@go-to-k/cdkd 0.70.0 → 0.72.0

package/dist/cli.js

@@ -708,10 +708,10 @@ var require_GraphQLError = __commonJS({
        */
       constructor(message, ...rawArgs) {
         var _this$nodes, _nodeLocations$, _ref;
-        const { nodes, source, positions, path: path2, originalError, extensions } = toNormalizedOptions(rawArgs);
+        const { nodes, source, positions, path: path3, originalError, extensions } = toNormalizedOptions(rawArgs);
         super(message);
         this.name = "GraphQLError";
-        this.path = path2 !== null && path2 !== void 0 ? path2 : void 0;
+        this.path = path3 !== null && path3 !== void 0 ? path3 : void 0;
         this.originalError = originalError !== null && originalError !== void 0 ? originalError : void 0;
         this.nodes = undefinedIfEmpty(
           Array.isArray(nodes) ? nodes : nodes ? [nodes] : void 0
@@ -4173,14 +4173,14 @@ var require_visitor = __commonJS({
       let node = root;
       let key = void 0;
       let parent = void 0;
-      const path2 = [];
+      const path3 = [];
       const ancestors = [];
       do {
         index++;
         const isLeaving = index === keys.length;
         const isEdited = isLeaving && edits.length !== 0;
         if (isLeaving) {
-          key = ancestors.length === 0 ? void 0 : path2[path2.length - 1];
+          key = ancestors.length === 0 ? void 0 : path3[path3.length - 1];
           node = parent;
           parent = ancestors.pop();
           if (isEdited) {
@@ -4214,7 +4214,7 @@ var require_visitor = __commonJS({
           if (node === null || node === void 0) {
             continue;
           }
-          path2.push(key);
+          path3.push(key);
         }
         let result;
         if (!Array.isArray(node)) {
@@ -4224,13 +4224,13 @@ var require_visitor = __commonJS({
             `Invalid AST Node: ${(0, _inspect.inspect)(node)}.`
           );
           const visitFn = isLeaving ? (_enterLeaveMap$get = enterLeaveMap.get(node.kind)) === null || _enterLeaveMap$get === void 0 ? void 0 : _enterLeaveMap$get.leave : (_enterLeaveMap$get2 = enterLeaveMap.get(node.kind)) === null || _enterLeaveMap$get2 === void 0 ? void 0 : _enterLeaveMap$get2.enter;
-          result = visitFn === null || visitFn === void 0 ? void 0 : visitFn.call(visitor, node, key, parent, path2, ancestors);
+          result = visitFn === null || visitFn === void 0 ? void 0 : visitFn.call(visitor, node, key, parent, path3, ancestors);
           if (result === BREAK) {
             break;
           }
           if (result === false) {
             if (!isLeaving) {
-              path2.pop();
+              path3.pop();
               continue;
             }
           } else if (result !== void 0) {
@@ -4239,7 +4239,7 @@ var require_visitor = __commonJS({
               if ((0, _ast.isNode)(result)) {
                 node = result;
               } else {
-                path2.pop();
+                path3.pop();
                 continue;
               }
             }
@@ -4249,7 +4249,7 @@ var require_visitor = __commonJS({
           edits.push([key, node]);
         }
         if (isLeaving) {
-          path2.pop();
+          path3.pop();
         } else {
           var _node$kind;
           stack = {
@@ -4374,16 +4374,16 @@ var require_printer = __commonJS({
       },
       // Document
       Document: {
-        leave: (node) => join8(node.definitions, "\n\n")
+        leave: (node) => join9(node.definitions, "\n\n")
       },
       OperationDefinition: {
         leave(node) {
-          const varDefs = hasMultilineItems(node.variableDefinitions) ? wrap("(\n", join8(node.variableDefinitions, "\n"), "\n)") : wrap("(", join8(node.variableDefinitions, ", "), ")");
-          const prefix = wrap("", node.description, "\n") + join8(
+          const varDefs = hasMultilineItems(node.variableDefinitions) ? wrap("(\n", join9(node.variableDefinitions, "\n"), "\n)") : wrap("(", join9(node.variableDefinitions, ", "), ")");
+          const prefix = wrap("", node.description, "\n") + join9(
             [
               node.operation,
-              join8([node.name, varDefs]),
-              join8(node.directives, " ")
+              join9([node.name, varDefs]),
+              join9(node.directives, " ")
             ],
             " "
           );
@@ -4391,7 +4391,7 @@ var require_printer = __commonJS({
         }
       },
       VariableDefinition: {
-        leave: ({ variable, type, defaultValue, directives, description }) => wrap("", description, "\n") + variable + ": " + type + wrap(" = ", defaultValue) + wrap(" ", join8(directives, " "))
+        leave: ({ variable, type, defaultValue, directives, description }) => wrap("", description, "\n") + variable + ": " + type + wrap(" = ", defaultValue) + wrap(" ", join9(directives, " "))
       },
       SelectionSet: {
         leave: ({ selections }) => block(selections)
@@ -4399,11 +4399,11 @@ var require_printer = __commonJS({
       Field: {
         leave({ alias, name, arguments: args, directives, selectionSet }) {
           const prefix = wrap("", alias, ": ") + name;
-          let argsLine = prefix + wrap("(", join8(args, ", "), ")");
+          let argsLine = prefix + wrap("(", join9(args, ", "), ")");
           if (argsLine.length > MAX_LINE_LENGTH) {
-            argsLine = prefix + wrap("(\n", indent(join8(args, "\n")), "\n)");
+            argsLine = prefix + wrap("(\n", indent(join9(args, "\n")), "\n)");
           }
-          return join8([argsLine, join8(directives, " "), selectionSet], " ");
+          return join9([argsLine, join9(directives, " "), selectionSet], " ");
         }
       },
       Argument: {
@@ -4411,14 +4411,14 @@ var require_printer = __commonJS({
       },
       // Fragments
       FragmentSpread: {
-        leave: ({ name, directives }) => "..." + name + wrap(" ", join8(directives, " "))
+        leave: ({ name, directives }) => "..." + name + wrap(" ", join9(directives, " "))
       },
       InlineFragment: {
-        leave: ({ typeCondition, directives, selectionSet }) => join8(
+        leave: ({ typeCondition, directives, selectionSet }) => join9(
           [
             "...",
             wrap("on ", typeCondition),
-            join8(directives, " "),
+            join9(directives, " "),
             selectionSet
           ],
           " "
@@ -4434,7 +4434,7 @@ var require_printer = __commonJS({
           description
         }) => wrap("", description, "\n") + // Note: fragment variable definitions are experimental and may be changed
         // or removed in the future.
-        `fragment ${name}${wrap("(", join8(variableDefinitions, ", "), ")")} on ${typeCondition} ${wrap("", join8(directives, " "), " ")}` + selectionSet
+        `fragment ${name}${wrap("(", join9(variableDefinitions, ", "), ")")} on ${typeCondition} ${wrap("", join9(directives, " "), " ")}` + selectionSet
       },
       // Value
       IntValue: {
@@ -4456,17 +4456,17 @@ var require_printer = __commonJS({
         leave: ({ value }) => value
       },
       ListValue: {
-        leave: ({ values }) => "[" + join8(values, ", ") + "]"
+        leave: ({ values }) => "[" + join9(values, ", ") + "]"
       },
       ObjectValue: {
-        leave: ({ fields }) => "{" + join8(fields, ", ") + "}"
+        leave: ({ fields }) => "{" + join9(fields, ", ") + "}"
       },
       ObjectField: {
         leave: ({ name, value }) => name + ": " + value
       },
       // Directive
       Directive: {
-        leave: ({ name, arguments: args }) => "@" + name + wrap("(", join8(args, ", "), ")")
+        leave: ({ name, arguments: args }) => "@" + name + wrap("(", join9(args, ", "), ")")
       },
       // Type
       NamedType: {
@@ -4480,61 +4480,61 @@ var require_printer = __commonJS({
       },
       // Type System Definitions
       SchemaDefinition: {
-        leave: ({ description, directives, operationTypes }) => wrap("", description, "\n") + join8(["schema", join8(directives, " "), block(operationTypes)], " ")
+        leave: ({ description, directives, operationTypes }) => wrap("", description, "\n") + join9(["schema", join9(directives, " "), block(operationTypes)], " ")
       },
       OperationTypeDefinition: {
         leave: ({ operation, type }) => operation + ": " + type
       },
       ScalarTypeDefinition: {
-        leave: ({ description, name, directives }) => wrap("", description, "\n") + join8(["scalar", name, join8(directives, " ")], " ")
+        leave: ({ description, name, directives }) => wrap("", description, "\n") + join9(["scalar", name, join9(directives, " ")], " ")
       },
       ObjectTypeDefinition: {
-        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join8(
+        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join9(
           [
             "type",
             name,
-            wrap("implements ", join8(interfaces, " & ")),
-            join8(directives, " "),
+            wrap("implements ", join9(interfaces, " & ")),
+            join9(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       FieldDefinition: {
-        leave: ({ description, name, arguments: args, type, directives }) => wrap("", description, "\n") + name + (hasMultilineItems(args) ? wrap("(\n", indent(join8(args, "\n")), "\n)") : wrap("(", join8(args, ", "), ")")) + ": " + type + wrap(" ", join8(directives, " "))
+        leave: ({ description, name, arguments: args, type, directives }) => wrap("", description, "\n") + name + (hasMultilineItems(args) ? wrap("(\n", indent(join9(args, "\n")), "\n)") : wrap("(", join9(args, ", "), ")")) + ": " + type + wrap(" ", join9(directives, " "))
       },
       InputValueDefinition: {
-        leave: ({ description, name, type, defaultValue, directives }) => wrap("", description, "\n") + join8(
-          [name + ": " + type, wrap("= ", defaultValue), join8(directives, " ")],
+        leave: ({ description, name, type, defaultValue, directives }) => wrap("", description, "\n") + join9(
+          [name + ": " + type, wrap("= ", defaultValue), join9(directives, " ")],
           " "
         )
       },
       InterfaceTypeDefinition: {
-        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join8(
+        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join9(
           [
             "interface",
             name,
-            wrap("implements ", join8(interfaces, " & ")),
-            join8(directives, " "),
+            wrap("implements ", join9(interfaces, " & ")),
+            join9(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       UnionTypeDefinition: {
-        leave: ({ description, name, directives, types }) => wrap("", description, "\n") + join8(
-          ["union", name, join8(directives, " "), wrap("= ", join8(types, " | "))],
+        leave: ({ description, name, directives, types }) => wrap("", description, "\n") + join9(
+          ["union", name, join9(directives, " "), wrap("= ", join9(types, " | "))],
           " "
         )
       },
       EnumTypeDefinition: {
-        leave: ({ description, name, directives, values }) => wrap("", description, "\n") + join8(["enum", name, join8(directives, " "), block(values)], " ")
+        leave: ({ description, name, directives, values }) => wrap("", description, "\n") + join9(["enum", name, join9(directives, " "), block(values)], " ")
       },
       EnumValueDefinition: {
-        leave: ({ description, name, directives }) => wrap("", description, "\n") + join8([name, join8(directives, " ")], " ")
+        leave: ({ description, name, directives }) => wrap("", description, "\n") + join9([name, join9(directives, " ")], " ")
       },
       InputObjectTypeDefinition: {
-        leave: ({ description, name, directives, fields }) => wrap("", description, "\n") + join8(["input", name, join8(directives, " "), block(fields)], " ")
+        leave: ({ description, name, directives, fields }) => wrap("", description, "\n") + join9(["input", name, join9(directives, " "), block(fields)], " ")
       },
       DirectiveDefinition: {
         leave: ({
@@ -4544,84 +4544,84 @@ var require_printer = __commonJS({
           directives,
           repeatable,
           locations
-        }) => wrap("", description, "\n") + "directive @" + name + (hasMultilineItems(args) ? wrap("(\n", indent(join8(args, "\n")), "\n)") : wrap("(", join8(args, ", "), ")")) + wrap(" ", join8(directives, " ")) + (repeatable ? " repeatable" : "") + " on " + join8(locations, " | ")
+        }) => wrap("", description, "\n") + "directive @" + name + (hasMultilineItems(args) ? wrap("(\n", indent(join9(args, "\n")), "\n)") : wrap("(", join9(args, ", "), ")")) + wrap(" ", join9(directives, " ")) + (repeatable ? " repeatable" : "") + " on " + join9(locations, " | ")
       },
       SchemaExtension: {
-        leave: ({ directives, operationTypes }) => join8(
-          ["extend schema", join8(directives, " "), block(operationTypes)],
+        leave: ({ directives, operationTypes }) => join9(
+          ["extend schema", join9(directives, " "), block(operationTypes)],
           " "
         )
       },
       ScalarTypeExtension: {
-        leave: ({ name, directives }) => join8(["extend scalar", name, join8(directives, " ")], " ")
+        leave: ({ name, directives }) => join9(["extend scalar", name, join9(directives, " ")], " ")
       },
       ObjectTypeExtension: {
-        leave: ({ name, interfaces, directives, fields }) => join8(
+        leave: ({ name, interfaces, directives, fields }) => join9(
           [
             "extend type",
             name,
-            wrap("implements ", join8(interfaces, " & ")),
-            join8(directives, " "),
+            wrap("implements ", join9(interfaces, " & ")),
+            join9(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       InterfaceTypeExtension: {
-        leave: ({ name, interfaces, directives, fields }) => join8(
+        leave: ({ name, interfaces, directives, fields }) => join9(
           [
             "extend interface",
             name,
-            wrap("implements ", join8(interfaces, " & ")),
-            join8(directives, " "),
+            wrap("implements ", join9(interfaces, " & ")),
+            join9(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       UnionTypeExtension: {
-        leave: ({ name, directives, types }) => join8(
+        leave: ({ name, directives, types }) => join9(
           [
             "extend union",
             name,
-            join8(directives, " "),
-            wrap("= ", join8(types, " | "))
+            join9(directives, " "),
+            wrap("= ", join9(types, " | "))
           ],
           " "
         )
       },
       EnumTypeExtension: {
-        leave: ({ name, directives, values }) => join8(["extend enum", name, join8(directives, " "), block(values)], " ")
+        leave: ({ name, directives, values }) => join9(["extend enum", name, join9(directives, " "), block(values)], " ")
       },
       InputObjectTypeExtension: {
-        leave: ({ name, directives, fields }) => join8(["extend input", name, join8(directives, " "), block(fields)], " ")
+        leave: ({ name, directives, fields }) => join9(["extend input", name, join9(directives, " "), block(fields)], " ")
       },
       DirectiveExtension: {
-        leave: ({ name, directives }) => join8(["extend directive @" + name, join8(directives, " ")], " ")
+        leave: ({ name, directives }) => join9(["extend directive @" + name, join9(directives, " ")], " ")
       },
       // Schema Coordinates
       TypeCoordinate: {
         leave: ({ name }) => name
       },
       MemberCoordinate: {
-        leave: ({ name, memberName }) => join8([name, wrap(".", memberName)])
+        leave: ({ name, memberName }) => join9([name, wrap(".", memberName)])
       },
       ArgumentCoordinate: {
-        leave: ({ name, fieldName, argumentName }) => join8([name, wrap(".", fieldName), wrap("(", argumentName, ":)")])
+        leave: ({ name, fieldName, argumentName }) => join9([name, wrap(".", fieldName), wrap("(", argumentName, ":)")])
       },
       DirectiveCoordinate: {
-        leave: ({ name }) => join8(["@", name])
+        leave: ({ name }) => join9(["@", name])
       },
       DirectiveArgumentCoordinate: {
-        leave: ({ name, argumentName }) => join8(["@", name, wrap("(", argumentName, ":)")])
+        leave: ({ name, argumentName }) => join9(["@", name, wrap("(", argumentName, ":)")])
       }
     };
-    function join8(maybeArray, separator = "") {
+    function join9(maybeArray, separator = "") {
       var _maybeArray$filter$jo;
       return (_maybeArray$filter$jo = maybeArray === null || maybeArray === void 0 ? void 0 : maybeArray.filter((x) => x).join(separator)) !== null && _maybeArray$filter$jo !== void 0 ? _maybeArray$filter$jo : "";
     }
     function block(array) {
-      return wrap("{\n", indent(join8(array, "\n")), "\n}");
+      return wrap("{\n", indent(join9(array, "\n")), "\n}");
     }
     function wrap(start, maybeString, end = "") {
       return maybeString != null && maybeString !== "" ? start + maybeString + end : "";
@@ -9578,8 +9578,8 @@ var require_printPathArray = __commonJS({
       value: true
     });
     exports.printPathArray = printPathArray;
-    function printPathArray(path2) {
-      return path2.map(
+    function printPathArray(path3) {
+      return path3.map(
         (key) => typeof key === "number" ? "[" + key.toString() + "]" : "." + key
       ).join("");
     }
@@ -9602,9 +9602,9 @@ var require_Path = __commonJS({
         typename
       };
     }
-    function pathToArray(path2) {
+    function pathToArray(path3) {
       const flattened = [];
-      let curr = path2;
+      let curr = path3;
       while (curr) {
         flattened.push(curr.key);
         curr = curr.prev;
@@ -9635,21 +9635,21 @@ var require_coerceInputValue = __commonJS({
     function coerceInputValue(inputValue, type, onError = defaultOnError) {
       return coerceInputValueImpl(inputValue, type, onError, void 0);
     }
-    function defaultOnError(path2, invalidValue, error) {
+    function defaultOnError(path3, invalidValue, error) {
       let errorPrefix = "Invalid value " + (0, _inspect.inspect)(invalidValue);
-      if (path2.length > 0) {
-        errorPrefix += ` at "value${(0, _printPathArray.printPathArray)(path2)}"`;
+      if (path3.length > 0) {
+        errorPrefix += ` at "value${(0, _printPathArray.printPathArray)(path3)}"`;
       }
       error.message = errorPrefix + ": " + error.message;
       throw error;
     }
-    function coerceInputValueImpl(inputValue, type, onError, path2) {
+    function coerceInputValueImpl(inputValue, type, onError, path3) {
       if ((0, _definition.isNonNullType)(type)) {
         if (inputValue != null) {
-          return coerceInputValueImpl(inputValue, type.ofType, onError, path2);
+          return coerceInputValueImpl(inputValue, type.ofType, onError, path3);
         }
         onError(
-          (0, _Path.pathToArray)(path2),
+          (0, _Path.pathToArray)(path3),
           inputValue,
           new _GraphQLError.GraphQLError(
             `Expected non-nullable type "${(0, _inspect.inspect)(
@@ -9666,16 +9666,16 @@ var require_coerceInputValue = __commonJS({
         const itemType = type.ofType;
         if ((0, _isIterableObject.isIterableObject)(inputValue)) {
           return Array.from(inputValue, (itemValue, index) => {
-            const itemPath = (0, _Path.addPath)(path2, index, void 0);
+            const itemPath = (0, _Path.addPath)(path3, index, void 0);
             return coerceInputValueImpl(itemValue, itemType, onError, itemPath);
           });
         }
-        return [coerceInputValueImpl(inputValue, itemType, onError, path2)];
+        return [coerceInputValueImpl(inputValue, itemType, onError, path3)];
       }
       if ((0, _definition.isInputObjectType)(type)) {
         if (!(0, _isObjectLike.isObjectLike)(inputValue) || Array.isArray(inputValue)) {
           onError(
-            (0, _Path.pathToArray)(path2),
+            (0, _Path.pathToArray)(path3),
             inputValue,
             new _GraphQLError.GraphQLError(
               `Expected type "${type.name}" to be an object.`
@@ -9693,7 +9693,7 @@ var require_coerceInputValue = __commonJS({
             } else if ((0, _definition.isNonNullType)(field.type)) {
               const typeStr = (0, _inspect.inspect)(field.type);
               onError(
-                (0, _Path.pathToArray)(path2),
+                (0, _Path.pathToArray)(path3),
                 inputValue,
                 new _GraphQLError.GraphQLError(
                   `Field "${field.name}" of required type "${typeStr}" was not provided.`
@@ -9706,7 +9706,7 @@ var require_coerceInputValue = __commonJS({
             fieldValue,
             field.type,
             onError,
-            (0, _Path.addPath)(path2, field.name, type.name)
+            (0, _Path.addPath)(path3, field.name, type.name)
           );
         }
         for (const fieldName of Object.keys(inputValue)) {
@@ -9716,7 +9716,7 @@ var require_coerceInputValue = __commonJS({
               Object.keys(type.getFields())
             );
             onError(
-              (0, _Path.pathToArray)(path2),
+              (0, _Path.pathToArray)(path3),
               inputValue,
               new _GraphQLError.GraphQLError(
                 `Field "${fieldName}" is not defined by type "${type.name}".` + (0, _didYouMean.didYouMean)(suggestions)
@@ -9728,7 +9728,7 @@ var require_coerceInputValue = __commonJS({
           const keys = Object.keys(coercedValue);
           if (keys.length !== 1) {
             onError(
-              (0, _Path.pathToArray)(path2),
+              (0, _Path.pathToArray)(path3),
               inputValue,
               new _GraphQLError.GraphQLError(
                 `Exactly one key must be specified for OneOf type "${type.name}".`
@@ -9739,7 +9739,7 @@ var require_coerceInputValue = __commonJS({
           const value = coercedValue[key];
           if (value === null) {
             onError(
-              (0, _Path.pathToArray)(path2).concat(key),
+              (0, _Path.pathToArray)(path3).concat(key),
               value,
               new _GraphQLError.GraphQLError(`Field "${key}" must be non-null.`)
             );
@@ -9753,10 +9753,10 @@ var require_coerceInputValue = __commonJS({
           parseResult = type.parseValue(inputValue);
         } catch (error) {
           if (error instanceof _GraphQLError.GraphQLError) {
-            onError((0, _Path.pathToArray)(path2), inputValue, error);
+            onError((0, _Path.pathToArray)(path3), inputValue, error);
           } else {
             onError(
-              (0, _Path.pathToArray)(path2),
+              (0, _Path.pathToArray)(path3),
               inputValue,
               new _GraphQLError.GraphQLError(
                 `Expected type "${type.name}". ` + error.message,
@@ -9770,7 +9770,7 @@ var require_coerceInputValue = __commonJS({
         }
         if (parseResult === void 0) {
           onError(
-            (0, _Path.pathToArray)(path2),
+            (0, _Path.pathToArray)(path3),
             inputValue,
             new _GraphQLError.GraphQLError(`Expected type "${type.name}".`)
           );
@@ -10011,11 +10011,11 @@ var require_values = __commonJS({
         coercedValues[varName] = (0, _coerceInputValue.coerceInputValue)(
           value,
           varType,
-          (path2, invalidValue, error) => {
+          (path3, invalidValue, error) => {
             let prefix = `Variable "$${varName}" got invalid value ` + (0, _inspect.inspect)(invalidValue);
-            if (path2.length > 0) {
+            if (path3.length > 0) {
               prefix += ` at "${varName}${(0, _printPathArray.printPathArray)(
-                path2
+                path3
               )}"`;
             }
             onError(
@@ -11745,7 +11745,7 @@ var require_locatedError = __commonJS({
     exports.locatedError = locatedError;
     var _toError = require_toError();
     var _GraphQLError = require_GraphQLError();
-    function locatedError(rawOriginalError, nodes, path2) {
+    function locatedError(rawOriginalError, nodes, path3) {
       var _nodes;
       const originalError = (0, _toError.toError)(rawOriginalError);
       if (isLocatedGraphQLError(originalError)) {
@@ -11755,7 +11755,7 @@ var require_locatedError = __commonJS({
         nodes: (_nodes = originalError.nodes) !== null && _nodes !== void 0 ? _nodes : nodes,
         source: originalError.source,
         positions: originalError.positions,
-        path: path2,
+        path: path3,
         originalError
       });
     }
@@ -11815,20 +11815,20 @@ var require_execute = __commonJS({
       get errors() {
         return this._errors;
       }
-      add(error, path2) {
-        if (this._hasNulledPosition(path2)) {
+      add(error, path3) {
+        if (this._hasNulledPosition(path3)) {
           return;
         }
-        this._errorPositions.add(path2);
+        this._errorPositions.add(path3);
         this._errors.push(error);
       }
       _hasNulledPosition(startPath) {
-        let path2 = startPath;
-        while (path2 !== void 0) {
-          if (this._errorPositions.has(path2)) {
+        let path3 = startPath;
+        while (path3 !== void 0) {
+          if (this._errorPositions.has(path3)) {
             return true;
           }
-          path2 = path2.prev;
+          path3 = path3.prev;
         }
         return this._errorPositions.has(void 0);
       }
@@ -11977,27 +11977,27 @@ var require_execute = __commonJS({
         rootType,
         operation.selectionSet
       );
-      const path2 = void 0;
+      const path3 = void 0;
       switch (operation.operation) {
         case _ast.OperationTypeNode.QUERY:
-          return executeFields(exeContext, rootType, rootValue, path2, rootFields);
+          return executeFields(exeContext, rootType, rootValue, path3, rootFields);
         case _ast.OperationTypeNode.MUTATION:
           return executeFieldsSerially(
             exeContext,
             rootType,
             rootValue,
-            path2,
+            path3,
             rootFields
           );
         case _ast.OperationTypeNode.SUBSCRIPTION:
-          return executeFields(exeContext, rootType, rootValue, path2, rootFields);
+          return executeFields(exeContext, rootType, rootValue, path3, rootFields);
       }
     }
-    function executeFieldsSerially(exeContext, parentType, sourceValue, path2, fields) {
+    function executeFieldsSerially(exeContext, parentType, sourceValue, path3, fields) {
       return (0, _promiseReduce.promiseReduce)(
         fields.entries(),
         (results, [responseName, fieldNodes]) => {
-          const fieldPath = (0, _Path.addPath)(path2, responseName, parentType.name);
+          const fieldPath = (0, _Path.addPath)(path3, responseName, parentType.name);
           const result = executeField(
             exeContext,
             parentType,
@@ -12020,12 +12020,12 @@ var require_execute = __commonJS({
         /* @__PURE__ */ Object.create(null)
       );
     }
-    function executeFields(exeContext, parentType, sourceValue, path2, fields) {
+    function executeFields(exeContext, parentType, sourceValue, path3, fields) {
       const results = /* @__PURE__ */ Object.create(null);
       let containsPromise = false;
       try {
         for (const [responseName, fieldNodes] of fields.entries()) {
-          const fieldPath = (0, _Path.addPath)(path2, responseName, parentType.name);
+          const fieldPath = (0, _Path.addPath)(path3, responseName, parentType.name);
           const result = executeField(
             exeContext,
             parentType,
@@ -12053,7 +12053,7 @@ var require_execute = __commonJS({
       }
       return (0, _promiseForObject.promiseForObject)(results);
     }
-    function executeField(exeContext, parentType, source, fieldNodes, path2) {
+    function executeField(exeContext, parentType, source, fieldNodes, path3) {
       var _fieldDef$resolve;
       const fieldDef = getFieldDef(exeContext.schema, parentType, fieldNodes[0]);
       if (!fieldDef) {
@@ -12066,7 +12066,7 @@ var require_execute = __commonJS({
         fieldDef,
         fieldNodes,
         parentType,
-        path2
+        path3
       );
       try {
         const args = (0, _values.getArgumentValues)(
@@ -12079,7 +12079,7 @@ var require_execute = __commonJS({
         let completed;
         if ((0, _isPromise.isPromise)(result)) {
           completed = result.then(
-            (resolved) => completeValue(exeContext, returnType, fieldNodes, info, path2, resolved)
+            (resolved) => completeValue(exeContext, returnType, fieldNodes, info, path3, resolved)
           );
         } else {
           completed = completeValue(
@@ -12087,7 +12087,7 @@ var require_execute = __commonJS({
             returnType,
             fieldNodes,
             info,
-            path2,
+            path3,
             result
           );
         }
@@ -12096,9 +12096,9 @@ var require_execute = __commonJS({
             const error = (0, _locatedError.locatedError)(
               rawError,
               fieldNodes,
-              (0, _Path.pathToArray)(path2)
+              (0, _Path.pathToArray)(path3)
             );
-            return handleFieldError(error, returnType, path2, exeContext);
+            return handleFieldError(error, returnType, path3, exeContext);
           });
         }
         return completed;
@@ -12106,18 +12106,18 @@ var require_execute = __commonJS({
         const error = (0, _locatedError.locatedError)(
           rawError,
           fieldNodes,
-          (0, _Path.pathToArray)(path2)
+          (0, _Path.pathToArray)(path3)
         );
-        return handleFieldError(error, returnType, path2, exeContext);
+        return handleFieldError(error, returnType, path3, exeContext);
       }
     }
-    function buildResolveInfo(exeContext, fieldDef, fieldNodes, parentType, path2) {
+    function buildResolveInfo(exeContext, fieldDef, fieldNodes, parentType, path3) {
       return {
         fieldName: fieldDef.name,
         fieldNodes,
         returnType: fieldDef.type,
         parentType,
-        path: path2,
+        path: path3,
         schema: exeContext.schema,
         fragments: exeContext.fragments,
         rootValue: exeContext.rootValue,
@@ -12125,14 +12125,14 @@ var require_execute = __commonJS({
         variableValues: exeContext.variableValues
       };
     }
-    function handleFieldError(error, returnType, path2, exeContext) {
+    function handleFieldError(error, returnType, path3, exeContext) {
       if ((0, _definition.isNonNullType)(returnType)) {
         throw error;
       }
-      exeContext.collectedErrors.add(error, path2);
+      exeContext.collectedErrors.add(error, path3);
       return null;
     }
-    function completeValue(exeContext, returnType, fieldNodes, info, path2, result) {
+    function completeValue(exeContext, returnType, fieldNodes, info, path3, result) {
       if (result instanceof Error) {
         throw result;
       }
@@ -12142,7 +12142,7 @@ var require_execute = __commonJS({
           returnType.ofType,
           fieldNodes,
           info,
-          path2,
+          path3,
           result
         );
         if (completed === null) {
@@ -12161,7 +12161,7 @@ var require_execute = __commonJS({
           returnType,
           fieldNodes,
           info,
-          path2,
+          path3,
           result
         );
       }
@@ -12174,7 +12174,7 @@ var require_execute = __commonJS({
           returnType,
           fieldNodes,
           info,
-          path2,
+          path3,
           result
         );
       }
@@ -12184,7 +12184,7 @@ var require_execute = __commonJS({
           returnType,
           fieldNodes,
           info,
-          path2,
+          path3,
           result
         );
       }
@@ -12193,7 +12193,7 @@ var require_execute = __commonJS({
         "Cannot complete value of unexpected output type: " + (0, _inspect.inspect)(returnType)
       );
     }
-    function completeListValue(exeContext, returnType, fieldNodes, info, path2, result) {
+    function completeListValue(exeContext, returnType, fieldNodes, info, path3, result) {
       if (!(0, _isIterableObject.isIterableObject)(result)) {
         throw new _GraphQLError.GraphQLError(
           `Expected Iterable, but did not find one for field "${info.parentType.name}.${info.fieldName}".`
@@ -12202,7 +12202,7 @@ var require_execute = __commonJS({
       const itemType = returnType.ofType;
       let containsPromise = false;
       const completedResults = Array.from(result, (item, index) => {
-        const itemPath = (0, _Path.addPath)(path2, index, void 0);
+        const itemPath = (0, _Path.addPath)(path3, index, void 0);
         try {
           let completedItem;
           if ((0, _isPromise.isPromise)(item)) {
@@ -12260,7 +12260,7 @@ var require_execute = __commonJS({
       }
       return serializedResult;
     }
-    function completeAbstractValue(exeContext, returnType, fieldNodes, info, path2, result) {
+    function completeAbstractValue(exeContext, returnType, fieldNodes, info, path3, result) {
       var _returnType$resolveTy;
       const resolveTypeFn = (_returnType$resolveTy = returnType.resolveType) !== null && _returnType$resolveTy !== void 0 ? _returnType$resolveTy : exeContext.typeResolver;
       const contextValue = exeContext.contextValue;
@@ -12279,7 +12279,7 @@ var require_execute = __commonJS({
             ),
             fieldNodes,
             info,
-            path2,
+            path3,
             result
           )
         );
@@ -12296,7 +12296,7 @@ var require_execute = __commonJS({
         ),
         fieldNodes,
         info,
-        path2,
+        path3,
         result
       );
     }
@@ -12344,7 +12344,7 @@ var require_execute = __commonJS({
       }
       return runtimeType;
     }
-    function completeObjectValue(exeContext, returnType, fieldNodes, info, path2, result) {
+    function completeObjectValue(exeContext, returnType, fieldNodes, info, path3, result) {
       const subFieldNodes = collectSubfields(exeContext, returnType, fieldNodes);
       if (returnType.isTypeOf) {
         const isTypeOf = returnType.isTypeOf(result, exeContext.contextValue, info);
@@ -12357,7 +12357,7 @@ var require_execute = __commonJS({
               exeContext,
               returnType,
               result,
-              path2,
+              path3,
               subFieldNodes
             );
           });
@@ -12366,7 +12366,7 @@ var require_execute = __commonJS({
           throw invalidReturnTypeError(returnType, result, fieldNodes);
         }
       }
-      return executeFields(exeContext, returnType, result, path2, subFieldNodes);
+      return executeFields(exeContext, returnType, result, path3, subFieldNodes);
     }
     function invalidReturnTypeError(returnType, result, fieldNodes) {
       return new _GraphQLError.GraphQLError(
@@ -12448,7 +12448,7 @@ var require_graphql = __commonJS({
     var _validate2 = require_validate2();
     var _execute = require_execute();
     function graphql(args) {
-      return new Promise((resolve5) => resolve5(graphqlImpl(args)));
+      return new Promise((resolve6) => resolve6(graphqlImpl(args)));
     }
     function graphqlSync(args) {
       const result = graphqlImpl(args);
@@ -13450,13 +13450,13 @@ var require_subscribe = __commonJS({
           }
         );
       }
-      const path2 = (0, _Path.addPath)(void 0, responseName, rootType.name);
+      const path3 = (0, _Path.addPath)(void 0, responseName, rootType.name);
       const info = (0, _execute.buildResolveInfo)(
         exeContext,
         fieldDef,
         fieldNodes,
         rootType,
-        path2
+        path3
       );
       try {
         var _fieldDef$subscribe;
@@ -13476,7 +13476,7 @@ var require_subscribe = __commonJS({
         throw (0, _locatedError.locatedError)(
           error,
           fieldNodes,
-          (0, _Path.pathToArray)(path2)
+          (0, _Path.pathToArray)(path3)
         );
       }
     }
@@ -17797,7 +17797,7 @@ var require_graphql2 = __commonJS({
 });
 
 // src/cli/index.ts
-import { Command as Command15 } from "commander";
+import { Command as Command16 } from "commander";
 
 // src/cli/commands/bootstrap.ts
 import { Command, Option as Option2 } from "commander";
@@ -18412,6 +18412,13 @@ var StackTerminationProtectionError = class _StackTerminationProtectionError ext
     Object.setPrototypeOf(this, _StackTerminationProtectionError.prototype);
   }
 };
+var RouteDiscoveryError = class _RouteDiscoveryError extends CdkdError {
+  constructor(message, cause) {
+    super(message, "ROUTE_DISCOVERY_ERROR", cause);
+    this.name = "RouteDiscoveryError";
+    Object.setPrototypeOf(this, _RouteDiscoveryError.prototype);
+  }
+};
 function isCdkdError(error) {
   return error instanceof CdkdError;
 }
@@ -18862,7 +18869,7 @@ var IntrinsicFunctionResolver = class {
               this.logger.debug(
                 `VPC ${physicalId} IPv6 CIDR still associating (attempt ${attempt}/${maxAttempts}), waiting...`
               );
-              await new Promise((resolve5) => setTimeout(resolve5, 2e3));
+              await new Promise((resolve6) => setTimeout(resolve6, 2e3));
             }
             this.logger.warn(
               `VPC ${physicalId} IPv6 CIDR did not reach 'associated' state after ${maxAttempts} attempts`
@@ -19747,7 +19754,7 @@ var DagExecutor = class {
   async execute(concurrency, fn, cancelled = () => false) {
     let active = 0;
     const errors = [];
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const dispatch = () => {
         let changed = true;
         while (changed) {
@@ -19809,7 +19816,7 @@ var DagExecutor = class {
             );
             return;
           }
-          resolve5();
+          resolve6();
         }
       };
       dispatch();
@@ -20490,7 +20497,7 @@ Error: ${err.message || "Unknown error"}`,
    * Sleep for specified milliseconds
    */
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Check if a resource type is supported by Cloud Control API
@@ -21224,7 +21231,7 @@ var CustomResourceProvider = class _CustomResourceProvider {
     return result;
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Adopt an existing custom resource into cdkd state.
@@ -21654,7 +21661,7 @@ function isRetryableTransientError(error, message) {
 }
 
 // src/deployment/retry.ts
-var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 async function withRetry(operation, logicalId, opts = {}) {
   const maxRetries = opts.maxRetries ?? 8;
   const initialDelayMs = opts.initialDelayMs ?? 1e3;
@@ -21709,7 +21716,7 @@ function validateOptions(opts) {
 async function withResourceDeadline(operation, opts) {
   validateOptions(opts);
   const startedAt = Date.now();
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     let settled = false;
     let warnTimer;
     let timeoutTimer;
@@ -21749,7 +21756,7 @@ async function withResourceDeadline(operation, opts) {
           return;
         settled = true;
         cleanup();
-        resolve5(value);
+        resolve6(value);
       },
       (err) => {
         if (settled)
@@ -23320,6 +23327,41 @@ var contextOptions = [
     "Set context values (can be specified multiple times)"
   )
 ];
+var IAM_ROLE_ARN_REGEX = /^arn:[^:]+:iam::\d+:role\//;
+function parseAssumeRoleToken(raw, previous) {
+  const acc = previous ?? { perLambda: {} };
+  if (!acc.perLambda)
+    acc.perLambda = {};
+  const eqIndex = raw.indexOf("=");
+  if (eqIndex === -1) {
+    if (!IAM_ROLE_ARN_REGEX.test(raw)) {
+      throw new Error(
+        `Invalid --assume-role value "${raw}": expected an IAM role ARN like arn:aws:iam::123456789012:role/MyRole, or LogicalId=<arn>.`
+      );
+    }
+    acc.globalArn = raw;
+    return acc;
+  }
+  const logicalId = raw.substring(0, eqIndex).trim();
+  const arn = raw.substring(eqIndex + 1).trim();
+  if (!/^[A-Za-z][A-Za-z0-9]*$/.test(logicalId)) {
+    throw new Error(
+      `Invalid --assume-role value "${raw}": left-hand side "${logicalId}" must be a CloudFormation logical ID (alphanumeric, leading letter).`
+    );
+  }
+  if (!IAM_ROLE_ARN_REGEX.test(arn)) {
+    throw new Error(
+      `Invalid --assume-role value "${raw}": right-hand side "${arn}" must be an IAM role ARN like arn:aws:iam::123456789012:role/MyRole.`
+    );
+  }
+  acc.perLambda[logicalId] = arn;
+  return acc;
+}
+function effectiveAssumeRoleArn(logicalId, opt) {
+  if (!opt)
+    return void 0;
+  return opt.perLambda?.[logicalId] ?? opt.globalArn;
+}
 var destroyOptions = [
   new Option("-f, --force", "Do not ask for confirmation before destroying the stacks").default(
     false
@@ -23749,7 +23791,7 @@ var AppExecutor = class {
    * Spawn subprocess and wait for completion
    */
   spawn(commandLine, env) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const proc = spawn(commandLine, {
         stdio: ["ignore", "pipe", "pipe"],
         shell: true,
@@ -23775,7 +23817,7 @@ var AppExecutor = class {
       });
       proc.on("close", (code) => {
         if (code === 0) {
-          resolve5();
+          resolve6();
         } else {
           const stderr = stderrChunks.join("\n");
           reject(
@@ -24487,8 +24529,8 @@ var CcApiContextProvider = class {
   /**
    * Get nested property value using dot notation
    */
-  getNestedProperty(obj, path2) {
-    const parts = path2.split(".");
+  getNestedProperty(obj, path3) {
+    const parts = path3.split(".");
     let current = obj;
     for (const part of parts) {
       if (current === null || current === void 0 || typeof current !== "object") {
@@ -25297,11 +25339,11 @@ var FileAssetPublisher = class {
    */
   async uploadZip(client, dirPath, bucket, key) {
     const archiver = await import("archiver");
-    const body = await new Promise((resolve5, reject) => {
+    const body = await new Promise((resolve6, reject) => {
       const chunks = [];
       const archive = archiver.default("zip", { zlib: { level: 9 } });
       archive.on("data", (chunk) => chunks.push(chunk));
-      archive.on("end", () => resolve5(Buffer.concat(chunks)));
+      archive.on("end", () => resolve6(Buffer.concat(chunks)));
       archive.on("error", reject);
       const stat = statSync2(dirPath);
       if (stat.isDirectory()) {
@@ -25486,7 +25528,7 @@ var DockerAssetPublisher = class {
     const token = Buffer.from(authData.authorizationToken, "base64").toString();
     const [username, password] = token.split(":");
     const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.amazonaws.com`;
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve6, reject) => {
       const proc = spawn2(
         "docker",
         ["login", "--username", username, "--password-stdin", endpoint],
@@ -25500,7 +25542,7 @@ var DockerAssetPublisher = class {
       });
       proc.on("close", (code) => {
         if (code === 0) {
-          resolve5();
+          resolve6();
         } else {
           reject(new AssetError(`ECR login failed: ${stderr.trim()}`));
         }
@@ -25553,7 +25595,7 @@ var WorkGraph = class {
   async execute(concurrency, fn) {
     const active = { "asset-build": 0, "asset-publish": 0, stack: 0 };
     const errors = [];
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const dispatch = () => {
         const ready = [];
         for (const node of this.nodes.values()) {
@@ -25625,7 +25667,7 @@ ${msg}`
             );
             return;
           }
-          resolve5();
+          resolve6();
         }
       };
       dispatch();
@@ -26616,7 +26658,7 @@ var LockManager = class {
           this.logger.info(
             `Stack '${stackName}' (${region}) is locked by ${lockInfo2.owner}${lockInfo2.operation ? ` (operation: ${lockInfo2.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`
           );
-          await new Promise((resolve5) => setTimeout(resolve5, retryDelay));
+          await new Promise((resolve6) => setTimeout(resolve6, retryDelay));
           continue;
         }
       }
@@ -26864,11 +26906,11 @@ var DagBuilder = class {
     const cycles = [];
     const visited = /* @__PURE__ */ new Set();
     const recursionStack = /* @__PURE__ */ new Set();
-    const path2 = [];
+    const path3 = [];
     const dfs = (node) => {
       visited.add(node);
       recursionStack.add(node);
-      path2.push(node);
+      path3.push(node);
       const successors = graph.successors(node) || [];
       for (const successor of successors) {
         if (!visited.has(successor)) {
@@ -26876,14 +26918,14 @@ var DagBuilder = class {
             return true;
           }
         } else if (recursionStack.has(successor)) {
-          const cycleStart = path2.indexOf(successor);
-          const cycle = path2.slice(cycleStart);
+          const cycleStart = path3.indexOf(successor);
+          const cycle = path3.slice(cycleStart);
           cycle.push(successor);
           cycles.push(cycle);
           return true;
         }
       }
-      path2.pop();
+      path3.pop();
       recursionStack.delete(node);
       return false;
     };
@@ -28911,13 +28953,13 @@ var IAMInstanceProfileProvider = class {
       properties["InstanceProfileName"] || logicalId,
       { maxLength: 128 }
     );
-    const path2 = properties["Path"] || "/";
+    const path3 = properties["Path"] || "/";
     const roles = properties["Roles"];
     try {
       const response = await this.iamClient.send(
         new CreateInstanceProfileCommand({
           InstanceProfileName: instanceProfileName,
-          Path: path2
+          Path: path3
         })
       );
       this.logger.debug(`Created IAM instance profile: ${instanceProfileName}`);
@@ -35110,7 +35152,7 @@ var LambdaFunctionProvider = class {
     return enis;
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Build Lambda Code parameter from CDK properties
@@ -36987,7 +37029,7 @@ var DynamoDBTableProvider = class {
       if (status !== "CREATING") {
         throw new Error(`Unexpected table status: ${status}`);
       }
-      await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+      await new Promise((resolve6) => setTimeout(resolve6, 1e3));
     }
     throw new Error(`Table ${tableName} did not reach ACTIVE status within ${maxAttempts} seconds`);
   }
@@ -37007,7 +37049,7 @@ var DynamoDBTableProvider = class {
       if (status === "ACTIVE") {
         return;
       }
-      await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+      await new Promise((resolve6) => setTimeout(resolve6, 1e3));
     }
     throw new Error(
       `Table ${tableName} did not reach ACTIVE status within ${maxAttempts} seconds after UpdateTable`
@@ -40187,7 +40229,7 @@ var EC2Provider = class {
           this.logger.debug(
             `VPC ${physicalId} has dependencies (attempt ${attempt}/${maxAttempts}), retrying in ${attempt * 5}s...`
           );
-          await new Promise((resolve5) => setTimeout(resolve5, attempt * 5e3));
+          await new Promise((resolve6) => setTimeout(resolve6, attempt * 5e3));
           continue;
         }
         const cause = error instanceof Error ? error : void 0;
@@ -40351,7 +40393,7 @@ var EC2Provider = class {
           this.logger.debug(
             `Subnet ${physicalId} has dependencies (attempt ${attempt}/${maxAttempts}), retrying in ${attempt * 5}s...`
           );
-          await new Promise((resolve5) => setTimeout(resolve5, attempt * 5e3));
+          await new Promise((resolve6) => setTimeout(resolve6, attempt * 5e3));
           continue;
         }
         const cause = error instanceof Error ? error : void 0;
@@ -41109,7 +41151,7 @@ var EC2Provider = class {
           this.logger.debug(
             `SecurityGroup ${physicalId} has dependent objects (attempt ${attempt}/${maxAttempts}), retrying in ${attempt * 5}s...`
           );
-          await new Promise((resolve5) => setTimeout(resolve5, attempt * 5e3));
+          await new Promise((resolve6) => setTimeout(resolve6, attempt * 5e3));
           continue;
         }
         const cause = error instanceof Error ? error : void 0;
@@ -42053,7 +42095,7 @@ var EC2Provider = class {
    * `setTimeout` globally.
    */
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Check if an error indicates the resource was not found
@@ -43334,13 +43376,13 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
       { key: "IdentityValidationExpression", path: "/identityValidationExpression" },
       { key: "AuthorizerResultTtlInSeconds", path: "/authorizerResultTtlInSeconds" }
     ];
-    for (const { key, path: path2 } of primitiveFields) {
+    for (const { key, path: path3 } of primitiveFields) {
       const newVal = properties[key];
       const prevVal = previousProperties[key];
       if (newVal !== prevVal) {
         patchOperations.push({
           op: "replace",
-          path: path2,
+          path: path3,
           value: newVal !== void 0 ? String(newVal) : ""
         });
       }
@@ -43976,13 +44018,13 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
       { key: "OperationName", path: "/operationName" },
       { key: "RequestValidatorId", path: "/requestValidatorId" }
     ];
-    for (const { key, path: path2 } of primitiveFields) {
+    for (const { key, path: path3 } of primitiveFields) {
       const newVal = properties[key];
       const prevVal = previousProperties[key];
       if (newVal !== prevVal) {
         patchOperations.push({
           op: "replace",
-          path: path2,
+          path: path3,
           value: newVal !== void 0 ? String(newVal) : ""
         });
       }
@@ -44153,7 +44195,7 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
    * Sleep for specified milliseconds
    */
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Convert CloudFormation Tags (Array<{Key, Value}>) to SDK tags (Record<string, string>).
@@ -44355,12 +44397,12 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
 function appendMapPatchOps(ops, basePath, next, prev) {
   const escape = (k) => k.replace(/~/g, "~0").replace(/\//g, "~1");
   for (const [key, val] of Object.entries(next)) {
-    const path2 = `${basePath}/${escape(key)}`;
+    const path3 = `${basePath}/${escape(key)}`;
     const stringValue = String(val);
     if (!(key in prev)) {
-      ops.push({ op: "add", path: path2, value: stringValue });
+      ops.push({ op: "add", path: path3, value: stringValue });
     } else if (String(prev[key]) !== stringValue) {
-      ops.push({ op: "replace", path: path2, value: stringValue });
+      ops.push({ op: "replace", path: path3, value: stringValue });
     }
   }
   for (const key of Object.keys(prev)) {
@@ -46045,7 +46087,7 @@ var CloudFrontDistributionProvider = class {
         );
         const sleepEnd = Date.now() + delay2;
         while (Date.now() < sleepEnd && !interrupted) {
-          await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+          await new Promise((resolve6) => setTimeout(resolve6, 1e3));
         }
         delay2 = Math.min(delay2 * 1.5, maxDelay);
       }
@@ -46165,17 +46207,17 @@ var CloudFrontDistributionProvider = class {
   /**
    * Apply Quantity wrapping at a nested path (e.g., "ForwardedValues.Headers").
    */
-  applyQuantityAtPath(obj, path2) {
-    if (path2.length === 0)
+  applyQuantityAtPath(obj, path3) {
+    if (path3.length === 0)
       return;
-    if (path2.length === 1) {
-      const key = path2[0];
+    if (path3.length === 1) {
+      const key = path3[0];
       if (obj[key] !== void 0) {
         obj[key] = this.wrapWithQuantity(obj[key]);
       }
       return;
     }
-    const [head, ...rest] = path2;
+    const [head, ...rest] = path3;
     const headKey = head;
     if (obj[headKey] && typeof obj[headKey] === "object") {
       const nested = { ...obj[headKey] };
@@ -49857,7 +49899,7 @@ var RDSProvider = class {
     throw new Error(`Timed out waiting for DBInstance ${dbInstanceIdentifier} to be deleted`);
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Adopt an existing RDS resource into cdkd state.
@@ -50842,7 +50884,7 @@ var DocDBProvider = class {
     throw new Error(`Timed out waiting for DocDB DBInstance ${dbInstanceIdentifier} to be deleted`);
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Adopt an existing DocDB resource into cdkd state.
@@ -51832,7 +51874,7 @@ var NeptuneProvider = class {
     );
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Adopt an existing Neptune resource into cdkd state.
@@ -54372,7 +54414,7 @@ var ElastiCacheProvider = class {
     throw new Error(`Timed out waiting for CacheCluster ${cacheClusterId} to be deleted`);
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   /**
    * Read the AWS-current ElastiCache resource configuration in CFn-property shape.
@@ -55087,7 +55129,7 @@ var ServiceDiscoveryProvider = class {
           logicalId
         );
       }
-      await new Promise((resolve5) => setTimeout(resolve5, delay2));
+      await new Promise((resolve6) => setTimeout(resolve6, delay2));
       delay2 = Math.min(delay2 * 2, 1e4);
     }
     throw new ProvisioningError(
@@ -59612,7 +59654,7 @@ var KinesisStreamProvider = class {
       if (status !== "CREATING" && status !== "UPDATING") {
         throw new Error(`Unexpected stream status: ${status}`);
       }
-      await new Promise((resolve5) => setTimeout(resolve5, 2e3));
+      await new Promise((resolve6) => setTimeout(resolve6, 2e3));
     }
     throw new Error(
       `Stream ${streamName} did not reach ACTIVE status within ${maxAttempts * 2} seconds`
@@ -59945,7 +59987,7 @@ var KinesisStreamConsumerProvider = class {
       if (status !== "CREATING") {
         throw new Error(`Unexpected consumer status: ${status}`);
       }
-      await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+      await new Promise((resolve6) => setTimeout(resolve6, 1e3));
     }
     throw new Error(
       `Consumer ${consumerArn} did not reach ACTIVE status within ${maxAttempts} seconds`
@@ -60250,7 +60292,7 @@ var EFSProvider = class {
       this.logger.debug(
         `FileSystem ${fileSystemId} state: ${fs?.LifeCycleState ?? "unknown"}, waiting...`
       );
-      await new Promise((resolve5) => setTimeout(resolve5, pollIntervalMs));
+      await new Promise((resolve6) => setTimeout(resolve6, pollIntervalMs));
     }
     throw new ProvisioningError(
       `Timed out waiting for EFS FileSystem ${fileSystemId} to become available (60s)`,
@@ -60328,7 +60370,7 @@ var EFSProvider = class {
       this.logger.debug(
         `MountTarget ${mountTargetId} state: ${mountTarget?.LifeCycleState ?? "unknown"}, waiting...`
       );
-      await new Promise((resolve5) => setTimeout(resolve5, pollIntervalMs));
+      await new Promise((resolve6) => setTimeout(resolve6, pollIntervalMs));
     }
     throw new ProvisioningError(
       `Timed out waiting for EFS MountTarget ${mountTargetId} to become available (120s)`,
@@ -60394,7 +60436,7 @@ var EFSProvider = class {
         }
         throw error;
       }
-      await new Promise((resolve5) => setTimeout(resolve5, pollIntervalMs));
+      await new Promise((resolve6) => setTimeout(resolve6, pollIntervalMs));
     }
     this.logger.warn(
       `Timed out waiting for EFS MountTarget ${mountTargetId} deletion for ${logicalId} (120s)`
@@ -61352,7 +61394,7 @@ var FirehoseProvider = class {
       this.logger.debug(
         `Firehose ${logicalId} status: ${status} (attempt ${attempt}/${maxAttempts})`
       );
-      await new Promise((resolve5) => setTimeout(resolve5, 2e3));
+      await new Promise((resolve6) => setTimeout(resolve6, 2e3));
     }
     this.logger.warn(`Firehose ${logicalId} did not reach ACTIVE after ${maxAttempts} attempts`);
   }
@@ -64822,7 +64864,7 @@ var ASGProvider = class {
     );
   }
   sleep(ms) {
-    return new Promise((resolve5) => setTimeout(resolve5, ms));
+    return new Promise((resolve6) => setTimeout(resolve6, ms));
   }
   // ─── Sub-shape diff helpers ───────────────────────────────────────
   // Each helper is a no-op when before/after JSON is identical (the cheap
@@ -65743,29 +65785,29 @@ function calculateResourceDrift(stateProperties, awsProperties, options) {
   }
   return drifts;
 }
-function isIgnoredPath(path2, ignorePaths) {
+function isIgnoredPath(path3, ignorePaths) {
   for (const entry of ignorePaths) {
-    if (path2 === entry)
+    if (path3 === entry)
       return true;
-    if (path2.startsWith(`${entry}.`))
+    if (path3.startsWith(`${entry}.`))
       return true;
   }
   return false;
 }
-function diffAt(path2, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
+function diffAt(path3, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
   if (deepEqual(stateValue, awsValue))
     return;
   if (isPlainObject(stateValue) && isPlainObject(awsValue) && !Array.isArray(stateValue) && !Array.isArray(awsValue)) {
     const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateValue), ...Object.keys(awsValue)]) : Object.keys(stateValue);
     for (const key of keys) {
-      const childPath = `${path2}.${key}`;
+      const childPath = `${path3}.${key}`;
       if (isIgnoredPath(childPath, ignorePaths))
         continue;
       diffAt(childPath, stateValue[key], awsValue[key], out, ignorePaths, unionWalkObjects);
     }
     return;
   }
-  out.push({ path: path2, stateValue, awsValue });
+  out.push({ path: path3, stateValue, awsValue });
 }
 function deepEqual(a, b) {
   if (a === b)
@@ -66168,11 +66210,11 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
     };
   });
 }
-function setAtPath(target, path2, value) {
-  if (path2.length === 0) {
+function setAtPath(target, path3, value) {
+  if (path3.length === 0) {
     return;
   }
-  const segments = path2.split(".");
+  const segments = path3.split(".");
   let cursor = target;
   for (let i = 0; i < segments.length - 1; i++) {
     const key = segments[i];
@@ -66762,7 +66804,7 @@ Acquiring lock for stack ${stackName}...`);
                   logger.debug(
                     `  \u23F3 Retrying delete ${logicalId} in ${delay2 / 1e3}s (attempt ${attempt + 1}/${maxAttempts})`
                   );
-                  await new Promise((resolve5) => setTimeout(resolve5, delay2));
+                  await new Promise((resolve6) => setTimeout(resolve6, delay2));
                 }
               }
               if (lastDeleteError)
@@ -67072,19 +67114,19 @@ function buildCdkPathIndex(template) {
   for (const [logicalId, resource] of Object.entries(template.Resources)) {
     if (resource.Type === "AWS::CDK::Metadata")
       continue;
-    const path2 = readCdkPath(resource);
-    if (path2)
-      index.set(path2, logicalId);
+    const path3 = readCdkPath(resource);
+    if (path3)
+      index.set(path3, logicalId);
   }
   return index;
 }
 function resolveCdkPathToLogicalIds(input, index) {
   const seen = /* @__PURE__ */ new Map();
   const prefix = `${input}/`;
-  for (const [path2, logicalId] of index) {
-    if (path2 === input || path2.startsWith(prefix)) {
+  for (const [path3, logicalId] of index) {
+    if (path3 === input || path3.startsWith(prefix)) {
       if (!seen.has(logicalId))
-        seen.set(logicalId, path2);
+        seen.set(logicalId, path3);
     }
   }
   return [...seen.entries()].map(([logicalId, cdkPath]) => ({ logicalId, cdkPath }));
@@ -69992,11 +70034,11 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 }
 
 // src/cli/commands/local-invoke.ts
-import { mkdtempSync as mkdtempSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync6, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname2 } from "node:path";
-import * as path from "node:path";
-import { Command as Command14, Option as Option7 } from "commander";
+import { mkdtempSync as mkdtempSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname3 } from "node:path";
+import * as path2 from "node:path";
+import { Command as Command15, Option as Option8 } from "commander";
 
 // src/local/lambda-resolver.ts
 import { existsSync as existsSync4, statSync as statSync3 } from "node:fs";
@@ -70661,41 +70703,6 @@ function runForeground(cmd, args) {
 
 // src/local/docker-image-builder.ts
 import { createHash as createHash2 } from "node:crypto";
-async function buildContainerImage(asset, cdkOutDir, options) {
-  const tag = computeLocalTag(asset.source);
-  const platform = architectureToPlatform(options.architecture);
-  const logger = getLogger().child("local-invoke-build");
-  logger.info(`Building container image (platform=${platform})...`);
-  logger.debug(`Local tag: ${tag}`);
-  await buildDockerImage(asset, cdkOutDir, tag, {
-    platform,
-    wrapError: (stderr) => new LocalInvokeBuildError(
-      `docker build failed for container Lambda asset (${asset.source.directory}): ${stderr}`
-    )
-  });
-  return tag;
-}
-function architectureToPlatform(architecture) {
-  return architecture === "arm64" ? "linux/arm64" : "linux/amd64";
-}
-function computeLocalTag(source) {
-  const hash = createHash2("sha256");
-  hash.update(source.directory);
-  hash.update("\0");
-  hash.update(source.dockerFile ?? "");
-  hash.update("\0");
-  hash.update(source.dockerBuildTarget ?? "");
-  hash.update("\0");
-  if (source.dockerBuildArgs) {
-    for (const [k, v] of Object.entries(source.dockerBuildArgs)) {
-      hash.update(k);
-      hash.update("=");
-      hash.update(v);
-      hash.update("\0");
-    }
-  }
-  return `cdkd-local-invoke-${hash.digest("hex").slice(0, 16)}`;
-}
 
 // src/local/ecr-puller.ts
 import { execFile as execFile4, spawn as spawn4 } from "node:child_process";
@@ -70773,7 +70780,7 @@ async function ecrLogin(client, accountId, region) {
   const token = Buffer.from(authData.authorizationToken, "base64").toString();
   const [username, password] = token.split(":");
   const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.amazonaws.com`;
-  await new Promise((resolve5, reject) => {
+  await new Promise((resolve6, reject) => {
     const proc = spawn4("docker", ["login", "--username", username, "--password-stdin", endpoint], {
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -70783,7 +70790,7 @@ async function ecrLogin(client, accountId, region) {
     });
     proc.on("close", (code) => {
       if (code === 0)
-        resolve5();
+        resolve6();
       else
         reject(new LocalInvokeBuildError(`ECR login failed: ${stderr.trim()}`));
     });
@@ -70803,19 +70810,74 @@ async function verifyImageInLocalCache(imageUri) {
     );
   }
 }
+async function isImageInLocalCache(imageRef) {
+  try {
+    await execFileAsync4("docker", ["image", "inspect", imageRef]);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function runForeground2(cmd, args) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const proc = spawn4(cmd, args, { stdio: "inherit" });
     proc.on("error", (err) => reject(new LocalInvokeBuildError(`${cmd} failed: ${err.message}`)));
     proc.on("close", (code) => {
       if (code === 0)
-        resolve5();
+        resolve6();
       else
         reject(new LocalInvokeBuildError(`${cmd} exited with code ${code}`));
     });
   });
 }
 
+// src/local/docker-image-builder.ts
+async function buildContainerImage(asset, cdkOutDir, options) {
+  const tag = computeLocalTag(asset.source);
+  const platform = architectureToPlatform(options.architecture);
+  const logger = getLogger().child("local-invoke-build");
+  if (options.noBuild === true) {
+    logger.info(`Skipping docker build (--no-build). Verifying ${tag} is in local registry...`);
+    if (!await isImageInLocalCache(tag)) {
+      throw new LocalInvokeBuildError(
+        `image '${tag}' not in local registry and --no-build is set; remove --no-build or run \`docker build\` manually first.`
+      );
+    }
+    logger.debug(`Local tag ${tag} is cached; skipping build.`);
+    return tag;
+  }
+  logger.info(`Building container image (platform=${platform})...`);
+  logger.debug(`Local tag: ${tag}`);
+  await buildDockerImage(asset, cdkOutDir, tag, {
+    platform,
+    wrapError: (stderr) => new LocalInvokeBuildError(
+      `docker build failed for container Lambda asset (${asset.source.directory}): ${stderr}`
+    )
+  });
+  return tag;
+}
+function architectureToPlatform(architecture) {
+  return architecture === "arm64" ? "linux/arm64" : "linux/amd64";
+}
+function computeLocalTag(source) {
+  const hash = createHash2("sha256");
+  hash.update(source.directory);
+  hash.update("\0");
+  hash.update(source.dockerFile ?? "");
+  hash.update("\0");
+  hash.update(source.dockerBuildTarget ?? "");
+  hash.update("\0");
+  if (source.dockerBuildArgs) {
+    for (const [k, v] of Object.entries(source.dockerBuildArgs)) {
+      hash.update(k);
+      hash.update("=");
+      hash.update(v);
+      hash.update("\0");
+    }
+  }
+  return `cdkd-local-invoke-${hash.digest("hex").slice(0, 16)}`;
+}
+
 // src/local/rie-client.ts
 import { setTimeout as delay } from "node:timers/promises";
 var INVOKE_PATH = "/2015-03-31/functions/function/invocations";
@@ -71025,6 +71087,1657 @@ function extractHashFromImageUri(imageUri) {
 
 // src/cli/commands/local-invoke.ts
 init_aws_clients();
+
+// src/cli/commands/local-start-api.ts
+import { mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import * as path from "node:path";
+import { Command as Command14, Option as Option7 } from "commander";
+
+// src/local/route-discovery.ts
+function discoverRoutes(stacks) {
+  const routes = [];
+  const errors = [];
+  for (const stack of stacks) {
+    const template = stack.template;
+    const resources = template.Resources ?? {};
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      try {
+        switch (resource.Type) {
+          case "AWS::ApiGateway::Method":
+            routes.push(...discoverRestV1Method(logicalId, resource, template, stack.stackName));
+            break;
+          case "AWS::ApiGatewayV2::Route":
+            routes.push(...discoverHttpApiRoute(logicalId, resource, template, stack.stackName));
+            break;
+          case "AWS::Lambda::Url":
+            routes.push(...discoverFunctionUrl(logicalId, resource, stack.stackName));
+            break;
+          default:
+            break;
+        }
+      } catch (err) {
+        errors.push(err instanceof Error ? err.message : String(err));
+      }
+    }
+  }
+  if (errors.length > 0) {
+    throw new RouteDiscoveryError(
+      `cdkd local start-api: ${errors.length} unsupported route(s) in the synthesized template:
+` + errors.map((e) => `  - ${e}`).join("\n")
+    );
+  }
+  return routes;
+}
+function discoverRestV1Method(logicalId, resource, template, stackName) {
+  const props = resource.Properties ?? {};
+  const integration = props["Integration"];
+  if (!integration) {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGateway::Method): missing Integration property`
+    );
+  }
+  const integrationType = integration["Type"];
+  if (integrationType !== "AWS_PROXY") {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGateway::Method): integration type '${String(
+        integrationType
+      )}' is not supported (only AWS_PROXY). MOCK / AWS / HTTP / HTTP_PROXY require mapping templates that cdkd cannot emulate.`
+    );
+  }
+  const integrationUri = integration["Uri"];
+  const lambdaLogicalId = resolveLambdaArnIntrinsic(
+    integrationUri,
+    `${stackName}/${logicalId}.Integration.Uri`
+  );
+  const restApiId = props["RestApiId"];
+  const restApiLogicalId = pickRefLogicalId(restApiId);
+  if (!restApiLogicalId) {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGateway::Method): RestApiId must be a { Ref: '...' } reference (got ${shortJson(
+        restApiId
+      )}).`
+    );
+  }
+  const resourceId = props["ResourceId"];
+  const path3 = buildRestV1Path(resourceId, restApiLogicalId, template, stackName, logicalId);
+  const httpMethod = String(props["HttpMethod"] ?? "ANY");
+  const stage = pickRestV1Stage(restApiLogicalId, template);
+  return [
+    {
+      method: httpMethod,
+      pathPattern: path3,
+      lambdaLogicalId,
+      source: "rest-v1",
+      apiVersion: "v1",
+      stage,
+      declaredAt: `${stackName}/${logicalId}`
+    }
+  ];
+}
+function buildRestV1Path(resourceIdIntrinsic, restApiLogicalId, template, stackName, methodLogicalId) {
+  if (resourceIdIntrinsic && typeof resourceIdIntrinsic === "object" && !Array.isArray(resourceIdIntrinsic)) {
+    const obj = resourceIdIntrinsic;
+    if ("Fn::GetAtt" in obj) {
+      const arg = obj["Fn::GetAtt"];
+      if (Array.isArray(arg) && arg.length === 2 && arg[1] === "RootResourceId") {
+        return "/";
+      }
+    }
+  }
+  const resourceLogicalId = pickRefLogicalId(resourceIdIntrinsic);
+  if (!resourceLogicalId) {
+    throw new Error(
+      `${stackName}/${methodLogicalId}: ResourceId must be { Ref: '...' } or { 'Fn::GetAtt': [..., 'RootResourceId'] } (got ${shortJson(
+        resourceIdIntrinsic
+      )}).`
+    );
+  }
+  const segments = [];
+  const visited = /* @__PURE__ */ new Set();
+  let cursor = resourceLogicalId;
+  while (cursor && cursor !== restApiLogicalId) {
+    if (visited.has(cursor)) {
+      throw new Error(
+        `${stackName}/${methodLogicalId}: cycle detected in AWS::ApiGateway::Resource ParentId chain at ${cursor}`
+      );
+    }
+    visited.add(cursor);
+    const node = template.Resources?.[cursor];
+    if (!node) {
+      throw new Error(
+        `${stackName}/${methodLogicalId}: ParentId chain references missing resource '${cursor}'`
+      );
+    }
+    if (node.Type !== "AWS::ApiGateway::Resource") {
+      throw new Error(
+        `${stackName}/${methodLogicalId}: ParentId chain hit ${node.Type} (expected AWS::ApiGateway::Resource or RestApi root)`
+      );
+    }
+    const nodeProps = node.Properties ?? {};
+    const pathPart = nodeProps["PathPart"];
+    if (typeof pathPart !== "string") {
+      throw new Error(
+        `${stackName}/${methodLogicalId}: AWS::ApiGateway::Resource '${cursor}' missing PathPart`
+      );
+    }
+    segments.unshift(pathPart);
+    const parentId = nodeProps["ParentId"];
+    if (parentId && typeof parentId === "object" && !Array.isArray(parentId) && "Fn::GetAtt" in parentId) {
+      const arg = parentId["Fn::GetAtt"];
+      if (Array.isArray(arg) && arg[1] === "RootResourceId")
+        break;
+    }
+    cursor = pickRefLogicalId(parentId) ?? void 0;
+  }
+  return "/" + segments.join("/");
+}
+function pickRestV1Stage(restApiLogicalId, template) {
+  const resources = template.Resources ?? {};
+  for (const [, resource] of Object.entries(resources)) {
+    if (resource.Type !== "AWS::ApiGateway::Stage")
+      continue;
+    const props = resource.Properties ?? {};
+    const ref = pickRefLogicalId(props["RestApiId"]);
+    if (ref === restApiLogicalId) {
+      const stageName = props["StageName"];
+      if (typeof stageName === "string")
+        return stageName;
+    }
+  }
+  return "$default";
+}
+function discoverHttpApiRoute(logicalId, resource, template, stackName) {
+  const props = resource.Properties ?? {};
+  const apiId = props["ApiId"];
+  const apiLogicalId = pickRefLogicalId(apiId);
+  if (!apiLogicalId) {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): ApiId must be { Ref: '...' } (got ${shortJson(
+        apiId
+      )}).`
+    );
+  }
+  const apiResource = template.Resources?.[apiLogicalId];
+  if (apiResource?.Type === "AWS::ApiGatewayV2::Api") {
+    const protocolType = (apiResource.Properties ?? {})["ProtocolType"];
+    if (protocolType === "WEBSOCKET") {
+      throw new Error(
+        `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): WebSocket APIs are not supported in cdkd local start-api (deferred follow-up PR).`
+      );
+    }
+  }
+  const routeKey = props["RouteKey"];
+  if (typeof routeKey !== "string" || routeKey.length === 0) {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): RouteKey must be a string`
+    );
+  }
+  const target = props["Target"];
+  const integrationLogicalId = parseHttpApiTargetIntegration(
+    target,
+    `${stackName}/${logicalId}.Target`
+  );
+  const integration = template.Resources?.[integrationLogicalId];
+  if (!integration || integration.Type !== "AWS::ApiGatewayV2::Integration") {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): Target points at '${integrationLogicalId}' which is not an AWS::ApiGatewayV2::Integration`
+    );
+  }
+  const integrationProps = integration.Properties ?? {};
+  const integrationType = integrationProps["IntegrationType"];
+  if (integrationType !== "AWS_PROXY") {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): integration type '${String(
+        integrationType
+      )}' is not supported (only AWS_PROXY).`
+    );
+  }
+  if (integrationProps["IntegrationSubtype"] !== void 0) {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): IntegrationSubtype '${String(
+        integrationProps["IntegrationSubtype"]
+      )}' is not supported (ApiGatewayV2 service integrations like SQS/EventBridge cannot run locally).`
+    );
+  }
+  const lambdaLogicalId = resolveLambdaArnIntrinsic(
+    integrationProps["IntegrationUri"],
+    `${stackName}/${integrationLogicalId}.IntegrationUri`
+  );
+  const { method, pathPattern } = parseRouteKey(routeKey);
+  return [
+    {
+      method,
+      pathPattern,
+      lambdaLogicalId,
+      source: "http-api",
+      apiVersion: "v2",
+      stage: "$default",
+      declaredAt: `${stackName}/${logicalId}`
+    }
+  ];
+}
+function discoverFunctionUrl(logicalId, resource, stackName) {
+  const props = resource.Properties ?? {};
+  const authType = props["AuthType"];
+  if (authType !== "NONE") {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::Lambda::Url): AuthType '${String(
+        authType
+      )}' is not supported (only NONE \u2014 IAM auth requires SigV4 verification cdkd cannot emulate locally; deferred follow-up PR).`
+    );
+  }
+  const invokeMode = props["InvokeMode"];
+  if (invokeMode === "RESPONSE_STREAM") {
+    throw new Error(
+      `${stackName}/${logicalId} (AWS::Lambda::Url): InvokeMode RESPONSE_STREAM is not supported (deferred follow-up PR).`
+    );
+  }
+  const targetArn = props["TargetFunctionArn"];
+  const lambdaLogicalId = resolveLambdaArnIntrinsic(
+    targetArn,
+    `${stackName}/${logicalId}.TargetFunctionArn`
+  );
+  return [
+    {
+      method: "ANY",
+      pathPattern: "/{proxy+}",
+      lambdaLogicalId,
+      source: "function-url",
+      apiVersion: "v2",
+      stage: "$default",
+      declaredAt: `${stackName}/${logicalId}`
+    }
+  ];
+}
+function resolveLambdaArnIntrinsic(value, location) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const obj = value;
+    if ("Ref" in obj && typeof obj["Ref"] === "string") {
+      return obj["Ref"];
+    }
+    if ("Fn::GetAtt" in obj) {
+      const arg = obj["Fn::GetAtt"];
+      if (Array.isArray(arg) && arg.length === 2 && typeof arg[0] === "string" && arg[1] === "Arn") {
+        return arg[0];
+      }
+    }
+    if ("Fn::Join" in obj) {
+      const join9 = obj["Fn::Join"];
+      if (Array.isArray(join9) && join9.length === 2 && Array.isArray(join9[1])) {
+        const parts = join9[1];
+        const literalParts = parts.filter((p) => typeof p === "string").join("");
+        if (literalParts.includes(":lambda:path/2015-03-31/functions/")) {
+          for (const p of parts) {
+            if (p && typeof p === "object" && !Array.isArray(p)) {
+              const inner = p;
+              const arg = inner["Fn::GetAtt"];
+              if (Array.isArray(arg) && arg.length === 2 && typeof arg[0] === "string" && arg[1] === "Arn") {
+                return arg[0];
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  throw new Error(
+    `${location}: only { Ref: <LambdaLogicalId> }, { 'Fn::GetAtt': [<LambdaLogicalId>, 'Arn'] }, or the REST v1 invoke-ARN Fn::Join wrapper are supported (got ${shortJson(
+      value
+    )}). Other intrinsics (Fn::Sub against arbitrary templates, etc.) require deploy-state and are not supported in cdkd local start-api.`
+  );
+}
+function parseHttpApiTargetIntegration(target, location) {
+  if (typeof target === "string") {
+    const m = /^integrations\/(.+)$/.exec(target);
+    if (m)
+      return m[1];
+    throw new Error(`${location}: literal Target '${target}' must start with 'integrations/'`);
+  }
+  if (target && typeof target === "object" && !Array.isArray(target)) {
+    const obj = target;
+    const join9 = obj["Fn::Join"];
+    if (Array.isArray(join9) && join9.length === 2 && Array.isArray(join9[1])) {
+      const sep = join9[0];
+      const parts = join9[1];
+      if (sep === "/" && parts.length === 2 && parts[0] === "integrations") {
+        const ref = pickRefLogicalId(parts[1]);
+        if (ref)
+          return ref;
+      }
+      if (sep === "" && parts.length === 2 && parts[0] === "integrations/") {
+        const ref = pickRefLogicalId(parts[1]);
+        if (ref)
+          return ref;
+      }
+    }
+  }
+  throw new Error(
+    `${location}: Target must be 'integrations/<id>' or Fn::Join with one of the documented shapes (got ${shortJson(
+      target
+    )}).`
+  );
+}
+function parseRouteKey(routeKey) {
+  if (routeKey === "$default") {
+    return { method: "ANY", pathPattern: "$default" };
+  }
+  const m = /^([A-Za-z]+)\s+(\S+)$/.exec(routeKey);
+  if (!m) {
+    throw new Error(
+      `RouteKey '${routeKey}' is malformed: expected '<METHOD> <path>' (e.g. 'GET /items/{id}') or '$default'.`
+    );
+  }
+  return { method: m[1].toUpperCase(), pathPattern: m[2] };
+}
+function pickRefLogicalId(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const ref = value["Ref"];
+    if (typeof ref === "string")
+      return ref;
+  }
+  return null;
+}
+function shortJson(value) {
+  try {
+    const s = JSON.stringify(value);
+    return s.length > 200 ? `${s.slice(0, 200)}\u2026` : s;
+  } catch {
+    return String(value);
+  }
+}
+
+// src/local/container-pool.ts
+var DEFAULT_IDLE_MS = 6e4;
+var MAX_PER_LAMBDA_CONCURRENCY = 4;
+var MIN_PER_LAMBDA_CONCURRENCY = 1;
+function createContainerPool(specs, options) {
+  const logger = getLogger().child("container-pool");
+  const concurrencyCap = clampConcurrency(options.perLambdaConcurrency);
+  const idleMs = options.idleMs ?? DEFAULT_IDLE_MS;
+  const streamingEnabled = options.streamLogs !== false;
+  const entries = /* @__PURE__ */ new Map();
+  const inFlightStarts = /* @__PURE__ */ new Set();
+  for (const logicalId of specs.keys()) {
+    entries.set(logicalId, emptyEntry(logicalId));
+  }
+  function emptyEntry(logicalId) {
+    return {
+      logicalId,
+      warm: [],
+      inUse: /* @__PURE__ */ new Set(),
+      waitQueue: [],
+      idleTimer: null,
+      growthMutex: Promise.resolve()
+    };
+  }
+  async function startOne(spec) {
+    const image = resolveRuntimeImage(spec.lambda.runtime);
+    const hostPort = await pickFreePort();
+    const name = `cdkd-local-${spec.lambda.logicalId}-${process.pid}-${Math.floor(
+      Math.random() * 1e6
+    )}`;
+    logger.debug(
+      `Starting container ${name} for ${spec.lambda.logicalId} on ${spec.containerHost}:${hostPort}`
+    );
+    const containerId = await runDetached({
+      image,
+      mounts: [{ hostPath: spec.codeDir, containerPath: "/var/task", readOnly: true }],
+      env: spec.env,
+      cmd: [spec.lambda.handler],
+      hostPort,
+      host: spec.containerHost,
+      name,
+      ...spec.debugPort !== void 0 && { debugPort: spec.debugPort }
+    });
+    const stopLogStream = streamingEnabled ? streamLogs(containerId) : () => void 0;
+    try {
+      await waitForRieReady(spec.containerHost, hostPort, 3e4);
+    } catch (err) {
+      stopLogStream();
+      await removeContainer(containerId).catch(() => void 0);
+      throw err;
+    }
+    return {
+      logicalId: spec.lambda.logicalId,
+      containerId,
+      containerName: name,
+      hostPort,
+      containerHost: spec.containerHost,
+      stopLogStream
+    };
+  }
+  async function withMutex(entry, body) {
+    const previous = entry.growthMutex;
+    let release;
+    entry.growthMutex = new Promise((r) => release = r);
+    try {
+      await previous;
+      return await body();
+    } finally {
+      release();
+    }
+  }
+  async function tearDown(handle) {
+    try {
+      handle.stopLogStream();
+    } catch (err) {
+      logger.debug(
+        `stopLogStream(${handle.containerName}) failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    try {
+      await removeContainer(handle.containerId);
+    } catch (err) {
+      logger.warn(
+        `Failed to remove container ${handle.containerName}: ${err instanceof Error ? err.message : String(err)}. Continuing cleanup.`
+      );
+    }
+  }
+  function poolSize(entry) {
+    return entry.warm.length + entry.inUse.size;
+  }
+  function resetIdleTimer(entry) {
+    if (entry.idleTimer) {
+      clearTimeout(entry.idleTimer);
+      entry.idleTimer = null;
+    }
+    if (entry.warm.length === 0)
+      return;
+    entry.idleTimer = setTimeout(() => {
+      void gcIdle(entry);
+    }, idleMs);
+    entry.idleTimer.unref?.();
+  }
+  async function gcIdle(entry) {
+    const handles = entry.warm.splice(0, entry.warm.length);
+    entry.idleTimer = null;
+    if (handles.length === 0)
+      return;
+    logger.debug(`Idle GC: tearing down ${handles.length} container(s) for ${entry.logicalId}`);
+    await Promise.allSettled(handles.map((h) => tearDown(h)));
+  }
+  return {
+    async acquire(logicalId) {
+      const entry = entries.get(logicalId);
+      if (!entry) {
+        throw new Error(
+          `containerPool.acquire: no spec registered for Lambda '${logicalId}'. This is a bug \u2014 every reachable route's Lambda should be registered at server boot.`
+        );
+      }
+      if (entry.warm.length > 0) {
+        const handle = entry.warm.shift();
+        entry.inUse.add(handle);
+        if (entry.idleTimer) {
+          clearTimeout(entry.idleTimer);
+          entry.idleTimer = null;
+        }
+        return handle;
+      }
+      return await withMutex(entry, async () => {
+        if (entry.warm.length > 0) {
+          const handle = entry.warm.shift();
+          entry.inUse.add(handle);
+          return handle;
+        }
+        if (poolSize(entry) < concurrencyCap) {
+          const spec = specs.get(logicalId);
+          const startPromise = startOne(spec);
+          inFlightStarts.add(startPromise);
+          let handle;
+          try {
+            handle = await startPromise;
+          } finally {
+            inFlightStarts.delete(startPromise);
+          }
+          entry.inUse.add(handle);
+          return handle;
+        }
+        return await new Promise((resolveAcquire, rejectAcquire) => {
+          entry.waitQueue.push({ resolve: resolveAcquire, reject: rejectAcquire });
+        });
+      });
+    },
+    release(handle) {
+      const entry = entries.get(handle.logicalId);
+      if (!entry)
+        return;
+      entry.inUse.delete(handle);
+      const waiter = entry.waitQueue.shift();
+      if (waiter) {
+        entry.inUse.add(handle);
+        waiter.resolve(handle);
+        return;
+      }
+      entry.warm.push(handle);
+      resetIdleTimer(entry);
+    },
+    async dispose() {
+      logger.debug("Disposing container pool");
+      const allHandles = [];
+      for (const entry of entries.values()) {
+        if (entry.idleTimer) {
+          clearTimeout(entry.idleTimer);
+          entry.idleTimer = null;
+        }
+        for (const waiter of entry.waitQueue.splice(0, entry.waitQueue.length)) {
+          try {
+            waiter.reject(
+              new Error(`Container pool disposed while ${entry.logicalId} was waiting`)
+            );
+          } catch {
+          }
+        }
+        allHandles.push(...entry.warm.splice(0, entry.warm.length));
+        for (const h of entry.inUse)
+          allHandles.push(h);
+        entry.inUse.clear();
+      }
+      const startPromises = [...inFlightStarts];
+      if (startPromises.length > 0) {
+        logger.debug(
+          `Waiting for ${startPromises.length} in-flight container start(s) to settle before teardown`
+        );
+        const drainTimeoutMs = 5e3;
+        const wrapped = startPromises.map(
+          (p) => Promise.race([
+            p.then((h) => ({ kind: "ok", handle: h })),
+            new Promise((r) => {
+              const t = setTimeout(() => r({ kind: "timeout" }), drainTimeoutMs);
+              t.unref?.();
+            })
+          ]).catch((err) => {
+            logger.debug(
+              `In-flight startOne rejected during dispose: ${err instanceof Error ? err.message : String(err)}`
+            );
+            return { kind: "rejected" };
+          })
+        );
+        const results = await Promise.all(wrapped);
+        let timedOut = 0;
+        for (const r of results) {
+          if (r.kind === "ok") {
+            allHandles.push(r.handle);
+          } else if (r.kind === "timeout") {
+            timedOut++;
+          }
+        }
+        if (timedOut > 0) {
+          logger.warn(
+            `Container pool disposed with ${timedOut} in-flight start(s) still pending after ${drainTimeoutMs}ms; relying on docker --rm + the verify.sh sweep to clean up.`
+          );
+        }
+        inFlightStarts.clear();
+      }
+      await Promise.allSettled(allHandles.map((h) => tearDown(h)));
+      entries.clear();
+    }
+  };
+}
+function clampConcurrency(input) {
+  if (!Number.isFinite(input))
+    return 2;
+  return Math.min(
+    MAX_PER_LAMBDA_CONCURRENCY,
+    Math.max(MIN_PER_LAMBDA_CONCURRENCY, Math.trunc(input))
+  );
+}
+
+// src/local/http-server.ts
+import { createServer as createServer2 } from "node:http";
+
+// src/local/api-gateway-event.ts
+import { randomUUID } from "node:crypto";
+var MOCK_ACCOUNT_ID = "123456789012";
+var MOCK_DOMAIN_PREFIX = "local";
+var MOCK_DOMAIN_NAME = "localhost";
+var MOCK_API_ID = "local";
+function buildHttpApiV2Event(req, ctx, opts = {}) {
+  const { rawPath, rawQueryString } = splitRawUrl(req.rawUrl);
+  const { headers, cookies } = normalizeHeadersV2(req.headers);
+  const queryStringParameters = parseQueryStringV2(rawQueryString);
+  const userAgent = headers["user-agent"] ?? "";
+  const contentType = headers["content-type"] ?? "";
+  const { body, isBase64Encoded } = encodeBody(req.body, contentType);
+  const now = opts.now ? opts.now() : /* @__PURE__ */ new Date();
+  const routeKey = ctx.route.pathPattern === "$default" ? "$default" : `${ctx.route.method} ${ctx.route.pathPattern}`;
+  const event = {
+    version: "2.0",
+    routeKey,
+    rawPath,
+    rawQueryString,
+    cookies,
+    headers,
+    queryStringParameters,
+    pathParameters: decodePathParameters(ctx.pathParameters),
+    stageVariables: null,
+    requestContext: {
+      accountId: MOCK_ACCOUNT_ID,
+      apiId: MOCK_API_ID,
+      domainName: MOCK_DOMAIN_NAME,
+      domainPrefix: MOCK_DOMAIN_PREFIX,
+      http: {
+        method: req.method.toUpperCase(),
+        path: ctx.matchedPath,
+        protocol: "HTTP/1.1",
+        sourceIp: req.sourceIp ?? "127.0.0.1",
+        userAgent
+      },
+      requestId: randomUUID(),
+      routeKey,
+      stage: ctx.route.stage,
+      time: formatRequestTime(now),
+      timeEpoch: now.getTime(),
+      authentication: null,
+      authorizer: null
+    },
+    body,
+    isBase64Encoded
+  };
+  return event;
+}
+function buildRestV1Event(req, ctx, opts = {}) {
+  const { rawPath, rawQueryString } = splitRawUrl(req.rawUrl);
+  const { singular: headers, multi: multiValueHeaders } = normalizeHeadersV1(req.headers);
+  const { singular: queryStringParameters, multi: multiValueQueryStringParameters } = parseQueryStringV1(rawQueryString);
+  const contentType = headers["content-type"] ?? "";
+  const { body, isBase64Encoded } = encodeBody(req.body, contentType);
+  const now = opts.now ? opts.now() : /* @__PURE__ */ new Date();
+  const pathParams = decodePathParameters(ctx.pathParameters);
+  const event = {
+    resource: ctx.route.pathPattern,
+    path: ctx.matchedPath,
+    httpMethod: req.method.toUpperCase(),
+    headers,
+    multiValueHeaders,
+    queryStringParameters: Object.keys(queryStringParameters).length > 0 ? queryStringParameters : null,
+    multiValueQueryStringParameters: Object.keys(multiValueQueryStringParameters).length > 0 ? multiValueQueryStringParameters : null,
+    pathParameters: Object.keys(pathParams).length > 0 ? pathParams : null,
+    stageVariables: null,
+    requestContext: {
+      accountId: MOCK_ACCOUNT_ID,
+      apiId: MOCK_API_ID,
+      domainName: MOCK_DOMAIN_NAME,
+      domainPrefix: MOCK_DOMAIN_PREFIX,
+      httpMethod: req.method.toUpperCase(),
+      identity: {
+        sourceIp: req.sourceIp ?? "127.0.0.1",
+        userAgent: headers["user-agent"] ?? ""
+      },
+      path: `/${ctx.route.stage}${ctx.matchedPath}`,
+      protocol: "HTTP/1.1",
+      requestId: randomUUID(),
+      requestTime: formatRequestTime(now),
+      requestTimeEpoch: now.getTime(),
+      resourcePath: ctx.route.pathPattern,
+      stage: ctx.route.stage,
+      authorizer: null
+    },
+    body: req.body.length === 0 ? null : body,
+    isBase64Encoded
+  };
+  return event;
+}
+function splitRawUrl(rawUrl) {
+  const q = rawUrl.indexOf("?");
+  if (q === -1)
+    return { rawPath: rawUrl, rawQueryString: "" };
+  return { rawPath: rawUrl.slice(0, q), rawQueryString: rawUrl.slice(q + 1) };
+}
+function normalizeHeadersV2(rawHeaders) {
+  const headers = {};
+  let cookies = [];
+  for (const [name, values] of Object.entries(rawHeaders)) {
+    const lower = name.toLowerCase();
+    if (lower === "cookie") {
+      cookies = values.flatMap((v) => v.split(";")).map((s) => s.trim()).filter((s) => s.length > 0);
+      continue;
+    }
+    headers[lower] = values.join(",");
+  }
+  return { headers, cookies };
+}
+function normalizeHeadersV1(rawHeaders) {
+  const singular = {};
+  const multi = {};
+  for (const [name, values] of Object.entries(rawHeaders)) {
+    const lower = name.toLowerCase();
+    if (values.length === 0)
+      continue;
+    multi[lower] = [...values];
+    singular[lower] = values[values.length - 1];
+  }
+  return { singular, multi };
+}
+function parseQueryStringV2(rawQueryString) {
+  if (rawQueryString.length === 0)
+    return {};
+  const out = {};
+  for (const pair of rawQueryString.split("&")) {
+    if (pair.length === 0)
+      continue;
+    const eq = pair.indexOf("=");
+    const rawKey = eq === -1 ? pair : pair.slice(0, eq);
+    const rawValue = eq === -1 ? "" : pair.slice(eq + 1);
+    const key = safeDecode(rawKey);
+    const value = safeDecode(rawValue);
+    if (!out[key])
+      out[key] = [];
+    out[key].push(value);
+  }
+  const result = {};
+  for (const [k, vs] of Object.entries(out))
+    result[k] = vs.join(",");
+  return result;
+}
+function parseQueryStringV1(rawQueryString) {
+  const multi = {};
+  if (rawQueryString.length > 0) {
+    for (const pair of rawQueryString.split("&")) {
+      if (pair.length === 0)
+        continue;
+      const eq = pair.indexOf("=");
+      const rawKey = eq === -1 ? pair : pair.slice(0, eq);
+      const rawValue = eq === -1 ? "" : pair.slice(eq + 1);
+      const key = safeDecode(rawKey);
+      const value = safeDecode(rawValue);
+      if (!multi[key])
+        multi[key] = [];
+      multi[key].push(value);
+    }
+  }
+  const singular = {};
+  for (const [k, vs] of Object.entries(multi)) {
+    if (vs.length > 0)
+      singular[k] = vs[vs.length - 1];
+  }
+  return { singular, multi };
+}
+function decodePathParameters(pathParameters) {
+  const out = {};
+  for (const [k, v] of Object.entries(pathParameters)) {
+    out[k] = safeDecode(v);
+  }
+  return out;
+}
+function safeDecode(s) {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return s;
+  }
+}
+function encodeBody(body, contentType) {
+  if (body.length === 0) {
+    return { body: "", isBase64Encoded: false };
+  }
+  if (isTextualContentType(contentType)) {
+    return { body: body.toString("utf-8"), isBase64Encoded: false };
+  }
+  return { body: body.toString("base64"), isBase64Encoded: true };
+}
+var TEXT_PREFIXES = [
+  "text/",
+  "application/json",
+  "application/xml",
+  "application/javascript",
+  "application/x-www-form-urlencoded",
+  "application/graphql"
+];
+function isTextualContentType(contentType) {
+  if (!contentType)
+    return false;
+  const lower = contentType.toLowerCase();
+  return TEXT_PREFIXES.some((p) => lower.startsWith(p));
+}
+function formatRequestTime(d) {
+  const months = [
+    "Jan",
+    "Feb",
+    "Mar",
+    "Apr",
+    "May",
+    "Jun",
+    "Jul",
+    "Aug",
+    "Sep",
+    "Oct",
+    "Nov",
+    "Dec"
+  ];
+  const dd = String(d.getUTCDate()).padStart(2, "0");
+  const mmm = months[d.getUTCMonth()];
+  const yyyy = d.getUTCFullYear();
+  const HH = String(d.getUTCHours()).padStart(2, "0");
+  const MM = String(d.getUTCMinutes()).padStart(2, "0");
+  const SS = String(d.getUTCSeconds()).padStart(2, "0");
+  return `${dd}/${mmm}/${yyyy}:${HH}:${MM}:${SS} +0000`;
+}
+
+// src/local/api-gateway-response.ts
+function translateLambdaResponse(payload, version) {
+  if (isErrorEnvelope(payload)) {
+    return errorEnvelopeResponse();
+  }
+  if (isShapedResponse(payload)) {
+    return translateShapedResponse(payload, version);
+  }
+  return autoFormatResponse(payload);
+}
+function isErrorEnvelope(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return false;
+  const obj = payload;
+  if ("statusCode" in obj)
+    return false;
+  return typeof obj["errorMessage"] === "string";
+}
+function isShapedResponse(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return false;
+  const status = payload["statusCode"];
+  return typeof status === "number";
+}
+function errorEnvelopeResponse() {
+  const body = Buffer.from('{"message":"Internal server error"}', "utf-8");
+  return {
+    statusCode: 502,
+    headers: {
+      "content-type": "application/json",
+      "content-length": String(body.length)
+    },
+    cookies: [],
+    body
+  };
+}
+function translateShapedResponse(payload, version) {
+  const statusCode = Number(payload["statusCode"]);
+  const isBase64 = payload["isBase64Encoded"] === true;
+  const rawBody = payload["body"];
+  let body;
+  if (rawBody === void 0 || rawBody === null) {
+    body = Buffer.alloc(0);
+  } else if (typeof rawBody === "string") {
+    body = isBase64 ? Buffer.from(rawBody, "base64") : Buffer.from(rawBody, "utf-8");
+  } else {
+    body = Buffer.from(JSON.stringify(rawBody), "utf-8");
+  }
+  const headers = {};
+  const cookies = [];
+  const headersIn = payload["headers"];
+  if (headersIn && typeof headersIn === "object" && !Array.isArray(headersIn)) {
+    for (const [name, value] of Object.entries(headersIn)) {
+      const lower = name.toLowerCase();
+      const stringValue = stringifyHeaderValue(value);
+      if (lower === "set-cookie") {
+        cookies.push(stringValue);
+        continue;
+      }
+      headers[lower] = stringValue;
+    }
+  }
+  if (version === "v1") {
+    const mvh = payload["multiValueHeaders"];
+    if (mvh && typeof mvh === "object" && !Array.isArray(mvh)) {
+      for (const [name, values] of Object.entries(mvh)) {
+        if (!Array.isArray(values))
+          continue;
+        const lower = name.toLowerCase();
+        const stringified = values.map((v) => stringifyHeaderValue(v));
+        if (lower === "set-cookie") {
+          for (const c of stringified)
+            cookies.push(c);
+          continue;
+        }
+        headers[lower] = stringified.join(",");
+      }
+    }
+  }
+  if (version === "v2") {
+    const cookieList = payload["cookies"];
+    if (Array.isArray(cookieList)) {
+      for (const c of cookieList) {
+        if (typeof c === "string")
+          cookies.push(c);
+      }
+    }
+  }
+  if (!("content-length" in headers)) {
+    headers["content-length"] = String(body.length);
+  }
+  return { statusCode, headers, cookies, body };
+}
+function autoFormatResponse(payload) {
+  const body = payload === void 0 ? Buffer.alloc(0) : Buffer.from(JSON.stringify(payload), "utf-8");
+  return {
+    statusCode: 200,
+    headers: {
+      "content-type": "application/json",
+      "content-length": String(body.length)
+    },
+    cookies: [],
+    body
+  };
+}
+function stringifyHeaderValue(value) {
+  if (value === null || value === void 0)
+    return "";
+  if (Array.isArray(value))
+    return value.map((v) => String(v)).join(",");
+  return String(value);
+}
+
+// src/local/route-matcher.ts
+function matchRoute(method, requestPath, routes) {
+  const methodUpper = method.toUpperCase();
+  const normalizedPath = requestPath.length > 1 ? requestPath.replace(/\/+$/, "") : requestPath;
+  const requestSegments = splitPath(normalizedPath);
+  let bestFull = null;
+  for (const route of routes) {
+    if (!methodMatches(route.method, methodUpper))
+      continue;
+    if (route.pathPattern === "$default")
+      continue;
+    if (isProxyRoute(route.pathPattern))
+      continue;
+    const result = matchFullPattern(requestSegments, route.pathPattern);
+    if (!result)
+      continue;
+    if (!bestFull || result.literalCount > bestFull.literalCount) {
+      bestFull = {
+        route,
+        pathParameters: result.pathParameters,
+        literalCount: result.literalCount
+      };
+    }
+  }
+  if (bestFull)
+    return { route: bestFull.route, pathParameters: bestFull.pathParameters };
+  let bestProxy = null;
+  for (const route of routes) {
+    if (!methodMatches(route.method, methodUpper))
+      continue;
+    if (route.pathPattern === "$default")
+      continue;
+    if (!isProxyRoute(route.pathPattern))
+      continue;
+    const result = matchProxyPattern(requestSegments, route.pathPattern);
+    if (!result)
+      continue;
+    if (!bestProxy || result.literalCount > bestProxy.literalCount) {
+      bestProxy = {
+        route,
+        pathParameters: result.pathParameters,
+        literalCount: result.literalCount
+      };
+    }
+  }
+  if (bestProxy)
+    return { route: bestProxy.route, pathParameters: bestProxy.pathParameters };
+  for (const route of routes) {
+    if (!methodMatches(route.method, methodUpper))
+      continue;
+    if (route.pathPattern === "$default")
+      return { route, pathParameters: {} };
+  }
+  return null;
+}
+function splitPath(path3) {
+  return path3.split("/").filter((s) => s.length > 0);
+}
+function methodMatches(routeMethod, requestMethodUpper) {
+  if (routeMethod === "ANY")
+    return true;
+  return routeMethod.toUpperCase() === requestMethodUpper;
+}
+function isProxyRoute(pattern) {
+  return /\/\{[^/{}]+\+\}$/.test(pattern) || pattern === "/{proxy+}";
+}
+function matchFullPattern(requestSegments, pattern) {
+  const patternSegments = splitPath(pattern);
+  if (patternSegments.length !== requestSegments.length)
+    return null;
+  const pathParameters = {};
+  let literalCount = 0;
+  for (let i = 0; i < patternSegments.length; i++) {
+    const ps = patternSegments[i];
+    const rs = requestSegments[i];
+    if (isPlaceholder(ps)) {
+      const name = ps.slice(1, -1);
+      pathParameters[name] = rs;
+    } else if (ps === rs) {
+      literalCount++;
+    } else {
+      return null;
+    }
+  }
+  return { pathParameters, literalCount };
+}
+function matchProxyPattern(requestSegments, pattern) {
+  const patternSegments = splitPath(pattern);
+  if (patternSegments.length === 0)
+    return null;
+  const tail = patternSegments[patternSegments.length - 1];
+  if (!/^\{[^/{}]+\+\}$/.test(tail))
+    return null;
+  const proxyName = tail.slice(1, -2);
+  const fixedPrefixLen = patternSegments.length - 1;
+  if (requestSegments.length < fixedPrefixLen)
+    return null;
+  const pathParameters = {};
+  let literalCount = 0;
+  for (let i = 0; i < fixedPrefixLen; i++) {
+    const ps = patternSegments[i];
+    const rs = requestSegments[i];
+    if (isPlaceholder(ps)) {
+      pathParameters[ps.slice(1, -1)] = rs;
+    } else if (ps === rs) {
+      literalCount++;
+    } else {
+      return null;
+    }
+  }
+  pathParameters[proxyName] = requestSegments.slice(fixedPrefixLen).join("/");
+  return { pathParameters, literalCount };
+}
+function isPlaceholder(segment) {
+  return /^\{[^/{}+]+\}$/.test(segment);
+}
+
+// src/local/http-server.ts
+async function startApiServer(opts) {
+  const logger = getLogger().child("start-api");
+  const server = createServer2((req, res) => {
+    handleRequest(req, res, opts).catch((err) => {
+      logger.error(
+        `Unhandled request error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`
+      );
+      if (!res.headersSent) {
+        writeError(res, 502);
+      }
+    });
+  });
+  server.on("connection", (socket) => {
+    socket.setNoDelay(true);
+  });
+  const { actualPort, actualHost } = await new Promise(
+    (resolveListen, rejectListen) => {
+      server.once("error", rejectListen);
+      server.listen(opts.port, opts.host, () => {
+        const addr = server.address();
+        if (addr === null || typeof addr === "string") {
+          rejectListen(new Error("Could not determine listening address"));
+          return;
+        }
+        resolveListen({ actualPort: addr.port, actualHost: opts.host });
+      });
+    }
+  );
+  let closed = false;
+  return {
+    port: actualPort,
+    host: actualHost,
+    server,
+    close: async () => {
+      if (closed)
+        return;
+      closed = true;
+      await new Promise((resolveClose) => {
+        server.close(() => resolveClose());
+        server.closeAllConnections?.();
+      });
+    }
+  };
+}
+async function handleRequest(req, res, opts) {
+  const logger = getLogger().child("start-api");
+  const bodyBuf = await readBody(req);
+  const rawUrl = req.url ?? "/";
+  const method = (req.method ?? "GET").toUpperCase();
+  const requestPath = rawUrl.split("?")[0] ?? "/";
+  const match = matchRoute(method, requestPath, opts.routes);
+  if (!match) {
+    writeError(res, 404, '{"message":"Not Found"}');
+    return;
+  }
+  const snapshot = {
+    method,
+    rawUrl,
+    headers: collectHeaders(req),
+    body: bodyBuf,
+    ...req.socket.remoteAddress !== void 0 && { sourceIp: req.socket.remoteAddress }
+  };
+  const matchCtx = {
+    route: match.route,
+    pathParameters: match.pathParameters,
+    matchedPath: requestPath
+  };
+  const event = match.route.apiVersion === "v1" ? buildRestV1Event(snapshot, matchCtx) : buildHttpApiV2Event(snapshot, matchCtx);
+  let handle;
+  try {
+    handle = await opts.pool.acquire(match.route.lambdaLogicalId);
+  } catch (err) {
+    logger.error(
+      `Failed to acquire container for ${match.route.lambdaLogicalId}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    writeError(res, 502);
+    return;
+  }
+  try {
+    const invokeResult = await invokeRie(
+      handle.containerHost,
+      handle.hostPort,
+      event,
+      opts.rieTimeoutMs
+    );
+    const translated = translateLambdaResponse(invokeResult.payload, match.route.apiVersion);
+    res.statusCode = translated.statusCode;
+    for (const [name, value] of Object.entries(translated.headers)) {
+      res.setHeader(name, value);
+    }
+    if (translated.cookies.length > 0) {
+      res.setHeader("set-cookie", translated.cookies);
+    }
+    res.end(translated.body);
+  } catch (err) {
+    logger.error(
+      `RIE invoke failed for ${match.route.lambdaLogicalId}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    if (!res.headersSent) {
+      writeError(res, 502);
+    } else {
+      res.end();
+    }
+  } finally {
+    opts.pool.release(handle);
+  }
+}
+function readBody(req) {
+  return new Promise((resolveBody, rejectBody) => {
+    const chunks = [];
+    req.on("data", (chunk) => {
+      chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    });
+    req.on("end", () => resolveBody(Buffer.concat(chunks)));
+    req.on("error", rejectBody);
+  });
+}
+function collectHeaders(req) {
+  const out = {};
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (Array.isArray(value)) {
+      out[name] = value;
+    } else if (typeof value === "string") {
+      out[name] = [value];
+    }
+  }
+  return out;
+}
+function writeError(res, statusCode, body = '{"message":"Internal server error"}') {
+  res.statusCode = statusCode;
+  res.setHeader("content-type", "application/json");
+  res.setHeader("content-length", String(Buffer.byteLength(body, "utf-8")));
+  res.end(body);
+}
+
+// src/cli/commands/local-start-api.ts
+async function localStartApiCommand(options) {
+  const logger = getLogger();
+  if (options.verbose) {
+    logger.setLevel("debug");
+  }
+  warnIfDeprecatedRegion(options);
+  await applyRoleArnIfSet({ roleArn: options.roleArn, region: options.region });
+  await ensureDockerAvailable();
+  const appCmd = resolveApp(options.app);
+  if (!appCmd) {
+    throw new Error('No CDK app specified. Pass --app, set CDKD_APP, or add "app" to cdk.json.');
+  }
+  logger.info("Synthesizing CDK app...");
+  const synthesizer = new Synthesizer();
+  const context = parseContextOptions(options.context);
+  const synthOpts = {
+    app: appCmd,
+    output: options.output,
+    ...options.region && { region: options.region },
+    ...options.profile && { profile: options.profile },
+    ...Object.keys(context).length > 0 && { context }
+  };
+  const { stacks } = await synthesizer.synthesize(synthOpts);
+  const targetStacks = pickTargetStacks(stacks, options.stack);
+  if (targetStacks.length === 0) {
+    throw new Error("No stacks matched. Pass --stack <name> or run from a single-stack app.");
+  }
+  const routes = discoverRoutes(targetStacks);
+  if (routes.length === 0) {
+    throw new Error(
+      "No supported API routes were discovered. cdkd local start-api supports AWS::ApiGateway::* (REST v1), AWS::ApiGatewayV2::* (HTTP), and AWS::Lambda::Url (Function URL) with AWS_PROXY integrations only."
+    );
+  }
+  const lambdaIds = uniqueLambdaIds(routes);
+  const overrides = readEnvOverridesFile(options.envVars);
+  const debugPortBase = options.debugPortBase ? parseDebugPort(options.debugPortBase) : void 0;
+  const specs = /* @__PURE__ */ new Map();
+  const inlineTmpDirs = /* @__PURE__ */ new Set();
+  for (let i = 0; i < lambdaIds.length; i++) {
+    const logicalId = lambdaIds[i];
+    const spec = await buildContainerSpec({
+      logicalId,
+      stacks: targetStacks,
+      overrides,
+      assumeRole: options.assumeRole,
+      containerHost: options.containerHost,
+      ...debugPortBase !== void 0 && { debugPort: debugPortBase + i },
+      stsRegion: options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"],
+      inlineTmpDirs
+    });
+    specs.set(logicalId, spec);
+  }
+  const distinctImages = /* @__PURE__ */ new Set();
+  for (const spec of specs.values()) {
+    distinctImages.add(resolveRuntimeImage(spec.lambda.runtime));
+  }
+  for (const image of distinctImages) {
+    await pullImage(image, options.pull === false);
+  }
+  const perLambdaConcurrency = parsePerLambdaConcurrency(options.perLambdaConcurrency);
+  const pool = createContainerPool(specs, {
+    perLambdaConcurrency,
+    skipPull: options.pull === false
+  });
+  if (options.warm) {
+    logger.info(`Pre-warming ${specs.size} container(s)...`);
+    const handles = await Promise.allSettled([...specs.keys()].map((id) => pool.acquire(id)));
+    for (const result of handles) {
+      if (result.status === "fulfilled") {
+        pool.release(result.value);
+      } else {
+        logger.warn(
+          `Pre-warm failed for one Lambda (cold start cost will apply on first request): ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`
+        );
+      }
+    }
+  }
+  let maxTimeoutSec = 0;
+  for (const spec of specs.values()) {
+    if (spec.lambda.timeoutSec > maxTimeoutSec)
+      maxTimeoutSec = spec.lambda.timeoutSec;
+  }
+  const rieTimeoutMs = Math.max(3e4, maxTimeoutSec * 2 * 1e3);
+  const port = parseInt(options.port, 10);
+  if (!Number.isFinite(port) || port < 0 || port > 65535) {
+    throw new Error(`--port must be 0..65535 (got ${options.port}).`);
+  }
+  const server = await startApiServer({
+    routes,
+    pool,
+    rieTimeoutMs,
+    host: options.host,
+    port
+  });
+  printRouteTable(routes);
+  logger.info(
+    `Per-Lambda concurrency: ${perLambdaConcurrency} (override with --per-lambda-concurrency)`
+  );
+  process.stdout.write(`Server listening on http://${server.host}:${server.port}
+`);
+  process.stdout.write("^C to stop and clean up containers.\n");
+  let shuttingDown = false;
+  let forceExitArmed = false;
+  const shutdown = async (signal, exitCode) => {
+    if (shuttingDown) {
+      if (!forceExitArmed) {
+        forceExitArmed = true;
+        logger.warn(
+          `Received second ${signal}; force-exiting. Orphan containers may remain \u2014 run 'docker ps --filter name=cdkd-local-' and 'docker rm -f' to clean up.`
+        );
+        process.exit(130);
+      }
+      return;
+    }
+    shuttingDown = true;
+    logger.info(`Received ${signal}, shutting down...`);
+    try {
+      await server.close();
+    } catch (err) {
+      logger.warn(`server.close() failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+      await pool.dispose();
+    } catch (err) {
+      logger.warn(`pool.dispose() failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    for (const dir of inlineTmpDirs) {
+      try {
+        rmSync2(dir, { recursive: true, force: true });
+      } catch (err) {
+        logger.warn(
+          `Failed to remove inline-code tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    process.exit(exitCode);
+  };
+  process.on("SIGINT", () => {
+    void shutdown("SIGINT", 130);
+  });
+  process.on("SIGTERM", () => {
+    void shutdown("SIGTERM", 0);
+  });
+  process.on("uncaughtException", (err) => {
+    logger.error(
+      `Uncaught exception: ${err instanceof Error ? err.stack ?? err.message : String(err)}`
+    );
+    void shutdown("uncaughtException", 1);
+  });
+  process.on("unhandledRejection", (reason) => {
+    logger.error(
+      `Unhandled rejection: ${reason instanceof Error ? reason.stack ?? reason.message : String(reason)}`
+    );
+    void shutdown("unhandledRejection", 1);
+  });
+  await new Promise(() => void 0);
+}
+function pickTargetStacks(stacks, pattern) {
+  if (pattern) {
+    return matchStacks(stacks, [pattern]);
+  }
+  if (stacks.length === 1)
+    return stacks;
+  if (stacks.length === 0)
+    return [];
+  throw new Error(
+    `Multi-stack app: pass --stack <name> to pick a target. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`
+  );
+}
+function uniqueLambdaIds(routes) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const r of routes) {
+    if (!seen.has(r.lambdaLogicalId)) {
+      seen.add(r.lambdaLogicalId);
+      out.push(r.lambdaLogicalId);
+    }
+  }
+  return out;
+}
+async function buildContainerSpec(args) {
+  const {
+    logicalId,
+    stacks,
+    overrides,
+    assumeRole,
+    containerHost,
+    debugPort,
+    stsRegion,
+    inlineTmpDirs
+  } = args;
+  const lambda = resolveLambdaByLogicalId(logicalId, stacks);
+  const codeDir = lambda.codePath ?? materializeInlineCode(
+    lambda.handler,
+    lambda.inlineCode ?? "",
+    resolveRuntimeFileExtension(lambda.runtime),
+    inlineTmpDirs
+  );
+  const templateEnv = getTemplateEnv(lambda.resource);
+  const envResult = resolveEnvVars(logicalId, templateEnv, overrides);
+  for (const key of envResult.unresolved) {
+    getLogger().warn(
+      `Lambda ${logicalId}: env var ${key} contains a CloudFormation intrinsic and was dropped. Override it with --env-vars (e.g. {"${logicalId}":{"${key}":"<literal>"}}) to surface a literal value.`
+    );
+  }
+  const dockerEnv = {
+    AWS_LAMBDA_FUNCTION_NAME: logicalId,
+    AWS_LAMBDA_FUNCTION_MEMORY_SIZE: String(lambda.memoryMb),
+    AWS_LAMBDA_FUNCTION_TIMEOUT: String(lambda.timeoutSec),
+    AWS_LAMBDA_FUNCTION_VERSION: "$LATEST",
+    AWS_LAMBDA_LOG_GROUP_NAME: `/aws/lambda/${logicalId}`,
+    AWS_LAMBDA_LOG_STREAM_NAME: "local",
+    ...envResult.resolved
+  };
+  const roleArn = effectiveAssumeRoleArn(logicalId, assumeRole);
+  if (roleArn) {
+    const creds = await assumeLambdaExecutionRole(roleArn, stsRegion);
+    dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
+    dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
+    dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
+    if (stsRegion)
+      dockerEnv["AWS_REGION"] = stsRegion;
+  } else {
+    forwardAwsEnv(dockerEnv);
+  }
+  if (debugPort !== void 0) {
+    dockerEnv["NODE_OPTIONS"] = `--inspect-brk=0.0.0.0:${debugPort}`;
+  }
+  const spec = {
+    lambda,
+    codeDir,
+    env: dockerEnv,
+    containerHost,
+    ...debugPort !== void 0 && { debugPort }
+  };
+  return spec;
+}
+function resolveLambdaByLogicalId(logicalId, stacks) {
+  for (const stack of stacks) {
+    const resource = stack.template.Resources?.[logicalId];
+    if (!resource || resource.Type !== "AWS::Lambda::Function")
+      continue;
+    const props = resource.Properties ?? {};
+    const runtime = typeof props["Runtime"] === "string" ? props["Runtime"] : "";
+    const handler = typeof props["Handler"] === "string" ? props["Handler"] : "";
+    const memoryMb = typeof props["MemorySize"] === "number" ? props["MemorySize"] : 128;
+    const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
+    if (!runtime) {
+      throw new Error(
+        `Lambda '${logicalId}' has no Runtime property. Container-image Lambdas (Code.ImageUri) are not supported in cdkd local start-api v1.`
+      );
+    }
+    if (!handler) {
+      throw new Error(`Lambda '${logicalId}' has no Handler property.`);
+    }
+    const code = props["Code"] ?? {};
+    const imageUri = code["ImageUri"];
+    if (typeof imageUri === "string" || typeof imageUri === "object" && imageUri !== null && "Fn::Sub" in imageUri) {
+      throw new Error(
+        `Lambda '${logicalId}' uses Code.ImageUri (container-image Lambda). 'cdkd local start-api' v1 supports ZIP Lambdas only \u2014 container-image support is deferred to a follow-up PR. Use 'cdkd local invoke' to exercise this function locally.`
+      );
+    }
+    const inlineCode = typeof code["ZipFile"] === "string" ? code["ZipFile"] : void 0;
+    let codePath = null;
+    if (!inlineCode) {
+      codePath = resolveAssetCodePath2(stack, logicalId, resource);
+    }
+    return {
+      kind: "zip",
+      stack,
+      logicalId,
+      resource,
+      runtime,
+      handler,
+      memoryMb,
+      timeoutSec,
+      codePath,
+      ...inlineCode !== void 0 && { inlineCode }
+    };
+  }
+  throw new Error(
+    `No AWS::Lambda::Function resource named '${logicalId}' found in target stacks. This is likely a synthesis bug \u2014 the route-discovery phase resolved a route to this logical ID.`
+  );
+}
+function resolveAssetCodePath2(stack, logicalId, resource) {
+  const meta = resource.Metadata;
+  const assetPath = meta?.["aws:asset:path"];
+  if (typeof assetPath !== "string" || assetPath.length === 0) {
+    throw new Error(
+      `Lambda '${logicalId}' has no Metadata['aws:asset:path']. cdkd local start-api needs this hint to find the local asset directory. Re-synthesize the app and retry.`
+    );
+  }
+  const cdkOutDir = stack.assetManifestPath ? path.dirname(stack.assetManifestPath) : process.cwd();
+  return path.isAbsolute(assetPath) ? assetPath : path.resolve(cdkOutDir, assetPath);
+}
+function printRouteTable(routes) {
+  const sorted = [...routes].sort((a, b) => {
+    if (a.pathPattern !== b.pathPattern)
+      return a.pathPattern.localeCompare(b.pathPattern);
+    return a.method.localeCompare(b.method);
+  });
+  const methodWidth = Math.max(...sorted.map((r) => r.method.length), 6);
+  const pathWidth = Math.max(...sorted.map((r) => r.pathPattern.length), 8);
+  process.stdout.write("Discovered routes:\n");
+  for (const r of sorted) {
+    const sourceLabel = r.source === "http-api" ? "HTTP API" : r.source === "rest-v1" ? `REST v1, stage '${r.stage}'` : "Function URL";
+    process.stdout.write(
+      `  ${r.method.padEnd(methodWidth)}  ${r.pathPattern.padEnd(pathWidth)}  -> ${r.lambdaLogicalId}  (${sourceLabel})
+`
+    );
+  }
+  process.stdout.write("\n");
+}
+function materializeInlineCode(handler, source, fileExtension, tmpDirsOut) {
+  const lastDot = handler.lastIndexOf(".");
+  if (lastDot <= 0) {
+    throw new Error(`Handler '${handler}' is malformed: expected '<modulePath>.<exportName>'.`);
+  }
+  const modulePath = handler.substring(0, lastDot);
+  const dir = mkdtempSync2(path.join(tmpdir2(), "cdkd-local-start-api-"));
+  tmpDirsOut.add(dir);
+  const filePath = path.join(dir, `${modulePath}${fileExtension}`);
+  mkdirSync2(path.dirname(filePath), { recursive: true });
+  writeFileSync5(filePath, source, "utf-8");
+  return dir;
+}
+function getTemplateEnv(resource) {
+  const props = resource.Properties ?? {};
+  const env = props["Environment"];
+  if (!env || typeof env !== "object")
+    return void 0;
+  const vars = env["Variables"];
+  if (!vars || typeof vars !== "object")
+    return void 0;
+  return vars;
+}
+function readEnvOverridesFile(filePath) {
+  if (!filePath)
+    return void 0;
+  let raw;
+  try {
+    raw = readFileSync6(filePath, "utf-8");
+  } catch (err) {
+    throw new Error(
+      `Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse --env-vars file '${filePath}' as JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`--env-vars file '${filePath}' must contain a JSON object at the top level.`);
+  }
+  return parsed;
+}
+function forwardAwsEnv(env) {
+  const passThrough = [
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+    "AWS_REGION",
+    "AWS_DEFAULT_REGION"
+  ];
+  for (const key of passThrough) {
+    const value = process.env[key];
+    if (value !== void 0)
+      env[key] = value;
+  }
+}
+async function assumeLambdaExecutionRole(roleArn, region) {
+  const { STSClient: STSClient11, AssumeRoleCommand: AssumeRoleCommand2 } = await import("@aws-sdk/client-sts");
+  const sts = new STSClient11({ ...region && { region } });
+  try {
+    const response = await sts.send(
+      new AssumeRoleCommand2({
+        RoleArn: roleArn,
+        RoleSessionName: `cdkd-local-start-api-${Date.now()}`,
+        DurationSeconds: 3600
+      })
+    );
+    const creds = response.Credentials;
+    if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) {
+      throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+    }
+    return {
+      accessKeyId: creds.AccessKeyId,
+      secretAccessKey: creds.SecretAccessKey,
+      sessionToken: creds.SessionToken
+    };
+  } finally {
+    sts.destroy();
+  }
+}
+function parsePerLambdaConcurrency(raw) {
+  const parsed = parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed < 1) {
+    throw new Error(`--per-lambda-concurrency must be a positive integer (got '${raw}')`);
+  }
+  if (parsed > 4) {
+    getLogger().warn(
+      `--per-lambda-concurrency ${parsed} exceeds the v1 cap of 4; clamping to 4. (Raise this in a follow-up PR if your workload needs more.)`
+    );
+    return 4;
+  }
+  return parsed;
+}
+function parseDebugPort(raw) {
+  const parsed = parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed < 1 || parsed > 65535) {
+    throw new Error(`--debug-port-base must be 1..65535 (got '${raw}')`);
+  }
+  return parsed;
+}
+function createLocalStartApiCommand() {
+  const startApi = new Command14("start-api").description(
+    "Run a long-running local HTTP server that maps API Gateway routes (REST v1, HTTP API, Function URL) to Lambda invocations against the AWS Lambda Runtime Interface Emulator (Docker required)."
+  ).addOption(
+    new Option7("--port <port>", "HTTP server port (default: auto-allocate)").default("0")
+  ).addOption(new Option7("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option7("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(
+    new Option7("--warm", "Pre-start one container per Lambda at server boot").default(false)
+  ).addOption(
+    new Option7(
+      "--per-lambda-concurrency <n>",
+      "Pool size cap per Lambda (default 2, max 4)"
+    ).default("2")
+  ).addOption(new Option7("--no-pull", "Skip docker pull (cached image)")).addOption(
+    new Option7(
+      "--container-host <host>",
+      "Hostname/IP the container reaches the host on"
+    ).default("host.docker.internal")
+  ).addOption(
+    new Option7(
+      "--debug-port-base <port>",
+      "Reserve a contiguous --debug-port range (one per Lambda)"
+    )
+  ).addOption(
+    new Option7(
+      "--env-vars <file>",
+      'JSON env-var overrides (SAM-compatible: {"LogicalId":{"KEY":"VALUE"}, "Parameters": {...}})'
+    )
+  ).addOption(
+    new Option7(
+      "--assume-role <arn-or-pair>",
+      "Assume the Lambda's execution role and forward STS-issued temp creds. Bare <arn> = global default; <LogicalId>=<arn> = per-Lambda override (repeatable). Per-Lambda > global > unset (developer creds passed through)."
+    ).argParser((raw, prev) => parseAssumeRoleToken(raw, prev))
+  ).action(withErrorHandling(localStartApiCommand));
+  [...commonOptions, ...appOptions, ...contextOptions].forEach((opt) => startApi.addOption(opt));
+  startApi.addOption(deprecatedRegionOption);
+  return startApi;
+}
+
+// src/cli/commands/local-invoke.ts
 async function localInvokeCommand(target, options) {
   const logger = getLogger();
   if (options.verbose) {
@@ -71053,7 +72766,7 @@ async function localInvokeCommand(target, options) {
   logger.info(`Target: ${lambda.stack.stackName}/${lambda.logicalId} (${targetLabel})`);
   const imagePlan = await resolveImagePlan(lambda, options);
   let stateAudit;
-  let templateEnv = getTemplateEnv(lambda.resource);
+  let templateEnv = getTemplateEnv2(lambda.resource);
   let stateForRoleHint;
   if (options.fromState) {
     const loaded = await loadStateForStack(lambda.stack.stackName, lambda.stack.region, {
@@ -71078,7 +72791,7 @@ async function localInvokeCommand(target, options) {
       }
     }
   }
-  const overrides = readEnvOverridesFile(options.envVars);
+  const overrides = readEnvOverridesFile2(options.envVars);
   const envResult = resolveEnvVars(lambda.logicalId, templateEnv, overrides);
   for (const key of envResult.unresolved) {
     if (stateAudit && stateAudit.unresolved.some((u) => u.key === key))
@@ -71102,14 +72815,14 @@ async function localInvokeCommand(target, options) {
   };
   if (options.assumeRole) {
     const stsRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
-    const creds = await assumeLambdaExecutionRole(options.assumeRole, stsRegion);
+    const creds = await assumeLambdaExecutionRole2(options.assumeRole, stsRegion);
     dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
     dockerEnv["AWS_SECRET_ACCESS_KEY"] = creds.secretAccessKey;
     dockerEnv["AWS_SESSION_TOKEN"] = creds.sessionToken;
     if (stsRegion)
       dockerEnv["AWS_REGION"] = stsRegion;
   } else {
-    forwardAwsEnv(dockerEnv);
+    forwardAwsEnv2(dockerEnv);
   }
   let debugPort;
   if (options.debugPort) {
@@ -71160,7 +72873,7 @@ async function localInvokeCommand(target, options) {
     await removeContainer(containerId);
     if (imagePlan.inlineTmpDir) {
       try {
-        rmSync2(imagePlan.inlineTmpDir, { recursive: true, force: true });
+        rmSync3(imagePlan.inlineTmpDir, { recursive: true, force: true });
       } catch (err) {
         getLogger().debug(
           `Failed to remove inline-code tmpdir ${imagePlan.inlineTmpDir}: ${err instanceof Error ? err.message : String(err)}`
@@ -71179,7 +72892,7 @@ async function resolveZipImagePlan(lambda, options) {
   let inlineTmpDir;
   let codeDir = lambda.codePath;
   if (codeDir === null) {
-    inlineTmpDir = materializeInlineCode(
+    inlineTmpDir = materializeInlineCode2(
       lambda.handler,
       lambda.inlineCode ?? "",
       resolveRuntimeFileExtension(lambda.runtime)
@@ -71202,7 +72915,11 @@ async function resolveContainerImagePlan(lambda, options) {
   let imageRef;
   if (localBuild) {
     imageRef = await buildContainerImage(localBuild.asset, localBuild.cdkOutDir, {
-      architecture: lambda.architecture
+      architecture: lambda.architecture,
+      // `options.build === false` triggers the no-build path: skip
+      // `docker build` and verify the deterministic tag is already
+      // cached. Default `true` (build as usual). Closes #233.
+      noBuild: options.build === false
     });
   } else {
     if (!parseEcrUri(lambda.imageUri)) {
@@ -71235,7 +72952,7 @@ async function resolveLocalBuildPlan(lambda) {
   const manifestPath = lambda.stack.assetManifestPath;
   if (!manifestPath)
     return void 0;
-  const cdkOutDir = dirname2(manifestPath);
+  const cdkOutDir = dirname3(manifestPath);
   const loader = new AssetManifestLoader();
   const manifest = await loader.loadManifest(cdkOutDir, lambda.stack.stackName);
   if (!manifest)
@@ -71245,7 +72962,7 @@ async function resolveLocalBuildPlan(lambda) {
     return void 0;
   return { asset: entry.asset, cdkOutDir };
 }
-function getTemplateEnv(resource) {
+function getTemplateEnv2(resource) {
   const props = resource.Properties ?? {};
   const env = props["Environment"];
   if (!env || typeof env !== "object")
@@ -71255,12 +72972,12 @@ function getTemplateEnv(resource) {
     return void 0;
   return vars;
 }
-function readEnvOverridesFile(filePath) {
+function readEnvOverridesFile2(filePath) {
   if (!filePath)
     return void 0;
   let raw;
   try {
-    raw = readFileSync6(filePath, "utf-8");
+    raw = readFileSync7(filePath, "utf-8");
   } catch (err) {
     throw new Error(
       `Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`
@@ -71288,7 +73005,7 @@ async function readEvent(options) {
     return parseEvent(raw, "<stdin>");
   }
   if (options.event) {
-    const raw = readFileSync6(options.event, "utf-8");
+    const raw = readFileSync7(options.event, "utf-8");
     return parseEvent(raw, options.event);
   }
   return {};
@@ -71309,7 +73026,7 @@ async function readStdin() {
   }
   return Buffer.concat(chunks).toString("utf-8");
 }
-async function assumeLambdaExecutionRole(roleArn, region) {
+async function assumeLambdaExecutionRole2(roleArn, region) {
   const { STSClient: STSClient11, AssumeRoleCommand: AssumeRoleCommand2 } = await import("@aws-sdk/client-sts");
   const sts = new STSClient11({ ...region && { region } });
   try {
@@ -71333,7 +73050,7 @@ async function assumeLambdaExecutionRole(roleArn, region) {
     sts.destroy();
   }
 }
-function forwardAwsEnv(env) {
+function forwardAwsEnv2(env) {
   const passThrough = [
     "AWS_ACCESS_KEY_ID",
     "AWS_SECRET_ACCESS_KEY",
@@ -71347,16 +73064,16 @@ function forwardAwsEnv(env) {
       env[key] = value;
   }
 }
-function materializeInlineCode(handler, source, fileExtension) {
+function materializeInlineCode2(handler, source, fileExtension) {
   const lastDot = handler.lastIndexOf(".");
   if (lastDot <= 0) {
     throw new Error(`Handler '${handler}' is malformed: expected '<modulePath>.<exportName>'.`);
   }
   const modulePath = handler.substring(0, lastDot);
-  const dir = mkdtempSync2(path.join(tmpdir2(), "cdkd-local-invoke-"));
-  const filePath = path.join(dir, `${modulePath}${fileExtension}`);
-  mkdirSync2(path.dirname(filePath), { recursive: true });
-  writeFileSync5(filePath, source, "utf-8");
+  const dir = mkdtempSync3(path2.join(tmpdir3(), "cdkd-local-invoke-"));
+  const filePath = path2.join(dir, `${modulePath}${fileExtension}`);
+  mkdirSync3(path2.dirname(filePath), { recursive: true });
+  writeFileSync6(filePath, source, "utf-8");
   return dir;
 }
 async function loadStateForStack(stackName, synthRegion, opts) {
@@ -71463,35 +73180,40 @@ function pickReferencedLogicalId(intrinsic) {
   return void 0;
 }
 function createLocalCommand() {
-  const local = new Command14("local").description(
+  const local = new Command15("local").description(
     "Local Lambda execution against the AWS Lambda Runtime Interface Emulator (Docker required)"
   );
-  const invoke = new Command14("invoke").description(
+  const invoke = new Command15("invoke").description(
     "Run a Lambda function locally in a Docker container (RIE-backed). Target accepts a CDK display path (MyStack/MyApi/Handler) or stack-qualified logical ID (MyStack:MyApiHandler1234ABCD). Single-stack apps may omit the stack prefix."
-  ).argument("<target>", "CDK display path or stack-qualified logical ID of the Lambda to invoke").addOption(new Option7("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option7("--event-stdin", "Read event JSON from stdin").default(false)).addOption(
-    new Option7(
+  ).argument("<target>", "CDK display path or stack-qualified logical ID of the Lambda to invoke").addOption(new Option8("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option8("--event-stdin", "Read event JSON from stdin").default(false)).addOption(
+    new Option8(
       "--env-vars <file>",
       'JSON env-var overrides (SAM-compatible: {"LogicalId":{"KEY":"VALUE"}})'
     )
   ).addOption(
-    new Option7(
+    new Option8(
       "--no-pull",
       "Skip docker pull (use cached image) \u2014 no-op for IMAGE local-build path; `docker build` does not pull base layers by default"
     )
-  ).addOption(new Option7("--debug-port <port>", "Node --inspect-brk port (default: off)")).addOption(
-    new Option7("--container-host <host>", "Host to bind the RIE port to").default("127.0.0.1")
   ).addOption(
-    new Option7(
+    new Option8(
+      "--no-build",
+      "Skip docker build on the IMAGE local-build path (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ZIP Lambdas and the IMAGE ECR-pull path. Compatible with --no-pull."
+    )
+  ).addOption(new Option8("--debug-port <port>", "Node --inspect-brk port (default: off)")).addOption(
+    new Option8("--container-host <host>", "Host to bind the RIE port to").default("127.0.0.1")
+  ).addOption(
+    new Option8(
       "--assume-role <arn>",
       `Assume the Lambda's deployed execution role and forward STS-issued temp credentials to the container so the handler runs with the deployed function's narrow permissions (closes the "developer admin / function narrow" skew). Off by default \u2014 when omitted, the developer's shell credentials are forwarded unchanged (SAM-compatible default).`
     )
   ).addOption(
-    new Option7(
+    new Option8(
       "--from-state",
       "Read cdkd S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub in env vars with the deployed physical IDs / attributes. Off by default \u2014 keep PR 1 warn-and-drop semantics; turn on for stacks already deployed via cdkd deploy."
     ).default(false)
   ).addOption(
-    new Option7(
+    new Option8(
       "--stack-region <region>",
       "Region of the cdkd state record to read (used with --from-state when the same stack name has state in multiple regions)."
     )
@@ -71501,6 +73223,7 @@ function createLocalCommand() {
   );
   invoke.addOption(deprecatedRegionOption);
   local.addCommand(invoke);
+  local.addCommand(createLocalStartApiCommand());
   return local;
 }
 
@@ -71532,8 +73255,8 @@ function reorderArgs(argv) {
   return [...prefix, ...cmdAndAfter, ...beforeCmd];
 }
 async function main() {
-  const program = new Command15();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.70.0");
+  const program = new Command16();
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.72.0");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());