@go-to-k/cdkd 0.69.0 → 0.71.0

package/dist/cli.js

@@ -708,10 +708,10 @@ var require_GraphQLError = __commonJS({
        */
       constructor(message, ...rawArgs) {
         var _this$nodes, _nodeLocations$, _ref;
-        const { nodes, source, positions, path: path2, originalError, extensions } = toNormalizedOptions(rawArgs);
+        const { nodes, source, positions, path: path3, originalError, extensions } = toNormalizedOptions(rawArgs);
         super(message);
         this.name = "GraphQLError";
-        this.path = path2 !== null && path2 !== void 0 ? path2 : void 0;
+        this.path = path3 !== null && path3 !== void 0 ? path3 : void 0;
         this.originalError = originalError !== null && originalError !== void 0 ? originalError : void 0;
         this.nodes = undefinedIfEmpty(
           Array.isArray(nodes) ? nodes : nodes ? [nodes] : void 0
@@ -4173,14 +4173,14 @@ var require_visitor = __commonJS({
       let node = root;
       let key = void 0;
       let parent = void 0;
-      const path2 = [];
+      const path3 = [];
       const ancestors = [];
       do {
         index++;
         const isLeaving = index === keys.length;
         const isEdited = isLeaving && edits.length !== 0;
         if (isLeaving) {
-          key = ancestors.length === 0 ? void 0 : path2[path2.length - 1];
+          key = ancestors.length === 0 ? void 0 : path3[path3.length - 1];
           node = parent;
           parent = ancestors.pop();
           if (isEdited) {
@@ -4214,7 +4214,7 @@ var require_visitor = __commonJS({
           if (node === null || node === void 0) {
             continue;
           }
-          path2.push(key);
+          path3.push(key);
         }
         let result;
         if (!Array.isArray(node)) {
@@ -4224,13 +4224,13 @@ var require_visitor = __commonJS({
             `Invalid AST Node: ${(0, _inspect.inspect)(node)}.`
           );
           const visitFn = isLeaving ? (_enterLeaveMap$get = enterLeaveMap.get(node.kind)) === null || _enterLeaveMap$get === void 0 ? void 0 : _enterLeaveMap$get.leave : (_enterLeaveMap$get2 = enterLeaveMap.get(node.kind)) === null || _enterLeaveMap$get2 === void 0 ? void 0 : _enterLeaveMap$get2.enter;
-          result = visitFn === null || visitFn === void 0 ? void 0 : visitFn.call(visitor, node, key, parent, path2, ancestors);
+          result = visitFn === null || visitFn === void 0 ? void 0 : visitFn.call(visitor, node, key, parent, path3, ancestors);
           if (result === BREAK) {
             break;
           }
           if (result === false) {
             if (!isLeaving) {
-              path2.pop();
+              path3.pop();
               continue;
             }
           } else if (result !== void 0) {
@@ -4239,7 +4239,7 @@ var require_visitor = __commonJS({
               if ((0, _ast.isNode)(result)) {
                 node = result;
               } else {
-                path2.pop();
+                path3.pop();
                 continue;
               }
             }
@@ -4249,7 +4249,7 @@ var require_visitor = __commonJS({
           edits.push([key, node]);
         }
         if (isLeaving) {
-          path2.pop();
+          path3.pop();
         } else {
           var _node$kind;
           stack = {
@@ -4374,16 +4374,16 @@ var require_printer = __commonJS({
       },
       // Document
       Document: {
-        leave: (node) => join7(node.definitions, "\n\n")
+        leave: (node) => join9(node.definitions, "\n\n")
       },
       OperationDefinition: {
         leave(node) {
-          const varDefs = hasMultilineItems(node.variableDefinitions) ? wrap("(\n", join7(node.variableDefinitions, "\n"), "\n)") : wrap("(", join7(node.variableDefinitions, ", "), ")");
-          const prefix = wrap("", node.description, "\n") + join7(
+          const varDefs = hasMultilineItems(node.variableDefinitions) ? wrap("(\n", join9(node.variableDefinitions, "\n"), "\n)") : wrap("(", join9(node.variableDefinitions, ", "), ")");
+          const prefix = wrap("", node.description, "\n") + join9(
             [
               node.operation,
-              join7([node.name, varDefs]),
-              join7(node.directives, " ")
+              join9([node.name, varDefs]),
+              join9(node.directives, " ")
             ],
             " "
           );
@@ -4391,7 +4391,7 @@ var require_printer = __commonJS({
         }
       },
       VariableDefinition: {
-        leave: ({ variable, type, defaultValue, directives, description }) => wrap("", description, "\n") + variable + ": " + type + wrap(" = ", defaultValue) + wrap(" ", join7(directives, " "))
+        leave: ({ variable, type, defaultValue, directives, description }) => wrap("", description, "\n") + variable + ": " + type + wrap(" = ", defaultValue) + wrap(" ", join9(directives, " "))
       },
       SelectionSet: {
         leave: ({ selections }) => block(selections)
@@ -4399,11 +4399,11 @@ var require_printer = __commonJS({
       Field: {
         leave({ alias, name, arguments: args, directives, selectionSet }) {
           const prefix = wrap("", alias, ": ") + name;
-          let argsLine = prefix + wrap("(", join7(args, ", "), ")");
+          let argsLine = prefix + wrap("(", join9(args, ", "), ")");
           if (argsLine.length > MAX_LINE_LENGTH) {
-            argsLine = prefix + wrap("(\n", indent(join7(args, "\n")), "\n)");
+            argsLine = prefix + wrap("(\n", indent(join9(args, "\n")), "\n)");
           }
-          return join7([argsLine, join7(directives, " "), selectionSet], " ");
+          return join9([argsLine, join9(directives, " "), selectionSet], " ");
         }
       },
       Argument: {
@@ -4411,14 +4411,14 @@ var require_printer = __commonJS({
       },
       // Fragments
       FragmentSpread: {
-        leave: ({ name, directives }) => "..." + name + wrap(" ", join7(directives, " "))
+        leave: ({ name, directives }) => "..." + name + wrap(" ", join9(directives, " "))
       },
       InlineFragment: {
-        leave: ({ typeCondition, directives, selectionSet }) => join7(
+        leave: ({ typeCondition, directives, selectionSet }) => join9(
           [
             "...",
             wrap("on ", typeCondition),
-            join7(directives, " "),
+            join9(directives, " "),
             selectionSet
           ],
           " "
@@ -4434,7 +4434,7 @@ var require_printer = __commonJS({
           description
         }) => wrap("", description, "\n") + // Note: fragment variable definitions are experimental and may be changed
         // or removed in the future.
-        `fragment ${name}${wrap("(", join7(variableDefinitions, ", "), ")")} on ${typeCondition} ${wrap("", join7(directives, " "), " ")}` + selectionSet
+        `fragment ${name}${wrap("(", join9(variableDefinitions, ", "), ")")} on ${typeCondition} ${wrap("", join9(directives, " "), " ")}` + selectionSet
       },
       // Value
       IntValue: {
@@ -4456,17 +4456,17 @@ var require_printer = __commonJS({
         leave: ({ value }) => value
       },
       ListValue: {
-        leave: ({ values }) => "[" + join7(values, ", ") + "]"
+        leave: ({ values }) => "[" + join9(values, ", ") + "]"
       },
       ObjectValue: {
-        leave: ({ fields }) => "{" + join7(fields, ", ") + "}"
+        leave: ({ fields }) => "{" + join9(fields, ", ") + "}"
       },
       ObjectField: {
         leave: ({ name, value }) => name + ": " + value
       },
       // Directive
       Directive: {
-        leave: ({ name, arguments: args }) => "@" + name + wrap("(", join7(args, ", "), ")")
+        leave: ({ name, arguments: args }) => "@" + name + wrap("(", join9(args, ", "), ")")
       },
       // Type
       NamedType: {
@@ -4480,61 +4480,61 @@ var require_printer = __commonJS({
       },
       // Type System Definitions
       SchemaDefinition: {
-        leave: ({ description, directives, operationTypes }) => wrap("", description, "\n") + join7(["schema", join7(directives, " "), block(operationTypes)], " ")
+        leave: ({ description, directives, operationTypes }) => wrap("", description, "\n") + join9(["schema", join9(directives, " "), block(operationTypes)], " ")
       },
       OperationTypeDefinition: {
         leave: ({ operation, type }) => operation + ": " + type
       },
       ScalarTypeDefinition: {
-        leave: ({ description, name, directives }) => wrap("", description, "\n") + join7(["scalar", name, join7(directives, " ")], " ")
+        leave: ({ description, name, directives }) => wrap("", description, "\n") + join9(["scalar", name, join9(directives, " ")], " ")
       },
       ObjectTypeDefinition: {
-        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join7(
+        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join9(
           [
             "type",
             name,
-            wrap("implements ", join7(interfaces, " & ")),
-            join7(directives, " "),
+            wrap("implements ", join9(interfaces, " & ")),
+            join9(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       FieldDefinition: {
-        leave: ({ description, name, arguments: args, type, directives }) => wrap("", description, "\n") + name + (hasMultilineItems(args) ? wrap("(\n", indent(join7(args, "\n")), "\n)") : wrap("(", join7(args, ", "), ")")) + ": " + type + wrap(" ", join7(directives, " "))
+        leave: ({ description, name, arguments: args, type, directives }) => wrap("", description, "\n") + name + (hasMultilineItems(args) ? wrap("(\n", indent(join9(args, "\n")), "\n)") : wrap("(", join9(args, ", "), ")")) + ": " + type + wrap(" ", join9(directives, " "))
       },
       InputValueDefinition: {
-        leave: ({ description, name, type, defaultValue, directives }) => wrap("", description, "\n") + join7(
-          [name + ": " + type, wrap("= ", defaultValue), join7(directives, " ")],
+        leave: ({ description, name, type, defaultValue, directives }) => wrap("", description, "\n") + join9(
+          [name + ": " + type, wrap("= ", defaultValue), join9(directives, " ")],
           " "
         )
       },
       InterfaceTypeDefinition: {
-        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join7(
+        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join9(
           [
             "interface",
             name,
-            wrap("implements ", join7(interfaces, " & ")),
-            join7(directives, " "),
+            wrap("implements ", join9(interfaces, " & ")),
+            join9(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       UnionTypeDefinition: {
-        leave: ({ description, name, directives, types }) => wrap("", description, "\n") + join7(
-          ["union", name, join7(directives, " "), wrap("= ", join7(types, " | "))],
+        leave: ({ description, name, directives, types }) => wrap("", description, "\n") + join9(
+          ["union", name, join9(directives, " "), wrap("= ", join9(types, " | "))],
           " "
         )
       },
       EnumTypeDefinition: {
-        leave: ({ description, name, directives, values }) => wrap("", description, "\n") + join7(["enum", name, join7(directives, " "), block(values)], " ")
+        leave: ({ description, name, directives, values }) => wrap("", description, "\n") + join9(["enum", name, join9(directives, " "), block(values)], " ")
       },
       EnumValueDefinition: {
-        leave: ({ description, name, directives }) => wrap("", description, "\n") + join7([name, join7(directives, " ")], " ")
+        leave: ({ description, name, directives }) => wrap("", description, "\n") + join9([name, join9(directives, " ")], " ")
       },
       InputObjectTypeDefinition: {
-        leave: ({ description, name, directives, fields }) => wrap("", description, "\n") + join7(["input", name, join7(directives, " "), block(fields)], " ")
+        leave: ({ description, name, directives, fields }) => wrap("", description, "\n") + join9(["input", name, join9(directives, " "), block(fields)], " ")
       },
       DirectiveDefinition: {
         leave: ({
@@ -4544,84 +4544,84 @@ var require_printer = __commonJS({
           directives,
           repeatable,
           locations
-        }) => wrap("", description, "\n") + "directive @" + name + (hasMultilineItems(args) ? wrap("(\n", indent(join7(args, "\n")), "\n)") : wrap("(", join7(args, ", "), ")")) + wrap(" ", join7(directives, " ")) + (repeatable ? " repeatable" : "") + " on " + join7(locations, " | ")
+        }) => wrap("", description, "\n") + "directive @" + name + (hasMultilineItems(args) ? wrap("(\n", indent(join9(args, "\n")), "\n)") : wrap("(", join9(args, ", "), ")")) + wrap(" ", join9(directives, " ")) + (repeatable ? " repeatable" : "") + " on " + join9(locations, " | ")
       },
       SchemaExtension: {
-        leave: ({ directives, operationTypes }) => join7(
-          ["extend schema", join7(directives, " "), block(operationTypes)],
+        leave: ({ directives, operationTypes }) => join9(
+          ["extend schema", join9(directives, " "), block(operationTypes)],
           " "
         )
       },
       ScalarTypeExtension: {
-        leave: ({ name, directives }) => join7(["extend scalar", name, join7(directives, " ")], " ")
+        leave: ({ name, directives }) => join9(["extend scalar", name, join9(directives, " ")], " ")
       },
       ObjectTypeExtension: {
-        leave: ({ name, interfaces, directives, fields }) => join7(
+        leave: ({ name, interfaces, directives, fields }) => join9(
           [
             "extend type",
             name,
-            wrap("implements ", join7(interfaces, " & ")),
-            join7(directives, " "),
+            wrap("implements ", join9(interfaces, " & ")),
+            join9(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       InterfaceTypeExtension: {
-        leave: ({ name, interfaces, directives, fields }) => join7(
+        leave: ({ name, interfaces, directives, fields }) => join9(
           [
             "extend interface",
             name,
-            wrap("implements ", join7(interfaces, " & ")),
-            join7(directives, " "),
+            wrap("implements ", join9(interfaces, " & ")),
+            join9(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       UnionTypeExtension: {
-        leave: ({ name, directives, types }) => join7(
+        leave: ({ name, directives, types }) => join9(
           [
             "extend union",
             name,
-            join7(directives, " "),
-            wrap("= ", join7(types, " | "))
+            join9(directives, " "),
+            wrap("= ", join9(types, " | "))
           ],
           " "
         )
       },
       EnumTypeExtension: {
-        leave: ({ name, directives, values }) => join7(["extend enum", name, join7(directives, " "), block(values)], " ")
+        leave: ({ name, directives, values }) => join9(["extend enum", name, join9(directives, " "), block(values)], " ")
       },
       InputObjectTypeExtension: {
-        leave: ({ name, directives, fields }) => join7(["extend input", name, join7(directives, " "), block(fields)], " ")
+        leave: ({ name, directives, fields }) => join9(["extend input", name, join9(directives, " "), block(fields)], " ")
       },
       DirectiveExtension: {
-        leave: ({ name, directives }) => join7(["extend directive @" + name, join7(directives, " ")], " ")
+        leave: ({ name, directives }) => join9(["extend directive @" + name, join9(directives, " ")], " ")
       },
       // Schema Coordinates
       TypeCoordinate: {
         leave: ({ name }) => name
       },
       MemberCoordinate: {
-        leave: ({ name, memberName }) => join7([name, wrap(".", memberName)])
+        leave: ({ name, memberName }) => join9([name, wrap(".", memberName)])
       },
       ArgumentCoordinate: {
-        leave: ({ name, fieldName, argumentName }) => join7([name, wrap(".", fieldName), wrap("(", argumentName, ":)")])
+        leave: ({ name, fieldName, argumentName }) => join9([name, wrap(".", fieldName), wrap("(", argumentName, ":)")])
       },
       DirectiveCoordinate: {
-        leave: ({ name }) => join7(["@", name])
+        leave: ({ name }) => join9(["@", name])
       },
       DirectiveArgumentCoordinate: {
-        leave: ({ name, argumentName }) => join7(["@", name, wrap("(", argumentName, ":)")])
+        leave: ({ name, argumentName }) => join9(["@", name, wrap("(", argumentName, ":)")])
       }
     };
-    function join7(maybeArray, separator = "") {
+    function join9(maybeArray, separator = "") {
       var _maybeArray$filter$jo;
       return (_maybeArray$filter$jo = maybeArray === null || maybeArray === void 0 ? void 0 : maybeArray.filter((x) => x).join(separator)) !== null && _maybeArray$filter$jo !== void 0 ? _maybeArray$filter$jo : "";
     }
     function block(array) {
-      return wrap("{\n", indent(join7(array, "\n")), "\n}");
+      return wrap("{\n", indent(join9(array, "\n")), "\n}");
     }
     function wrap(start, maybeString, end = "") {
       return maybeString != null && maybeString !== "" ? start + maybeString + end : "";
@@ -9578,8 +9578,8 @@ var require_printPathArray = __commonJS({
       value: true
     });
     exports.printPathArray = printPathArray;
-    function printPathArray(path2) {
-      return path2.map(
+    function printPathArray(path3) {
+      return path3.map(
         (key) => typeof key === "number" ? "[" + key.toString() + "]" : "." + key
       ).join("");
     }
@@ -9602,9 +9602,9 @@ var require_Path = __commonJS({
         typename
       };
     }
-    function pathToArray(path2) {
+    function pathToArray(path3) {
       const flattened = [];
-      let curr = path2;
+      let curr = path3;
       while (curr) {
         flattened.push(curr.key);
         curr = curr.prev;
@@ -9635,21 +9635,21 @@ var require_coerceInputValue = __commonJS({
     function coerceInputValue(inputValue, type, onError = defaultOnError) {
       return coerceInputValueImpl(inputValue, type, onError, void 0);
     }
-    function defaultOnError(path2, invalidValue, error) {
+    function defaultOnError(path3, invalidValue, error) {
       let errorPrefix = "Invalid value " + (0, _inspect.inspect)(invalidValue);
-      if (path2.length > 0) {
-        errorPrefix += ` at "value${(0, _printPathArray.printPathArray)(path2)}"`;
+      if (path3.length > 0) {
+        errorPrefix += ` at "value${(0, _printPathArray.printPathArray)(path3)}"`;
       }
       error.message = errorPrefix + ": " + error.message;
       throw error;
     }
-    function coerceInputValueImpl(inputValue, type, onError, path2) {
+    function coerceInputValueImpl(inputValue, type, onError, path3) {
       if ((0, _definition.isNonNullType)(type)) {
         if (inputValue != null) {
-          return coerceInputValueImpl(inputValue, type.ofType, onError, path2);
+          return coerceInputValueImpl(inputValue, type.ofType, onError, path3);
         }
         onError(
-          (0, _Path.pathToArray)(path2),
+          (0, _Path.pathToArray)(path3),
           inputValue,
           new _GraphQLError.GraphQLError(
             `Expected non-nullable type "${(0, _inspect.inspect)(
@@ -9666,16 +9666,16 @@ var require_coerceInputValue = __commonJS({
         const itemType = type.ofType;
         if ((0, _isIterableObject.isIterableObject)(inputValue)) {
           return Array.from(inputValue, (itemValue, index) => {
-            const itemPath = (0, _Path.addPath)(path2, index, void 0);
+            const itemPath = (0, _Path.addPath)(path3, index, void 0);
             return coerceInputValueImpl(itemValue, itemType, onError, itemPath);
           });
         }
-        return [coerceInputValueImpl(inputValue, itemType, onError, path2)];
+        return [coerceInputValueImpl(inputValue, itemType, onError, path3)];
       }
       if ((0, _definition.isInputObjectType)(type)) {
         if (!(0, _isObjectLike.isObjectLike)(inputValue) || Array.isArray(inputValue)) {
           onError(
-            (0, _Path.pathToArray)(path2),
+            (0, _Path.pathToArray)(path3),
             inputValue,
             new _GraphQLError.GraphQLError(
               `Expected type "${type.name}" to be an object.`
@@ -9693,7 +9693,7 @@ var require_coerceInputValue = __commonJS({
             } else if ((0, _definition.isNonNullType)(field.type)) {
               const typeStr = (0, _inspect.inspect)(field.type);
               onError(
-                (0, _Path.pathToArray)(path2),
+                (0, _Path.pathToArray)(path3),
                 inputValue,
                 new _GraphQLError.GraphQLError(
                   `Field "${field.name}" of required type "${typeStr}" was not provided.`
@@ -9706,7 +9706,7 @@ var require_coerceInputValue = __commonJS({
             fieldValue,
             field.type,
             onError,
-            (0, _Path.addPath)(path2, field.name, type.name)
+            (0, _Path.addPath)(path3, field.name, type.name)
           );
         }
         for (const fieldName of Object.keys(inputValue)) {
@@ -9716,7 +9716,7 @@ var require_coerceInputValue = __commonJS({
               Object.keys(type.getFields())
             );
             onError(
-              (0, _Path.pathToArray)(path2),
+              (0, _Path.pathToArray)(path3),
               inputValue,
               new _GraphQLError.GraphQLError(
                 `Field "${fieldName}" is not defined by type "${type.name}".` + (0, _didYouMean.didYouMean)(suggestions)
@@ -9728,7 +9728,7 @@ var require_coerceInputValue = __commonJS({
           const keys = Object.keys(coercedValue);
           if (keys.length !== 1) {
             onError(
-              (0, _Path.pathToArray)(path2),
+              (0, _Path.pathToArray)(path3),
               inputValue,
               new _GraphQLError.GraphQLError(
                 `Exactly one key must be specified for OneOf type "${type.name}".`
@@ -9739,7 +9739,7 @@ var require_coerceInputValue = __commonJS({
           const value = coercedValue[key];
           if (value === null) {
             onError(
-              (0, _Path.pathToArray)(path2).concat(key),
+              (0, _Path.pathToArray)(path3).concat(key),
               value,
               new _GraphQLError.GraphQLError(`Field "${key}" must be non-null.`)
             );
@@ -9753,10 +9753,10 @@ var require_coerceInputValue = __commonJS({
           parseResult = type.parseValue(inputValue);
         } catch (error) {
           if (error instanceof _GraphQLError.GraphQLError) {
-            onError((0, _Path.pathToArray)(path2), inputValue, error);
+            onError((0, _Path.pathToArray)(path3), inputValue, error);
           } else {
             onError(
-              (0, _Path.pathToArray)(path2),
+              (0, _Path.pathToArray)(path3),
               inputValue,
               new _GraphQLError.GraphQLError(
                 `Expected type "${type.name}". ` + error.message,
@@ -9770,7 +9770,7 @@ var require_coerceInputValue = __commonJS({
         }
         if (parseResult === void 0) {
           onError(
-            (0, _Path.pathToArray)(path2),
+            (0, _Path.pathToArray)(path3),
             inputValue,
             new _GraphQLError.GraphQLError(`Expected type "${type.name}".`)
           );
@@ -10011,11 +10011,11 @@ var require_values = __commonJS({
         coercedValues[varName] = (0, _coerceInputValue.coerceInputValue)(
           value,
           varType,
-          (path2, invalidValue, error) => {
+          (path3, invalidValue, error) => {
             let prefix = `Variable "$${varName}" got invalid value ` + (0, _inspect.inspect)(invalidValue);
-            if (path2.length > 0) {
+            if (path3.length > 0) {
               prefix += ` at "${varName}${(0, _printPathArray.printPathArray)(
-                path2
+                path3
               )}"`;
             }
             onError(
@@ -11745,7 +11745,7 @@ var require_locatedError = __commonJS({
     exports.locatedError = locatedError;
     var _toError = require_toError();
     var _GraphQLError = require_GraphQLError();
-    function locatedError(rawOriginalError, nodes, path2) {
+    function locatedError(rawOriginalError, nodes, path3) {
       var _nodes;
       const originalError = (0, _toError.toError)(rawOriginalError);
       if (isLocatedGraphQLError(originalError)) {
@@ -11755,7 +11755,7 @@ var require_locatedError = __commonJS({
         nodes: (_nodes = originalError.nodes) !== null && _nodes !== void 0 ? _nodes : nodes,
         source: originalError.source,
         positions: originalError.positions,
-        path: path2,
+        path: path3,
         originalError
       });
     }
@@ -11815,20 +11815,20 @@ var require_execute = __commonJS({
       get errors() {
         return this._errors;
       }
-      add(error, path2) {
-        if (this._hasNulledPosition(path2)) {
+      add(error, path3) {
+        if (this._hasNulledPosition(path3)) {
           return;
         }
-        this._errorPositions.add(path2);
+        this._errorPositions.add(path3);
         this._errors.push(error);
       }
       _hasNulledPosition(startPath) {
-        let path2 = startPath;
-        while (path2 !== void 0) {
-          if (this._errorPositions.has(path2)) {
+        let path3 = startPath;
+        while (path3 !== void 0) {
+          if (this._errorPositions.has(path3)) {
             return true;
           }
-          path2 = path2.prev;
+          path3 = path3.prev;
         }
         return this._errorPositions.has(void 0);
       }
@@ -11977,27 +11977,27 @@ var require_execute = __commonJS({
         rootType,
         operation.selectionSet
       );
-      const path2 = void 0;
+      const path3 = void 0;
       switch (operation.operation) {
         case _ast.OperationTypeNode.QUERY:
-          return executeFields(exeContext, rootType, rootValue, path2, rootFields);
+          return executeFields(exeContext, rootType, rootValue, path3, rootFields);
         case _ast.OperationTypeNode.MUTATION:
           return executeFieldsSerially(
             exeContext,
             rootType,
             rootValue,
-            path2,
+            path3,
             rootFields
           );
         case _ast.OperationTypeNode.SUBSCRIPTION:
-          return executeFields(exeContext, rootType, rootValue, path2, rootFields);
+          return executeFields(exeContext, rootType, rootValue, path3, rootFields);
       }
     }
-    function executeFieldsSerially(exeContext, parentType, sourceValue, path2, fields) {
+    function executeFieldsSerially(exeContext, parentType, sourceValue, path3, fields) {
       return (0, _promiseReduce.promiseReduce)(
         fields.entries(),
         (results, [responseName, fieldNodes]) => {
-          const fieldPath = (0, _Path.addPath)(path2, responseName, parentType.name);
+          const fieldPath = (0, _Path.addPath)(path3, responseName, parentType.name);
           const result = executeField(
             exeContext,
             parentType,
@@ -12020,12 +12020,12 @@ var require_execute = __commonJS({
         /* @__PURE__ */ Object.create(null)
       );
     }
-    function executeFields(exeContext, parentType, sourceValue, path2, fields) {
+    function executeFields(exeContext, parentType, sourceValue, path3, fields) {
       const results = /* @__PURE__ */ Object.create(null);
       let containsPromise = false;
       try {
         for (const [responseName, fieldNodes] of fields.entries()) {
-          const fieldPath = (0, _Path.addPath)(path2, responseName, parentType.name);
+          const fieldPath = (0, _Path.addPath)(path3, responseName, parentType.name);
           const result = executeField(
             exeContext,
             parentType,
@@ -12053,7 +12053,7 @@ var require_execute = __commonJS({
       }
       return (0, _promiseForObject.promiseForObject)(results);
     }
-    function executeField(exeContext, parentType, source, fieldNodes, path2) {
+    function executeField(exeContext, parentType, source, fieldNodes, path3) {
       var _fieldDef$resolve;
       const fieldDef = getFieldDef(exeContext.schema, parentType, fieldNodes[0]);
       if (!fieldDef) {
@@ -12066,7 +12066,7 @@ var require_execute = __commonJS({
         fieldDef,
         fieldNodes,
         parentType,
-        path2
+        path3
       );
       try {
         const args = (0, _values.getArgumentValues)(
@@ -12079,7 +12079,7 @@ var require_execute = __commonJS({
         let completed;
         if ((0, _isPromise.isPromise)(result)) {
           completed = result.then(
-            (resolved) => completeValue(exeContext, returnType, fieldNodes, info, path2, resolved)
+            (resolved) => completeValue(exeContext, returnType, fieldNodes, info, path3, resolved)
           );
         } else {
           completed = completeValue(
@@ -12087,7 +12087,7 @@ var require_execute = __commonJS({
             returnType,
             fieldNodes,
             info,
-            path2,
+            path3,
             result
           );
         }
@@ -12096,9 +12096,9 @@ var require_execute = __commonJS({
             const error = (0, _locatedError.locatedError)(
               rawError,
               fieldNodes,
-              (0, _Path.pathToArray)(path2)
+              (0, _Path.pathToArray)(path3)
             );
-            return handleFieldError(error, returnType, path2, exeContext);
+            return handleFieldError(error, returnType, path3, exeContext);
           });
         }
         return completed;
@@ -12106,18 +12106,18 @@ var require_execute = __commonJS({
         const error = (0, _locatedError.locatedError)(
           rawError,
           fieldNodes,
-          (0, _Path.pathToArray)(path2)
+          (0, _Path.pathToArray)(path3)
         );
-        return handleFieldError(error, returnType, path2, exeContext);
+        return handleFieldError(error, returnType, path3, exeContext);
       }
     }
-    function buildResolveInfo(exeContext, fieldDef, fieldNodes, parentType, path2) {
+    function buildResolveInfo(exeContext, fieldDef, fieldNodes, parentType, path3) {
       return {
         fieldName: fieldDef.name,
         fieldNodes,
         returnType: fieldDef.type,
         parentType,
-        path: path2,
+        path: path3,
         schema: exeContext.schema,
         fragments: exeContext.fragments,
         rootValue: exeContext.rootValue,
@@ -12125,14 +12125,14 @@ var require_execute = __commonJS({
         variableValues: exeContext.variableValues
       };
     }
-    function handleFieldError(error, returnType, path2, exeContext) {
+    function handleFieldError(error, returnType, path3, exeContext) {
       if ((0, _definition.isNonNullType)(returnType)) {
         throw error;
       }
-      exeContext.collectedErrors.add(error, path2);
+      exeContext.collectedErrors.add(error, path3);
       return null;
     }
-    function completeValue(exeContext, returnType, fieldNodes, info, path2, result) {
+    function completeValue(exeContext, returnType, fieldNodes, info, path3, result) {
       if (result instanceof Error) {
         throw result;
       }
@@ -12142,7 +12142,7 @@ var require_execute = __commonJS({
           returnType.ofType,
           fieldNodes,
           info,
-          path2,
+          path3,
           result
         );
         if (completed === null) {
@@ -12161,7 +12161,7 @@ var require_execute = __commonJS({
           returnType,
           fieldNodes,
           info,
-          path2,
+          path3,
           result
         );
       }
@@ -12174,7 +12174,7 @@ var require_execute = __commonJS({
           returnType,
           fieldNodes,
           info,
-          path2,
+          path3,
           result
         );
       }
@@ -12184,7 +12184,7 @@ var require_execute = __commonJS({
           returnType,
           fieldNodes,
           info,
-          path2,
+          path3,
           result
         );
       }
@@ -12193,7 +12193,7 @@ var require_execute = __commonJS({
         "Cannot complete value of unexpected output type: " + (0, _inspect.inspect)(returnType)
       );
     }
-    function completeListValue(exeContext, returnType, fieldNodes, info, path2, result) {
+    function completeListValue(exeContext, returnType, fieldNodes, info, path3, result) {
       if (!(0, _isIterableObject.isIterableObject)(result)) {
         throw new _GraphQLError.GraphQLError(
           `Expected Iterable, but did not find one for field "${info.parentType.name}.${info.fieldName}".`
@@ -12202,7 +12202,7 @@ var require_execute = __commonJS({
       const itemType = returnType.ofType;
       let containsPromise = false;
       const completedResults = Array.from(result, (item, index) => {
-        const itemPath = (0, _Path.addPath)(path2, index, void 0);
+        const itemPath = (0, _Path.addPath)(path3, index, void 0);
         try {
           let completedItem;
           if ((0, _isPromise.isPromise)(item)) {
@@ -12260,7 +12260,7 @@ var require_execute = __commonJS({
       }
       return serializedResult;
     }
-    function completeAbstractValue(exeContext, returnType, fieldNodes, info, path2, result) {
+    function completeAbstractValue(exeContext, returnType, fieldNodes, info, path3, result) {
       var _returnType$resolveTy;
       const resolveTypeFn = (_returnType$resolveTy = returnType.resolveType) !== null && _returnType$resolveTy !== void 0 ? _returnType$resolveTy : exeContext.typeResolver;
       const contextValue = exeContext.contextValue;
@@ -12279,7 +12279,7 @@ var require_execute = __commonJS({
             ),
             fieldNodes,
             info,
-            path2,
+            path3,
             result
           )
         );
@@ -12296,7 +12296,7 @@ var require_execute = __commonJS({
         ),
         fieldNodes,
         info,
-        path2,
+        path3,
         result
       );
     }
@@ -12344,7 +12344,7 @@ var require_execute = __commonJS({
       }
       return runtimeType;
     }
-    function completeObjectValue(exeContext, returnType, fieldNodes, info, path2, result) {
+    function completeObjectValue(exeContext, returnType, fieldNodes, info, path3, result) {
       const subFieldNodes = collectSubfields(exeContext, returnType, fieldNodes);
       if (returnType.isTypeOf) {
         const isTypeOf = returnType.isTypeOf(result, exeContext.contextValue, info);
@@ -12357,7 +12357,7 @@ var require_execute = __commonJS({
               exeContext,
               returnType,
               result,
-              path2,
+              path3,
               subFieldNodes
             );
           });
@@ -12366,7 +12366,7 @@ var require_execute = __commonJS({
           throw invalidReturnTypeError(returnType, result, fieldNodes);
         }
       }
-      return executeFields(exeContext, returnType, result, path2, subFieldNodes);
+      return executeFields(exeContext, returnType, result, path3, subFieldNodes);
     }
     function invalidReturnTypeError(returnType, result, fieldNodes) {
       return new _GraphQLError.GraphQLError(
@@ -12448,7 +12448,7 @@ var require_graphql = __commonJS({
     var _validate2 = require_validate2();
     var _execute = require_execute();
     function graphql(args) {
-      return new Promise((resolve5) => resolve5(graphqlImpl(args)));
+      return new Promise((resolve6) => resolve6(graphqlImpl(args)));
     }
     function graphqlSync(args) {
       const result = graphqlImpl(args);
@@ -13450,13 +13450,13 @@ var require_subscribe = __commonJS({
           }
         );
       }
-      const path2 = (0, _Path.addPath)(void 0, responseName, rootType.name);
+      const path3 = (0, _Path.addPath)(void 0, responseName, rootType.name);
       const info = (0, _execute.buildResolveInfo)(
         exeContext,
         fieldDef,
         fieldNodes,
         rootType,
-        path2
+        path3
       );
       try {
         var _fieldDef$subscribe;
@@ -13476,7 +13476,7 @@ var require_subscribe = __commonJS({
         throw (0, _locatedError.locatedError)(
           error,
           fieldNodes,
-          (0, _Path.pathToArray)(path2)
+          (0, _Path.pathToArray)(path3)
         );
       }
     }
@@ -17797,7 +17797,7 @@ var require_graphql2 = __commonJS({
 });
 
 // src/cli/index.ts
-import { Command as Command15 } from "commander";
+import { Command as Command16 } from "commander";
 
 // src/cli/commands/bootstrap.ts
 import { Command, Option as Option2 } from "commander";
@@ -18319,6 +18319,13 @@ var AssetError = class _AssetError extends CdkdError {
     Object.setPrototypeOf(this, _AssetError.prototype);
   }
 };
+var LocalInvokeBuildError = class _LocalInvokeBuildError extends CdkdError {
+  constructor(message, cause) {
+    super(message, "LOCAL_INVOKE_BUILD_ERROR", cause);
+    this.name = "LocalInvokeBuildError";
+    Object.setPrototypeOf(this, _LocalInvokeBuildError.prototype);
+  }
+};
 var ProvisioningError = class _ProvisioningError extends CdkdError {
   constructor(message, resourceType, logicalId, physicalId, cause) {
     super(message, "PROVISIONING_ERROR", cause);
@@ -18405,6 +18412,13 @@ var StackTerminationProtectionError = class _StackTerminationProtectionError ext
     Object.setPrototypeOf(this, _StackTerminationProtectionError.prototype);
   }
 };
+var RouteDiscoveryError = class _RouteDiscoveryError extends CdkdError {
+  constructor(message, cause) {
+    super(message, "ROUTE_DISCOVERY_ERROR", cause);
+    this.name = "RouteDiscoveryError";
+    Object.setPrototypeOf(this, _RouteDiscoveryError.prototype);
+  }
+};
 function isCdkdError(error) {
   return error instanceof CdkdError;
 }
@@ -18855,7 +18869,7 @@ var IntrinsicFunctionResolver = class {
               this.logger.debug(
                 `VPC ${physicalId} IPv6 CIDR still associating (attempt ${attempt}/${maxAttempts}), waiting...`
               );
-              await new Promise((resolve5) => setTimeout(resolve5, 2e3));
+              await new Promise((resolve6) => setTimeout(resolve6, 2e3));
             }
             this.logger.warn(
               `VPC ${physicalId} IPv6 CIDR did not reach 'associated' state after ${maxAttempts} attempts`
@@ -19740,7 +19754,7 @@ var DagExecutor = class {
   async execute(concurrency, fn, cancelled = () => false) {
     let active = 0;
     const errors = [];
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const dispatch = () => {
         let changed = true;
         while (changed) {
@@ -19802,7 +19816,7 @@ var DagExecutor = class {
             );
             return;
           }
-          resolve5();
+          resolve6();
         }
       };
       dispatch();
@@ -20483,7 +20497,7 @@ Error: ${err.message || "Unknown error"}`,
    * Sleep for specified milliseconds
    */
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Check if a resource type is supported by Cloud Control API
@@ -21217,7 +21231,7 @@ var CustomResourceProvider = class _CustomResourceProvider {
     return result;
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Adopt an existing custom resource into cdkd state.
@@ -21647,7 +21661,7 @@ function isRetryableTransientError(error, message) {
 }
 
 // src/deployment/retry.ts
-var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 async function withRetry(operation, logicalId, opts = {}) {
   const maxRetries = opts.maxRetries ?? 8;
   const initialDelayMs = opts.initialDelayMs ?? 1e3;
@@ -21702,7 +21716,7 @@ function validateOptions(opts) {
 async function withResourceDeadline(operation, opts) {
   validateOptions(opts);
   const startedAt = Date.now();
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     let settled = false;
     let warnTimer;
     let timeoutTimer;
@@ -21742,7 +21756,7 @@ async function withResourceDeadline(operation, opts) {
           return;
         settled = true;
         cleanup();
-        resolve5(value);
+        resolve6(value);
       },
       (err) => {
         if (settled)
@@ -23313,6 +23327,41 @@ var contextOptions = [
     "Set context values (can be specified multiple times)"
   )
 ];
+var IAM_ROLE_ARN_REGEX = /^arn:[^:]+:iam::\d+:role\//;
+function parseAssumeRoleToken(raw, previous) {
+  const acc = previous ?? { perLambda: {} };
+  if (!acc.perLambda)
+    acc.perLambda = {};
+  const eqIndex = raw.indexOf("=");
+  if (eqIndex === -1) {
+    if (!IAM_ROLE_ARN_REGEX.test(raw)) {
+      throw new Error(
+        `Invalid --assume-role value "${raw}": expected an IAM role ARN like arn:aws:iam::123456789012:role/MyRole, or LogicalId=<arn>.`
+      );
+    }
+    acc.globalArn = raw;
+    return acc;
+  }
+  const logicalId = raw.substring(0, eqIndex).trim();
+  const arn = raw.substring(eqIndex + 1).trim();
+  if (!/^[A-Za-z][A-Za-z0-9]*$/.test(logicalId)) {
+    throw new Error(
+      `Invalid --assume-role value "${raw}": left-hand side "${logicalId}" must be a CloudFormation logical ID (alphanumeric, leading letter).`
+    );
+  }
+  if (!IAM_ROLE_ARN_REGEX.test(arn)) {
+    throw new Error(
+      `Invalid --assume-role value "${raw}": right-hand side "${arn}" must be an IAM role ARN like arn:aws:iam::123456789012:role/MyRole.`
+    );
+  }
+  acc.perLambda[logicalId] = arn;
+  return acc;
+}
+function effectiveAssumeRoleArn(logicalId, opt) {
+  if (!opt)
+    return void 0;
+  return opt.perLambda?.[logicalId] ?? opt.globalArn;
+}
 var destroyOptions = [
   new Option("-f, --force", "Do not ask for confirmation before destroying the stacks").default(
     false
@@ -23436,11 +23485,11 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
     return syncResult;
   const logger = getLogger();
   logger.debug("No state bucket specified, resolving default from account...");
-  const { GetCallerIdentityCommand: GetCallerIdentityCommand11 } = await import("@aws-sdk/client-sts");
+  const { GetCallerIdentityCommand: GetCallerIdentityCommand12 } = await import("@aws-sdk/client-sts");
   const { S3Client: S3Client12 } = await import("@aws-sdk/client-s3");
   const { getAwsClients: getAwsClients2 } = await Promise.resolve().then(() => (init_aws_clients(), aws_clients_exports));
   const awsClients = getAwsClients2();
-  const identity = await awsClients.sts.send(new GetCallerIdentityCommand11({}));
+  const identity = await awsClients.sts.send(new GetCallerIdentityCommand12({}));
   const accountId = identity.Account;
   const newName = getDefaultStateBucketName(accountId);
   const legacyName = getLegacyStateBucketName(accountId, region);
@@ -23742,7 +23791,7 @@ var AppExecutor = class {
    * Spawn subprocess and wait for completion
    */
   spawn(commandLine, env) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const proc = spawn(commandLine, {
         stdio: ["ignore", "pipe", "pipe"],
         shell: true,
@@ -23768,7 +23817,7 @@ var AppExecutor = class {
       });
       proc.on("close", (code) => {
         if (code === 0) {
-          resolve5();
+          resolve6();
         } else {
           const stderr = stderrChunks.join("\n");
           reject(
@@ -24480,8 +24529,8 @@ var CcApiContextProvider = class {
   /**
    * Get nested property value using dot notation
    */
-  getNestedProperty(obj, path2) {
-    const parts = path2.split(".");
+  getNestedProperty(obj, path3) {
+    const parts = path3.split(".");
     let current = obj;
     for (const part of parts) {
       if (current === null || current === void 0 || typeof current !== "object") {
@@ -25290,11 +25339,11 @@ var FileAssetPublisher = class {
    */
   async uploadZip(client, dirPath, bucket, key) {
     const archiver = await import("archiver");
-    const body = await new Promise((resolve5, reject) => {
+    const body = await new Promise((resolve6, reject) => {
       const chunks = [];
       const archive = archiver.default("zip", { zlib: { level: 9 } });
       archive.on("data", (chunk) => chunks.push(chunk));
-      archive.on("end", () => resolve5(Buffer.concat(chunks)));
+      archive.on("end", () => resolve6(Buffer.concat(chunks)));
       archive.on("error", reject);
       const stat = statSync2(dirPath);
       if (stat.isDirectory()) {
@@ -25322,14 +25371,57 @@ var FileAssetPublisher = class {
 };
 
 // src/assets/docker-asset-publisher.ts
-import { execFile, spawn as spawn2 } from "node:child_process";
-import { promisify } from "node:util";
+import { execFile as execFile2, spawn as spawn2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
 import {
   ECRClient,
   GetAuthorizationTokenCommand,
   DescribeImagesCommand as DescribeImagesCommand2
 } from "@aws-sdk/client-ecr";
+
+// src/assets/docker-build.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 var execFileAsync = promisify(execFile);
+async function buildDockerImage(asset, cdkOutDir, tag, options) {
+  const logger = getLogger().child("docker-build");
+  const args = ["build", "-t", tag];
+  if (options.platform) {
+    args.push("--platform", options.platform);
+  }
+  if (asset.source.dockerFile) {
+    args.push("-f", asset.source.dockerFile);
+  }
+  if (asset.source.dockerBuildArgs) {
+    for (const [key, value] of Object.entries(asset.source.dockerBuildArgs)) {
+      args.push("--build-arg", `${key}=${value}`);
+    }
+  }
+  if (asset.source.dockerBuildTarget) {
+    args.push("--target", asset.source.dockerBuildTarget);
+  }
+  if (asset.source.dockerOutputs) {
+    for (const output of asset.source.dockerOutputs) {
+      args.push("--output", output);
+    }
+  }
+  const contextDir = `${cdkOutDir}/${asset.source.directory}`;
+  args.push(contextDir);
+  logger.debug(`docker ${args.join(" ")}`);
+  try {
+    await execFileAsync("docker", args, {
+      maxBuffer: 50 * 1024 * 1024
+      // 50MB for build output
+    });
+  } catch (error) {
+    const err = error;
+    const stderr = err.stderr || err.message || String(error);
+    throw options.wrapError(stderr);
+  }
+}
+
+// src/assets/docker-asset-publisher.ts
+var execFileAsync2 = promisify2(execFile2);
 var DockerAssetPublisher = class {
   logger = getLogger().child("DockerAssetPublisher");
   /**
@@ -25412,38 +25504,17 @@ var DockerAssetPublisher = class {
     }
   }
   /**
-   * Build Docker image
+   * Build Docker image — delegates to the shared `buildDockerImage`
+   * helper so this code path stays in sync with `cdkd local invoke`'s
+   * container-Lambda build path. `--platform` is currently not threaded
+   * through here (publish-assets has no Architectures hint to consult);
+   * a follow-up can lift this once the asset manifest carries a
+   * platform field.
    */
   async buildImage(asset, cdkOutputDir, tag) {
-    const args = ["build", "-t", tag];
-    if (asset.source.dockerFile) {
-      args.push("-f", asset.source.dockerFile);
-    }
-    if (asset.source.dockerBuildArgs) {
-      for (const [key, value] of Object.entries(asset.source.dockerBuildArgs)) {
-        args.push("--build-arg", `${key}=${value}`);
-      }
-    }
-    if (asset.source.dockerBuildTarget) {
-      args.push("--target", asset.source.dockerBuildTarget);
-    }
-    if (asset.source.dockerOutputs) {
-      for (const output of asset.source.dockerOutputs) {
-        args.push("--output", output);
-      }
-    }
-    const contextDir = `${cdkOutputDir}/${asset.source.directory}`;
-    args.push(contextDir);
-    this.logger.debug(`docker ${args.join(" ")}`);
-    try {
-      await execFileAsync("docker", args, {
-        maxBuffer: 50 * 1024 * 1024
-        // 50MB for build output
-      });
-    } catch (error) {
-      const err = error;
-      throw new AssetError(`Docker build failed: ${err.stderr || err.message || String(error)}`);
-    }
+    await buildDockerImage(asset, cdkOutputDir, tag, {
+      wrapError: (stderr) => new AssetError(`Docker build failed: ${stderr}`)
+    });
   }
   /**
    * Authenticate with ECR
@@ -25457,7 +25528,7 @@ var DockerAssetPublisher = class {
     const token = Buffer.from(authData.authorizationToken, "base64").toString();
     const [username, password] = token.split(":");
     const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.amazonaws.com`;
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve6, reject) => {
       const proc = spawn2(
         "docker",
         ["login", "--username", username, "--password-stdin", endpoint],
@@ -25471,7 +25542,7 @@ var DockerAssetPublisher = class {
       });
       proc.on("close", (code) => {
         if (code === 0) {
-          resolve5();
+          resolve6();
         } else {
           reject(new AssetError(`ECR login failed: ${stderr.trim()}`));
         }
@@ -25487,7 +25558,7 @@ var DockerAssetPublisher = class {
    * Tag Docker image
    */
   async tagImage(source, target) {
-    await execFileAsync("docker", ["tag", source, target]);
+    await execFileAsync2("docker", ["tag", source, target]);
   }
   /**
    * Push Docker image
@@ -25495,7 +25566,7 @@ var DockerAssetPublisher = class {
   async pushImage(uri) {
     this.logger.debug(`Pushing: ${uri}`);
     try {
-      await execFileAsync("docker", ["push", uri], {
+      await execFileAsync2("docker", ["push", uri], {
         maxBuffer: 50 * 1024 * 1024
       });
     } catch (error) {
@@ -25524,7 +25595,7 @@ var WorkGraph = class {
   async execute(concurrency, fn) {
     const active = { "asset-build": 0, "asset-publish": 0, stack: 0 };
     const errors = [];
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const dispatch = () => {
         const ready = [];
         for (const node of this.nodes.values()) {
@@ -25596,7 +25667,7 @@ ${msg}`
             );
             return;
           }
-          resolve5();
+          resolve6();
         }
       };
       dispatch();
@@ -25718,9 +25789,9 @@ var AssetPublisher = class {
       const region = options.region || process.env["AWS_REGION"] || "us-east-1";
       let accountId = options.accountId;
       if (!accountId) {
-        const { STSClient: STSClient10, GetCallerIdentityCommand: GetCallerIdentityCommand11 } = await import("@aws-sdk/client-sts");
-        const stsClient = new STSClient10({ region });
-        const identity = await stsClient.send(new GetCallerIdentityCommand11({}));
+        const { STSClient: STSClient11, GetCallerIdentityCommand: GetCallerIdentityCommand12 } = await import("@aws-sdk/client-sts");
+        const stsClient = new STSClient11({ region });
+        const identity = await stsClient.send(new GetCallerIdentityCommand12({}));
         accountId = identity.Account;
         stsClient.destroy();
       }
@@ -26587,7 +26658,7 @@ var LockManager = class {
           this.logger.info(
             `Stack '${stackName}' (${region}) is locked by ${lockInfo2.owner}${lockInfo2.operation ? ` (operation: ${lockInfo2.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`
           );
-          await new Promise((resolve5) => setTimeout(resolve5, retryDelay));
+          await new Promise((resolve6) => setTimeout(resolve6, retryDelay));
           continue;
         }
       }
@@ -26835,11 +26906,11 @@ var DagBuilder = class {
     const cycles = [];
     const visited = /* @__PURE__ */ new Set();
     const recursionStack = /* @__PURE__ */ new Set();
-    const path2 = [];
+    const path3 = [];
     const dfs = (node) => {
       visited.add(node);
       recursionStack.add(node);
-      path2.push(node);
+      path3.push(node);
       const successors = graph.successors(node) || [];
       for (const successor of successors) {
         if (!visited.has(successor)) {
@@ -26847,14 +26918,14 @@ var DagBuilder = class {
             return true;
           }
         } else if (recursionStack.has(successor)) {
-          const cycleStart = path2.indexOf(successor);
-          const cycle = path2.slice(cycleStart);
+          const cycleStart = path3.indexOf(successor);
+          const cycle = path3.slice(cycleStart);
           cycle.push(successor);
           cycles.push(cycle);
           return true;
         }
       }
-      path2.pop();
+      path3.pop();
       recursionStack.delete(node);
       return false;
     };
@@ -28882,13 +28953,13 @@ var IAMInstanceProfileProvider = class {
       properties["InstanceProfileName"] || logicalId,
       { maxLength: 128 }
     );
-    const path2 = properties["Path"] || "/";
+    const path3 = properties["Path"] || "/";
     const roles = properties["Roles"];
     try {
       const response = await this.iamClient.send(
         new CreateInstanceProfileCommand({
           InstanceProfileName: instanceProfileName,
-          Path: path2
+          Path: path3
         })
       );
       this.logger.debug(`Created IAM instance profile: ${instanceProfileName}`);
@@ -35081,7 +35152,7 @@ var LambdaFunctionProvider = class {
     return enis;
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Build Lambda Code parameter from CDK properties
@@ -36958,7 +37029,7 @@ var DynamoDBTableProvider = class {
       if (status !== "CREATING") {
         throw new Error(`Unexpected table status: ${status}`);
       }
-      await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+      await new Promise((resolve6) => setTimeout(resolve6, 1e3));
     }
     throw new Error(`Table ${tableName} did not reach ACTIVE status within ${maxAttempts} seconds`);
   }
@@ -36978,7 +37049,7 @@ var DynamoDBTableProvider = class {
       if (status === "ACTIVE") {
         return;
       }
-      await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+      await new Promise((resolve6) => setTimeout(resolve6, 1e3));
     }
     throw new Error(
       `Table ${tableName} did not reach ACTIVE status within ${maxAttempts} seconds after UpdateTable`
@@ -40158,7 +40229,7 @@ var EC2Provider = class {
           this.logger.debug(
             `VPC ${physicalId} has dependencies (attempt ${attempt}/${maxAttempts}), retrying in ${attempt * 5}s...`
           );
-          await new Promise((resolve5) => setTimeout(resolve5, attempt * 5e3));
+          await new Promise((resolve6) => setTimeout(resolve6, attempt * 5e3));
           continue;
         }
         const cause = error instanceof Error ? error : void 0;
@@ -40322,7 +40393,7 @@ var EC2Provider = class {
           this.logger.debug(
             `Subnet ${physicalId} has dependencies (attempt ${attempt}/${maxAttempts}), retrying in ${attempt * 5}s...`
           );
-          await new Promise((resolve5) => setTimeout(resolve5, attempt * 5e3));
+          await new Promise((resolve6) => setTimeout(resolve6, attempt * 5e3));
           continue;
         }
         const cause = error instanceof Error ? error : void 0;
@@ -41080,7 +41151,7 @@ var EC2Provider = class {
           this.logger.debug(
             `SecurityGroup ${physicalId} has dependent objects (attempt ${attempt}/${maxAttempts}), retrying in ${attempt * 5}s...`
           );
-          await new Promise((resolve5) => setTimeout(resolve5, attempt * 5e3));
+          await new Promise((resolve6) => setTimeout(resolve6, attempt * 5e3));
           continue;
         }
         const cause = error instanceof Error ? error : void 0;
@@ -42024,7 +42095,7 @@ var EC2Provider = class {
    * `setTimeout` globally.
    */
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Check if an error indicates the resource was not found
@@ -43305,13 +43376,13 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
       { key: "IdentityValidationExpression", path: "/identityValidationExpression" },
       { key: "AuthorizerResultTtlInSeconds", path: "/authorizerResultTtlInSeconds" }
     ];
-    for (const { key, path: path2 } of primitiveFields) {
+    for (const { key, path: path3 } of primitiveFields) {
       const newVal = properties[key];
       const prevVal = previousProperties[key];
       if (newVal !== prevVal) {
         patchOperations.push({
           op: "replace",
-          path: path2,
+          path: path3,
           value: newVal !== void 0 ? String(newVal) : ""
         });
       }
@@ -43947,13 +44018,13 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
       { key: "OperationName", path: "/operationName" },
       { key: "RequestValidatorId", path: "/requestValidatorId" }
     ];
-    for (const { key, path: path2 } of primitiveFields) {
+    for (const { key, path: path3 } of primitiveFields) {
       const newVal = properties[key];
       const prevVal = previousProperties[key];
       if (newVal !== prevVal) {
         patchOperations.push({
           op: "replace",
-          path: path2,
+          path: path3,
           value: newVal !== void 0 ? String(newVal) : ""
         });
       }
@@ -44124,7 +44195,7 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
    * Sleep for specified milliseconds
    */
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Convert CloudFormation Tags (Array<{Key, Value}>) to SDK tags (Record<string, string>).
@@ -44326,12 +44397,12 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
 function appendMapPatchOps(ops, basePath, next, prev) {
   const escape = (k) => k.replace(/~/g, "~0").replace(/\//g, "~1");
   for (const [key, val] of Object.entries(next)) {
-    const path2 = `${basePath}/${escape(key)}`;
+    const path3 = `${basePath}/${escape(key)}`;
     const stringValue = String(val);
     if (!(key in prev)) {
-      ops.push({ op: "add", path: path2, value: stringValue });
+      ops.push({ op: "add", path: path3, value: stringValue });
     } else if (String(prev[key]) !== stringValue) {
-      ops.push({ op: "replace", path: path2, value: stringValue });
+      ops.push({ op: "replace", path: path3, value: stringValue });
     }
   }
   for (const key of Object.keys(prev)) {
@@ -46016,7 +46087,7 @@ var CloudFrontDistributionProvider = class {
         );
         const sleepEnd = Date.now() + delay2;
         while (Date.now() < sleepEnd && !interrupted) {
-          await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+          await new Promise((resolve6) => setTimeout(resolve6, 1e3));
         }
         delay2 = Math.min(delay2 * 1.5, maxDelay);
       }
@@ -46136,17 +46207,17 @@ var CloudFrontDistributionProvider = class {
   /**
    * Apply Quantity wrapping at a nested path (e.g., "ForwardedValues.Headers").
    */
-  applyQuantityAtPath(obj, path2) {
-    if (path2.length === 0)
+  applyQuantityAtPath(obj, path3) {
+    if (path3.length === 0)
       return;
-    if (path2.length === 1) {
-      const key = path2[0];
+    if (path3.length === 1) {
+      const key = path3[0];
       if (obj[key] !== void 0) {
         obj[key] = this.wrapWithQuantity(obj[key]);
       }
       return;
     }
-    const [head, ...rest] = path2;
+    const [head, ...rest] = path3;
     const headKey = head;
     if (obj[headKey] && typeof obj[headKey] === "object") {
       const nested = { ...obj[headKey] };
@@ -49828,7 +49899,7 @@ var RDSProvider = class {
     throw new Error(`Timed out waiting for DBInstance ${dbInstanceIdentifier} to be deleted`);
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Adopt an existing RDS resource into cdkd state.
@@ -50813,7 +50884,7 @@ var DocDBProvider = class {
     throw new Error(`Timed out waiting for DocDB DBInstance ${dbInstanceIdentifier} to be deleted`);
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Adopt an existing DocDB resource into cdkd state.
@@ -51803,7 +51874,7 @@ var NeptuneProvider = class {
     );
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Adopt an existing Neptune resource into cdkd state.
@@ -54343,7 +54414,7 @@ var ElastiCacheProvider = class {
     throw new Error(`Timed out waiting for CacheCluster ${cacheClusterId} to be deleted`);
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Read the AWS-current ElastiCache resource configuration in CFn-property shape.
@@ -55058,7 +55129,7 @@ var ServiceDiscoveryProvider = class {
           logicalId
         );
       }
-      await new Promise((resolve5) => setTimeout(resolve5, delay2));
+      await new Promise((resolve6) => setTimeout(resolve6, delay2));
       delay2 = Math.min(delay2 * 2, 1e4);
     }
     throw new ProvisioningError(
@@ -59583,7 +59654,7 @@ var KinesisStreamProvider = class {
       if (status !== "CREATING" && status !== "UPDATING") {
         throw new Error(`Unexpected stream status: ${status}`);
       }
-      await new Promise((resolve5) => setTimeout(resolve5, 2e3));
+      await new Promise((resolve6) => setTimeout(resolve6, 2e3));
     }
     throw new Error(
       `Stream ${streamName} did not reach ACTIVE status within ${maxAttempts * 2} seconds`
@@ -59916,7 +59987,7 @@ var KinesisStreamConsumerProvider = class {
       if (status !== "CREATING") {
         throw new Error(`Unexpected consumer status: ${status}`);
       }
-      await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+      await new Promise((resolve6) => setTimeout(resolve6, 1e3));
     }
     throw new Error(
       `Consumer ${consumerArn} did not reach ACTIVE status within ${maxAttempts} seconds`
@@ -60221,7 +60292,7 @@ var EFSProvider = class {
       this.logger.debug(
         `FileSystem ${fileSystemId} state: ${fs?.LifeCycleState ?? "unknown"}, waiting...`
       );
-      await new Promise((resolve5) => setTimeout(resolve5, pollIntervalMs));
+      await new Promise((resolve6) => setTimeout(resolve6, pollIntervalMs));
     }
     throw new ProvisioningError(
       `Timed out waiting for EFS FileSystem ${fileSystemId} to become available (60s)`,
@@ -60299,7 +60370,7 @@ var EFSProvider = class {
       this.logger.debug(
         `MountTarget ${mountTargetId} state: ${mountTarget?.LifeCycleState ?? "unknown"}, waiting...`
       );
-      await new Promise((resolve5) => setTimeout(resolve5, pollIntervalMs));
+      await new Promise((resolve6) => setTimeout(resolve6, pollIntervalMs));
     }
     throw new ProvisioningError(
       `Timed out waiting for EFS MountTarget ${mountTargetId} to become available (120s)`,
@@ -60365,7 +60436,7 @@ var EFSProvider = class {
         }
         throw error;
       }
-      await new Promise((resolve5) => setTimeout(resolve5, pollIntervalMs));
+      await new Promise((resolve6) => setTimeout(resolve6, pollIntervalMs));
     }
     this.logger.warn(
       `Timed out waiting for EFS MountTarget ${mountTargetId} deletion for ${logicalId} (120s)`
@@ -61323,7 +61394,7 @@ var FirehoseProvider = class {
       this.logger.debug(
         `Firehose ${logicalId} status: ${status} (attempt ${attempt}/${maxAttempts})`
       );
-      await new Promise((resolve5) => setTimeout(resolve5, 2e3));
+      await new Promise((resolve6) => setTimeout(resolve6, 2e3));
     }
     this.logger.warn(`Firehose ${logicalId} did not reach ACTIVE after ${maxAttempts} attempts`);
   }
@@ -64793,7 +64864,7 @@ var ASGProvider = class {
     );
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   // ─── Sub-shape diff helpers ───────────────────────────────────────
   // Each helper is a no-op when before/after JSON is identical (the cheap
@@ -65303,11 +65374,11 @@ async function deployCommand(stacks, options) {
         addDependencies(stack.stackName);
       }
     }
-    const { STSClient: STSClient10, GetCallerIdentityCommand: GetCallerIdentityCommand11 } = await import("@aws-sdk/client-sts");
-    const stsClient = new STSClient10({
+    const { STSClient: STSClient11, GetCallerIdentityCommand: GetCallerIdentityCommand12 } = await import("@aws-sdk/client-sts");
+    const stsClient = new STSClient11({
       region: options.region || process.env["AWS_REGION"] || "us-east-1"
     });
-    const callerIdentity = await stsClient.send(new GetCallerIdentityCommand11({}));
+    const callerIdentity = await stsClient.send(new GetCallerIdentityCommand12({}));
     const accountId = callerIdentity.Account;
     stsClient.destroy();
     const assetPublisher = new AssetPublisher();
@@ -65714,29 +65785,29 @@ function calculateResourceDrift(stateProperties, awsProperties, options) {
   }
   return drifts;
 }
-function isIgnoredPath(path2, ignorePaths) {
+function isIgnoredPath(path3, ignorePaths) {
   for (const entry of ignorePaths) {
-    if (path2 === entry)
+    if (path3 === entry)
       return true;
-    if (path2.startsWith(`${entry}.`))
+    if (path3.startsWith(`${entry}.`))
       return true;
   }
   return false;
 }
-function diffAt(path2, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
+function diffAt(path3, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
   if (deepEqual(stateValue, awsValue))
     return;
   if (isPlainObject(stateValue) && isPlainObject(awsValue) && !Array.isArray(stateValue) && !Array.isArray(awsValue)) {
     const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateValue), ...Object.keys(awsValue)]) : Object.keys(stateValue);
     for (const key of keys) {
-      const childPath = `${path2}.${key}`;
+      const childPath = `${path3}.${key}`;
       if (isIgnoredPath(childPath, ignorePaths))
         continue;
       diffAt(childPath, stateValue[key], awsValue[key], out, ignorePaths, unionWalkObjects);
     }
     return;
   }
-  out.push({ path: path2, stateValue, awsValue });
+  out.push({ path: path3, stateValue, awsValue });
 }
 function deepEqual(a, b) {
   if (a === b)
@@ -66139,11 +66210,11 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
     };
   });
 }
-function setAtPath(target, path2, value) {
-  if (path2.length === 0) {
+function setAtPath(target, path3, value) {
+  if (path3.length === 0) {
     return;
   }
-  const segments = path2.split(".");
+  const segments = path3.split(".");
   let cursor = target;
   for (let i = 0; i < segments.length - 1; i++) {
     const key = segments[i];
@@ -66733,7 +66804,7 @@ Acquiring lock for stack ${stackName}...`);
                   logger.debug(
                     `  \u23F3 Retrying delete ${logicalId} in ${delay2 / 1e3}s (attempt ${attempt + 1}/${maxAttempts})`
                   );
-                  await new Promise((resolve5) => setTimeout(resolve5, delay2));
+                  await new Promise((resolve6) => setTimeout(resolve6, delay2));
                 }
               }
               if (lastDeleteError)
@@ -67043,19 +67114,19 @@ function buildCdkPathIndex(template) {
   for (const [logicalId, resource] of Object.entries(template.Resources)) {
     if (resource.Type === "AWS::CDK::Metadata")
       continue;
-    const path2 = readCdkPath(resource);
-    if (path2)
-      index.set(path2, logicalId);
+    const path3 = readCdkPath(resource);
+    if (path3)
+      index.set(path3, logicalId);
   }
   return index;
 }
 function resolveCdkPathToLogicalIds(input, index) {
   const seen = /* @__PURE__ */ new Map();
   const prefix = `${input}/`;
-  for (const [path2, logicalId] of index) {
-    if (path2 === input || path2.startsWith(prefix)) {
+  for (const [path3, logicalId] of index) {
+    if (path3 === input || path3.startsWith(prefix)) {
       if (!seen.has(logicalId))
-        seen.set(logicalId, path2);
+        seen.set(logicalId, path3);
     }
   }
   return [...seen.entries()].map(([logicalId, cdkPath]) => ({ logicalId, cdkPath }));
@@ -67780,9 +67851,9 @@ async function publishAssetsCommand(stacks, options) {
     );
   }
   const baseRegion = options.region || process.env["AWS_REGION"] || "us-east-1";
-  const { STSClient: STSClient10, GetCallerIdentityCommand: GetCallerIdentityCommand11 } = await import("@aws-sdk/client-sts");
-  const stsClient = new STSClient10({ region: baseRegion });
-  const callerIdentity = await stsClient.send(new GetCallerIdentityCommand11({}));
+  const { STSClient: STSClient11, GetCallerIdentityCommand: GetCallerIdentityCommand12 } = await import("@aws-sdk/client-sts");
+  const stsClient = new STSClient11({ region: baseRegion });
+  const callerIdentity = await stsClient.send(new GetCallerIdentityCommand12({}));
   const accountId = callerIdentity.Account;
   stsClient.destroy();
   const assetPublisher = new AssetPublisher();
@@ -69963,12 +70034,13 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 }
 
 // src/cli/commands/local-invoke.ts
-import { mkdtempSync as mkdtempSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import * as path from "node:path";
-import { Command as Command14, Option as Option7 } from "commander";
+import { mkdtempSync as mkdtempSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname3 } from "node:path";
+import * as path2 from "node:path";
+import { Command as Command15, Option as Option8 } from "commander";
 
-// src/local-invoke/lambda-resolver.ts
+// src/local/lambda-resolver.ts
 import { existsSync as existsSync4, statSync as statSync3 } from "node:fs";
 import { dirname, isAbsolute, resolve as resolve4 } from "node:path";
 var LocalInvokeResolutionError = class _LocalInvokeResolutionError extends Error {
@@ -70067,25 +70139,38 @@ function pickStack(parsed, stacks) {
 }
 function extractLambdaProperties(stack, logicalId, resource) {
   const props = resource.Properties ?? {};
-  const runtime = typeof props["Runtime"] === "string" ? props["Runtime"] : "";
-  const handler = typeof props["Handler"] === "string" ? props["Handler"] : "";
   const memoryMb = typeof props["MemorySize"] === "number" ? props["MemorySize"] : 128;
   const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
+  const code = props["Code"] ?? {};
+  const imageUri = extractImageUri(code["ImageUri"]);
+  if (imageUri !== void 0) {
+    return extractImageLambdaProperties({
+      stack,
+      logicalId,
+      resource,
+      memoryMb,
+      timeoutSec,
+      props,
+      imageUri
+    });
+  }
+  const runtime = typeof props["Runtime"] === "string" ? props["Runtime"] : "";
+  const handler = typeof props["Handler"] === "string" ? props["Handler"] : "";
   if (!runtime) {
     throw new LocalInvokeResolutionError(
-      `Lambda '${logicalId}' has no Runtime property. Container-image Lambdas (Code.ImageUri) are not supported in cdkd local invoke v1.`
+      `Lambda '${logicalId}' has no Runtime property and no Code.ImageUri. cdkd cannot tell if this is a ZIP or a container Lambda.`
     );
   }
   if (!handler) {
     throw new LocalInvokeResolutionError(`Lambda '${logicalId}' has no Handler property.`);
   }
-  const code = props["Code"] ?? {};
   const inlineCode = typeof code["ZipFile"] === "string" ? code["ZipFile"] : void 0;
   let codePath = null;
   if (!inlineCode) {
     codePath = resolveAssetCodePath(stack, logicalId, resource);
   }
   return {
+    kind: "zip",
     stack,
     logicalId,
     resource,
@@ -70097,6 +70182,62 @@ function extractLambdaProperties(stack, logicalId, resource) {
     ...inlineCode !== void 0 && { inlineCode }
   };
 }
+function extractImageUri(value) {
+  if (typeof value === "string" && value.length > 0)
+    return value;
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const obj = value;
+    const sub = obj["Fn::Sub"];
+    if (typeof sub === "string" && sub.length > 0)
+      return sub;
+    if (Array.isArray(sub) && typeof sub[0] === "string")
+      return sub[0];
+  }
+  return void 0;
+}
+function extractImageLambdaProperties(args) {
+  const { stack, logicalId, resource, memoryMb, timeoutSec, props, imageUri } = args;
+  const rawImageConfig = props["ImageConfig"] ?? {};
+  const imageConfig = {};
+  if (Array.isArray(rawImageConfig["Command"])) {
+    imageConfig.command = rawImageConfig["Command"].filter(
+      (s) => typeof s === "string"
+    );
+  }
+  if (Array.isArray(rawImageConfig["EntryPoint"])) {
+    imageConfig.entryPoint = rawImageConfig["EntryPoint"].filter(
+      (s) => typeof s === "string"
+    );
+  }
+  if (typeof rawImageConfig["WorkingDirectory"] === "string") {
+    imageConfig.workingDirectory = rawImageConfig["WorkingDirectory"];
+  }
+  const arches = props["Architectures"];
+  let architecture = "x86_64";
+  if (Array.isArray(arches) && arches.length > 0) {
+    const first = arches[0];
+    if (first === "arm64")
+      architecture = "arm64";
+    else if (first === "x86_64")
+      architecture = "x86_64";
+    else {
+      throw new LocalInvokeResolutionError(
+        `Lambda '${logicalId}' has unsupported Architectures value '${String(first)}'. cdkd local invoke supports x86_64 and arm64.`
+      );
+    }
+  }
+  return {
+    kind: "image",
+    stack,
+    logicalId,
+    resource,
+    memoryMb,
+    timeoutSec,
+    imageUri,
+    imageConfig,
+    architecture
+  };
+}
 function resolveAssetCodePath(stack, logicalId, resource) {
   const meta = resource.Metadata;
   const assetPath = meta?.["aws:asset:path"];
@@ -70140,7 +70281,7 @@ function notFoundError(target, stack, resources) {
   return new LocalInvokeResolutionError(msg.trimEnd());
 }
 
-// src/local-invoke/env-resolver.ts
+// src/local/env-resolver.ts
 function resolveEnvVars(logicalId, templateEnv, overrides) {
   const resolved = {};
   const unresolved = [];
@@ -70177,7 +70318,7 @@ function isLiteralEnvValue(value) {
   return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
 }
 
-// src/local-invoke/state-resolver.ts
+// src/local/state-resolver.ts
 function substituteAgainstState(value, resources) {
   if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
     return { kind: "literal", value };
@@ -70354,7 +70495,7 @@ function substituteEnvVarsFromState(templateEnv, resources) {
   return { env, audit };
 }
 
-// src/local-invoke/runtime-image.ts
+// src/local/runtime-image.ts
 var SUPPORTED_RUNTIMES = {
   "nodejs18.x": { image: "public.ecr.aws/lambda/nodejs:18", fileExtension: ".js" },
   "nodejs20.x": { image: "public.ecr.aws/lambda/nodejs:20", fileExtension: ".js" },
@@ -70381,7 +70522,7 @@ function resolveRuntimeSpec(runtime) {
   if (typeof runtime !== "string" || runtime.length === 0) {
     throw new UnsupportedRuntimeError(
       String(runtime),
-      "Lambda function has no Runtime property. Container-image Lambdas (Code.ImageUri) are not supported in cdkd local invoke v1."
+      "Lambda function has no Runtime property. This branch is only reached for ZIP Lambdas; container-image Lambdas (Code.ImageUri) take a different code path that does not consult the Runtime property."
     );
   }
   const spec = SUPPORTED_RUNTIMES[runtime];
@@ -70399,11 +70540,11 @@ function resolveRuntimeSpec(runtime) {
   );
 }
 
-// src/local-invoke/docker-runner.ts
-import { execFile as execFile2, spawn as spawn3 } from "node:child_process";
+// src/local/docker-runner.ts
+import { execFile as execFile3, spawn as spawn3 } from "node:child_process";
 import { createServer } from "node:net";
-import { promisify as promisify2 } from "node:util";
-var execFileAsync2 = promisify2(execFile2);
+import { promisify as promisify3 } from "node:util";
+var execFileAsync3 = promisify3(execFile3);
 var DockerRunnerError = class _DockerRunnerError extends Error {
   constructor(message) {
     super(message);
@@ -70422,6 +70563,12 @@ async function pullImage(image, skipPull) {
 }
 async function runDetached(opts) {
   const args = ["run", "-d", "--rm"];
+  if (opts.name) {
+    args.push("--name", opts.name);
+  }
+  if (opts.platform) {
+    args.push("--platform", opts.platform);
+  }
   const host = opts.host ?? "127.0.0.1";
   args.push("-p", `${host}:${opts.hostPort}:8080`);
   if (opts.debugPort !== void 0) {
@@ -70434,11 +70581,19 @@ async function runDetached(opts) {
   for (const [k, v] of Object.entries(opts.env)) {
     args.push("-e", `${k}=${v}`);
   }
-  args.push(opts.image, ...opts.cmd);
+  if (opts.workingDir) {
+    args.push("--workdir", opts.workingDir);
+  }
+  let entryPointTail = [];
+  if (opts.entryPoint && opts.entryPoint.length > 0) {
+    args.push("--entrypoint", opts.entryPoint[0]);
+    entryPointTail = opts.entryPoint.slice(1);
+  }
+  args.push(opts.image, ...entryPointTail, ...opts.cmd);
   const logger = getLogger().child("docker");
-  logger.debug(`docker ${args.join(" ")}`);
+  logger.debug(`docker ${redactAwsCredentialsInArgs(args).join(" ")}`);
   try {
-    const { stdout } = await execFileAsync2("docker", args, {
+    const { stdout } = await execFileAsync3("docker", args, {
       maxBuffer: 10 * 1024 * 1024
     });
     return stdout.trim();
@@ -70467,7 +70622,7 @@ async function removeContainer(containerId) {
     return;
   const logger = getLogger().child("docker");
   try {
-    await execFileAsync2("docker", ["rm", "-f", containerId]);
+    await execFileAsync3("docker", ["rm", "-f", containerId]);
     logger.debug(`Removed container ${containerId}`);
   } catch (error) {
     const err = error;
@@ -70478,7 +70633,7 @@ async function removeContainer(containerId) {
 }
 async function ensureDockerAvailable() {
   try {
-    await execFileAsync2("docker", ["version", "--format", "{{.Server.Version}}"]);
+    await execFileAsync3("docker", ["version", "--format", "{{.Server.Version}}"]);
   } catch (error) {
     const err = error;
     if (err.code === "ENOENT") {
@@ -70508,6 +70663,31 @@ function pickFreePort() {
     });
   });
 }
+var REDACTED_ENV_KEYS = /* @__PURE__ */ new Set([
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN"
+]);
+function redactAwsCredentialsInArgs(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    const cur = args[i];
+    const next = args[i + 1];
+    if (cur === "-e" && typeof next === "string") {
+      const eqIdx = next.indexOf("=");
+      if (eqIdx > 0) {
+        const key = next.substring(0, eqIdx);
+        if (REDACTED_ENV_KEYS.has(key)) {
+          out.push("-e", `${key}=***`);
+          i++;
+          continue;
+        }
+      }
+    }
+    out.push(cur);
+  }
+  return out;
+}
 function runForeground(cmd, args) {
   return new Promise((resolveProc, rejectProc) => {
     const proc = spawn3(cmd, args, { stdio: "inherit" });
@@ -70521,7 +70701,164 @@ function runForeground(cmd, args) {
   });
 }
 
-// src/local-invoke/rie-client.ts
+// src/local/docker-image-builder.ts
+import { createHash as createHash2 } from "node:crypto";
+async function buildContainerImage(asset, cdkOutDir, options) {
+  const tag = computeLocalTag(asset.source);
+  const platform = architectureToPlatform(options.architecture);
+  const logger = getLogger().child("local-invoke-build");
+  logger.info(`Building container image (platform=${platform})...`);
+  logger.debug(`Local tag: ${tag}`);
+  await buildDockerImage(asset, cdkOutDir, tag, {
+    platform,
+    wrapError: (stderr) => new LocalInvokeBuildError(
+      `docker build failed for container Lambda asset (${asset.source.directory}): ${stderr}`
+    )
+  });
+  return tag;
+}
+function architectureToPlatform(architecture) {
+  return architecture === "arm64" ? "linux/arm64" : "linux/amd64";
+}
+function computeLocalTag(source) {
+  const hash = createHash2("sha256");
+  hash.update(source.directory);
+  hash.update("\0");
+  hash.update(source.dockerFile ?? "");
+  hash.update("\0");
+  hash.update(source.dockerBuildTarget ?? "");
+  hash.update("\0");
+  if (source.dockerBuildArgs) {
+    for (const [k, v] of Object.entries(source.dockerBuildArgs)) {
+      hash.update(k);
+      hash.update("=");
+      hash.update(v);
+      hash.update("\0");
+    }
+  }
+  return `cdkd-local-invoke-${hash.digest("hex").slice(0, 16)}`;
+}
+
+// src/local/ecr-puller.ts
+import { execFile as execFile4, spawn as spawn4 } from "node:child_process";
+import { promisify as promisify4 } from "node:util";
+import { ECRClient as ECRClient3, GetAuthorizationTokenCommand as GetAuthorizationTokenCommand2 } from "@aws-sdk/client-ecr";
+import { GetCallerIdentityCommand as GetCallerIdentityCommand11, STSClient as STSClient10 } from "@aws-sdk/client-sts";
+var execFileAsync4 = promisify4(execFile4);
+var ECR_URI_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.amazonaws\.com(?:\.cn)?\/([^:]+):(.+)$/;
+function parseEcrUri(imageUri) {
+  const m = ECR_URI_REGEX.exec(imageUri);
+  if (!m)
+    return void 0;
+  return {
+    accountId: m[1],
+    region: m[2],
+    repository: m[3],
+    tag: m[4]
+  };
+}
+async function pullEcrImage(imageUri, options) {
+  const logger = getLogger().child("ecr-puller");
+  const parsed = parseEcrUri(imageUri);
+  if (!parsed) {
+    throw new LocalInvokeBuildError(
+      `Image URI '${imageUri}' is not an ECR URI. cdkd local invoke v1 only authenticates against ECR for the deployed-image fallback path.`
+    );
+  }
+  const sts = new STSClient10({ region: parsed.region });
+  let callerAccount;
+  try {
+    const identity = await sts.send(new GetCallerIdentityCommand11({}));
+    if (!identity.Account) {
+      throw new LocalInvokeBuildError(
+        "STS GetCallerIdentity returned no Account. Verify your AWS credentials."
+      );
+    }
+    callerAccount = identity.Account;
+  } finally {
+    sts.destroy();
+  }
+  if (callerAccount !== parsed.accountId) {
+    throw new LocalInvokeBuildError(
+      `Image URI '${imageUri}' is in account ${parsed.accountId}, but the caller is ${callerAccount}. Cross-account ECR pull is not supported in cdkd local invoke v1 \u2014 deferred to a follow-up PR. Workaround: assume a role in the target account before invoking, or build the image locally with \`cdkd local invoke -a cdk.out\` (no ECR pull).`
+    );
+  }
+  const callerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
+  if (callerRegion && callerRegion !== parsed.region) {
+    throw new LocalInvokeBuildError(
+      `Image URI '${imageUri}' is in region ${parsed.region}, but the caller's region is ${callerRegion}. Cross-region ECR pull is not supported in cdkd local invoke v1 \u2014 deferred to a follow-up PR. Workaround: re-run with AWS_REGION=${parsed.region} set, or build the image locally with -a cdk.out.`
+    );
+  }
+  if (options.skipPull) {
+    logger.info(`Skipping ECR pull (--no-pull). Verifying ${imageUri} is in local cache...`);
+    await verifyImageInLocalCache(imageUri);
+    return imageUri;
+  }
+  const ecr = new ECRClient3({ region: parsed.region });
+  try {
+    await ecrLogin(ecr, parsed.accountId, parsed.region);
+  } finally {
+    ecr.destroy();
+  }
+  logger.info(`Pulling ${imageUri}...`);
+  await runForeground2("docker", ["pull", imageUri]);
+  return imageUri;
+}
+async function ecrLogin(client, accountId, region) {
+  const logger = getLogger().child("ecr-puller");
+  logger.debug(`ECR login (account=${accountId}, region=${region})`);
+  const response = await client.send(new GetAuthorizationTokenCommand2({}));
+  const authData = response.authorizationData?.[0];
+  if (!authData?.authorizationToken) {
+    throw new LocalInvokeBuildError("Failed to get ECR authorization token");
+  }
+  const token = Buffer.from(authData.authorizationToken, "base64").toString();
+  const [username, password] = token.split(":");
+  const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.amazonaws.com`;
+  await new Promise((resolve6, reject) => {
+    const proc = spawn4("docker", ["login", "--username", username, "--password-stdin", endpoint], {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stderr = "";
+    proc.stderr?.on("data", (data) => {
+      stderr += data.toString();
+    });
+    proc.on("close", (code) => {
+      if (code === 0)
+        resolve6();
+      else
+        reject(new LocalInvokeBuildError(`ECR login failed: ${stderr.trim()}`));
+    });
+    proc.on("error", (err) => {
+      reject(new LocalInvokeBuildError(`ECR login failed: ${err.message}`));
+    });
+    proc.stdin?.write(password);
+    proc.stdin?.end();
+  });
+}
+async function verifyImageInLocalCache(imageUri) {
+  try {
+    await execFileAsync4("docker", ["image", "inspect", imageUri]);
+  } catch {
+    throw new LocalInvokeBuildError(
+      `Image '${imageUri}' is not in the local docker cache and --no-pull was set. Either remove --no-pull (cdkd will pull from ECR) or pre-pull the image manually with \`docker pull\`.`
+    );
+  }
+}
+function runForeground2(cmd, args) {
+  return new Promise((resolve6, reject) => {
+    const proc = spawn4(cmd, args, { stdio: "inherit" });
+    proc.on("error", (err) => reject(new LocalInvokeBuildError(`${cmd} failed: ${err.message}`)));
+    proc.on("close", (code) => {
+      if (code === 0)
+        resolve6();
+      else
+        reject(new LocalInvokeBuildError(`${cmd} exited with code ${code}`));
+    });
+  });
+}
+
+// src/local/rie-client.ts
 import { setTimeout as delay } from "node:timers/promises";
 var INVOKE_PATH = "/2015-03-31/functions/function/invocations";
 async function waitForRieReady(host, port, timeoutMs = 5e3) {
@@ -70630,9 +70967,1301 @@ async function fetchWithStartupRetry(url, body, signal) {
   throw lastError;
 }
 
+// src/assets/asset-manifest-loader.ts
+import { readFile } from "fs/promises";
+import { join as join6 } from "path";
+var AssetManifestLoader = class {
+  logger = getLogger().child("AssetManifestLoader");
+  /**
+   * Load asset manifest from CDK output directory
+   *
+   * @param cdkOutputDir CDK output directory (e.g., "cdk.out")
+   * @param stackName Stack name
+   * @returns Asset manifest or null if not found
+   */
+  async loadManifest(cdkOutputDir, stackName) {
+    const manifestPath = join6(cdkOutputDir, `${stackName}.assets.json`);
+    try {
+      this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
+      const content = await readFile(manifestPath, "utf-8");
+      const manifest = JSON.parse(content);
+      this.logger.debug(
+        `Loaded asset manifest: ${Object.keys(manifest.files).length} file assets, ${Object.keys(manifest.dockerImages).length} docker image assets`
+      );
+      return manifest;
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        this.logger.debug(`Asset manifest not found: ${manifestPath}`);
+        return null;
+      }
+      throw new Error(
+        `Failed to load asset manifest from ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  /**
+   * Get file assets from manifest (excludes CloudFormation templates)
+   *
+   * @param manifest Asset manifest
+   * @returns Map of asset hash to file asset
+   */
+  getFileAssets(manifest) {
+    const fileAssets = /* @__PURE__ */ new Map();
+    for (const [assetHash, asset] of Object.entries(manifest.files)) {
+      if (asset.source.path.endsWith(".json") || asset.source.path.endsWith(".template.json")) {
+        this.logger.debug(`Skipping CloudFormation template asset: ${asset.displayName}`);
+        continue;
+      }
+      fileAssets.set(assetHash, asset);
+    }
+    this.logger.debug(`Found ${fileAssets.size} file assets (excluding templates)`);
+    return fileAssets;
+  }
+  /**
+   * Get asset source path (absolute path)
+   *
+   * @param cdkOutputDir CDK output directory
+   * @param asset File asset
+   * @returns Absolute path to asset source
+   */
+  getAssetSourcePath(cdkOutputDir, asset) {
+    return join6(cdkOutputDir, asset.source.path);
+  }
+  /**
+   * Resolve asset destination values (replace ${AWS::AccountId}, ${AWS::Region}, etc.)
+   *
+   * @param value Value with placeholders
+   * @param accountId AWS account ID
+   * @param region AWS region
+   * @param partition AWS partition (default: "aws")
+   * @returns Resolved value
+   */
+  resolveAssetDestinationValue(value, accountId, region, partition = "aws") {
+    return value.replace(/\$\{AWS::AccountId\}/g, accountId).replace(/\$\{AWS::Region\}/g, region).replace(/\$\{AWS::Partition\}/g, partition);
+  }
+};
+function getDockerImageBySourceHash(manifest, imageUri) {
+  const dockerImages = manifest.dockerImages ?? {};
+  const entries = Object.entries(dockerImages);
+  if (entries.length === 0)
+    return void 0;
+  const hash = extractHashFromImageUri(imageUri);
+  if (hash !== void 0) {
+    const asset = dockerImages[hash];
+    if (asset) {
+      return { hash, asset };
+    }
+  }
+  if (entries.length === 1) {
+    const [singleHash, singleAsset] = entries[0];
+    return { hash: singleHash, asset: singleAsset };
+  }
+  return void 0;
+}
+function extractHashFromImageUri(imageUri) {
+  if (imageUri.includes("@sha256:"))
+    return void 0;
+  const match = /:([a-f0-9]{8,})$/.exec(imageUri);
+  return match?.[1];
+}
+
 // src/cli/commands/local-invoke.ts
 init_aws_clients();
-async function localInvokeCommand(target, options) {
+
+// src/cli/commands/local-start-api.ts
+import { mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import * as path from "node:path";
+import { Command as Command14, Option as Option7 } from "commander";
+
+// src/local/route-discovery.ts
+function discoverRoutes(stacks) {
+  const routes = [];
+  const errors = [];
+  for (const stack of stacks) {
+    const template = stack.template;
+    const resources = template.Resources ?? {};
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      try {
+        switch (resource.Type) {
+          case "AWS::ApiGateway::Method":
+            routes.push(...discoverRestV1Method(logicalId, resource, template, stack.stackName));
+            break;
+          case "AWS::ApiGatewayV2::Route":
+            routes.push(...discoverHttpApiRoute(logicalId, resource, template, stack.stackName));
+            break;
+          case "AWS::Lambda::Url":
+            routes.push(...discoverFunctionUrl(logicalId, resource, stack.stackName));
+            break;
+          default:
+            break;
+        }
+      } catch (err) {
+        errors.push(err instanceof Error ? err.message : String(err));
+      }
+    }
+  }
+  if (errors.length > 0) {
+    throw new RouteDiscoveryError(
+      `cdkd local start-api: ${errors.length} unsupported route(s) in the synthesized template:
+` + errors.map((e) => `  - ${e}`).join("\n")
+    );
+  }
+  return routes;
+}
+function discoverRestV1Method(logicalId, resource, template, stackName) {
+  const props = resource.Properties ?? {};
+  const integration = props["Integration"];
+  if (!integration) {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGateway::Method): missing Integration property`
+    );
+  }
+  const integrationType = integration["Type"];
+  if (integrationType !== "AWS_PROXY") {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGateway::Method): integration type '${String(
+        integrationType
+      )}' is not supported (only AWS_PROXY). MOCK / AWS / HTTP / HTTP_PROXY require mapping templates that cdkd cannot emulate.`
+    );
+  }
+  const integrationUri = integration["Uri"];
+  const lambdaLogicalId = resolveLambdaArnIntrinsic(
+    integrationUri,
+    `${stackName}/${logicalId}.Integration.Uri`
+  );
+  const restApiId = props["RestApiId"];
+  const restApiLogicalId = pickRefLogicalId(restApiId);
+  if (!restApiLogicalId) {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGateway::Method): RestApiId must be a { Ref: '...' } reference (got ${shortJson(
+        restApiId
+      )}).`
+    );
+  }
+  const resourceId = props["ResourceId"];
+  const path3 = buildRestV1Path(resourceId, restApiLogicalId, template, stackName, logicalId);
+  const httpMethod = String(props["HttpMethod"] ?? "ANY");
+  const stage = pickRestV1Stage(restApiLogicalId, template);
+  return [
+    {
+      method: httpMethod,
+      pathPattern: path3,
+      lambdaLogicalId,
+      source: "rest-v1",
+      apiVersion: "v1",
+      stage,
+      declaredAt: `${stackName}/${logicalId}`
+    }
+  ];
+}
+function buildRestV1Path(resourceIdIntrinsic, restApiLogicalId, template, stackName, methodLogicalId) {
+  if (resourceIdIntrinsic && typeof resourceIdIntrinsic === "object" && !Array.isArray(resourceIdIntrinsic)) {
+    const obj = resourceIdIntrinsic;
+    if ("Fn::GetAtt" in obj) {
+      const arg = obj["Fn::GetAtt"];
+      if (Array.isArray(arg) && arg.length === 2 && arg[1] === "RootResourceId") {
+        return "/";
+      }
+    }
+  }
+  const resourceLogicalId = pickRefLogicalId(resourceIdIntrinsic);
+  if (!resourceLogicalId) {
+    throw new Error(
+      `${stackName}/${methodLogicalId}: ResourceId must be { Ref: '...' } or { 'Fn::GetAtt': [..., 'RootResourceId'] } (got ${shortJson(
+        resourceIdIntrinsic
+      )}).`
+    );
+  }
+  const segments = [];
+  const visited = /* @__PURE__ */ new Set();
+  let cursor = resourceLogicalId;
+  while (cursor && cursor !== restApiLogicalId) {
+    if (visited.has(cursor)) {
+      throw new Error(
+        `${stackName}/${methodLogicalId}: cycle detected in AWS::ApiGateway::Resource ParentId chain at ${cursor}`
+      );
+    }
+    visited.add(cursor);
+    const node = template.Resources?.[cursor];
+    if (!node) {
+      throw new Error(
+        `${stackName}/${methodLogicalId}: ParentId chain references missing resource '${cursor}'`
+      );
+    }
+    if (node.Type !== "AWS::ApiGateway::Resource") {
+      throw new Error(
+        `${stackName}/${methodLogicalId}: ParentId chain hit ${node.Type} (expected AWS::ApiGateway::Resource or RestApi root)`
+      );
+    }
+    const nodeProps = node.Properties ?? {};
+    const pathPart = nodeProps["PathPart"];
+    if (typeof pathPart !== "string") {
+      throw new Error(
+        `${stackName}/${methodLogicalId}: AWS::ApiGateway::Resource '${cursor}' missing PathPart`
+      );
+    }
+    segments.unshift(pathPart);
+    const parentId = nodeProps["ParentId"];
+    if (parentId && typeof parentId === "object" && !Array.isArray(parentId) && "Fn::GetAtt" in parentId) {
+      const arg = parentId["Fn::GetAtt"];
+      if (Array.isArray(arg) && arg[1] === "RootResourceId")
+        break;
+    }
+    cursor = pickRefLogicalId(parentId) ?? void 0;
+  }
+  return "/" + segments.join("/");
+}
+function pickRestV1Stage(restApiLogicalId, template) {
+  const resources = template.Resources ?? {};
+  for (const [, resource] of Object.entries(resources)) {
+    if (resource.Type !== "AWS::ApiGateway::Stage")
+      continue;
+    const props = resource.Properties ?? {};
+    const ref = pickRefLogicalId(props["RestApiId"]);
+    if (ref === restApiLogicalId) {
+      const stageName = props["StageName"];
+      if (typeof stageName === "string")
+        return stageName;
+    }
+  }
+  return "$default";
+}
+function discoverHttpApiRoute(logicalId, resource, template, stackName) {
+  const props = resource.Properties ?? {};
+  const apiId = props["ApiId"];
+  const apiLogicalId = pickRefLogicalId(apiId);
+  if (!apiLogicalId) {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): ApiId must be { Ref: '...' } (got ${shortJson(
+        apiId
+      )}).`
+    );
+  }
+  const apiResource = template.Resources?.[apiLogicalId];
+  if (apiResource?.Type === "AWS::ApiGatewayV2::Api") {
+    const protocolType = (apiResource.Properties ?? {})["ProtocolType"];
+    if (protocolType === "WEBSOCKET") {
+      throw new Error(
+        `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): WebSocket APIs are not supported in cdkd local start-api (deferred follow-up PR).`
+      );
+    }
+  }
+  const routeKey = props["RouteKey"];
+  if (typeof routeKey !== "string" || routeKey.length === 0) {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): RouteKey must be a string`
+    );
+  }
+  const target = props["Target"];
+  const integrationLogicalId = parseHttpApiTargetIntegration(
+    target,
+    `${stackName}/${logicalId}.Target`
+  );
+  const integration = template.Resources?.[integrationLogicalId];
+  if (!integration || integration.Type !== "AWS::ApiGatewayV2::Integration") {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): Target points at '${integrationLogicalId}' which is not an AWS::ApiGatewayV2::Integration`
+    );
+  }
+  const integrationProps = integration.Properties ?? {};
+  const integrationType = integrationProps["IntegrationType"];
+  if (integrationType !== "AWS_PROXY") {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): integration type '${String(
+        integrationType
+      )}' is not supported (only AWS_PROXY).`
+    );
+  }
+  if (integrationProps["IntegrationSubtype"] !== void 0) {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): IntegrationSubtype '${String(
+        integrationProps["IntegrationSubtype"]
+      )}' is not supported (ApiGatewayV2 service integrations like SQS/EventBridge cannot run locally).`
+    );
+  }
+  const lambdaLogicalId = resolveLambdaArnIntrinsic(
+    integrationProps["IntegrationUri"],
+    `${stackName}/${integrationLogicalId}.IntegrationUri`
+  );
+  const { method, pathPattern } = parseRouteKey(routeKey);
+  return [
+    {
+      method,
+      pathPattern,
+      lambdaLogicalId,
+      source: "http-api",
+      apiVersion: "v2",
+      stage: "$default",
+      declaredAt: `${stackName}/${logicalId}`
+    }
+  ];
+}
+function discoverFunctionUrl(logicalId, resource, stackName) {
+  const props = resource.Properties ?? {};
+  const authType = props["AuthType"];
+  if (authType !== "NONE") {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::Lambda::Url): AuthType '${String(
+        authType
+      )}' is not supported (only NONE \u2014 IAM auth requires SigV4 verification cdkd cannot emulate locally; deferred follow-up PR).`
+    );
+  }
+  const invokeMode = props["InvokeMode"];
+  if (invokeMode === "RESPONSE_STREAM") {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::Lambda::Url): InvokeMode RESPONSE_STREAM is not supported (deferred follow-up PR).`
+    );
+  }
+  const targetArn = props["TargetFunctionArn"];
+  const lambdaLogicalId = resolveLambdaArnIntrinsic(
+    targetArn,
+    `${stackName}/${logicalId}.TargetFunctionArn`
+  );
+  return [
+    {
+      method: "ANY",
+      pathPattern: "/{proxy+}",
+      lambdaLogicalId,
+      source: "function-url",
+      apiVersion: "v2",
+      stage: "$default",
+      declaredAt: `${stackName}/${logicalId}`
+    }
+  ];
+}
+function resolveLambdaArnIntrinsic(value, location) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const obj = value;
+    if ("Ref" in obj && typeof obj["Ref"] === "string") {
+      return obj["Ref"];
+    }
+    if ("Fn::GetAtt" in obj) {
+      const arg = obj["Fn::GetAtt"];
+      if (Array.isArray(arg) && arg.length === 2 && typeof arg[0] === "string" && arg[1] === "Arn") {
+        return arg[0];
+      }
+    }
+    if ("Fn::Join" in obj) {
+      const join9 = obj["Fn::Join"];
+      if (Array.isArray(join9) && join9.length === 2 && Array.isArray(join9[1])) {
+        const parts = join9[1];
+        const literalParts = parts.filter((p) => typeof p === "string").join("");
+        if (literalParts.includes(":lambda:path/2015-03-31/functions/")) {
+          for (const p of parts) {
+            if (p && typeof p === "object" && !Array.isArray(p)) {
+              const inner = p;
+              const arg = inner["Fn::GetAtt"];
+              if (Array.isArray(arg) && arg.length === 2 && typeof arg[0] === "string" && arg[1] === "Arn") {
+                return arg[0];
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  throw new Error(
+    `${location}: only { Ref: <LambdaLogicalId> }, { 'Fn::GetAtt': [<LambdaLogicalId>, 'Arn'] }, or the REST v1 invoke-ARN Fn::Join wrapper are supported (got ${shortJson(
+      value
+    )}). Other intrinsics (Fn::Sub against arbitrary templates, etc.) require deploy-state and are not supported in cdkd local start-api.`
+  );
+}
+function parseHttpApiTargetIntegration(target, location) {
+  if (typeof target === "string") {
+    const m = /^integrations\/(.+)$/.exec(target);
+    if (m)
+      return m[1];
+    throw new Error(`${location}: literal Target '${target}' must start with 'integrations/'`);
+  }
+  if (target && typeof target === "object" && !Array.isArray(target)) {
+    const obj = target;
+    const join9 = obj["Fn::Join"];
+    if (Array.isArray(join9) && join9.length === 2 && Array.isArray(join9[1])) {
+      const sep = join9[0];
+      const parts = join9[1];
+      if (sep === "/" && parts.length === 2 && parts[0] === "integrations") {
+        const ref = pickRefLogicalId(parts[1]);
+        if (ref)
+          return ref;
+      }
+      if (sep === "" && parts.length === 2 && parts[0] === "integrations/") {
+        const ref = pickRefLogicalId(parts[1]);
+        if (ref)
+          return ref;
+      }
+    }
+  }
+  throw new Error(
+    `${location}: Target must be 'integrations/<id>' or Fn::Join with one of the documented shapes (got ${shortJson(
+      target
+    )}).`
+  );
+}
+function parseRouteKey(routeKey) {
+  if (routeKey === "$default") {
+    return { method: "ANY", pathPattern: "$default" };
+  }
+  const m = /^([A-Za-z]+)\s+(\S+)$/.exec(routeKey);
+  if (!m) {
+    throw new Error(
+      `RouteKey '${routeKey}' is malformed: expected '<METHOD> <path>' (e.g. 'GET /items/{id}') or '$default'.`
+    );
+  }
+  return { method: m[1].toUpperCase(), pathPattern: m[2] };
+}
+function pickRefLogicalId(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const ref = value["Ref"];
+    if (typeof ref === "string")
+      return ref;
+  }
+  return null;
+}
+function shortJson(value) {
+  try {
+    const s = JSON.stringify(value);
+    return s.length > 200 ? `${s.slice(0, 200)}\u2026` : s;
+  } catch {
+    return String(value);
+  }
+}
+
+// src/local/container-pool.ts
+var DEFAULT_IDLE_MS = 6e4;
+var MAX_PER_LAMBDA_CONCURRENCY = 4;
+var MIN_PER_LAMBDA_CONCURRENCY = 1;
+function createContainerPool(specs, options) {
+  const logger = getLogger().child("container-pool");
+  const concurrencyCap = clampConcurrency(options.perLambdaConcurrency);
+  const idleMs = options.idleMs ?? DEFAULT_IDLE_MS;
+  const streamingEnabled = options.streamLogs !== false;
+  const entries = /* @__PURE__ */ new Map();
+  const inFlightStarts = /* @__PURE__ */ new Set();
+  for (const logicalId of specs.keys()) {
+    entries.set(logicalId, emptyEntry(logicalId));
+  }
+  function emptyEntry(logicalId) {
+    return {
+      logicalId,
+      warm: [],
+      inUse: /* @__PURE__ */ new Set(),
+      waitQueue: [],
+      idleTimer: null,
+      growthMutex: Promise.resolve()
+    };
+  }
+  async function startOne(spec) {
+    const image = resolveRuntimeImage(spec.lambda.runtime);
+    const hostPort = await pickFreePort();
+    const name = `cdkd-local-${spec.lambda.logicalId}-${process.pid}-${Math.floor(
+      Math.random() * 1e6
+    )}`;
+    logger.debug(
+      `Starting container ${name} for ${spec.lambda.logicalId} on ${spec.containerHost}:${hostPort}`
+    );
+    const containerId = await runDetached({
+      image,
+      mounts: [{ hostPath: spec.codeDir, containerPath: "/var/task", readOnly: true }],
+      env: spec.env,
+      cmd: [spec.lambda.handler],
+      hostPort,
+      host: spec.containerHost,
+      name,
+      ...spec.debugPort !== void 0 && { debugPort: spec.debugPort }
+    });
+    const stopLogStream = streamingEnabled ? streamLogs(containerId) : () => void 0;
+    try {
+      await waitForRieReady(spec.containerHost, hostPort, 3e4);
+    } catch (err) {
+      stopLogStream();
+      await removeContainer(containerId).catch(() => void 0);
+      throw err;
+    }
+    return {
+      logicalId: spec.lambda.logicalId,
+      containerId,
+      containerName: name,
+      hostPort,
+      containerHost: spec.containerHost,
+      stopLogStream
+    };
+  }
+  async function withMutex(entry, body) {
+    const previous = entry.growthMutex;
+    let release;
+    entry.growthMutex = new Promise((r) => release = r);
+    try {
+      await previous;
+      return await body();
+    } finally {
+      release();
+    }
+  }
+  async function tearDown(handle) {
+    try {
+      handle.stopLogStream();
+    } catch (err) {
+      logger.debug(
+        `stopLogStream(${handle.containerName}) failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    try {
+      await removeContainer(handle.containerId);
+    } catch (err) {
+      logger.warn(
+        `Failed to remove container ${handle.containerName}: ${err instanceof Error ? err.message : String(err)}. Continuing cleanup.`
+      );
+    }
+  }
+  function poolSize(entry) {
+    return entry.warm.length + entry.inUse.size;
+  }
+  function resetIdleTimer(entry) {
+    if (entry.idleTimer) {
+      clearTimeout(entry.idleTimer);
+      entry.idleTimer = null;
+    }
+    if (entry.warm.length === 0)
+      return;
+    entry.idleTimer = setTimeout(() => {
+      void gcIdle(entry);
+    }, idleMs);
+    entry.idleTimer.unref?.();
+  }
+  async function gcIdle(entry) {
+    const handles = entry.warm.splice(0, entry.warm.length);
+    entry.idleTimer = null;
+    if (handles.length === 0)
+      return;
+    logger.debug(`Idle GC: tearing down ${handles.length} container(s) for ${entry.logicalId}`);
+    await Promise.allSettled(handles.map((h) => tearDown(h)));
+  }
+  return {
+    async acquire(logicalId) {
+      const entry = entries.get(logicalId);
+      if (!entry) {
+        throw new Error(
+          `containerPool.acquire: no spec registered for Lambda '${logicalId}'. This is a bug \u2014 every reachable route's Lambda should be registered at server boot.`
+        );
+      }
+      if (entry.warm.length > 0) {
+        const handle = entry.warm.shift();
+        entry.inUse.add(handle);
+        if (entry.idleTimer) {
+          clearTimeout(entry.idleTimer);
+          entry.idleTimer = null;
+        }
+        return handle;
+      }
+      return await withMutex(entry, async () => {
+        if (entry.warm.length > 0) {
+          const handle = entry.warm.shift();
+          entry.inUse.add(handle);
+          return handle;
+        }
+        if (poolSize(entry) < concurrencyCap) {
+          const spec = specs.get(logicalId);
+          const startPromise = startOne(spec);
+          inFlightStarts.add(startPromise);
+          let handle;
+          try {
+            handle = await startPromise;
+          } finally {
+            inFlightStarts.delete(startPromise);
+          }
+          entry.inUse.add(handle);
+          return handle;
+        }
+        return await new Promise((resolveAcquire, rejectAcquire) => {
+          entry.waitQueue.push({ resolve: resolveAcquire, reject: rejectAcquire });
+        });
+      });
+    },
+    release(handle) {
+      const entry = entries.get(handle.logicalId);
+      if (!entry)
+        return;
+      entry.inUse.delete(handle);
+      const waiter = entry.waitQueue.shift();
+      if (waiter) {
+        entry.inUse.add(handle);
+        waiter.resolve(handle);
+        return;
+      }
+      entry.warm.push(handle);
+      resetIdleTimer(entry);
+    },
+    async dispose() {
+      logger.debug("Disposing container pool");
+      const allHandles = [];
+      for (const entry of entries.values()) {
+        if (entry.idleTimer) {
+          clearTimeout(entry.idleTimer);
+          entry.idleTimer = null;
+        }
+        for (const waiter of entry.waitQueue.splice(0, entry.waitQueue.length)) {
+          try {
+            waiter.reject(
+              new Error(`Container pool disposed while ${entry.logicalId} was waiting`)
+            );
+          } catch {
+          }
+        }
+        allHandles.push(...entry.warm.splice(0, entry.warm.length));
+        for (const h of entry.inUse)
+          allHandles.push(h);
+        entry.inUse.clear();
+      }
+      const startPromises = [...inFlightStarts];
+      if (startPromises.length > 0) {
+        logger.debug(
+          `Waiting for ${startPromises.length} in-flight container start(s) to settle before teardown`
+        );
+        const drainTimeoutMs = 5e3;
+        const wrapped = startPromises.map(
+          (p) => Promise.race([
+            p.then((h) => ({ kind: "ok", handle: h })),
+            new Promise((r) => {
+              const t = setTimeout(() => r({ kind: "timeout" }), drainTimeoutMs);
+              t.unref?.();
+            })
+          ]).catch((err) => {
+            logger.debug(
+              `In-flight startOne rejected during dispose: ${err instanceof Error ? err.message : String(err)}`
+            );
+            return { kind: "rejected" };
+          })
+        );
+        const results = await Promise.all(wrapped);
+        let timedOut = 0;
+        for (const r of results) {
+          if (r.kind === "ok") {
+            allHandles.push(r.handle);
+          } else if (r.kind === "timeout") {
+            timedOut++;
+          }
+        }
+        if (timedOut > 0) {
+          logger.warn(
+            `Container pool disposed with ${timedOut} in-flight start(s) still pending after ${drainTimeoutMs}ms; relying on docker --rm + the verify.sh sweep to clean up.`
+          );
+        }
+        inFlightStarts.clear();
+      }
+      await Promise.allSettled(allHandles.map((h) => tearDown(h)));
+      entries.clear();
+    }
+  };
+}
+function clampConcurrency(input) {
+  if (!Number.isFinite(input))
+    return 2;
+  return Math.min(
+    MAX_PER_LAMBDA_CONCURRENCY,
+    Math.max(MIN_PER_LAMBDA_CONCURRENCY, Math.trunc(input))
+  );
+}
+
+// src/local/http-server.ts
+import { createServer as createServer2 } from "node:http";
+
+// src/local/api-gateway-event.ts
+import { randomUUID } from "node:crypto";
+var MOCK_ACCOUNT_ID = "123456789012";
+var MOCK_DOMAIN_PREFIX = "local";
+var MOCK_DOMAIN_NAME = "localhost";
+var MOCK_API_ID = "local";
+function buildHttpApiV2Event(req, ctx, opts = {}) {
+  const { rawPath, rawQueryString } = splitRawUrl(req.rawUrl);
+  const { headers, cookies } = normalizeHeadersV2(req.headers);
+  const queryStringParameters = parseQueryStringV2(rawQueryString);
+  const userAgent = headers["user-agent"] ?? "";
+  const contentType = headers["content-type"] ?? "";
+  const { body, isBase64Encoded } = encodeBody(req.body, contentType);
+  const now = opts.now ? opts.now() : /* @__PURE__ */ new Date();
+  const routeKey = ctx.route.pathPattern === "$default" ? "$default" : `${ctx.route.method} ${ctx.route.pathPattern}`;
+  const event = {
+    version: "2.0",
+    routeKey,
+    rawPath,
+    rawQueryString,
+    cookies,
+    headers,
+    queryStringParameters,
+    pathParameters: decodePathParameters(ctx.pathParameters),
+    stageVariables: null,
+    requestContext: {
+      accountId: MOCK_ACCOUNT_ID,
+      apiId: MOCK_API_ID,
+      domainName: MOCK_DOMAIN_NAME,
+      domainPrefix: MOCK_DOMAIN_PREFIX,
+      http: {
+        method: req.method.toUpperCase(),
+        path: ctx.matchedPath,
+        protocol: "HTTP/1.1",
+        sourceIp: req.sourceIp ?? "127.0.0.1",
+        userAgent
+      },
+      requestId: randomUUID(),
+      routeKey,
+      stage: ctx.route.stage,
+      time: formatRequestTime(now),
+      timeEpoch: now.getTime(),
+      authentication: null,
+      authorizer: null
+    },
+    body,
+    isBase64Encoded
+  };
+  return event;
+}
+function buildRestV1Event(req, ctx, opts = {}) {
+  const { rawPath, rawQueryString } = splitRawUrl(req.rawUrl);
+  const { singular: headers, multi: multiValueHeaders } = normalizeHeadersV1(req.headers);
+  const { singular: queryStringParameters, multi: multiValueQueryStringParameters } = parseQueryStringV1(rawQueryString);
+  const contentType = headers["content-type"] ?? "";
+  const { body, isBase64Encoded } = encodeBody(req.body, contentType);
+  const now = opts.now ? opts.now() : /* @__PURE__ */ new Date();
+  const pathParams = decodePathParameters(ctx.pathParameters);
+  const event = {
+    resource: ctx.route.pathPattern,
+    path: ctx.matchedPath,
+    httpMethod: req.method.toUpperCase(),
+    headers,
+    multiValueHeaders,
+    queryStringParameters: Object.keys(queryStringParameters).length > 0 ? queryStringParameters : null,
+    multiValueQueryStringParameters: Object.keys(multiValueQueryStringParameters).length > 0 ? multiValueQueryStringParameters : null,
+    pathParameters: Object.keys(pathParams).length > 0 ? pathParams : null,
+    stageVariables: null,
+    requestContext: {
+      accountId: MOCK_ACCOUNT_ID,
+      apiId: MOCK_API_ID,
+      domainName: MOCK_DOMAIN_NAME,
+      domainPrefix: MOCK_DOMAIN_PREFIX,
+      httpMethod: req.method.toUpperCase(),
+      identity: {
+        sourceIp: req.sourceIp ?? "127.0.0.1",
+        userAgent: headers["user-agent"] ?? ""
+      },
+      path: `/${ctx.route.stage}${ctx.matchedPath}`,
+      protocol: "HTTP/1.1",
+      requestId: randomUUID(),
+      requestTime: formatRequestTime(now),
+      requestTimeEpoch: now.getTime(),
+      resourcePath: ctx.route.pathPattern,
+      stage: ctx.route.stage,
+      authorizer: null
+    },
+    body: req.body.length === 0 ? null : body,
+    isBase64Encoded
+  };
+  return event;
+}
+function splitRawUrl(rawUrl) {
+  const q = rawUrl.indexOf("?");
+  if (q === -1)
+    return { rawPath: rawUrl, rawQueryString: "" };
+  return { rawPath: rawUrl.slice(0, q), rawQueryString: rawUrl.slice(q + 1) };
+}
+function normalizeHeadersV2(rawHeaders) {
+  const headers = {};
+  let cookies = [];
+  for (const [name, values] of Object.entries(rawHeaders)) {
+    const lower = name.toLowerCase();
+    if (lower === "cookie") {
+      cookies = values.flatMap((v) => v.split(";")).map((s) => s.trim()).filter((s) => s.length > 0);
+      continue;
+    }
+    headers[lower] = values.join(",");
+  }
+  return { headers, cookies };
+}
+function normalizeHeadersV1(rawHeaders) {
+  const singular = {};
+  const multi = {};
+  for (const [name, values] of Object.entries(rawHeaders)) {
+    const lower = name.toLowerCase();
+    if (values.length === 0)
+      continue;
+    multi[lower] = [...values];
+    singular[lower] = values[values.length - 1];
+  }
+  return { singular, multi };
+}
+function parseQueryStringV2(rawQueryString) {
+  if (rawQueryString.length === 0)
+    return {};
+  const out = {};
+  for (const pair of rawQueryString.split("&")) {
+    if (pair.length === 0)
+      continue;
+    const eq = pair.indexOf("=");
+    const rawKey = eq === -1 ? pair : pair.slice(0, eq);
+    const rawValue = eq === -1 ? "" : pair.slice(eq + 1);
+    const key = safeDecode(rawKey);
+    const value = safeDecode(rawValue);
+    if (!out[key])
+      out[key] = [];
+    out[key].push(value);
+  }
+  const result = {};
+  for (const [k, vs] of Object.entries(out))
+    result[k] = vs.join(",");
+  return result;
+}
+function parseQueryStringV1(rawQueryString) {
+  const multi = {};
+  if (rawQueryString.length > 0) {
+    for (const pair of rawQueryString.split("&")) {
+      if (pair.length === 0)
+        continue;
+      const eq = pair.indexOf("=");
+      const rawKey = eq === -1 ? pair : pair.slice(0, eq);
+      const rawValue = eq === -1 ? "" : pair.slice(eq + 1);
+      const key = safeDecode(rawKey);
+      const value = safeDecode(rawValue);
+      if (!multi[key])
+        multi[key] = [];
+      multi[key].push(value);
+    }
+  }
+  const singular = {};
+  for (const [k, vs] of Object.entries(multi)) {
+    if (vs.length > 0)
+      singular[k] = vs[vs.length - 1];
+  }
+  return { singular, multi };
+}
+function decodePathParameters(pathParameters) {
+  const out = {};
+  for (const [k, v] of Object.entries(pathParameters)) {
+    out[k] = safeDecode(v);
+  }
+  return out;
+}
+function safeDecode(s) {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return s;
+  }
+}
+function encodeBody(body, contentType) {
+  if (body.length === 0) {
+    return { body: "", isBase64Encoded: false };
+  }
+  if (isTextualContentType(contentType)) {
+    return { body: body.toString("utf-8"), isBase64Encoded: false };
+  }
+  return { body: body.toString("base64"), isBase64Encoded: true };
+}
+var TEXT_PREFIXES = [
+  "text/",
+  "application/json",
+  "application/xml",
+  "application/javascript",
+  "application/x-www-form-urlencoded",
+  "application/graphql"
+];
+function isTextualContentType(contentType) {
+  if (!contentType)
+    return false;
+  const lower = contentType.toLowerCase();
+  return TEXT_PREFIXES.some((p) => lower.startsWith(p));
+}
+function formatRequestTime(d) {
+  const months = [
+    "Jan",
+    "Feb",
+    "Mar",
+    "Apr",
+    "May",
+    "Jun",
+    "Jul",
+    "Aug",
+    "Sep",
+    "Oct",
+    "Nov",
+    "Dec"
+  ];
+  const dd = String(d.getUTCDate()).padStart(2, "0");
+  const mmm = months[d.getUTCMonth()];
+  const yyyy = d.getUTCFullYear();
+  const HH = String(d.getUTCHours()).padStart(2, "0");
+  const MM = String(d.getUTCMinutes()).padStart(2, "0");
+  const SS = String(d.getUTCSeconds()).padStart(2, "0");
+  return `${dd}/${mmm}/${yyyy}:${HH}:${MM}:${SS} +0000`;
+}
+
+// src/local/api-gateway-response.ts
+function translateLambdaResponse(payload, version) {
+  if (isErrorEnvelope(payload)) {
+    return errorEnvelopeResponse();
+  }
+  if (isShapedResponse(payload)) {
+    return translateShapedResponse(payload, version);
+  }
+  return autoFormatResponse(payload);
+}
+function isErrorEnvelope(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return false;
+  const obj = payload;
+  if ("statusCode" in obj)
+    return false;
+  return typeof obj["errorMessage"] === "string";
+}
+function isShapedResponse(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return false;
+  const status = payload["statusCode"];
+  return typeof status === "number";
+}
+function errorEnvelopeResponse() {
+  const body = Buffer.from('{"message":"Internal server error"}', "utf-8");
+  return {
+    statusCode: 502,
+    headers: {
+      "content-type": "application/json",
+      "content-length": String(body.length)
+    },
+    cookies: [],
+    body
+  };
+}
+function translateShapedResponse(payload, version) {
+  const statusCode = Number(payload["statusCode"]);
+  const isBase64 = payload["isBase64Encoded"] === true;
+  const rawBody = payload["body"];
+  let body;
+  if (rawBody === void 0 || rawBody === null) {
+    body = Buffer.alloc(0);
+  } else if (typeof rawBody === "string") {
+    body = isBase64 ? Buffer.from(rawBody, "base64") : Buffer.from(rawBody, "utf-8");
+  } else {
+    body = Buffer.from(JSON.stringify(rawBody), "utf-8");
+  }
+  const headers = {};
+  const cookies = [];
+  const headersIn = payload["headers"];
+  if (headersIn && typeof headersIn === "object" && !Array.isArray(headersIn)) {
+    for (const [name, value] of Object.entries(headersIn)) {
+      const lower = name.toLowerCase();
+      const stringValue = stringifyHeaderValue(value);
+      if (lower === "set-cookie") {
+        cookies.push(stringValue);
+        continue;
+      }
+      headers[lower] = stringValue;
+    }
+  }
+  if (version === "v1") {
+    const mvh = payload["multiValueHeaders"];
+    if (mvh && typeof mvh === "object" && !Array.isArray(mvh)) {
+      for (const [name, values] of Object.entries(mvh)) {
+        if (!Array.isArray(values))
+          continue;
+        const lower = name.toLowerCase();
+        const stringified = values.map((v) => stringifyHeaderValue(v));
+        if (lower === "set-cookie") {
+          for (const c of stringified)
+            cookies.push(c);
+          continue;
+        }
+        headers[lower] = stringified.join(",");
+      }
+    }
+  }
+  if (version === "v2") {
+    const cookieList = payload["cookies"];
+    if (Array.isArray(cookieList)) {
+      for (const c of cookieList) {
+        if (typeof c === "string")
+          cookies.push(c);
+      }
+    }
+  }
+  if (!("content-length" in headers)) {
+    headers["content-length"] = String(body.length);
+  }
+  return { statusCode, headers, cookies, body };
+}
+function autoFormatResponse(payload) {
+  const body = payload === void 0 ? Buffer.alloc(0) : Buffer.from(JSON.stringify(payload), "utf-8");
+  return {
+    statusCode: 200,
+    headers: {
+      "content-type": "application/json",
+      "content-length": String(body.length)
+    },
+    cookies: [],
+    body
+  };
+}
+function stringifyHeaderValue(value) {
+  if (value === null || value === void 0)
+    return "";
+  if (Array.isArray(value))
+    return value.map((v) => String(v)).join(",");
+  return String(value);
+}
+
+// src/local/route-matcher.ts
+function matchRoute(method, requestPath, routes) {
+  const methodUpper = method.toUpperCase();
+  const normalizedPath = requestPath.length > 1 ? requestPath.replace(/\/+$/, "") : requestPath;
+  const requestSegments = splitPath(normalizedPath);
+  let bestFull = null;
+  for (const route of routes) {
+    if (!methodMatches(route.method, methodUpper))
+      continue;
+    if (route.pathPattern === "$default")
+      continue;
+    if (isProxyRoute(route.pathPattern))
+      continue;
+    const result = matchFullPattern(requestSegments, route.pathPattern);
+    if (!result)
+      continue;
+    if (!bestFull || result.literalCount > bestFull.literalCount) {
+      bestFull = {
+        route,
+        pathParameters: result.pathParameters,
+        literalCount: result.literalCount
+      };
+    }
+  }
+  if (bestFull)
+    return { route: bestFull.route, pathParameters: bestFull.pathParameters };
+  let bestProxy = null;
+  for (const route of routes) {
+    if (!methodMatches(route.method, methodUpper))
+      continue;
+    if (route.pathPattern === "$default")
+      continue;
+    if (!isProxyRoute(route.pathPattern))
+      continue;
+    const result = matchProxyPattern(requestSegments, route.pathPattern);
+    if (!result)
+      continue;
+    if (!bestProxy || result.literalCount > bestProxy.literalCount) {
+      bestProxy = {
+        route,
+        pathParameters: result.pathParameters,
+        literalCount: result.literalCount
+      };
+    }
+  }
+  if (bestProxy)
+    return { route: bestProxy.route, pathParameters: bestProxy.pathParameters };
+  for (const route of routes) {
+    if (!methodMatches(route.method, methodUpper))
+      continue;
+    if (route.pathPattern === "$default")
+      return { route, pathParameters: {} };
+  }
+  return null;
+}
+function splitPath(path3) {
+  return path3.split("/").filter((s) => s.length > 0);
+}
+function methodMatches(routeMethod, requestMethodUpper) {
+  if (routeMethod === "ANY")
+    return true;
+  return routeMethod.toUpperCase() === requestMethodUpper;
+}
+function isProxyRoute(pattern) {
+  return /\/\{[^/{}]+\+\}$/.test(pattern) || pattern === "/{proxy+}";
+}
+function matchFullPattern(requestSegments, pattern) {
+  const patternSegments = splitPath(pattern);
+  if (patternSegments.length !== requestSegments.length)
+    return null;
+  const pathParameters = {};
+  let literalCount = 0;
+  for (let i = 0; i < patternSegments.length; i++) {
+    const ps = patternSegments[i];
+    const rs = requestSegments[i];
+    if (isPlaceholder(ps)) {
+      const name = ps.slice(1, -1);
+      pathParameters[name] = rs;
+    } else if (ps === rs) {
+      literalCount++;
+    } else {
+      return null;
+    }
+  }
+  return { pathParameters, literalCount };
+}
+function matchProxyPattern(requestSegments, pattern) {
+  const patternSegments = splitPath(pattern);
+  if (patternSegments.length === 0)
+    return null;
+  const tail = patternSegments[patternSegments.length - 1];
+  if (!/^\{[^/{}]+\+\}$/.test(tail))
+    return null;
+  const proxyName = tail.slice(1, -2);
+  const fixedPrefixLen = patternSegments.length - 1;
+  if (requestSegments.length < fixedPrefixLen)
+    return null;
+  const pathParameters = {};
+  let literalCount = 0;
+  for (let i = 0; i < fixedPrefixLen; i++) {
+    const ps = patternSegments[i];
+    const rs = requestSegments[i];
+    if (isPlaceholder(ps)) {
+      pathParameters[ps.slice(1, -1)] = rs;
+    } else if (ps === rs) {
+      literalCount++;
+    } else {
+      return null;
+    }
+  }
+  pathParameters[proxyName] = requestSegments.slice(fixedPrefixLen).join("/");
+  return { pathParameters, literalCount };
+}
+function isPlaceholder(segment) {
+  return /^\{[^/{}+]+\}$/.test(segment);
+}
+
+// src/local/http-server.ts
+async function startApiServer(opts) {
+  const logger = getLogger().child("start-api");
+  const server = createServer2((req, res) => {
+    handleRequest(req, res, opts).catch((err) => {
+      logger.error(
+        `Unhandled request error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`
+      );
+      if (!res.headersSent) {
+        writeError(res, 502);
+      }
+    });
+  });
+  server.on("connection", (socket) => {
+    socket.setNoDelay(true);
+  });
+  const { actualPort, actualHost } = await new Promise(
+    (resolveListen, rejectListen) => {
+      server.once("error", rejectListen);
+      server.listen(opts.port, opts.host, () => {
+        const addr = server.address();
+        if (addr === null || typeof addr === "string") {
+          rejectListen(new Error("Could not determine listening address"));
+          return;
+        }
+        resolveListen({ actualPort: addr.port, actualHost: opts.host });
+      });
+    }
+  );
+  let closed = false;
+  return {
+    port: actualPort,
+    host: actualHost,
+    server,
+    close: async () => {
+      if (closed)
+        return;
+      closed = true;
+      await new Promise((resolveClose) => {
+        server.close(() => resolveClose());
+        server.closeAllConnections?.();
+      });
+    }
+  };
+}
+async function handleRequest(req, res, opts) {
+  const logger = getLogger().child("start-api");
+  const bodyBuf = await readBody(req);
+  const rawUrl = req.url ?? "/";
+  const method = (req.method ?? "GET").toUpperCase();
+  const requestPath = rawUrl.split("?")[0] ?? "/";
+  const match = matchRoute(method, requestPath, opts.routes);
+  if (!match) {
+    writeError(res, 404, '{"message":"Not Found"}');
+    return;
+  }
+  const snapshot = {
+    method,
+    rawUrl,
+    headers: collectHeaders(req),
+    body: bodyBuf,
+    ...req.socket.remoteAddress !== void 0 && { sourceIp: req.socket.remoteAddress }
+  };
+  const matchCtx = {
+    route: match.route,
+    pathParameters: match.pathParameters,
+    matchedPath: requestPath
+  };
+  const event = match.route.apiVersion === "v1" ? buildRestV1Event(snapshot, matchCtx) : buildHttpApiV2Event(snapshot, matchCtx);
+  let handle;
+  try {
+    handle = await opts.pool.acquire(match.route.lambdaLogicalId);
+  } catch (err) {
+    logger.error(
+      `Failed to acquire container for ${match.route.lambdaLogicalId}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    writeError(res, 502);
+    return;
+  }
+  try {
+    const invokeResult = await invokeRie(
+      handle.containerHost,
+      handle.hostPort,
+      event,
+      opts.rieTimeoutMs
+    );
+    const translated = translateLambdaResponse(invokeResult.payload, match.route.apiVersion);
+    res.statusCode = translated.statusCode;
+    for (const [name, value] of Object.entries(translated.headers)) {
+      res.setHeader(name, value);
+    }
+    if (translated.cookies.length > 0) {
+      res.setHeader("set-cookie", translated.cookies);
+    }
+    res.end(translated.body);
+  } catch (err) {
+    logger.error(
+      `RIE invoke failed for ${match.route.lambdaLogicalId}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    if (!res.headersSent) {
+      writeError(res, 502);
+    } else {
+      res.end();
+    }
+  } finally {
+    opts.pool.release(handle);
+  }
+}
+function readBody(req) {
+  return new Promise((resolveBody, rejectBody) => {
+    const chunks = [];
+    req.on("data", (chunk) => {
+      chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    });
+    req.on("end", () => resolveBody(Buffer.concat(chunks)));
+    req.on("error", rejectBody);
+  });
+}
+function collectHeaders(req) {
+  const out = {};
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (Array.isArray(value)) {
+      out[name] = value;
+    } else if (typeof value === "string") {
+      out[name] = [value];
+    }
+  }
+  return out;
+}
+function writeError(res, statusCode, body = '{"message":"Internal server error"}') {
+  res.statusCode = statusCode;
+  res.setHeader("content-type", "application/json");
+  res.setHeader("content-length", String(Buffer.byteLength(body, "utf-8")));
+  res.end(body);
+}
+
+// src/cli/commands/local-start-api.ts
+async function localStartApiCommand(options) {
   const logger = getLogger();
   if (options.verbose) {
     logger.setLevel("debug");
@@ -70655,15 +72284,469 @@ async function localInvokeCommand(target, options) {
     ...Object.keys(context).length > 0 && { context }
   };
   const { stacks } = await synthesizer.synthesize(synthOpts);
-  const lambda = resolveLambdaTarget(target, stacks);
-  logger.info(`Target: ${lambda.stack.stackName}/${lambda.logicalId} (${lambda.runtime})`);
+  const targetStacks = pickTargetStacks(stacks, options.stack);
+  if (targetStacks.length === 0) {
+    throw new Error("No stacks matched. Pass --stack <name> or run from a single-stack app.");
+  }
+  const routes = discoverRoutes(targetStacks);
+  if (routes.length === 0) {
+    throw new Error(
+      "No supported API routes were discovered. cdkd local start-api supports AWS::ApiGateway::* (REST v1), AWS::ApiGatewayV2::* (HTTP), and AWS::Lambda::Url (Function URL) with AWS_PROXY integrations only."
+    );
+  }
+  const lambdaIds = uniqueLambdaIds(routes);
+  const overrides = readEnvOverridesFile(options.envVars);
+  const debugPortBase = options.debugPortBase ? parseDebugPort(options.debugPortBase) : void 0;
+  const specs = /* @__PURE__ */ new Map();
+  const inlineTmpDirs = /* @__PURE__ */ new Set();
+  for (let i = 0; i < lambdaIds.length; i++) {
+    const logicalId = lambdaIds[i];
+    const spec = await buildContainerSpec({
+      logicalId,
+      stacks: targetStacks,
+      overrides,
+      assumeRole: options.assumeRole,
+      containerHost: options.containerHost,
+      ...debugPortBase !== void 0 && { debugPort: debugPortBase + i },
+      stsRegion: options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"],
+      inlineTmpDirs
+    });
+    specs.set(logicalId, spec);
+  }
+  const distinctImages = /* @__PURE__ */ new Set();
+  for (const spec of specs.values()) {
+    distinctImages.add(resolveRuntimeImage(spec.lambda.runtime));
+  }
+  for (const image of distinctImages) {
+    await pullImage(image, options.pull === false);
+  }
+  const perLambdaConcurrency = parsePerLambdaConcurrency(options.perLambdaConcurrency);
+  const pool = createContainerPool(specs, {
+    perLambdaConcurrency,
+    skipPull: options.pull === false
+  });
+  if (options.warm) {
+    logger.info(`Pre-warming ${specs.size} container(s)...`);
+    const handles = await Promise.allSettled([...specs.keys()].map((id) => pool.acquire(id)));
+    for (const result of handles) {
+      if (result.status === "fulfilled") {
+        pool.release(result.value);
+      } else {
+        logger.warn(
+          `Pre-warm failed for one Lambda (cold start cost will apply on first request): ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`
+        );
+      }
+    }
+  }
+  let maxTimeoutSec = 0;
+  for (const spec of specs.values()) {
+    if (spec.lambda.timeoutSec > maxTimeoutSec)
+      maxTimeoutSec = spec.lambda.timeoutSec;
+  }
+  const rieTimeoutMs = Math.max(3e4, maxTimeoutSec * 2 * 1e3);
+  const port = parseInt(options.port, 10);
+  if (!Number.isFinite(port) || port < 0 || port > 65535) {
+    throw new Error(`--port must be 0..65535 (got ${options.port}).`);
+  }
+  const server = await startApiServer({
+    routes,
+    pool,
+    rieTimeoutMs,
+    host: options.host,
+    port
+  });
+  printRouteTable(routes);
+  logger.info(
+    `Per-Lambda concurrency: ${perLambdaConcurrency} (override with --per-lambda-concurrency)`
+  );
+  process.stdout.write(`Server listening on http://${server.host}:${server.port}
+`);
+  process.stdout.write("^C to stop and clean up containers.\n");
+  let shuttingDown = false;
+  let forceExitArmed = false;
+  const shutdown = async (signal, exitCode) => {
+    if (shuttingDown) {
+      if (!forceExitArmed) {
+        forceExitArmed = true;
+        logger.warn(
+          `Received second ${signal}; force-exiting. Orphan containers may remain \u2014 run 'docker ps --filter name=cdkd-local-' and 'docker rm -f' to clean up.`
+        );
+        process.exit(130);
+      }
+      return;
+    }
+    shuttingDown = true;
+    logger.info(`Received ${signal}, shutting down...`);
+    try {
+      await server.close();
+    } catch (err) {
+      logger.warn(`server.close() failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+      await pool.dispose();
+    } catch (err) {
+      logger.warn(`pool.dispose() failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    for (const dir of inlineTmpDirs) {
+      try {
+        rmSync2(dir, { recursive: true, force: true });
+      } catch (err) {
+        logger.warn(
+          `Failed to remove inline-code tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    process.exit(exitCode);
+  };
+  process.on("SIGINT", () => {
+    void shutdown("SIGINT", 130);
+  });
+  process.on("SIGTERM", () => {
+    void shutdown("SIGTERM", 0);
+  });
+  process.on("uncaughtException", (err) => {
+    logger.error(
+      `Uncaught exception: ${err instanceof Error ? err.stack ?? err.message : String(err)}`
+    );
+    void shutdown("uncaughtException", 1);
+  });
+  process.on("unhandledRejection", (reason) => {
+    logger.error(
+      `Unhandled rejection: ${reason instanceof Error ? reason.stack ?? reason.message : String(reason)}`
+    );
+    void shutdown("unhandledRejection", 1);
+  });
+  await new Promise(() => void 0);
+}
+function pickTargetStacks(stacks, pattern) {
+  if (pattern) {
+    return matchStacks(stacks, [pattern]);
+  }
+  if (stacks.length === 1)
+    return stacks;
+  if (stacks.length === 0)
+    return [];
+  throw new Error(
+    `Multi-stack app: pass --stack <name> to pick a target. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`
+  );
+}
+function uniqueLambdaIds(routes) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const r of routes) {
+    if (!seen.has(r.lambdaLogicalId)) {
+      seen.add(r.lambdaLogicalId);
+      out.push(r.lambdaLogicalId);
+    }
+  }
+  return out;
+}
+async function buildContainerSpec(args) {
+  const {
+    logicalId,
+    stacks,
+    overrides,
+    assumeRole,
+    containerHost,
+    debugPort,
+    stsRegion,
+    inlineTmpDirs
+  } = args;
+  const lambda = resolveLambdaByLogicalId(logicalId, stacks);
   const codeDir = lambda.codePath ?? materializeInlineCode(
     lambda.handler,
     lambda.inlineCode ?? "",
-    resolveRuntimeFileExtension(lambda.runtime)
+    resolveRuntimeFileExtension(lambda.runtime),
+    inlineTmpDirs
   );
+  const templateEnv = getTemplateEnv(lambda.resource);
+  const envResult = resolveEnvVars(logicalId, templateEnv, overrides);
+  for (const key of envResult.unresolved) {
+    getLogger().warn(
+      `Lambda ${logicalId}: env var ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${logicalId}":{"${key}":"<literal>"}}) to surface a literal value.`
+    );
+  }
+  const dockerEnv = {
+    AWS_LAMBDA_FUNCTION_NAME: logicalId,
+    AWS_LAMBDA_FUNCTION_MEMORY_SIZE: String(lambda.memoryMb),
+    AWS_LAMBDA_FUNCTION_TIMEOUT: String(lambda.timeoutSec),
+    AWS_LAMBDA_FUNCTION_VERSION: "$LATEST",
+    AWS_LAMBDA_LOG_GROUP_NAME: `/aws/lambda/${logicalId}`,
+    AWS_LAMBDA_LOG_STREAM_NAME: "local",
+    ...envResult.resolved
+  };
+  const roleArn = effectiveAssumeRoleArn(logicalId, assumeRole);
+  if (roleArn) {
+    const creds = await assumeLambdaExecutionRole(roleArn, stsRegion);
+    dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
+    dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
+    dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
+    if (stsRegion)
+      dockerEnv["AWS_REGION"] = stsRegion;
+  } else {
+    forwardAwsEnv(dockerEnv);
+  }
+  if (debugPort !== void 0) {
+    dockerEnv["NODE_OPTIONS"] = `--inspect-brk=0.0.0.0:${debugPort}`;
+  }
+  const spec = {
+    lambda,
+    codeDir,
+    env: dockerEnv,
+    containerHost,
+    ...debugPort !== void 0 && { debugPort }
+  };
+  return spec;
+}
+function resolveLambdaByLogicalId(logicalId, stacks) {
+  for (const stack of stacks) {
+    const resource = stack.template.Resources?.[logicalId];
+    if (!resource || resource.Type !== "AWS::Lambda::Function")
+      continue;
+    const props = resource.Properties ?? {};
+    const runtime = typeof props["Runtime"] === "string" ? props["Runtime"] : "";
+    const handler = typeof props["Handler"] === "string" ? props["Handler"] : "";
+    const memoryMb = typeof props["MemorySize"] === "number" ? props["MemorySize"] : 128;
+    const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
+    if (!runtime) {
+      throw new Error(
+        `Lambda '${logicalId}' has no Runtime property. Container-image Lambdas (Code.ImageUri) are not supported in cdkd local start-api v1.`
+      );
+    }
+    if (!handler) {
+      throw new Error(`Lambda '${logicalId}' has no Handler property.`);
+    }
+    const code = props["Code"] ?? {};
+    const imageUri = code["ImageUri"];
+    if (typeof imageUri === "string" || typeof imageUri === "object" && imageUri !== null && "Fn::Sub" in imageUri) {
+      throw new Error(
+        `Lambda '${logicalId}' uses Code.ImageUri (container-image Lambda). 'cdkd local start-api' v1 supports ZIP Lambdas only \u2014 container-image support is deferred to a follow-up PR. Use 'cdkd local invoke' to exercise this function locally.`
+      );
+    }
+    const inlineCode = typeof code["ZipFile"] === "string" ? code["ZipFile"] : void 0;
+    let codePath = null;
+    if (!inlineCode) {
+      codePath = resolveAssetCodePath2(stack, logicalId, resource);
+    }
+    return {
+      kind: "zip",
+      stack,
+      logicalId,
+      resource,
+      runtime,
+      handler,
+      memoryMb,
+      timeoutSec,
+      codePath,
+      ...inlineCode !== void 0 && { inlineCode }
+    };
+  }
+  throw new Error(
+    `No AWS::Lambda::Function resource named '${logicalId}' found in target stacks. This is likely a synthesis bug \u2014 the route-discovery phase resolved a route to this logical ID.`
+  );
+}
+function resolveAssetCodePath2(stack, logicalId, resource) {
+  const meta = resource.Metadata;
+  const assetPath = meta?.["aws:asset:path"];
+  if (typeof assetPath !== "string" || assetPath.length === 0) {
+    throw new Error(
+      `Lambda '${logicalId}' has no Metadata['aws:asset:path']. cdkd local start-api needs this hint to find the local asset directory. Re-synthesize the app and retry.`
+    );
+  }
+  const cdkOutDir = stack.assetManifestPath ? path.dirname(stack.assetManifestPath) : process.cwd();
+  return path.isAbsolute(assetPath) ? assetPath : path.resolve(cdkOutDir, assetPath);
+}
+function printRouteTable(routes) {
+  const sorted = [...routes].sort((a, b) => {
+    if (a.pathPattern !== b.pathPattern)
+      return a.pathPattern.localeCompare(b.pathPattern);
+    return a.method.localeCompare(b.method);
+  });
+  const methodWidth = Math.max(...sorted.map((r) => r.method.length), 6);
+  const pathWidth = Math.max(...sorted.map((r) => r.pathPattern.length), 8);
+  process.stdout.write("Discovered routes:\n");
+  for (const r of sorted) {
+    const sourceLabel = r.source === "http-api" ? "HTTP API" : r.source === "rest-v1" ? `REST v1, stage '${r.stage}'` : "Function URL";
+    process.stdout.write(
+      `  ${r.method.padEnd(methodWidth)}  ${r.pathPattern.padEnd(pathWidth)}  -> ${r.lambdaLogicalId}  (${sourceLabel})
+`
+    );
+  }
+  process.stdout.write("\n");
+}
+function materializeInlineCode(handler, source, fileExtension, tmpDirsOut) {
+  const lastDot = handler.lastIndexOf(".");
+  if (lastDot <= 0) {
+    throw new Error(`Handler '${handler}' is malformed: expected '<modulePath>.<exportName>'.`);
+  }
+  const modulePath = handler.substring(0, lastDot);
+  const dir = mkdtempSync2(path.join(tmpdir2(), "cdkd-local-start-api-"));
+  tmpDirsOut.add(dir);
+  const filePath = path.join(dir, `${modulePath}${fileExtension}`);
+  mkdirSync2(path.dirname(filePath), { recursive: true });
+  writeFileSync5(filePath, source, "utf-8");
+  return dir;
+}
+function getTemplateEnv(resource) {
+  const props = resource.Properties ?? {};
+  const env = props["Environment"];
+  if (!env || typeof env !== "object")
+    return void 0;
+  const vars = env["Variables"];
+  if (!vars || typeof vars !== "object")
+    return void 0;
+  return vars;
+}
+function readEnvOverridesFile(filePath) {
+  if (!filePath)
+    return void 0;
+  let raw;
+  try {
+    raw = readFileSync6(filePath, "utf-8");
+  } catch (err) {
+    throw new Error(
+      `Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse --env-vars file '${filePath}' as JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`--env-vars file '${filePath}' must contain a JSON object at the top level.`);
+  }
+  return parsed;
+}
+function forwardAwsEnv(env) {
+  const passThrough = [
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+    "AWS_REGION",
+    "AWS_DEFAULT_REGION"
+  ];
+  for (const key of passThrough) {
+    const value = process.env[key];
+    if (value !== void 0)
+      env[key] = value;
+  }
+}
+async function assumeLambdaExecutionRole(roleArn, region) {
+  const { STSClient: STSClient11, AssumeRoleCommand: AssumeRoleCommand2 } = await import("@aws-sdk/client-sts");
+  const sts = new STSClient11({ ...region && { region } });
+  try {
+    const response = await sts.send(
+      new AssumeRoleCommand2({
+        RoleArn: roleArn,
+        RoleSessionName: `cdkd-local-start-api-${Date.now()}`,
+        DurationSeconds: 3600
+      })
+    );
+    const creds = response.Credentials;
+    if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) {
+      throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+    }
+    return {
+      accessKeyId: creds.AccessKeyId,
+      secretAccessKey: creds.SecretAccessKey,
+      sessionToken: creds.SessionToken
+    };
+  } finally {
+    sts.destroy();
+  }
+}
+function parsePerLambdaConcurrency(raw) {
+  const parsed = parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed < 1) {
+    throw new Error(`--per-lambda-concurrency must be a positive integer (got '${raw}')`);
+  }
+  if (parsed > 4) {
+    getLogger().warn(
+      `--per-lambda-concurrency ${parsed} exceeds the v1 cap of 4; clamping to 4. (Raise this in a follow-up PR if your workload needs more.)`
+    );
+    return 4;
+  }
+  return parsed;
+}
+function parseDebugPort(raw) {
+  const parsed = parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed < 1 || parsed > 65535) {
+    throw new Error(`--debug-port-base must be 1..65535 (got '${raw}')`);
+  }
+  return parsed;
+}
+function createLocalStartApiCommand() {
+  const startApi = new Command14("start-api").description(
+    "Run a long-running local HTTP server that maps API Gateway routes (REST v1, HTTP API, Function URL) to Lambda invocations against the AWS Lambda Runtime Interface Emulator (Docker required)."
+  ).addOption(
+    new Option7("--port <port>", "HTTP server port (default: auto-allocate)").default("0")
+  ).addOption(new Option7("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option7("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(
+    new Option7("--warm", "Pre-start one container per Lambda at server boot").default(false)
+  ).addOption(
+    new Option7(
+      "--per-lambda-concurrency <n>",
+      "Pool size cap per Lambda (default 2, max 4)"
+    ).default("2")
+  ).addOption(new Option7("--no-pull", "Skip docker pull (cached image)")).addOption(
+    new Option7(
+      "--container-host <host>",
+      "Hostname/IP the container reaches the host on"
+    ).default("host.docker.internal")
+  ).addOption(
+    new Option7(
+      "--debug-port-base <port>",
+      "Reserve a contiguous --debug-port range (one per Lambda)"
+    )
+  ).addOption(
+    new Option7(
+      "--env-vars <file>",
+      'JSON env-var overrides (SAM-compatible: {"LogicalId":{"KEY":"VALUE"}, "Parameters": {...}})'
+    )
+  ).addOption(
+    new Option7(
+      "--assume-role <arn-or-pair>",
+      "Assume the Lambda's execution role and forward STS-issued temp creds. Bare <arn> = global default; <LogicalId>=<arn> = per-Lambda override (repeatable). Per-Lambda > global > unset (developer creds passed through)."
+    ).argParser((raw, prev) => parseAssumeRoleToken(raw, prev))
+  ).action(withErrorHandling(localStartApiCommand));
+  [...commonOptions, ...appOptions, ...contextOptions].forEach((opt) => startApi.addOption(opt));
+  startApi.addOption(deprecatedRegionOption);
+  return startApi;
+}
+
+// src/cli/commands/local-invoke.ts
+async function localInvokeCommand(target, options) {
+  const logger = getLogger();
+  if (options.verbose) {
+    logger.setLevel("debug");
+  }
+  warnIfDeprecatedRegion(options);
+  await applyRoleArnIfSet({ roleArn: options.roleArn, region: options.region });
+  await ensureDockerAvailable();
+  const appCmd = resolveApp(options.app);
+  if (!appCmd) {
+    throw new Error('No CDK app specified. Pass --app, set CDKD_APP, or add "app" to cdk.json.');
+  }
+  logger.info("Synthesizing CDK app...");
+  const synthesizer = new Synthesizer();
+  const context = parseContextOptions(options.context);
+  const synthOpts = {
+    app: appCmd,
+    output: options.output,
+    ...options.region && { region: options.region },
+    ...options.profile && { profile: options.profile },
+    ...Object.keys(context).length > 0 && { context }
+  };
+  const { stacks } = await synthesizer.synthesize(synthOpts);
+  const lambda = resolveLambdaTarget(target, stacks);
+  const targetLabel = lambda.kind === "zip" ? lambda.runtime : "container image";
+  logger.info(`Target: ${lambda.stack.stackName}/${lambda.logicalId} (${targetLabel})`);
+  const imagePlan = await resolveImagePlan(lambda, options);
   let stateAudit;
-  let templateEnv = getTemplateEnv(lambda.resource);
+  let templateEnv = getTemplateEnv2(lambda.resource);
   let stateForRoleHint;
   if (options.fromState) {
     const loaded = await loadStateForStack(lambda.stack.stackName, lambda.stack.region, {
@@ -70688,7 +72771,7 @@ async function localInvokeCommand(target, options) {
       }
     }
   }
-  const overrides = readEnvOverridesFile(options.envVars);
+  const overrides = readEnvOverridesFile2(options.envVars);
   const envResult = resolveEnvVars(lambda.logicalId, templateEnv, overrides);
   for (const key of envResult.unresolved) {
     if (stateAudit && stateAudit.unresolved.some((u) => u.key === key))
@@ -70701,7 +72784,6 @@ async function localInvokeCommand(target, options) {
     suggestAssumeRoleFromState(stateForRoleHint, lambda.logicalId);
   }
   const event = await readEvent(options);
-  const image = resolveRuntimeImage(lambda.runtime);
   const dockerEnv = {
     AWS_LAMBDA_FUNCTION_NAME: lambda.logicalId,
     AWS_LAMBDA_FUNCTION_MEMORY_SIZE: String(lambda.memoryMb),
@@ -70713,14 +72795,14 @@ async function localInvokeCommand(target, options) {
   };
   if (options.assumeRole) {
     const stsRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
-    const creds = await assumeLambdaExecutionRole(options.assumeRole, stsRegion);
+    const creds = await assumeLambdaExecutionRole2(options.assumeRole, stsRegion);
     dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
     dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
     dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
     if (stsRegion)
       dockerEnv["AWS_REGION"] = stsRegion;
   } else {
-    forwardAwsEnv(dockerEnv);
+    forwardAwsEnv2(dockerEnv);
   }
   let debugPort;
   if (options.debugPort) {
@@ -70729,19 +72811,26 @@ async function localInvokeCommand(target, options) {
       throw new Error(`--debug-port must be an integer in 1..65535, got '${options.debugPort}'`);
     }
     dockerEnv["NODE_OPTIONS"] = `--inspect-brk=0.0.0.0:${debugPort}`;
+    if (lambda.kind === "image") {
+      logger.warn(
+        "--debug-port sets NODE_OPTIONS unconditionally on container Lambdas. If the image's runtime is not Node.js, this flag is a no-op."
+      );
+    }
   }
-  await pullImage(image, options.pull === false);
   const hostPort = await pickFreePort();
-  const containerHost = options.containerHost || "127.0.0.1";
-  logger.info(`Starting container (image=${image}, port=${hostPort})...`);
+  const containerHost = options.containerHost;
+  logger.info(`Starting container (image=${imagePlan.image}, port=${hostPort})...`);
   const containerId = await runDetached({
-    image,
-    mounts: [{ hostPath: codeDir, containerPath: "/var/task", readOnly: true }],
+    image: imagePlan.image,
+    mounts: imagePlan.mounts,
     env: dockerEnv,
-    cmd: [lambda.handler],
+    cmd: imagePlan.cmd,
     hostPort,
     host: containerHost,
-    ...debugPort !== void 0 && { debugPort }
+    ...debugPort !== void 0 && { debugPort },
+    ...imagePlan.platform !== void 0 && { platform: imagePlan.platform },
+    ...imagePlan.entryPoint !== void 0 && { entryPoint: imagePlan.entryPoint },
+    ...imagePlan.workingDir !== void 0 && { workingDir: imagePlan.workingDir }
   });
   const stopLogs = streamLogs(containerId);
   const sigintHandler = () => {
@@ -70762,9 +72851,94 @@ async function localInvokeCommand(target, options) {
     process.off("SIGINT", sigintHandler);
     stopLogs();
     await removeContainer(containerId);
+    if (imagePlan.inlineTmpDir) {
+      try {
+        rmSync3(imagePlan.inlineTmpDir, { recursive: true, force: true });
+      } catch (err) {
+        getLogger().debug(
+          `Failed to remove inline-code tmpdir ${imagePlan.inlineTmpDir}: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
   }
 }
-function getTemplateEnv(resource) {
+async function resolveImagePlan(lambda, options) {
+  if (lambda.kind === "zip") {
+    return resolveZipImagePlan(lambda, options);
+  }
+  return resolveContainerImagePlan(lambda, options);
+}
+async function resolveZipImagePlan(lambda, options) {
+  let inlineTmpDir;
+  let codeDir = lambda.codePath;
+  if (codeDir === null) {
+    inlineTmpDir = materializeInlineCode2(
+      lambda.handler,
+      lambda.inlineCode ?? "",
+      resolveRuntimeFileExtension(lambda.runtime)
+    );
+    codeDir = inlineTmpDir;
+  }
+  const image = resolveRuntimeImage(lambda.runtime);
+  await pullImage(image, options.pull === false);
+  return {
+    image,
+    mounts: [{ hostPath: codeDir, containerPath: "/var/task", readOnly: true }],
+    cmd: [lambda.handler],
+    ...inlineTmpDir !== void 0 && { inlineTmpDir }
+  };
+}
+async function resolveContainerImagePlan(lambda, options) {
+  const logger = getLogger();
+  const platform = architectureToPlatform(lambda.architecture);
+  const localBuild = await resolveLocalBuildPlan(lambda);
+  let imageRef;
+  if (localBuild) {
+    imageRef = await buildContainerImage(localBuild.asset, localBuild.cdkOutDir, {
+      architecture: lambda.architecture
+    });
+  } else {
+    if (!parseEcrUri(lambda.imageUri)) {
+      throw new Error(
+        `Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI cdkd can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`
+      );
+    }
+    logger.info(
+      `No matching cdk.out asset for ${lambda.imageUri}; falling back to ECR pull (same-acct/region only)...`
+    );
+    imageRef = await pullEcrImage(lambda.imageUri, {
+      skipPull: options.pull === false,
+      ...options.region !== void 0 && { region: options.region }
+    });
+  }
+  return {
+    image: imageRef,
+    mounts: [],
+    cmd: lambda.imageConfig.command ?? [],
+    platform,
+    ...lambda.imageConfig.entryPoint && lambda.imageConfig.entryPoint.length > 0 && {
+      entryPoint: lambda.imageConfig.entryPoint
+    },
+    ...lambda.imageConfig.workingDirectory !== void 0 && {
+      workingDir: lambda.imageConfig.workingDirectory
+    }
+  };
+}
+async function resolveLocalBuildPlan(lambda) {
+  const manifestPath = lambda.stack.assetManifestPath;
+  if (!manifestPath)
+    return void 0;
+  const cdkOutDir = dirname3(manifestPath);
+  const loader = new AssetManifestLoader();
+  const manifest = await loader.loadManifest(cdkOutDir, lambda.stack.stackName);
+  if (!manifest)
+    return void 0;
+  const entry = getDockerImageBySourceHash(manifest, lambda.imageUri);
+  if (!entry)
+    return void 0;
+  return { asset: entry.asset, cdkOutDir };
+}
+function getTemplateEnv2(resource) {
   const props = resource.Properties ?? {};
   const env = props["Environment"];
   if (!env || typeof env !== "object")
@@ -70774,12 +72948,12 @@ function getTemplateEnv(resource) {
     return void 0;
   return vars;
 }
-function readEnvOverridesFile(filePath) {
+function readEnvOverridesFile2(filePath) {
   if (!filePath)
     return void 0;
   let raw;
   try {
-    raw = readFileSync6(filePath, "utf-8");
+    raw = readFileSync7(filePath, "utf-8");
   } catch (err) {
     throw new Error(
       `Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`
@@ -70807,7 +72981,7 @@ async function readEvent(options) {
     return parseEvent(raw, "<stdin>");
   }
   if (options.event) {
-    const raw = readFileSync6(options.event, "utf-8");
+    const raw = readFileSync7(options.event, "utf-8");
     return parseEvent(raw, options.event);
   }
   return {};
@@ -70828,9 +73002,9 @@ async function readStdin() {
   }
   return Buffer.concat(chunks).toString("utf-8");
 }
-async function assumeLambdaExecutionRole(roleArn, region) {
-  const { STSClient: STSClient10, AssumeRoleCommand: AssumeRoleCommand2 } = await import("@aws-sdk/client-sts");
-  const sts = new STSClient10({ ...region && { region } });
+async function assumeLambdaExecutionRole2(roleArn, region) {
+  const { STSClient: STSClient11, AssumeRoleCommand: AssumeRoleCommand2 } = await import("@aws-sdk/client-sts");
+  const sts = new STSClient11({ ...region && { region } });
   try {
     const response = await sts.send(
       new AssumeRoleCommand2({
@@ -70852,7 +73026,7 @@ async function assumeLambdaExecutionRole(roleArn, region) {
     sts.destroy();
   }
 }
-function forwardAwsEnv(env) {
+function forwardAwsEnv2(env) {
   const passThrough = [
     "AWS_ACCESS_KEY_ID",
     "AWS_SECRET_ACCESS_KEY",
@@ -70866,16 +73040,16 @@ function forwardAwsEnv(env) {
       env[key] = value;
   }
 }
-function materializeInlineCode(handler, source, fileExtension) {
+function materializeInlineCode2(handler, source, fileExtension) {
   const lastDot = handler.lastIndexOf(".");
   if (lastDot <= 0) {
     throw new Error(`Handler '${handler}' is malformed: expected '<modulePath>.<exportName>'.`);
   }
   const modulePath = handler.substring(0, lastDot);
-  const dir = mkdtempSync2(path.join(tmpdir2(), "cdkd-local-invoke-"));
-  const filePath = path.join(dir, `${modulePath}${fileExtension}`);
-  mkdirSync2(path.dirname(filePath), { recursive: true });
-  writeFileSync5(filePath, source, "utf-8");
+  const dir = mkdtempSync3(path2.join(tmpdir3(), "cdkd-local-invoke-"));
+  const filePath = path2.join(dir, `${modulePath}${fileExtension}`);
+  mkdirSync3(path2.dirname(filePath), { recursive: true });
+  writeFileSync6(filePath, source, "utf-8");
   return dir;
 }
 async function loadStateForStack(stackName, synthRegion, opts) {
@@ -70982,30 +73156,35 @@ function pickReferencedLogicalId(intrinsic) {
   return void 0;
 }
 function createLocalCommand() {
-  const local = new Command14("local").description(
+  const local = new Command15("local").description(
     "Local Lambda execution against the AWS Lambda Runtime Interface Emulator (Docker required)"
   );
-  const invoke = new Command14("invoke").description(
+  const invoke = new Command15("invoke").description(
     "Run a Lambda function locally in a Docker container (RIE-backed). Target accepts a CDK display path (MyStack/MyApi/Handler) or stack-qualified logical ID (MyStack:MyApiHandler1234ABCD). Single-stack apps may omit the stack prefix."
-  ).argument("<target>", "CDK display path or stack-qualified logical ID of the Lambda to invoke").addOption(new Option7("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option7("--event-stdin", "Read event JSON from stdin").default(false)).addOption(
-    new Option7(
+  ).argument("<target>", "CDK display path or stack-qualified logical ID of the Lambda to invoke").addOption(new Option8("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option8("--event-stdin", "Read event JSON from stdin").default(false)).addOption(
+    new Option8(
       "--env-vars <file>",
       'JSON env-var overrides (SAM-compatible: {"LogicalId":{"KEY":"VALUE"}})'
     )
-  ).addOption(new Option7("--no-pull", "Skip docker pull (use cached image)")).addOption(new Option7("--debug-port <port>", "Node --inspect-brk port (default: off)")).addOption(
-    new Option7("--container-host <host>", "Host to bind the RIE port to").default("127.0.0.1")
   ).addOption(
-    new Option7(
+    new Option8(
+      "--no-pull",
+      "Skip docker pull (use cached image) \u2014 no-op for IMAGE local-build path; `docker build` does not pull base layers by default"
+    )
+  ).addOption(new Option8("--debug-port <port>", "Node --inspect-brk port (default: off)")).addOption(
+    new Option8("--container-host <host>", "Host to bind the RIE port to").default("127.0.0.1")
+  ).addOption(
+    new Option8(
       "--assume-role <arn>",
       `Assume the Lambda's deployed execution role and forward STS-issued temp credentials to the container so the handler runs with the deployed function's narrow permissions (closes the "developer admin / function narrow" skew). Off by default \u2014 when omitted, the developer's shell credentials are forwarded unchanged (SAM-compatible default).`
     )
   ).addOption(
-    new Option7(
+    new Option8(
       "--from-state",
       "Read cdkd S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub in env vars with the deployed physical IDs / attributes. Off by default \u2014 keep PR 1 warn-and-drop semantics; turn on for stacks already deployed via cdkd deploy."
     ).default(false)
   ).addOption(
-    new Option7(
+    new Option8(
       "--stack-region <region>",
       "Region of the cdkd state record to read (used with --from-state when the same stack name has state in multiple regions)."
     )
@@ -71015,6 +73194,7 @@ function createLocalCommand() {
   );
   invoke.addOption(deprecatedRegionOption);
   local.addCommand(invoke);
+  local.addCommand(createLocalStartApiCommand());
   return local;
 }
 
@@ -71046,8 +73226,8 @@ function reorderArgs(argv) {
   return [...prefix, ...cmdAndAfter, ...beforeCmd];
 }
 async function main() {
-  const program = new Command15();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.69.0");
+  const program = new Command16();
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.71.0");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());