFn provider is
 * region-bound at construction time; we apply the precedence chain
 * `--stack-region` > `--region` > `AWS_REGION` > `AWS_DEFAULT_REGION`
@@ -41881,8 +41973,9 @@ function rejectExplicitCfnStackWithMultipleStacks(options, routedStackCount) {
 */
 function createLocalStateProvider(options, cdkdStackName, synthRegion) {
 	const cfnStackOpt = options.fromCfnStack;
-	const cfnFlagPresent = cfnStackOpt !== void 0 && cfnStackOpt !== false;
+	const cfnFlagPresent = isCfnFlagPresent(options);
 	if (options.fromState && cfnFlagPresent) throw new LocalStateSourceError("--from-state and --from-cfn-stack are mutually exclusive. Use --from-state for stacks deployed via `cdkd deploy`; use --from-cfn-stack for stacks deployed via `cdk deploy` (CloudFormation).");
+	if (cfnStackOpt === "") throw new LocalStateSourceError("--from-cfn-stack requires a non-empty stack name when an explicit value is provided. Drop the value to use the cdkd stack name, or pass --from-cfn-stack <name>.");
 	if (options.fromState) return new S3LocalStateProvider({
 		statePrefix: options.statePrefix,
 		...options.stateBucket !== void 0 && { stateBucket: options.stateBucket },
@@ -46661,9 +46754,14 @@ function classifyServiceIntegrationRoute(baseRoute, integrationProps, stackName,
 *     JSON prelude — `{statusCode, headers, cookies?}` — followed by 8
 *     NULL bytes and then the raw body chunks). The HTTP server pipes
 *     the chunks to the client with `Transfer-Encoding: chunked` (#467).
-*   - `AuthType !== 'NONE'` (e.g. `AWS_IAM`) → deferred-error
-*     unsupported. Boot proceeds; HTTP 501 + `reason` at request time.
-*     IAM auth would need SigV4 verification cdkd cannot emulate.
+*   - `AuthType === 'AWS_IAM'` → normal route. The `IamAuthorizer` is
+*     attached at the authorizer-resolver pass (`detectAuthorizer` in
+*     `authorizer-resolver.ts`) so the HTTP server runs the same SigV4
+*     verification it ships for REST v1 `AuthorizationType: 'AWS_IAM'`
+*     (PR #447). Signature verification only — no IAM policy emulation.
+*   - `AuthType` other than `'NONE'` / `'AWS_IAM'` (defensive — AWS docs
+*     only define those two values) → deferred-error unsupported. Boot
+*     proceeds; HTTP 501 + `reason` at request time.
 *
 * The Lambda Arn intrinsic resolution still **hard-errors** when it
 * cannot pin down a same-template Lambda — Function URLs have no other
@@ -46688,10 +46786,10 @@ function discoverFunctionUrl(logicalId, resource, template, stackName) {
 		declaredAt: `${stackName}/${logicalId}`
 	};
 	const authType = props["AuthType"];
-	if (authType !== "NONE") return [{
+	if (authType !== "NONE" && authType !== "AWS_IAM") return [{
 		...baseRoute,
 		lambdaLogicalId,
-		unsupported: { reason: `${stackName}/${logicalId}: AuthType '${String(authType)}' is not supported (only NONE — IAM auth requires SigV4 verification cdkd cannot emulate locally).` }
+		unsupported: { reason: `${stackName}/${logicalId}: AuthType ${shortJson$1(authType)} is not a recognized Function URL auth type (expected 'NONE' or 'AWS_IAM').` }
 	}];
 	const invokeModeRaw = props["InvokeMode"];
 	let invokeMode = "BUFFERED";
@@ -50994,6 +51092,28 @@ function detectAuthorizer(route, stack) {
 	if (!resource) return void 0;
 	if (resource.Type === "AWS::ApiGateway::Method") return detectRestV1Authorizer(resource, logicalId, stack);
 	if (resource.Type === "AWS::ApiGatewayV2::Route") return detectHttpApiAuthorizer(resource, logicalId, stack);
+	if (resource.Type === "AWS::Lambda::Url") return detectFunctionUrlAuthorizer(resource, logicalId, stack);
+}
+/**
+* Function URL (`AWS::Lambda::Url`) authorizer detection (issue #621).
+*
+* `AuthType: 'AWS_IAM'` uses the same SigV4 mechanism REST v1 ships
+* (PR #447), so we route through the same `IamAuthorizer` descriptor and
+* let the HTTP server's existing `if (authorizer.kind === 'iam')`
+* request-time branch run `verifySigV4`. Like REST v1 AWS_IAM, no IAM
+* policy emulation — signature verification only.
+*
+* `AuthType: 'NONE'` (and any non-AWS_IAM AuthType that
+* `route-discovery.ts` already flipped to `unsupported`) returns
+* `undefined` so the route runs without an authorizer pass.
+*/
+function detectFunctionUrlAuthorizer(urlResource, urlLogicalId, stack) {
+	if ((urlResource.Properties ?? {})["AuthType"] !== "AWS_IAM") return void 0;
+	return {
+		kind: "iam",
+		logicalId: "AWS_IAM",
+		declaredAt: `${stack.stackName}/${urlLogicalId}`
+	};
 }
 function detectRestV1Authorizer(methodResource, methodLogicalId, stack) {
 	const props = methodResource.Properties ?? {};
@@ -52455,15 +52575,15 @@ async function handleRequest(req, res, state, opts) {
 			outcome = await runAuthorizerPass(authorizer, snapshot, matchCtx, state, opts, baseEvent["requestContext"]);
 		} catch (err) {
 			logger.error(`Authorizer ${authorizer.logicalId} threw for ${match.route.declaredAt}: ${err instanceof Error ? err.message : String(err)}`);
-			writeAuthRejection(res, match.route.apiVersion, "policy-deny");
+			writeAuthRejection(res, match.route.apiVersion, "policy-deny", authorizer.kind);
 			return;
 		}
 		if (!outcome.result.allow) {
-			writeAuthRejection(res, match.route.apiVersion, outcome.denyKind ?? "policy-deny");
+			writeAuthRejection(res, match.route.apiVersion, outcome.denyKind ?? "policy-deny", authorizer.kind);
 			return;
 		}
 		authResult = outcome.result;
-		const overlay = buildOverlay(authorizer, authResult);
+		const overlay = buildOverlay(authorizer, authResult, match.route.apiVersion);
 		if (overlay) baseEvent = applyAuthorizerOverlay(baseEvent, overlay);
 	}
 	if (match.route.serviceIntegration) {
@@ -52874,7 +52994,7 @@ function pickSourceIp(apiVersion, requestContext, snapshot) {
 	}
 	return snapshot.sourceIp ?? "127.0.0.1";
 }
-function buildOverlay(authorizer, result) {
+function buildOverlay(authorizer, result, routeApiVersion) {
 	if (authorizer.kind === "lambda-token" || authorizer.kind === "lambda-request") return authorizer.kind === "lambda-request" && authorizer.apiVersion === "v2" ? {
 		kind: "lambda-http-v2",
 		...result.principalId !== void 0 && { principalId: result.principalId },
@@ -52888,10 +53008,13 @@ function buildOverlay(authorizer, result) {
 		kind: "cognito-rest-v1",
 		claims: result.context ?? {}
 	};
-	if (authorizer.kind === "iam") return {
-		kind: "lambda-rest-v1",
-		...result.principalId !== void 0 && { principalId: result.principalId }
-	};
+	if (authorizer.kind === "iam") {
+		if (routeApiVersion === "v2") return void 0;
+		return {
+			kind: "lambda-rest-v1",
+			...result.principalId !== void 0 && { principalId: result.principalId }
+		};
+	}
 	return {
 		kind: "jwt-http-v2",
 		claims: result.context ?? {}
@@ -52906,8 +53029,15 @@ function buildOverlay(authorizer, result) {
 *     authorizer ran and denied; status mirrors AWS API Gateway).
 *   - HTTP v2, both kinds → 401 `{"message":"Unauthorized"}` (HTTP API
 *     collapses both into the same response).
+*   - Function URL with AWS_IAM (issue #621) → 403 `{"Message":"Forbidden"}`
+*     for both deny kinds (matches Lambda's deployed Function URL IAM
+*     behavior — the AWS SigV4 layer rejects with 403, not 401).
 */
-function writeAuthRejection(res, apiVersion, denyKind) {
+function writeAuthRejection(res, apiVersion, denyKind, authorizerKind) {
+	if (apiVersion === "v2" && authorizerKind === "iam") {
+		writeError(res, 403, "{\"Message\":\"Forbidden\"}");
+		return;
+	}
 	if (apiVersion === "v2") {
 		writeError(res, 401, "{\"message\":\"Unauthorized\"}");
 		return;
@@ -53827,7 +53957,7 @@ async function localStartApiCommand(target, options) {
 			const m = buildCorsConfigByApiId(stack.template);
 			for (const [k, v] of m) corsConfigByApiId.set(k, v);
 		}
-		const stateByStack = options.fromState || options.fromCfnStack !== void 0 && options.fromCfnStack !== false ? await loadStateForRoutedStacks(targetStacks, routes, routesWithAuth, options) : /* @__PURE__ */ new Map();
+		const stateByStack = options.fromState || isCfnFlagPresent(options) ? await loadStateForRoutedStacks(targetStacks, routes, routesWithAuth, options) : /* @__PURE__ */ new Map();
 		const lambdaIds = uniqueLambdaIds(routes, routesWithAuth, webSocketApis);
 		const specs = /* @__PURE__ */ new Map();
 		for (let i = 0; i < lambdaIds.length; i++) {
@@ -55004,7 +55134,7 @@ function resolveMtlsConfig(options) {
 * Builder for the `start-api` subcommand. Wired up by `local.ts`.
 */
 function createLocalStartApiCommand() {
-	const startApi = new Command("start-api").description("Run a long-running local HTTP server that maps API Gateway routes (REST v1, HTTP API, Function URL) to Lambda invocations against the AWS Lambda Runtime Interface Emulator (Docker required). Supports Lambda TOKEN/REQUEST authorizers, Cognito User Pool / HTTP v2 JWT authorizers, and REST v1 AWS_IAM (SigV4 signature verification only — IAM policy evaluation is NOT emulated; see docs/local-emulation.md). When JWKS is unreachable, JWT authorizers fall back to pass-through (every token accepted) with a warn line — local dev fallback. VPC-config Lambdas run locally and surface a warn line at startup; their containers do NOT get attached to the deployed VPC subnets, so calls to private RDS / ElastiCache will fail.").argument("[target]", "Optional API filter. Accepts the bare CDK logical id ('MyHttpApi'; single-stack apps only), stack-qualified logical id ('MyStack:MyHttpApi'), full CDK Construct path ('MyStack/MyHttpApi/Resource'), or an ancestor Construct path that prefix-matches ('MyStack/MyHttpApi'). When omitted, every discovered API gets its own server. Mirrors `cdkd local invoke` / `cdkd local run-task` target syntax.").addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(new Option("--warm", "Pre-start one container per Lambda at server boot").default(false)).addOption(new Option("--per-lambda-concurrency <n>", "Pool size cap per Lambda (default 2, max 4)").default("2")).addOption(new Option("--no-pull", "Skip docker pull (cached image)")).addOption(new Option("--container-host <host>", "IP the host uses to bind/probe the RIE port (must be a numeric IP — `docker run -p <ip>:<port>:8080` rejects hostnames). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--debug-port-base <port>", "Reserve a contiguous --debug-port range (one per Lambda)")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--assume-role <arn-or-pair>", "Assume the Lambda's execution role and forward STS-issued temp creds. Bare <arn> = global default; <LogicalId>=<arn> = per-Lambda override (repeatable). Per-Lambda > global > unset (developer creds passed through).").argParser((raw, prev) => parseAssumeRoleToken(raw, prev))).addOption(new Option("--watch", "Hot-reload: re-synth + re-discover routes when cdk.out/ or asset directories change. Off by default; the server keeps the previous version serving when synth fails mid-reload.").default(false)).addOption(new Option("--stage <name>", "Select an API Gateway Stage by its 'StageName'. Default: the first Stage attached to each API. Drives event.stageVariables for both REST v1 and HTTP API v2. NOTE: For HTTP API v2 routes, requestContext.stage is always '$default' regardless of this flag (AWS-side limitation — HTTP API only exposes one stage to the integration event); only event.stageVariables is affected for v2 routes. For REST v1 routes the selected StageName is also threaded into requestContext.stage.")).addOption(new Option("--api <id>", "DEPRECATED — use the positional <target> argument instead. Same accepted forms (bare logical id, stack-qualified, Construct path, ancestor prefix). Will be removed in a future major release.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--from-state", "Read cdkd S3 state for every routed stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::Join (and AWS pseudo parameters) in Lambda env vars with the deployed physical IDs / attributes. Off by default — pre-PR warn-and-drop semantics are preserved. Turn on for stacks already deployed via cdkd deploy. Mirrors `cdkd local invoke --from-state` / `cdkd local run-task --from-state`. Re-runs against fresh state on every hot-reload firing (--watch).").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via DescribeStackResources and substitute Ref / Fn::ImportValue in Lambda env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name per routed stack; pass an explicit value when a single CFn stack should serve every routed stack. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn DescribeStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).")).addOption(new Option("--mtls-truststore <path>", "PEM-encoded CA bundle for client-certificate verification (mutual TLS). When set, the local server switches from HTTP to HTTPS and the TLS handshake rejects clients whose certificate doesn't chain to one of these CAs. Verified certs are surfaced on the Lambda event under requestContext.identity.clientCert (REST v1) / requestContext.authentication.clientCert (HTTP API v2). Must be set together with --mtls-cert + --mtls-key; partial flag sets are rejected. Generate a CA + server + client cert for local dev: openssl req -x509 -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.pem -subj \"/CN=cdkd-local-ca\" -days 365; openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-csr.pem -subj \"/CN=localhost\"; openssl x509 -req -in server-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365; openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-csr.pem -subj \"/CN=client\"; openssl x509 -req -in client-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365; curl --cacert ca.pem --cert client-cert.pem --key client-key.pem https://localhost:<port>/...")).addOption(new Option("--mtls-cert <path>", "PEM-encoded server certificate for mutual TLS. Self-signed is fine for local dev. Must be set together with --mtls-truststore + --mtls-key.")).addOption(new Option("--mtls-key <path>", "PEM-encoded server private key matching --mtls-cert. Must be set together with --mtls-truststore + --mtls-cert.")).addOption(new Option("--allow-unverified-sigv4", "Opt-in: allow AWS_IAM SigV4 requests that cannot be cryptographically verified (foreign access-key-id, OR no local AWS credentials configured) to pass through with a placeholder principalId. DEFAULT off — fail-closed so unauthenticated bypass is impossible against `event.requestContext.identity.accessKey`-trusting handler code. Use only in dev loops where you understand the risk.").default(false)).action(withErrorHandling(localStartApiCommand));
+	const startApi = new Command("start-api").description("Run a long-running local HTTP server that maps API Gateway routes (REST v1, HTTP API, Function URL) to Lambda invocations against the AWS Lambda Runtime Interface Emulator (Docker required). Supports Lambda TOKEN/REQUEST authorizers, Cognito User Pool / HTTP v2 JWT authorizers, and AWS_IAM auth (REST v1 `AuthorizationType: AWS_IAM` and Function URL `AuthType: AWS_IAM` — SigV4 signature verification only; IAM policy evaluation is NOT emulated; see docs/local-emulation.md). When JWKS is unreachable, JWT authorizers fall back to pass-through (every token accepted) with a warn line — local dev fallback. VPC-config Lambdas run locally and surface a warn line at startup; their containers do NOT get attached to the deployed VPC subnets, so calls to private RDS / ElastiCache will fail.").argument("[target]", "Optional API filter. Accepts the bare CDK logical id ('MyHttpApi'; single-stack apps only), stack-qualified logical id ('MyStack:MyHttpApi'), full CDK Construct path ('MyStack/MyHttpApi/Resource'), or an ancestor Construct path that prefix-matches ('MyStack/MyHttpApi'). When omitted, every discovered API gets its own server. Mirrors `cdkd local invoke` / `cdkd local run-task` target syntax.").addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(new Option("--warm", "Pre-start one container per Lambda at server boot").default(false)).addOption(new Option("--per-lambda-concurrency <n>", "Pool size cap per Lambda (default 2, max 4)").default("2")).addOption(new Option("--no-pull", "Skip docker pull (cached image)")).addOption(new Option("--container-host <host>", "IP the host uses to bind/probe the RIE port (must be a numeric IP — `docker run -p <ip>:<port>:8080` rejects hostnames). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--debug-port-base <port>", "Reserve a contiguous --debug-port range (one per Lambda)")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--assume-role <arn-or-pair>", "Assume the Lambda's execution role and forward STS-issued temp creds. Bare <arn> = global default; <LogicalId>=<arn> = per-Lambda override (repeatable). Per-Lambda > global > unset (developer creds passed through).").argParser((raw, prev) => parseAssumeRoleToken(raw, prev))).addOption(new Option("--watch", "Hot-reload: re-synth + re-discover routes when cdk.out/ or asset directories change. Off by default; the server keeps the previous version serving when synth fails mid-reload.").default(false)).addOption(new Option("--stage <name>", "Select an API Gateway Stage by its 'StageName'. Default: the first Stage attached to each API. Drives event.stageVariables for both REST v1 and HTTP API v2. NOTE: For HTTP API v2 routes, requestContext.stage is always '$default' regardless of this flag (AWS-side limitation — HTTP API only exposes one stage to the integration event); only event.stageVariables is affected for v2 routes. For REST v1 routes the selected StageName is also threaded into requestContext.stage.")).addOption(new Option("--api <id>", "DEPRECATED — use the positional <target> argument instead. Same accepted forms (bare logical id, stack-qualified, Construct path, ancestor prefix). Will be removed in a future major release.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--from-state", "Read cdkd S3 state for every routed stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::Join (and AWS pseudo parameters) in Lambda env vars with the deployed physical IDs / attributes. Off by default — pre-PR warn-and-drop semantics are preserved. Turn on for stacks already deployed via cdkd deploy. Mirrors `cdkd local invoke --from-state` / `cdkd local run-task --from-state`. Re-runs against fresh state on every hot-reload firing (--watch).").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via DescribeStackResources and substitute Ref / Fn::ImportValue in Lambda env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name per routed stack; pass an explicit value when a single CFn stack should serve every routed stack. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn DescribeStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).")).addOption(new Option("--mtls-truststore <path>", "PEM-encoded CA bundle for client-certificate verification (mutual TLS). When set, the local server switches from HTTP to HTTPS and the TLS handshake rejects clients whose certificate doesn't chain to one of these CAs. Verified certs are surfaced on the Lambda event under requestContext.identity.clientCert (REST v1) / requestContext.authentication.clientCert (HTTP API v2). Must be set together with --mtls-cert + --mtls-key; partial flag sets are rejected. Generate a CA + server + client cert for local dev: openssl req -x509 -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.pem -subj \"/CN=cdkd-local-ca\" -days 365; openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-csr.pem -subj \"/CN=localhost\"; openssl x509 -req -in server-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365; openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-csr.pem -subj \"/CN=client\"; openssl x509 -req -in client-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365; curl --cacert ca.pem --cert client-cert.pem --key client-key.pem https://localhost:<port>/...")).addOption(new Option("--mtls-cert <path>", "PEM-encoded server certificate for mutual TLS. Self-signed is fine for local dev. Must be set together with --mtls-truststore + --mtls-key.")).addOption(new Option("--mtls-key <path>", "PEM-encoded server private key matching --mtls-cert. Must be set together with --mtls-truststore + --mtls-cert.")).addOption(new Option("--allow-unverified-sigv4", "Opt-in: allow AWS_IAM SigV4 requests that cannot be cryptographically verified (foreign access-key-id, OR no local AWS credentials configured) to pass through with a placeholder principalId. DEFAULT off — fail-closed so unauthenticated bypass is impossible against `event.requestContext.identity.accessKey`-trusting handler code. Use only in dev loops where you understand the risk.").default(false)).action(withErrorHandling(localStartApiCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -59343,7 +59473,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.158.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.159.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());