cdk-local 0.155.0 → 0.157.0

package/dist/{local-studio-CsftJJ1r.js → local-studio-DKMdamzH.js}

@@ -46,10 +46,11 @@ import * as vm from "node:vm";
 import "@aws-sdk/signature-v4a";
 import { CloudFrontClient, paginateListKeyValueStores } from "@aws-sdk/client-cloudfront";
 import { CloudFrontKeyValueStoreClient, GetKeyCommand, ResourceNotFoundException } from "@aws-sdk/client-cloudfront-keyvaluestore";
-import { existsSync as existsSync$1, rmSync as rmSync$1, statSync as statSync$1 } from "fs";
+import { existsSync as existsSync$1, readFileSync as readFileSync$1, rmSync as rmSync$1, statSync as statSync$1 } from "fs";
 import { request as request$2 } from "http";
 import { execFile as execFile$1, spawn as spawn$1 } from "child_process";
 import { promisify as promisify$1 } from "util";
+import { randomUUID as randomUUID$1 } from "crypto";
 import { EventEmitter } from "node:events";
 
 //#region src/utils/url-authority.ts
@@ -3536,7 +3537,8 @@ function listTargets(stacks) {
 		agentCoreRuntimes: sortEntries(scanAgentCoreRuntimes(stacks)),
 		loadBalancers: sortEntries(scanApplicationLoadBalancers(stacks)),
 		cloudFrontDistributions: sortEntries(scanByType(stacks, "AWS::CloudFront::Distribution")),
-		webFunctions: sortEntries(scanByType(stacks, "AWS::Lambda::WebFunction"))
+		webFunctions: sortEntries(scanByType(stacks, "AWS::Lambda::WebFunction")),
+		microvmImages: sortEntries(scanByType(stacks, "AWS::Lambda::MicrovmImage"))
 	};
 }
 const pathOf$1 = (e) => e.displayPath ?? e.qualifiedId;
@@ -3559,7 +3561,7 @@ function sortApiEntries(entries) {
 	});
 }
 function countTargets(listing) {
-	return listing.lambdas.length + listing.apis.length + listing.ecsServices.length + listing.ecsTaskDefinitions.length + listing.agentCoreRuntimes.length + listing.loadBalancers.length + listing.cloudFrontDistributions.length + listing.webFunctions.length;
+	return listing.lambdas.length + listing.apis.length + listing.ecsServices.length + listing.ecsTaskDefinitions.length + listing.agentCoreRuntimes.length + listing.loadBalancers.length + listing.cloudFrontDistributions.length + listing.webFunctions.length + listing.microvmImages.length;
 }
 
 //#endregion
@@ -6493,7 +6495,7 @@ function pushMap(hash, name, value) {
 
 //#endregion
 //#region src/local/docker-runner.ts
-const execFileAsync$6 = promisify(execFile);
+const execFileAsync$7 = promisify(execFile);
 var DockerRunnerError = class DockerRunnerError extends Error {
 	constructor(message) {
 		super(message);
@@ -6555,6 +6557,7 @@ async function runDetached(opts) {
 	const host = opts.host ?? "127.0.0.1";
 	args.push("-p", `${host}:${opts.hostPort}:${opts.containerPort ?? 8080}`);
 	if (opts.debugPort !== void 0) args.push("-p", `${host}:${opts.debugPort}:${opts.debugPort}`);
+	for (const extra of opts.extraPorts ?? []) args.push("-p", `${host}:${extra.hostPort}:${extra.containerPort}`);
 	for (const mount of opts.mounts) {
 		const ro = mount.readOnly ? ":ro" : "";
 		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
@@ -6584,7 +6587,7 @@ async function runDetached(opts) {
 	if (refusal !== void 0) throw new DockerRunnerError(refusal);
 	warnFinchArgvExposure(forwardedKeys);
 	try {
-		const { stdout } = await execFileAsync$6(getDockerCmd(), args, {
+		const { stdout } = await execFileAsync$7(getDockerCmd(), args, {
 			maxBuffer: 10 * 1024 * 1024,
 			...execEnvForSecrets(passthroughEnv)
 		});
@@ -6641,8 +6644,8 @@ function streamLogs(containerId, opts = {}) {
 		proc.stderr?.on("data", (chunk) => tap(chunk));
 	}
 	let flush = () => void 0;
-	if (process.env["CDKL_PREFIX_CONTAINER_OUTPUT"] === "1") {
-		const tag = `[${flattenToOneLine(containerId.slice(0, 12)).replace(/[\]\s]/g, "_")}] `;
+	if (opts.prefix !== void 0 || process.env["CDKL_PREFIX_CONTAINER_OUTPUT"] === "1") {
+		const tag = opts.prefix ?? `[${flattenToOneLine(containerId.slice(0, 12)).replace(/[\]\s]/g, "_")}] `;
 		const stdoutRelay = createPrefixedLineRelay(tag, process.stdout);
 		const stderrRelay = createPrefixedLineRelay(tag, process.stderr);
 		proc.stdout?.on("data", (chunk) => stdoutRelay.push(chunk));
@@ -6666,7 +6669,7 @@ async function removeContainer(containerId) {
 	if (!containerId) return;
 	const logger = getLogger().child("docker");
 	try {
-		await execFileAsync$6(getDockerCmd(), [
+		await execFileAsync$7(getDockerCmd(), [
 			"rm",
 			"-f",
 			containerId
@@ -6680,7 +6683,7 @@ async function removeContainer(containerId) {
 async function ensureDockerAvailable() {
 	const cmd = getDockerCmd();
 	try {
-		await execFileAsync$6(cmd, [
+		await execFileAsync$7(cmd, [
 			"version",
 			"--format",
 			"{{.Server.Version}}"
@@ -7213,14 +7216,14 @@ async function handleConnectionsRequest(opts) {
 	const { req, res, registry } = opts;
 	const parsed = parseConnectionsPath(req.url ?? "");
 	if (!parsed) {
-		writeJson(res, 404, { message: "Not Found" });
+		writeJson$1(res, 404, { message: "Not Found" });
 		return;
 	}
 	const { connectionId } = parsed;
 	const entry = registry.get(connectionId);
 	const method = (req.method ?? "").toUpperCase();
 	if (!entry) {
-		writeJson(res, 410, { message: "GoneException" });
+		writeJson$1(res, 410, { message: "GoneException" });
 		return;
 	}
 	if (method === "POST") {
@@ -7228,17 +7231,17 @@ async function handleConnectionsRequest(opts) {
 		try {
 			body = await readRequestBody$1(req);
 		} catch (err) {
-			writeJson(res, 500, { message: `Failed to read request body: ${err instanceof Error ? err.message : String(err)}` });
+			writeJson$1(res, 500, { message: `Failed to read request body: ${err instanceof Error ? err.message : String(err)}` });
 			return;
 		}
 		if (entry.socket.readyState !== entry.socket.OPEN) {
-			writeJson(res, 410, { message: "GoneException" });
+			writeJson$1(res, 410, { message: "GoneException" });
 			return;
 		}
 		try {
 			entry.socket.send(body);
 		} catch (err) {
-			writeJson(res, 500, { message: `Failed to deliver to socket: ${err instanceof Error ? err.message : String(err)}` });
+			writeJson$1(res, 500, { message: `Failed to deliver to socket: ${err instanceof Error ? err.message : String(err)}` });
 			return;
 		}
 		res.writeHead(200);
@@ -7249,7 +7252,7 @@ async function handleConnectionsRequest(opts) {
 		try {
 			entry.socket.close(1e3, "DeleteConnection");
 		} catch (err) {
-			writeJson(res, 500, { message: `Failed to close socket: ${err instanceof Error ? err.message : String(err)}` });
+			writeJson$1(res, 500, { message: `Failed to close socket: ${err instanceof Error ? err.message : String(err)}` });
 			return;
 		}
 		res.writeHead(204);
@@ -7257,7 +7260,7 @@ async function handleConnectionsRequest(opts) {
 		return;
 	}
 	if (method === "GET") {
-		writeJson(res, 200, {
+		writeJson$1(res, 200, {
 			ConnectedAt: new Date(entry.connectedAt).toISOString(),
 			Identity: { SourceIp: "127.0.0.1" },
 			LastActiveAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -7265,9 +7268,9 @@ async function handleConnectionsRequest(opts) {
 		return;
 	}
 	res.setHeader("Allow", "POST, GET, DELETE");
-	writeJson(res, 405, { message: "MethodNotAllowedException" });
+	writeJson$1(res, 405, { message: "MethodNotAllowedException" });
 }
-function writeJson(res, status, body) {
+function writeJson$1(res, status, body) {
 	const json = JSON.stringify(body);
 	res.writeHead(status, {
 		"Content-Type": "application/json",
@@ -11049,7 +11052,7 @@ async function startApiServer(opts) {
 	const logger = getLogger().child("start-api");
 	let currentState = opts.state;
 	const requestHandler = (req, res) => {
-		handleRequest$2(req, res, currentState, opts).catch((err) => {
+		handleRequest$3(req, res, currentState, opts).catch((err) => {
 			logger.error(`Unhandled request error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
 			if (!res.headersSent) writeError$1(res, 502);
 		});
@@ -11101,7 +11104,7 @@ async function startApiServer(opts) {
 		getServerState: () => currentState
 	};
 }
-async function handleRequest$2(req, res, state, opts) {
+async function handleRequest$3(req, res, state, opts) {
 	const logger = getLogger().child("start-api");
 	if (opts.preDispatch) try {
 		if (await opts.preDispatch(req, res)) return;
@@ -15489,7 +15492,7 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	const loader = new AssetManifestLoader();
 	const manifest = await loader.loadStackManifest(resolved.stack, cdkOutDir);
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
-	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey$1(fileAssets, code.codeAssetHash) : void 0;
+	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey(fileAssets, code.codeAssetHash) : void 0;
 	if (!asset) throw new CdkLocalError(`AgentCore Runtime ${displayIdent(resolved.logicalId)} code bundle (asset ${displayIdent(code.codeAssetHash)}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
 	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, {
 		assetOutdir: assetPathDirs(resolved.stack).assetOutdir,
@@ -15539,7 +15542,7 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 		await bundle.cleanup();
 	}
 }
-function findFileAssetByObjectKey$1(fileAssets, hash) {
+function findFileAssetByObjectKey(fileAssets, hash) {
 	const zip = `${hash}.zip`;
 	for (const asset of fileAssets.values()) if (Object.values(asset.destinations).some((d) => d.objectKey === zip || d.objectKey.endsWith(`/${zip}`))) return asset;
 }
@@ -16030,7 +16033,7 @@ async function runAgentCoreWatchLoop(args) {
 		}
 	}
 }
-const execFileAsync$5 = promisify(execFile);
+const execFileAsync$6 = promisify(execFile);
 function describeExecError(err) {
 	if (!(err instanceof Error)) return String(err);
 	const stderr = err.stderr;
@@ -16042,7 +16045,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	const dockerCmd = getDockerCmd();
 	let workdir;
 	try {
-		const { stdout } = await execFileAsync$5(dockerCmd, [
+		const { stdout } = await execFileAsync$6(dockerCmd, [
 			"inspect",
 			"--format",
 			"{{.Config.WorkingDir}}",
@@ -16055,7 +16058,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	const workdirDest = workdir.endsWith("/") ? workdir : `${workdir}/`;
 	logger.info(`Soft-reload: docker cp ${flattenToOneLine(newAssetSourceDir)} -> ${containerId}:${workdirDest}; restart.`);
 	try {
-		await execFileAsync$5(dockerCmd, [
+		await execFileAsync$6(dockerCmd, [
 			"cp",
 			`${newAssetSourceDir}/.`,
 			`${containerId}:${workdirDest}`
@@ -16064,7 +16067,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 		throw new CdkLocalError(`softReloadAgentContainer: docker cp into '${containerId}:${workdir}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_CP_FAILED");
 	}
 	try {
-		await execFileAsync$5(dockerCmd, ["restart", containerId]);
+		await execFileAsync$6(dockerCmd, ["restart", containerId]);
 	} catch (err) {
 		throw new CdkLocalError(`softReloadAgentContainer: docker restart of '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_RESTART_FAILED");
 	}
@@ -16240,7 +16243,7 @@ function writePrefixedLines(prefix, buffer, out) {
 
 //#endregion
 //#region src/local/ecs-network.ts
-const execFileAsync$4 = promisify(execFile);
+const execFileAsync$5 = promisify(execFile);
 const METADATA_ENDPOINT_IMAGE = "amazon/amazon-ecs-local-container-endpoints:latest-amd64";
 const METADATA_ENDPOINT_IP = "169.254.170.2";
 const DEFAULT_METADATA_ENDPOINT_SUBNET = "169.254.170.0/24";
@@ -16276,7 +16279,7 @@ async function sweepOrphanedSvcNetworks(prefix) {
 	const filter = `${prefix}-svc-`;
 	let names;
 	try {
-		const { stdout } = await execFileAsync$4(getDockerCmd(), [
+		const { stdout } = await execFileAsync$5(getDockerCmd(), [
 			"network",
 			"ls",
 			"--filter",
@@ -16294,7 +16297,7 @@ async function sweepOrphanedSvcNetworks(prefix) {
 	for (const name of names) {
 		let attached;
 		try {
-			const { stdout } = await execFileAsync$4(getDockerCmd(), [
+			const { stdout } = await execFileAsync$5(getDockerCmd(), [
 				"network",
 				"inspect",
 				name,
@@ -16322,7 +16325,7 @@ async function createNetworkAndSidecar(args) {
 	await pullImage(METADATA_ENDPOINT_IMAGE, skipPull);
 	logger.info(`Creating docker network ${networkName} (subnet ${cidr})...`);
 	try {
-		await execFileAsync$4(getDockerCmd(), [
+		await execFileAsync$5(getDockerCmd(), [
 			"network",
 			"create",
 			"--driver",
@@ -16359,7 +16362,7 @@ async function createNetworkAndSidecar(args) {
 	warnFinchArgvExposure(Object.keys(sidecarPassthroughEnv));
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
 	try {
-		const { stdout } = await execFileAsync$4(getDockerCmd(), sidecarArgs, {
+		const { stdout } = await execFileAsync$5(getDockerCmd(), sidecarArgs, {
 			maxBuffer: 10 * 1024 * 1024,
 			...execEnvForSecrets(sidecarPassthroughEnv)
 		});
@@ -16407,7 +16410,7 @@ async function destroyNetworkOnly(networkName) {
 	if (!networkName) return;
 	const logger = getLogger().child("ecs-network");
 	try {
-		await execFileAsync$4(getDockerCmd(), [
+		await execFileAsync$5(getDockerCmd(), [
 			"network",
 			"rm",
 			networkName
@@ -16521,7 +16524,7 @@ async function resolveSsm(entry, shape, client) {
 
 //#endregion
 //#region src/local/ecs-task-runner.ts
-const execFileAsync$3 = promisify(execFile);
+const execFileAsync$4 = promisify(execFile);
 var EcsTaskRunnerError = class EcsTaskRunnerError extends Error {
 	constructor(message) {
 		super(message);
@@ -16564,7 +16567,7 @@ async function cleanupEcsRun(state, options) {
 	if (state.network && !state.network.ownedByCaller) await destroyTaskNetwork(state.network);
 	state.network = void 0;
 	for (const v of state.dockerVolumeNames) try {
-		await execFileAsync$3(getDockerCmd(), [
+		await execFileAsync$4(getDockerCmd(), [
 			"volume",
 			"rm",
 			v
@@ -16715,7 +16718,7 @@ async function runEcsTask(task, options, state) {
 		let id;
 		warnFinchArgvExposure(Object.keys(sensitiveEnv));
 		try {
-			const { stdout } = await execFileAsync$3(getDockerCmd(), args, {
+			const { stdout } = await execFileAsync$4(getDockerCmd(), args, {
 				maxBuffer: 10 * 1024 * 1024,
 				...execEnvForSecrets(sensitiveEnv)
 			});
@@ -16807,7 +16810,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 	let lastStatus = "";
 	while (Date.now() < deadline) {
 		try {
-			const { stdout } = await execFileAsync$3(getDockerCmd(), [
+			const { stdout } = await execFileAsync$4(getDockerCmd(), [
 				"inspect",
 				"--format",
 				"{{.State.Health.Status}}",
@@ -16830,7 +16833,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 }
 async function waitForContainerExit(containerId) {
 	try {
-		const { stdout } = await execFileAsync$3(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
+		const { stdout } = await execFileAsync$4(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 		const code = Number.parseInt(stdout.trim(), 10);
 		return Number.isFinite(code) ? code : 1;
 	} catch (err) {
@@ -16840,7 +16843,7 @@ async function waitForContainerExit(containerId) {
 }
 async function stopContainer(containerId, graceSeconds) {
 	try {
-		await execFileAsync$3(getDockerCmd(), [
+		await execFileAsync$4(getDockerCmd(), [
 			"stop",
 			"-t",
 			String(graceSeconds),
@@ -16935,7 +16938,7 @@ async function realizeDockerVolumes(volumes, state) {
 		const dockerVolumeName = `${getEmbedConfig().resourceNamePrefix}-${v.name}-${randHex(4)}`;
 		args.push(dockerVolumeName);
 		try {
-			await execFileAsync$3(getDockerCmd(), args);
+			await execFileAsync$4(getDockerCmd(), args);
 			state.dockerVolumeNames.push(dockerVolumeName);
 			logger.debug(`Created docker volume ${displayIdent(dockerVolumeName)} for task volume ${displayIdent(v.name)}`);
 		} catch (err) {
@@ -17335,11 +17338,11 @@ function notFoundError$1(target, stack, resources, parsed) {
 
 //#endregion
 //#region src/local/docker-inspect.ts
-const execFileAsync$2 = promisify(execFile);
+const execFileAsync$3 = promisify(execFile);
 async function getContainerNetworkIp(containerId, networkName) {
 	const format = `{{with index .NetworkSettings.Networks "${networkName}"}}{{.IPAddress}}{{end}}`;
 	try {
-		const { stdout } = await execFileAsync$2(getDockerCmd(), [
+		const { stdout } = await execFileAsync$3(getDockerCmd(), [
 			"inspect",
 			"--format",
 			format,
@@ -17355,7 +17358,7 @@ async function getContainerNetworkIp(containerId, networkName) {
 async function getPublishedHostPort(containerId, containerPort, protocol = "tcp") {
 	const format = `{{with index .NetworkSettings.Ports "${`${containerPort}/${protocol}`}"}}{{with index . 0}}{{.HostPort}}{{end}}{{end}}`;
 	try {
-		const { stdout } = await execFileAsync$2(getDockerCmd(), [
+		const { stdout } = await execFileAsync$3(getDockerCmd(), [
 			"inspect",
 			"--format",
 			format,
@@ -18653,7 +18656,7 @@ function buildHeaderMaps(headers) {
 		multi
 	};
 }
-function firstHeader(headers, name) {
+function firstHeader$1(headers, name) {
 	const lower = name.toLowerCase();
 	for (const [k, v] of Object.entries(headers)) if (k.toLowerCase() === lower) return v[0];
 }
@@ -18661,8 +18664,8 @@ function buildAlbLambdaEvent(req, opts) {
 	const { path, rawQuery } = splitRawUrl(req.rawUrl);
 	const query = parseQuery(rawQuery);
 	const headerMaps = buildHeaderMaps(req.headers);
-	const contentEncoding = firstHeader(req.headers, "content-encoding");
-	const contentType = firstHeader(req.headers, "content-type") ?? "";
+	const contentEncoding = firstHeader$1(req.headers, "content-encoding");
+	const contentType = firstHeader$1(req.headers, "content-type") ?? "";
 	const isBase64Encoded = req.body.length > 0 && (contentEncoding !== void 0 ? true : !isTextualContentType(contentType));
 	const body = isBase64Encoded ? req.body.toString("base64") : req.body.toString("utf-8");
 	const event = {
@@ -18765,7 +18768,7 @@ async function startFrontDoorServer(opts) {
 	const scheme = opts.tls ? "https" : "http";
 	server.on("connection", (socket) => socket.setNoDelay(true));
 	server.on("upgrade", (req, clientSocket, head) => {
-		handleUpgrade(req, clientSocket, head, effectiveOpts).catch((err) => {
+		handleUpgrade$1(req, clientSocket, head, effectiveOpts).catch((err) => {
 			logger.debug(`front-door upgrade error: ${err instanceof Error ? err.message : String(err)}`);
 			if (!clientSocket.destroyed) clientSocket.destroy();
 		});
@@ -19109,7 +19112,7 @@ function writeError(res, statusCode, message) {
 	res.writeHead(statusCode, { "content-type": "text/plain; charset=utf-8" });
 	res.end(`${message}\n`);
 }
-function handleUpgrade(req, clientSocket, head, opts) {
+function handleUpgrade$1(req, clientSocket, head, opts) {
 	clientSocket.setNoDelay?.(true);
 	if (!opts.route) {
 		writeRawHttpError(clientSocket, 404, "Not Found");
@@ -19296,7 +19299,9 @@ function sanitizeRawHeaderValue(value) {
 const STATUS_TEXT$1 = {
 	301: "Moved Permanently",
 	302: "Found",
+	400: "Bad Request",
 	401: "Unauthorized",
+	403: "Forbidden",
 	404: "Not Found",
 	502: "Bad Gateway",
 	503: "Service Unavailable"
@@ -19550,7 +19555,7 @@ function matchBitPrefix(a, b, prefixLength) {
 
 //#endregion
 //#region src/local/front-door-tls.ts
-const execFileAsync$1 = promisify(execFile);
+const execFileAsync$2 = promisify(execFile);
 async function resolveFrontDoorTlsMaterials(opts) {
 	const hasCert = opts.certPath !== void 0 && opts.certPath !== "";
 	const hasKey = opts.keyPath !== void 0 && opts.keyPath !== "";
@@ -19640,7 +19645,7 @@ function readCertNotAfter(certPath) {
 	}
 }
 async function runOpenssl(args) {
-	await execFileAsync$1("openssl", args, { timeout: 3e4 });
+	await execFileAsync$2("openssl", args, { timeout: 3e4 });
 }
 function readPemOrThrow(path, flagName) {
 	try {
@@ -21843,7 +21848,7 @@ function resolveAlbFrontDoor(stack, albLogicalId) {
 		if (resource.Type !== LISTENER_TYPE) continue;
 		const props = resource.Properties ?? {};
 		if (refOf(props["LoadBalancerArn"]) !== albLogicalId) continue;
-		const port = parsePort$2(props["Port"]);
+		const port = parsePort$3(props["Port"]);
 		if (port === void 0) continue;
 		const protocol = typeof props["Protocol"] === "string" ? props["Protocol"] : "HTTP";
 		if (protocol !== "HTTP" && protocol !== "HTTPS") {
@@ -22208,7 +22213,7 @@ function refOf(raw) {
 		if (typeof ref === "string" && ref.length > 0) return ref;
 	}
 }
-function parsePort$2(raw) {
+function parsePort$3(raw) {
 	if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1 && raw <= 65535) return raw;
 	if (typeof raw === "string" && /^\d+$/.test(raw)) {
 		const n = parseInt(raw, 10);
@@ -22216,7 +22221,7 @@ function parsePort$2(raw) {
 	}
 }
 function parseContainerPort(raw) {
-	return parsePort$2(raw);
+	return parsePort$3(raw);
 }
 function parseWeight(raw) {
 	if (typeof raw === "number" && Number.isFinite(raw)) return raw < 0 ? 0 : raw;
@@ -22459,6 +22464,93 @@ function addAlbSpecificOptions(cmd) {
 	return cmd.addOption(new Option("--lb-port <listenerPort=hostPort...>", "Bind the local front-door on a specific host port (e.g. 80=8080); repeatable. Default: host port == ALB listener port. Use this on macOS to remap a privileged listener port (< 1024) to a non-privileged host port.")).addOption(new Option("--tls", "Terminate TLS locally for cloud-HTTPS listeners. Default: a cloud-HTTPS listener is served over plain HTTP locally (X-Forwarded-Proto: https is preserved so the upstream app still sees the deployed listener protocol). Implied by --tls-cert / --tls-key. Use this when local-dev cookies need Secure / SameSite=None, when the upstream app inspects TLS metadata, or for mTLS / SNI testing — otherwise plain HTTP is friendlier (no self-signed cert warnings in curl / browser).")).addOption(new Option("--tls-cert <path>", "PEM-encoded server certificate for HTTPS front-door listeners. Implies --tls. Must be set together with --tls-key. Pass --tls alone (without --tls-cert / --tls-key) to auto-generate a self-signed cert (cached under $XDG_CACHE_HOME/cdk-local/alb-https/, default ~/.cache/cdk-local/alb-https/); requires openssl on PATH. The deployed Listener Certificates[] are NOT fetched (ACM private keys are not retrievable by design). The auto-generated cert lists DNS:localhost,IP:127.0.0.1 as SubjectAltName, so a client validating a non-loopback --container-host will fail the SAN check — pass --tls-cert / --tls-key with a SAN covering that host instead.")).addOption(new Option("--tls-key <path>", "PEM-encoded server private key matching --tls-cert. Implies --tls. Must be set together with --tls-cert.")).addOption(new Option("--no-verify-auth", "Disable local enforcement of authenticate-cognito / authenticate-oidc actions. Every request is served as if the auth check passed. Useful for local dev where you do not want to mint a Bearer token at all.")).addOption(new Option("--bearer-token <jwt>", "Default Bearer JWT this command INJECTS only when an inbound request has none (the default-when-missing role) — `cdkl start-alb` is the local ALB front-door RECEIVING outside-in requests, so this token is the fallback the front-door slots in as Authorization: Bearer <jwt> if the caller did not already supply one. Verified against the same JWKS / OIDC discovery URL the deployed ALB would (signature + iss + aud + exp). Cookie pass-through (AWSELBAuthSessionCookie-*) also bypasses the guard. Contrast with `cdkl invoke-agentcore --bearer-token`, where the role is reversed — that command is the outbound client and ALWAYS presents this token (the supplier).")).addOption(new Option("--watch", "Hot-reload: re-synth + per-replica reload of every ECS service behind the ALB when the CDK source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). A per-firing classifier picks the per-replica primitive: source-only edits on interpreted-language handlers (Node/Python/Ruby/shell) take a bind-mount FAST PATH (`docker cp` the new source into each replica + restart it; no rebuild, its front-door pool entry is drained and re-published once it listens again). Dockerfile / dependency manifest / compiled-language source / ambiguous edits fall through to the rebuild rolling primitive — boot a shadow under a bumped generation suffix, wait for its container port to accept a TCP connection, atomically register it in the front-door pool, then drop the old entry and retire the old container. Either path rolls one replica at a time, so a continuous external request stream against the listener port sees zero connection refusals across the reload. The host front-door (TLS, JWKS cache, Lambda-target containers, listener sockets) stays up across the reload. Lambda target groups behind the ALB are a no-op on reload (the warm RIE container keeps its boot-time image). Off by default; existing replica(s) keep serving when synth fails mid-reload.").default(false));
 }
 
+//#endregion
+//#region src/local/s3-object-asset.ts
+function findFileAssetForObjectKey(manifest, key) {
+	for (const [hash, asset] of Object.entries(manifest.files ?? {})) for (const dest of Object.values(asset.destinations ?? {})) if (dest.objectKey === key || dest.objectKey.endsWith(`/${key}`)) return {
+		hash,
+		asset
+	};
+	const hash = key.replace(/^.*\//, "").replace(/\.zip$/, "");
+	const byHash = Object.hasOwn(manifest.files ?? {}, hash) ? manifest.files[hash] : void 0;
+	return byHash ? {
+		hash,
+		asset: byHash
+	} : void 0;
+}
+function isBucketDeploymentResource(resource) {
+	return resource !== void 0 && String(resource.Type).startsWith("Custom::CDKBucketDeployment");
+}
+function bucketDeploymentSourceObjectKeys(resource) {
+	const keys = resource.Properties?.["SourceObjectKeys"];
+	return Array.isArray(keys) ? keys : [];
+}
+function resolveBucketDeploymentObjectKey(template, value) {
+	const select = asObject$3(value)?.["Fn::Select"];
+	if (!Array.isArray(select) || select.length !== 2) return void 0;
+	const index = selectIndex(select[0]);
+	const deploymentLogicalId = sourceObjectKeysGetAttTarget(select[1]);
+	if (index === void 0 || deploymentLogicalId === void 0) return void 0;
+	const resources = template.Resources ?? {};
+	const deployment = Object.hasOwn(resources, deploymentLogicalId) ? resources[deploymentLogicalId] : void 0;
+	if (!deployment || !isBucketDeploymentResource(deployment)) return void 0;
+	const props = deployment.Properties ?? {};
+	if (handlerFlag(props["Extract"])) return {
+		kind: "extracts",
+		deploymentLogicalId,
+		index
+	};
+	if (!handlerFlag(props["OutputObjectKeys"])) return {
+		kind: "object-keys-not-output",
+		deploymentLogicalId,
+		index
+	};
+	const prefix = props["DestinationBucketKeyPrefix"];
+	if (prefix !== void 0 && prefix !== "" && prefix !== "/") return {
+		kind: "prefixed-destination",
+		deploymentLogicalId,
+		index
+	};
+	const keys = bucketDeploymentSourceObjectKeys(deployment);
+	if (index >= keys.length) return {
+		kind: "index-out-of-range",
+		deploymentLogicalId,
+		index,
+		sourceCount: keys.length
+	};
+	const sourceObjectKey = keys[index];
+	if (typeof sourceObjectKey !== "string" || sourceObjectKey.length === 0) return {
+		kind: "source-key-not-literal",
+		deploymentLogicalId,
+		index
+	};
+	return {
+		kind: "resolved",
+		deploymentLogicalId,
+		index,
+		sourceObjectKey
+	};
+}
+function handlerFlag(value) {
+	if (value === void 0 || value === true || value === "true") return true;
+	return typeof value === "object" && value !== null;
+}
+function selectIndex(value) {
+	const n = typeof value === "number" ? value : typeof value === "string" && /^\d+$/.test(value) ? Number(value) : NaN;
+	return Number.isSafeInteger(n) && n >= 0 ? n : void 0;
+}
+function sourceObjectKeysGetAttTarget(value) {
+	const getAtt = asObject$3(value)?.["Fn::GetAtt"];
+	if (Array.isArray(getAtt)) return getAtt.length === 2 && typeof getAtt[0] === "string" && getAtt[1] === "SourceObjectKeys" ? getAtt[0] : void 0;
+	if (typeof getAtt === "string" && getAtt.endsWith(".SourceObjectKeys")) {
+		const id = getAtt.slice(0, -17);
+		return id.length > 0 && !id.includes(".") ? id : void 0;
+	}
+}
+function asObject$3(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+
 //#endregion
 //#region src/local/cloudfront-kvs.ts
 function createCloudFrontModule(sources) {
@@ -22760,6 +22852,177 @@ function decodePart(s) {
 	}
 }
 
+//#endregion
+//#region src/local/web-function-resolver.ts
+const WEB_FUNCTION_TYPE = "AWS::Lambda::WebFunction";
+const WEB_FUNCTION_REVISION_TYPE = "AWS::Lambda::WebFunctionRevision";
+const WEB_FUNCTION_ENDPOINT_TYPE = "AWS::Lambda::WebFunctionEndpoint";
+const WEB_TYPES = [
+	WEB_FUNCTION_ENDPOINT_TYPE,
+	WEB_FUNCTION_TYPE,
+	WEB_FUNCTION_REVISION_TYPE
+];
+var WebFunctionResolutionError = class WebFunctionResolutionError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WebFunctionResolutionError";
+		Object.setPrototypeOf(this, WebFunctionResolutionError.prototype);
+	}
+};
+function resolveWebFunctionTarget(target, stacks, revisionFlag) {
+	if (stacks.length === 0) throw new WebFunctionResolutionError("No stacks found in the synthesized assembly.");
+	const parsed = parseTarget(target);
+	const stack = pickStack$1(parsed, stacks, target);
+	const resources = stack.template.Resources ?? {};
+	const { logicalId, resource } = matchWebResource(parsed, target, stack, resources);
+	const functions = logicalIdsOfType(resources, WEB_FUNCTION_TYPE);
+	const linked = (value) => linkedFunctionLogicalId(value, resources, functions);
+	let functionLogicalId;
+	let endpoint;
+	let revisionLogicalId;
+	let selection;
+	if (resource.Type === "AWS::Lambda::WebFunctionRevision") {
+		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
+		revisionLogicalId = logicalId;
+		selection = "target-revision";
+	} else if (resource.Type === "AWS::Lambda::WebFunctionEndpoint") {
+		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
+		endpoint = readEndpoint(logicalId, resource, resources);
+	} else functionLogicalId = logicalId;
+	const revisionsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_REVISION_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
+	const endpointsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_ENDPOINT_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
+	if (revisionFlag !== void 0) {
+		const flagged = resources[revisionFlag];
+		if (!flagged || flagged.Type !== "AWS::Lambda::WebFunctionRevision") throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} is not an ${WEB_FUNCTION_REVISION_TYPE} logical id in ${displayStackName(stack.stackName)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
+		const owner = linked(flagged.Properties?.["FunctionName"]);
+		if (functionLogicalId !== void 0 && owner !== functionLogicalId) throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} belongs to a different web function than ${displayIdent(logicalId)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
+		functionLogicalId ??= owner;
+		revisionLogicalId = revisionFlag;
+		selection = "revision-flag";
+	}
+	if (revisionLogicalId === void 0 && endpoint !== void 0) {
+		revisionLogicalId = pickHighestWeight(endpoint);
+		if (revisionLogicalId !== void 0) selection = "endpoint-weight";
+	}
+	if (revisionLogicalId === void 0) {
+		const revisions = revisionsOfFunction();
+		if (revisions.length === 1) {
+			revisionLogicalId = revisions[0];
+			selection = "only-revision";
+		} else if (endpoint === void 0 && revisions.length > 1) {
+			const endpoints = endpointsOfFunction();
+			if (endpoints.length === 1) {
+				endpoint = readEndpoint(endpoints[0], resources[endpoints[0]], resources);
+				revisionLogicalId = pickHighestWeight(endpoint);
+				if (revisionLogicalId !== void 0) selection = "endpoint-weight";
+			}
+		}
+		if (revisionLogicalId === void 0) throw new WebFunctionResolutionError(revisions.length === 0 ? `${displayIdent(logicalId)} in ${displayStackName(stack.stackName)} resolves to no ${WEB_FUNCTION_REVISION_TYPE} in this template, so there is no code to serve. Target the revision itself, or pass --revision <logicalId>.` : `${displayIdent(logicalId)} has ${revisions.length} revisions and no single endpoint that picks one. Pass --revision <logicalId>, or target one of the function's endpoints. ${describeRevisions(revisions, stack)}`);
+	}
+	if (endpoint === void 0) {
+		const routing = endpointsOfFunction().map((id) => readEndpoint(id, resources[id], resources)).filter((e) => e.weights.some((w) => w.revisionLogicalId === revisionLogicalId));
+		if (routing.length === 1) endpoint = routing[0];
+	}
+	const fnName = (functionLogicalId !== void 0 ? resources[functionLogicalId] : void 0)?.Properties?.["FunctionName"];
+	return {
+		stack,
+		functionLogicalId,
+		functionName: typeof fnName === "string" && fnName.length > 0 ? fnName : functionLogicalId ?? revisionLogicalId,
+		revisionLogicalId,
+		revision: resources[revisionLogicalId],
+		endpoint,
+		selection: selection ?? "only-revision"
+	};
+}
+function pickStack$1(parsed, stacks, target) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new WebFunctionResolutionError(`Multiple stacks in app, target ${displayIdent(parsed.pathOrId)} is missing a stack prefix. Use StackName:<logicalId> or StackName/... (path form). Available stacks: ${describeStacks(stacks)}.`);
+		case "not-found": throw new WebFunctionResolutionError(`Stack ${displayStackName(selection.pattern)} not found. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new WebFunctionResolutionError(`Stack pattern ${displayStackName(selection.pattern)} matched ${selection.matched.length} stacks: ${describeStacks(selection.matched)}. Use a more specific pattern, or the stack's display path.`);
+	}
+}
+function matchWebResource(parsed, target, stack, resources) {
+	if (parsed.isPath) {
+		const matches = resolveCdkPathToLogicalIds(parsed.pathOrId, buildCdkPathIndex(stack.template)).filter(({ logicalId }) => WEB_TYPES.includes(resources[logicalId]?.Type ?? ""));
+		for (const type of WEB_TYPES) {
+			const ofType = matches.filter(({ logicalId }) => resources[logicalId].Type === type);
+			if (ofType.length === 1) {
+				const id = ofType[0].logicalId;
+				return {
+					logicalId: id,
+					resource: resources[id]
+				};
+			}
+			if (ofType.length > 1) throw new WebFunctionResolutionError(`Target ${displayStackName(target)} matches ${ofType.length} ${type} resources: ${ofType.map((m) => displayIdent(m.logicalId)).join(", ")}. Refine the path or use the StackName:<logicalId> form.`);
+		}
+		throw notFoundError(target, stack, resources);
+	}
+	const resource = resources[parsed.pathOrId];
+	if (!resource) throw notFoundError(target, stack, resources);
+	if (!WEB_TYPES.includes(resource.Type)) throw new WebFunctionResolutionError(`Resource ${displayIdent(parsed.pathOrId)} in ${displayStackName(stack.stackName)} is ${displayIdent(resource.Type)}, not a Lambda web function. ${getEmbedConfig().cliName} start-web-function serves ${WEB_TYPES.join(" / ")} targets.`);
+	return {
+		logicalId: parsed.pathOrId,
+		resource
+	};
+}
+function notFoundError(target, stack, resources) {
+	const available = WEB_TYPES.flatMap((t) => logicalIdsOfType(resources, t));
+	const hint = available.length > 0 ? `Web function resources in ${displayStackName(stack.stackName)}: ${available.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_TYPE} resources found in ${displayStackName(stack.stackName)}.`;
+	return new WebFunctionResolutionError(`Target ${displayStackName(target)} not found. ${hint}`);
+}
+function logicalIdsOfType(resources, type) {
+	return Object.keys(resources).filter((id) => resources[id]?.Type === type);
+}
+function linkedFunctionLogicalId(value, resources, functions) {
+	const ref = referencedLogicalId(value);
+	if (ref !== void 0) return functions.includes(ref) ? ref : void 0;
+	if (typeof value !== "string") return void 0;
+	const byName = functions.filter((id) => resources[id]?.Properties?.["FunctionName"] === value);
+	return byName.length === 1 ? byName[0] : void 0;
+}
+function referencedLogicalId(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const obj = value;
+	if (typeof obj["Ref"] === "string") return obj["Ref"];
+	const getAtt = obj["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
+	if (typeof getAtt === "string") return getAtt.split(".")[0];
+}
+function readEndpoint(logicalId, resource, resources) {
+	const props = resource.Properties ?? {};
+	const rawWeights = props["RevisionWeights"];
+	const weights = [];
+	if (Array.isArray(rawWeights)) for (const entry of rawWeights) {
+		if (!entry || typeof entry !== "object") continue;
+		const e = entry;
+		const ref = referencedLogicalId(e["RevisionId"]);
+		weights.push({
+			revisionLogicalId: ref !== void 0 && resources[ref]?.Type === "AWS::Lambda::WebFunctionRevision" ? ref : void 0,
+			weight: typeof e["Weight"] === "number" ? e["Weight"] : 0
+		});
+	}
+	const str = (v) => typeof v === "string" ? v : void 0;
+	return {
+		logicalId,
+		endpointType: str(props["EndpointType"]),
+		authType: str(props["AuthType"]),
+		weights
+	};
+}
+function pickHighestWeight(endpoint) {
+	let best;
+	for (const w of endpoint.weights) {
+		if (w.revisionLogicalId === void 0) continue;
+		if (best === void 0 || w.weight > best.weight) best = w;
+	}
+	return best?.revisionLogicalId;
+}
+function describeRevisions(revisions, stack) {
+	return revisions.length > 0 ? `Revisions: ${revisions.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_REVISION_TYPE} linked to it in ${displayStackName(stack.stackName)}.`;
+}
+
 //#endregion
 //#region src/local/cloudfront-resolver.ts
 const CLOUDFRONT_DISTRIBUTION_TYPE = "AWS::CloudFront::Distribution";
@@ -22944,6 +23207,18 @@ function resolveOrigins(dc, template, stack, overrides) {
 				out.set(originId, lambdaUrl);
 				continue;
 			}
+			const endpointLogicalId = pickWebFunctionEndpointLogicalIdFromOrigin(origin["DomainName"], template);
+			if (endpointLogicalId) {
+				const customConfig = origin["CustomOriginConfig"];
+				const readTimeout = customConfig && typeof customConfig === "object" ? customConfig["OriginReadTimeout"] : void 0;
+				out.set(originId, {
+					kind: "web-function",
+					originId,
+					endpointLogicalId,
+					...typeof readTimeout === "number" && readTimeout > 0 && { readTimeoutSeconds: readTimeout }
+				});
+				continue;
+			}
 			out.set(originId, {
 				kind: "custom",
 				originId,
@@ -23012,13 +23287,11 @@ function resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId)
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
 	const dirs = [];
 	for (const resource of Object.values(template.Resources ?? {})) {
-		if (!String(resource.Type).startsWith("Custom::CDKBucketDeployment")) continue;
-		const props = resource.Properties ?? {};
-		if (refLogicalId(props["DestinationBucketName"]) !== bucketLogicalId) continue;
-		const keys = Array.isArray(props["SourceObjectKeys"]) ? props["SourceObjectKeys"] : [];
-		for (const key of keys) {
+		if (!isBucketDeploymentResource(resource)) continue;
+		if (refLogicalId((resource.Properties ?? {})["DestinationBucketName"]) !== bucketLogicalId) continue;
+		for (const key of bucketDeploymentSourceObjectKeys(resource)) {
 			if (typeof key !== "string") continue;
-			const asset = findFileAssetByObjectKey(manifest, key);
+			const asset = findFileAssetForObjectKey(manifest, key)?.asset;
 			if (!asset) continue;
 			dirs.push(resolveAssetSourcePath({
 				manifestDir,
@@ -23035,11 +23308,6 @@ function resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId)
 	}
 	return dirs;
 }
-function findFileAssetByObjectKey(manifest, objectKey) {
-	for (const asset of Object.values(manifest.files ?? {})) for (const dest of Object.values(asset.destinations ?? {})) if (dest.objectKey === objectKey) return asset;
-	const hash = objectKey.replace(/\.zip$/, "");
-	return manifest.files?.[hash];
-}
 function pickBucketLogicalIdFromOrigin(origin, template) {
 	const candidate = getAttLogicalId(origin["DomainName"]);
 	if (!candidate) return void 0;
@@ -23067,6 +23335,11 @@ function resolveLambdaUrlOrigin(origin, template, originId) {
 		functionUrlLogicalId: urlLogicalId
 	};
 }
+function pickWebFunctionEndpointLogicalIdFromOrigin(value, template) {
+	const getAtt = asIntrinsic(value, "Fn::GetAtt");
+	if (!Array.isArray(getAtt) || getAtt.length !== 2 || typeof getAtt[0] !== "string" || getAtt[1] !== "DomainName") return;
+	return (template.Resources ?? {})[getAtt[0]]?.Type === "AWS::Lambda::WebFunctionEndpoint" ? getAtt[0] : void 0;
+}
 function pickFunctionUrlLogicalIdFromOrigin(value) {
 	const select = asIntrinsic(value, "Fn::Select");
 	if (!Array.isArray(select) || select.length !== 2 || select[0] !== 2) return void 0;
@@ -23384,34 +23657,115 @@ function normalizeHeaders(headers) {
 }
 
 //#endregion
-//#region src/local/cloudfront-static-origin.ts
-function serveFromStaticOrigin(input) {
-	const key = uriToKey(input.uri, input.defaultRootObject);
-	const containLinks = input.containLinks === true;
-	const hideIn = new Set(input.hideDotfilesIn ?? []);
-	const direct = readKey(input.localDirs, key, containLinks, hideIn);
-	if (direct) return {
-		statusCode: 200,
-		headers: { "content-type": contentTypeForKey(key) },
-		body: direct
-	};
-	for (const candidate of resolveErrorResponseCandidates(input.customErrorResponses)) {
-		const body = readKey(input.localDirs, candidate.errorKey, containLinks, hideIn);
-		if (body) return {
-			statusCode: candidate.responseCode,
-			headers: { "content-type": contentTypeForKey(candidate.errorKey) },
-			body
+//#region src/local/cloudfront-web-function-origin.ts
+const DEFAULT_ORIGIN_READ_TIMEOUT_SECONDS = 30;
+function serveWebFunctionOrigin(args) {
+	const { target, request: request$3 } = args;
+	const timeoutMs = (args.readTimeoutSeconds ?? 30) * 1e3;
+	const headers = buildOriginRequestHeaders(request$3, target);
+	if (request$3.body.length > 0) headers["content-length"] = String(request$3.body.length);
+	const path = request$3.querystring ? `${request$3.uri}?${request$3.querystring}` : request$3.uri;
+	return new Promise((resolveResult) => {
+		let settled = false;
+		const settle = (result) => {
+			if (settled) return;
+			settled = true;
+			resolveResult(result);
 		};
-	}
-	return {
-		statusCode: 404,
-		headers: { "content-type": "text/plain; charset=utf-8" },
-		body: Buffer.from(`Not found: ${input.uri}\n`)
-	};
-}
-function resolveErrorResponseCandidates(customErrorResponses) {
-	const errorResponses = customErrorResponses ?? [];
-	const out = [];
+		const req = request({
+			host: target.host,
+			port: target.port,
+			method: request$3.method,
+			path,
+			headers,
+			agent: false
+		}, (res) => {
+			const chunks = [];
+			res.on("data", (c) => chunks.push(c));
+			res.on("end", () => settle({
+				statusCode: res.statusCode ?? 502,
+				...splitResponseHeaders(res.headers),
+				body: Buffer.concat(chunks)
+			}));
+			res.on("error", (err) => settle(originError(502, err.message)));
+		});
+		req.setTimeout(timeoutMs, () => {
+			settle(originError(504, `the web function server did not answer within the origin read timeout (${timeoutMs / 1e3}s)`));
+			req.destroy();
+		});
+		req.on("error", (err) => settle(originError(502, err.message)));
+		req.end(request$3.body.length > 0 ? request$3.body : void 0);
+	});
+}
+function buildOriginRequestHeaders(request, target) {
+	const headers = {};
+	for (const [name, value] of Object.entries(request.headers)) if (value !== void 0) headers[name.toLowerCase()] = value;
+	stripHopByHopHeaders(headers);
+	delete headers["content-length"];
+	headers["host"] = formatAuthority(target.host, target.port);
+	if (request.sourceIp !== void 0) {
+		const prior = headers["x-forwarded-for"];
+		const priorValue = Array.isArray(prior) ? prior.join(", ") : prior;
+		headers["x-forwarded-for"] = priorValue ? `${priorValue}, ${request.sourceIp}` : request.sourceIp;
+	}
+	const out = {};
+	for (const [name, value] of Object.entries(headers)) if (value !== void 0) out[name] = value;
+	return out;
+}
+function splitResponseHeaders(raw) {
+	const copy = { ...raw };
+	stripHopByHopHeaders(copy);
+	delete copy["content-length"];
+	const cookies = copy["set-cookie"];
+	delete copy["set-cookie"];
+	const headers = {};
+	for (const [name, value] of Object.entries(copy)) {
+		if (value === void 0) continue;
+		headers[name] = Array.isArray(value) ? value.join(", ") : value;
+	}
+	return {
+		headers,
+		cookies: cookies === void 0 ? [] : Array.isArray(cookies) ? cookies : [cookies]
+	};
+}
+function originError(statusCode, detail) {
+	return {
+		statusCode,
+		headers: { "content-type": "text/plain; charset=utf-8" },
+		cookies: [],
+		body: Buffer.from(`${statusCode === 502 ? "Bad Gateway" : "Gateway Timeout"}: ${detail.replace(/[\r\n]+/g, " ")}\n`)
+	};
+}
+
+//#endregion
+//#region src/local/cloudfront-static-origin.ts
+function serveFromStaticOrigin(input) {
+	const key = uriToKey(input.uri, input.defaultRootObject);
+	const containLinks = input.containLinks === true;
+	const hideIn = new Set(input.hideDotfilesIn ?? []);
+	const direct = readKey(input.localDirs, key, containLinks, hideIn);
+	if (direct) return {
+		statusCode: 200,
+		headers: { "content-type": contentTypeForKey(key) },
+		body: direct
+	};
+	for (const candidate of resolveErrorResponseCandidates(input.customErrorResponses)) {
+		const body = readKey(input.localDirs, candidate.errorKey, containLinks, hideIn);
+		if (body) return {
+			statusCode: candidate.responseCode,
+			headers: { "content-type": contentTypeForKey(candidate.errorKey) },
+			body
+		};
+	}
+	return {
+		statusCode: 404,
+		headers: { "content-type": "text/plain; charset=utf-8" },
+		body: Buffer.from(`Not found: ${input.uri}\n`)
+	};
+}
+function resolveErrorResponseCandidates(customErrorResponses) {
+	const errorResponses = customErrorResponses ?? [];
+	const out = [];
 	for (const code of [403, 404]) {
 		const match = errorResponses.find((e) => e.errorCode === code);
 		if (!match || !match.responsePagePath) continue;
@@ -23552,9 +23906,10 @@ async function startCloudFrontServer(options) {
 	const lambdaInvokers = options.lambdaInvokers ?? /* @__PURE__ */ new Map();
 	const edgeInvokers = options.edgeInvokers ?? /* @__PURE__ */ new Map();
 	const s3OriginReaders = options.s3OriginReaders ?? /* @__PURE__ */ new Map();
+	const webFunctionOrigins = options.webFunctionOrigins ?? /* @__PURE__ */ new Map();
 	const state = { distribution: options.distribution };
 	const handler = (req, res) => {
-		handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger).catch((err) => {
+		handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, webFunctionOrigins, logger).catch((err) => {
 			logger.warn(`Request handling failed: ${err instanceof Error ? err.message : String(err)}`);
 			if (!res.headersSent) {
 				res.statusCode = 500;
@@ -23583,7 +23938,7 @@ async function startCloudFrontServer(options) {
 		}
 	};
 }
-async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, logger) {
+async function handleRequest$2(req, res, state, lambdaInvokers, edgeInvokers, s3OriginReaders, webFunctionOrigins, logger) {
 	const distribution = state.distribution;
 	const rawUrl = req.url ?? "/";
 	const queryIdx = rawUrl.indexOf("?");
@@ -23675,6 +24030,7 @@ async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3
 		distribution,
 		lambdaInvokers,
 		s3OriginReaders,
+		webFunctionOrigins,
 		logger
 	});
 	if (!originResult) return writePlain(res, 502, originUnavailableMessage(origin, behavior));
@@ -23830,6 +24186,28 @@ async function serveFromOrigin(origin, args) {
 			...result.cookies.length > 0 && { setCookies: result.cookies }
 		};
 	}
+	if (origin.kind === "web-function") {
+		const target = args.webFunctionOrigins.get(origin.endpointLogicalId);
+		if (!target) return void 0;
+		const result = await serveWebFunctionOrigin({
+			target,
+			request: {
+				method: args.method,
+				uri: args.uri,
+				querystring: args.querystring,
+				headers: args.headers,
+				body: await args.readBody(),
+				sourceIp: args.sourceIp
+			},
+			...origin.readTimeoutSeconds !== void 0 && { readTimeoutSeconds: origin.readTimeoutSeconds }
+		});
+		return {
+			statusCode: result.statusCode,
+			headers: result.headers,
+			body: result.body,
+			...result.cookies.length > 0 && { setCookies: result.cookies }
+		};
+	}
 	if (origin.kind === "s3-deployed") {
 		const reader = args.s3OriginReaders.get(origin.originId);
 		if (!reader) return void 0;
@@ -23862,7 +24240,8 @@ async function serveFromOrigin(origin, args) {
 function originUnavailableMessage(origin, behavior) {
 	if (!origin) return `Behavior ${behavior.pathPattern === void 0 ? "(default)" : displayUntrustedValue(behavior.pathPattern)} targets unknown origin ${displayIdent(behavior.targetOriginId)}.\n`;
 	if (origin.kind === "lambda-url") return `Origin ${displayIdent(origin.originId)} is a Lambda Function URL origin whose backing function ${displayIdent(origin.functionLogicalId)} was not booted (it was added after start-up). Restart start-cloudfront.\n`;
-	if (origin.kind === "custom") return `Origin ${displayIdent(origin.originId)} is a custom (non-S3) origin (${displayUntrustedValue(String(origin.domainName))}). cdkl start-cloudfront serves S3 origins and Lambda Function URL origins only.
+	if (origin.kind === "web-function") return `Origin ${displayIdent(origin.originId)} is a Lambda Web Function endpoint origin whose endpoint ${displayIdent(origin.endpointLogicalId)} was not booted (it was added after start-up). Restart start-cloudfront.\n`;
+	if (origin.kind === "custom") return `Origin ${displayIdent(origin.originId)} is a custom (non-S3) origin (${displayUntrustedValue(String(origin.domainName))}). cdkl start-cloudfront serves S3, Lambda Function URL and Lambda Web Function endpoint origins only.
 `;
 	if (origin.kind === "s3-deployed") return `Origin ${displayIdent(origin.originId)} is a deployed-S3 origin (bucket ${displayIdent(origin.bucketName)}) whose reader was not booted (it was promoted after start-up). Restart start-cloudfront.
 `;
@@ -24156,252 +24535,857 @@ function idFromArn(arn) {
 }
 
 //#endregion
-//#region src/cli/commands/local-start-cloudfront.ts
-var LocalStartCloudFrontError = class extends CdkLocalError {
-	constructor(message, cause) {
-		super(message, "LOCAL_START_CLOUDFRONT_ERROR", cause);
-	}
-};
-function parseOriginOverrides(values) {
-	const out = /* @__PURE__ */ new Map();
-	for (const raw of values ?? []) {
-		const eq = raw.indexOf("=");
-		if (eq <= 0 || eq === raw.length - 1) throw new LocalStartCloudFrontError(`Invalid --origin '${raw}'. Expected <originId>=<dir> (e.g. MyOrigin=./site).`);
-		out.set(raw.slice(0, eq).trim(), raw.slice(eq + 1).trim());
-	}
-	return out;
+//#region src/local/web-function-service-config.ts
+const WEB_FUNCTION_HTTP_ENDPOINT_ENV = "AWS_LAMBDA_HTTP_ENDPOINT";
+const APPLICATION_MANAGED_AUTH = "ApplicationManaged";
+const HOME_REGION_ENDPOINT = "HomeRegion";
+function readWebFunctionServiceConfig(revision) {
+	const sc = asObject$2(revision.Properties?.["ServiceConfig"]) ?? {};
+	const envRaw = sc["EnvironmentVariables"];
+	const envObj = asObject$2(envRaw);
+	const envKeys = envObj ? Object.keys(envObj) : [];
+	const env = envKeys.length === 1 && (envKeys[0] === "Ref" || envKeys[0].startsWith("Fn::")) ? void 0 : envObj;
+	const logGroup = asObject$2(asObject$2(sc["TelemetryConfig"])?.["LoggingConfig"])?.["LogGroup"];
+	return {
+		environmentVariables: env,
+		environmentUnreadable: envRaw !== void 0 && env === void 0,
+		executionRoleArn: sc["ExecutionRoleArn"],
+		egressNetworkConnectorArn: sc["EgressNetworkConnectorArn"],
+		timeoutSeconds: typeof sc["TimeoutSeconds"] === "number" ? sc["TimeoutSeconds"] : void 0,
+		logGroup: typeof logGroup === "string" && logGroup.length > 0 ? logGroup : void 0
+	};
 }
-function parseKvsFileOverrides(values) {
-	const out = /* @__PURE__ */ new Map();
-	for (const raw of values ?? []) {
-		const eq = raw.indexOf("=");
-		if (eq <= 0 || eq === raw.length - 1) throw new LocalStartCloudFrontError(`Invalid --kvs-file '${raw}'. Expected <key>=<file.json> (e.g. RoutesKvs=./kvs.json).`);
-		out.set(raw.slice(0, eq).trim(), raw.slice(eq + 1).trim());
-	}
-	return out;
+function buildWebFunctionLambdaView(resolved, config, runtime) {
+	return {
+		kind: "zip",
+		stack: resolved.stack,
+		logicalId: resolved.revisionLogicalId,
+		resource: {
+			Type: resolved.revision.Type,
+			Properties: {
+				...config.environmentVariables !== void 0 && { Environment: { Variables: config.environmentVariables } },
+				...config.executionRoleArn !== void 0 && { Role: config.executionRoleArn }
+			},
+			...resolved.revision.Metadata !== void 0 && { Metadata: resolved.revision.Metadata }
+		},
+		memoryMb: 128,
+		timeoutSec: config.timeoutSeconds ?? 0,
+		layers: [],
+		runtime,
+		handler: "",
+		codePath: null,
+		architecture: "arm64"
+	};
 }
-function collectKvsStoreIdentities(template) {
-	const out = [];
-	for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
-		if (resource.Type !== "AWS::CloudFront::KeyValueStore") continue;
-		const cdkPath = readCdkPath(resource) || void 0;
-		const constructPath = cdkPath?.endsWith("/Resource") ? cdkPath.slice(0, -9) : cdkPath;
-		const constructId = constructPath?.split("/").pop();
-		out.push({
-			logicalId,
-			...cdkPath !== void 0 && { cdkPath },
-			...constructPath !== void 0 && { constructPath },
-			...constructId !== void 0 && constructId !== "" && { constructId }
-		});
-	}
-	return out;
+function webFunctionAssumeRole(assumeRole, config) {
+	if (assumeRole === true && isIamRoleArn(config.executionRoleArn)) return config.executionRoleArn;
+	return assumeRole;
 }
-function normalizeKvsFileKeys(kvsFiles, template) {
-	if (kvsFiles.size === 0) return kvsFiles;
-	const stores = collectKvsStoreIdentities(template);
-	const candidates = () => stores.map((s) => s.constructPath ? `${displayIdent(s.logicalId, { listMember: true })} (${displayStackName(s.constructPath)})` : displayIdent(s.logicalId, { listMember: true })).join(", ") || "(none in this distribution)";
-	const out = /* @__PURE__ */ new Map();
-	for (const [key, filePath] of kvsFiles) {
-		const matched = [
-			stores.filter((s) => s.logicalId === key),
-			stores.filter((s) => s.constructPath === key || s.cdkPath === key),
-			stores.filter((s) => s.constructId === key)
-		].find((t) => t.length > 0) ?? [];
-		if (matched.length === 0) throw new LocalStartCloudFrontError(`--kvs-file key '${key}' matched no AWS::CloudFront::KeyValueStore in the distribution. Pass a store's logical id, construct path, or bare construct id. Candidates: ${candidates()}.`);
-		if (matched.length > 1) throw new LocalStartCloudFrontError(`--kvs-file key '${key}' is ambiguous — it matched ${matched.length} KeyValueStores (${matched.map((s) => displayIdent(s.logicalId, { listMember: true })).join(", ")}). Use the logical id or full construct path.`);
-		out.set(matched[0].logicalId, filePath);
+function finalizeWebFunctionEnv(lambdaEnv, opts) {
+	const env = { ...lambdaEnv };
+	delete env["AWS_LAMBDA_FUNCTION_MEMORY_SIZE"];
+	delete env["AWS_LAMBDA_FUNCTION_VERSION"];
+	delete env["AWS_LAMBDA_FUNCTION_TIMEOUT"];
+	env["AWS_LAMBDA_FUNCTION_NAME"] = opts.functionName;
+	env["AWS_LAMBDA_LOG_GROUP_NAME"] = opts.logGroup ?? `/aws/lambda/${opts.functionName}`;
+	if (opts.timeoutSeconds !== void 0) env["AWS_LAMBDA_FUNCTION_TIMEOUT"] = String(opts.timeoutSeconds);
+	const replacedHttpEndpoint = Object.hasOwn(lambdaEnv, WEB_FUNCTION_HTTP_ENDPOINT_ENV);
+	env[WEB_FUNCTION_HTTP_ENDPOINT_ENV] = `0.0.0.0:${opts.containerPort}`;
+	return {
+		env,
+		replacedHttpEndpoint
+	};
+}
+function webFunctionFidelityWarnings(resolved, config) {
+	const out = [];
+	const rev = displayIdent(resolved.revisionLogicalId);
+	if (config.egressNetworkConnectorArn !== void 0) out.push(`Revision ${rev} sets ServiceConfig.EgressNetworkConnectorArn; the network connector is not emulated, so the container reaches the network through Docker's default bridge.`);
+	if (config.environmentUnreadable) out.push(`Revision ${rev} declares ServiceConfig.EnvironmentVariables as an intrinsic rather than a map; none of its variables reach the container. Supply them with --env-vars.`);
+	const endpoint = resolved.endpoint;
+	if (endpoint) {
+		const ep = displayIdent(endpoint.logicalId);
+		if (endpoint.endpointType !== void 0 && endpoint.endpointType !== "HomeRegion") out.push(`Endpoint ${ep} has EndpointType ${displayIdent(endpoint.endpointType)}; only a single ${HOME_REGION_ENDPOINT} endpoint is reproduced, on one local port.`);
+		if (endpoint.authType !== void 0 && endpoint.authType !== "ApplicationManaged") out.push(`Endpoint ${ep} has AuthType ${displayIdent(endpoint.authType)}; it is not enforced locally — every request reaches the server unauthenticated.`);
+		const routed = endpoint.weights.filter((w) => w.weight > 0);
+		if (routed.length > 1) out.push(`Endpoint ${ep} splits traffic across ${routed.length} revisions; weighted routing is not emulated — every request goes to revision ${rev}.`);
 	}
 	return out;
 }
-async function attachKvsModules(distribution, stacks, options, profileCredentials, logger, extraStateProviders) {
-	const stack = stacks.find((s) => s.stackName === distribution.stackName);
-	const synthRegion = stack?.region;
-	const kvsFiles = stack ? normalizeKvsFileKeys(parseKvsFileOverrides(options.kvsFile), stack.template) : parseKvsFileOverrides(options.kvsFile);
-	const resolveDeployedKvs = isStateSourceActive(options, extraStateProviders) ? async (kvsLogicalId) => {
-		const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
-		if (!provider) return void 0;
-		let record;
-		try {
-			record = await provider.load(distribution.stackName, synthRegion);
-		} finally {
-			provider.dispose();
-		}
-		const physicalId = record?.resources[kvsLogicalId]?.physicalId;
-		if (!physicalId) return void 0;
-		if (physicalId.startsWith("arn:")) {
-			const id = idFromArn(physicalId);
-			return {
-				arn: physicalId,
-				...id !== void 0 && { id }
-			};
-		}
-		return resolveDeployedKvsArnByName(physicalId, { ...profileCredentials !== void 0 && { credentials: profileCredentials } });
-	} : void 0;
-	const { warnings } = await resolveKvsModulesForDistribution(distribution, {
-		...kvsFiles.size > 0 && { kvsFiles },
-		...resolveDeployedKvs !== void 0 && { resolveDeployedKvs },
-		...profileCredentials !== void 0 && { credentials: profileCredentials }
-	});
-	for (const warning of warnings) logger.warn(warning);
+function asObject$2(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function resolveCloudFrontTarget(target, stacks) {
-	if (stacks.length === 0) throw new LocalStartCloudFrontError("No stacks found in the synthesized assembly.");
-	const parsed = parseEcsTarget(target);
-	const stack = pickStack$1(parsed, stacks, target);
-	const resources = stack.template.Resources ?? {};
-	if (parsed.isPath) {
-		const index = buildCdkPathIndex(stack.template);
-		const dists = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId }) => {
-			const r = resources[logicalId];
-			return r !== void 0 && r.Type === "AWS::CloudFront::Distribution";
-		});
-		if (dists.length === 0) throw notFound(target, stack, resources);
-		if (dists.length > 1) throw new LocalStartCloudFrontError(`Target '${target}' matches ${dists.length} distributions in ${stack.stackName}: ${dists.map((d) => d.logicalId).join(", ")}. Refine the path or use the stack:LogicalId form.`);
-		return {
-			stack,
-			logicalId: dists[0].logicalId
+
+//#endregion
+//#region src/local/web-function-artifact.ts
+const SUPPORTED_CODE_CONFIG_KEYS = ["S3Object"];
+function parseWebFunctionBuildConfig(revisionLogicalId, buildConfig, template) {
+	const subject = `Web function revision ${displayIdent(revisionLogicalId)}`;
+	const build = asObject$1(buildConfig);
+	const runtime = asObject$1(build?.["RuntimeConfig"])?.["Runtime"];
+	if (typeof runtime !== "string" || runtime.length === 0) throw new CdkLocalError(`${subject} has no literal BuildConfig.RuntimeConfig.Runtime.`, "LOCAL_START_WEB_FUNCTION_NO_RUNTIME");
+	const codeConfig = asObject$1(build?.["CodeConfig"]);
+	if (!codeConfig) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
+	const unknownKeys = Object.keys(codeConfig).filter((k) => !SUPPORTED_CODE_CONFIG_KEYS.includes(k));
+	if (unknownKeys.length > 0) throw new CdkLocalError(`${subject} uses BuildConfig.CodeConfig.${unknownKeys.map((k) => displayIdent(k)).join(", ")}, which ${getEmbedConfig().cliName} start-web-function does not support yet. Supported: ${SUPPORTED_CODE_CONFIG_KEYS.join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_CODE_CONFIG");
+	const s3 = asObject$1(codeConfig["S3Object"]);
+	if (!s3) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig.S3Object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
+	const rawKey = s3["Key"];
+	let key;
+	let deployment;
+	if (typeof rawKey === "string" && rawKey.length > 0) key = rawKey;
+	else {
+		const viaDeployment = template ? resolveBucketDeploymentObjectKey(template, rawKey) : void 0;
+		if (viaDeployment === void 0) throw new CdkLocalError(`${subject} has a CodeConfig.S3Object.Key that is not a literal string (${describeValue$1(rawKey)}). The code must come from a CDK asset in this app: an s3assets.Asset passing asset.s3BucketName / asset.s3ObjectKey, whose key synthesizes as a literal` + (template ? ", or a BucketDeployment with extract: false passing Fn.select(<i>, deployment.objectKeys), which resolves to its i-th source asset." : "."), "LOCAL_START_WEB_FUNCTION_CODE_KEY_NOT_LITERAL");
+		key = bucketDeploymentSourceKey(subject, viaDeployment);
+		deployment = {
+			logicalId: viaDeployment.deploymentLogicalId,
+			index: viaDeployment.index
 		};
 	}
-	const res = resources[parsed.pathOrId];
-	if (!res || res.Type !== "AWS::CloudFront::Distribution") throw notFound(target, stack, resources);
+	const versionId = s3["VersionId"];
 	return {
-		stack,
-		logicalId: parsed.pathOrId
+		runtime,
+		s3Object: {
+			bucket: s3["Bucket"],
+			key,
+			...typeof versionId === "string" && { versionId },
+			...deployment !== void 0 && { deployment }
+		}
 	};
 }
-function pickStack$1(parsed, stacks, target) {
-	const selection = selectTargetStack(parsed, target, stacks);
-	switch (selection.kind) {
-		case "found": return selection.stack;
-		case "no-prefix": throw new LocalStartCloudFrontError(`Target '${target}' has no stack prefix, and the assembly contains ${stacks.length} stacks: ${describeStacks(stacks)}. Pass it as 'Stack/Path' or 'Stack:LogicalId'.`);
-		case "not-found": throw new LocalStartCloudFrontError(`No stack matches '${selection.pattern}'. Available stacks: ${describeStacks(stacks)}.`);
-		case "ambiguous": throw new LocalStartCloudFrontError(`Multiple stacks match '${selection.pattern}': ${describeStacks(selection.matched)}. Refine the pattern, or use the stack's display path (path form).`);
+function bucketDeploymentSourceKey(subject, r) {
+	const named = `CodeConfig.S3Object.Key selects source ${r.index} of BucketDeployment ${displayIdent(r.deploymentLogicalId)}`;
+	switch (r.kind) {
+		case "resolved": return r.sourceObjectKey;
+		case "extracts": throw new CdkLocalError(`${subject} ${named}, which does not set extract to a literal false, so it unpacks its sources and no object in the destination bucket holds that source's zip (Lambda could not read it either). Set extract: false on the BucketDeployment so it copies the zip as-is.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_DEPLOYMENT_EXTRACTS");
+		case "prefixed-destination": throw new CdkLocalError(`${subject} ${named}, which sets a destinationKeyPrefix: the zip lands at <prefix><key> while objectKeys returns <key>, so the selected key names no object (Lambda could not read it either). Remove destinationKeyPrefix from the deployment.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_DEPLOYMENT_SOURCE_UNRESOLVED");
+		case "object-keys-not-output": throw new CdkLocalError(`${subject} ${named}, which sets outputObjectKeys: false, so its SourceObjectKeys attribute is empty and the selection has no value. Remove outputObjectKeys: false.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_DEPLOYMENT_SOURCE_UNRESOLVED");
+		case "index-out-of-range": throw new CdkLocalError(`${subject} ${named}, which has only ${r.sourceCount} source(s).`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_DEPLOYMENT_SOURCE_UNRESOLVED");
+		case "source-key-not-literal": throw new CdkLocalError(`${subject} ${named}, whose SourceObjectKeys entry is not a literal string, so it is not a CDK asset of this app. Deploy the code with s3deploy.Source.asset(...).`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_DEPLOYMENT_SOURCE_UNRESOLVED");
 	}
 }
-function notFound(target, stack, resources) {
-	const dists = Object.entries(resources).filter(([, r]) => r.Type === CLOUDFRONT_DISTRIBUTION_TYPE).map(([logicalId]) => logicalId);
-	const available = dists.length > 0 ? ` Available distributions in ${stack.stackName}: ${dists.join(", ")}.` : ` ${stack.stackName} declares no ${CLOUDFRONT_DISTRIBUTION_TYPE} resources.`;
-	return new LocalStartCloudFrontError(`Target '${target}' did not match a CloudFront distribution in ${stack.stackName}.${available}`);
-}
-async function bootLambdaUrlOrigins(distribution, stacks, opts) {
-	const logger = getLogger();
-	const invokers = /* @__PURE__ */ new Map();
-	const runners = [];
-	const functionLogicalIds = /* @__PURE__ */ new Set();
-	for (const origin of distribution.origins.values()) if (origin.kind === "lambda-url") functionLogicalIds.add(origin.functionLogicalId);
-	for (const functionLogicalId of functionLogicalIds) {
-		let runner;
-		try {
-			const lambda = resolveLambdaTarget(`${distribution.stackName}:${functionLogicalId}`, stacks);
-			const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
-			runner = createFrontDoorLambdaRunner(lambda, {
-				containerHost: opts.containerHost,
-				skipPull: opts.skipPull,
-				...opts.envOptions.region !== void 0 && { region: opts.envOptions.region },
-				containerEnv: containerEnv.env,
-				...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
-			});
-			logger.info(`Booting Lambda Function URL origin container for ${functionLogicalId} (the backing Lambda runs locally via RIE)...`);
-			await runner.start();
-		} catch (err) {
-			await Promise.all(runners.map((r) => r.stop().catch(() => void 0)));
-			throw new LocalStartCloudFrontError(`Failed to boot the Lambda Function URL origin's backing function ${displayIdent(functionLogicalId)}: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
-		}
-		runners.push(runner);
-		invokers.set(functionLogicalId, (event) => runner.invoke(event));
-	}
+async function resolveWebFunctionArtifact(stack, revisionLogicalId, code, loader = new AssetManifestLoader()) {
+	const subject = `Web function revision ${displayUntrustedValue(revisionLogicalId)} code bundle`;
+	const { deployment } = code.s3Object;
+	const keyOrigin = deployment ? ` (source ${deployment.index} of BucketDeployment ${displayIdent(deployment.logicalId)})` : "";
+	const notFound = () => new CdkLocalError(`${subject} (S3Object bucket ${describeValue$1(code.s3Object.bucket)}, key ${displayUntrustedValue(code.s3Object.key)}${keyOrigin}) matches no file asset in this app's cdk.out. ${getEmbedConfig().cliName} start-web-function runs code that comes from a CDK asset in this app (for example an s3assets.Asset of a directory); it does not download deployed code. Re-synthesize the app, or point the revision at an asset.`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NOT_FOUND");
+	const manifestPath = stack.assetManifestPath;
+	if (!manifestPath) throw notFound();
+	const manifestDir = dirname$1(manifestPath);
+	const manifest = await loader.loadStackManifest(stack, manifestDir);
+	const match = manifest ? findFileAssetForObjectKey(manifest, code.s3Object.key) : void 0;
+	if (!match) throw notFound();
+	if (typeof match.asset.source.path !== "string" || match.asset.source.path.length === 0) throw new CdkLocalError(`${subject} matches file asset ${displayIdent(match.hash)}, which has no source.path (it is produced by source.executable at publish time), so there is no staged bundle in cdk.out to mount. Give the revision an asset of a directory or a .zip file (for example s3assets.Asset with path: '<dir>').`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NO_PATH");
+	const sourcePath = resolveAssetSourcePath({
+		manifestDir,
+		value: match.asset.source.path,
+		assetOutdir: assetPathDirs(stack).assetOutdir,
+		absolute: "honour-warn",
+		field: "source.path",
+		subject,
+		action: "mount it",
+		sink: "bind-mount that directory into the web function container",
+		wrapError: (message) => new CdkLocalError(message, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	});
+	if (!existsSync$1(sourcePath)) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} does not exist. Re-synthesize the app and retry.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_MISSING");
+	if (!statSync$1(sourcePath).isDirectory() && !sourcePath.endsWith(".zip")) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} is neither a directory nor a .zip archive, so it is not a code bundle.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_NOT_BUNDLE");
+	const materialized = materializeAssetCodeDir(sourcePath);
 	return {
-		invokers,
-		runners
+		kind: "zip",
+		runtime: code.runtime,
+		codeDir: materialized.dir,
+		...materialized.tmpDir !== void 0 && { tmpDir: materialized.tmpDir },
+		assetHash: match.hash
 	};
 }
-async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
-	const logger = getLogger();
-	const invokers = /* @__PURE__ */ new Map();
-	const runners = [];
-	const functionLogicalIds = /* @__PURE__ */ new Set();
-	for (const behavior of distribution.behaviors) {
-		const edge = behavior.lambdaEdge;
-		if (!edge) continue;
-		for (const assoc of [
-			edge.viewerRequest,
-			edge.originRequest,
-			edge.originResponse,
-			edge.viewerResponse
-		]) if (assoc) functionLogicalIds.add(assoc.functionLogicalId);
-	}
-	for (const functionLogicalId of functionLogicalIds) try {
-		const lambda = resolveLambdaTarget(`${distribution.stackName}:${functionLogicalId}`, stacks);
-		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
-		const runner = createFrontDoorLambdaRunner(lambda, {
-			containerHost: opts.containerHost,
-			skipPull: opts.skipPull,
-			...opts.envOptions.region !== void 0 && { region: opts.envOptions.region },
-			containerEnv: containerEnv.env,
-			...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
+function disposeWebFunctionArtifact(artifact) {
+	if (artifact?.kind !== "zip" || artifact.tmpDir === void 0) return;
+	try {
+		if (existsSync$1(artifact.tmpDir)) rmSync$1(artifact.tmpDir, {
+			recursive: true,
+			force: true
 		});
-		logger.info(`Booting Lambda@Edge container for ${functionLogicalId} (the function runs locally via RIE)...`);
-		await runner.start();
-		runners.push(runner);
-		invokers.set(functionLogicalId, (event) => runner.invoke(event));
-	} catch (err) {
-		logger.warn(`Could not boot Lambda@Edge function ${displayIdent(functionLogicalId)}; its stage will be skipped: ${err instanceof Error ? err.message : String(err)}`);
+	} catch {}
+}
+function asObject$1(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function describeValue$1(value) {
+	if (typeof value === "string") return displayUntrustedValue(value);
+	let json;
+	try {
+		json = JSON.stringify(value);
+	} catch {
+		json = void 0;
 	}
-	return {
-		invokers,
-		runners
-	};
+	return displayUntrustedValue(json ?? String(value));
 }
-function buildLambdaEnvOptions(options, extraStateProviders) {
+
+//#endregion
+//#region src/local/web-function-runtime.ts
+const NODE_CODE_MOUNT = "/var/task";
+const NODE_ENTRYPOINT_ENV = "AWS_LAMBDA_NODEJS_ENTRYPOINT";
+const NODE_DEFAULT_ENTRY = "index.js";
+function buildNodeEntryFileStart(runtime, env, codeDir, fileExists = existsSync$1) {
+	const configured = env[NODE_ENTRYPOINT_ENV];
+	const entryFile = configured !== void 0 && configured.length > 0 ? configured : NODE_DEFAULT_ENTRY;
+	const hostPath = resolve$1(codeDir, entryFile);
+	const rel = relative$1(codeDir, hostPath);
+	if (isAbsolute$1(entryFile) || rel === "" || rel === ".." || rel.startsWith(`..${sep$1}`) || isAbsolute$1(rel)) throw new CdkLocalError(`${NODE_ENTRYPOINT_ENV}=${displayUntrustedValue(entryFile)} must name a file inside the code bundle, relative to its root.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_OUTSIDE_BUNDLE");
+	if (!fileExists(hostPath)) throw new CdkLocalError(`The ${runtime} web function entry file ${displayUntrustedValue(entryFile)} was not found in the code bundle ${displayUntrustedValue(codeDir)}. The runtime loads ${NODE_DEFAULT_ENTRY} from the package root unless ${NODE_ENTRYPOINT_ENV} names another file.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_MISSING");
+	const posixRel = sep$1 === "\\" ? rel.split("\\").join("/") : rel;
 	return {
-		...hostStateSourceFields(options, extraStateProviders),
-		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
-		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
-		...options.region !== void 0 && { region: options.region },
-		...options.profile !== void 0 && { profile: options.profile },
-		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
+		entryPoint: ["/var/lang/bin/node"],
+		cmd: [posix.join(NODE_CODE_MOUNT, posixRel)],
+		label: entryFile
 	};
 }
-function buildLambdaBootOptions(options, profileCredentials, extraStateProviders) {
+const WEB_FUNCTION_RUNTIMES = { "nodejs24.x": {
+	runtime: "nodejs24.x",
+	baseImage: "public.ecr.aws/lambda/nodejs:24",
+	codeMountPath: NODE_CODE_MOUNT,
+	architectures: ["arm64"],
+	buildStart: (env, codeDir, deps) => buildNodeEntryFileStart("nodejs24.x", env, codeDir, deps?.fileExists)
+} };
+function supportedWebFunctionRuntimes(table = WEB_FUNCTION_RUNTIMES) {
+	return Object.keys(table).sort();
+}
+function resolveWebFunctionRuntime(runtime, table = WEB_FUNCTION_RUNTIMES) {
+	const spec = Object.hasOwn(table, runtime) ? table[runtime] : void 0;
+	if (!spec) throw new CdkLocalError(`Web function runtime ${displayIdent(runtime)} is not supported by ${getEmbedConfig().cliName} start-web-function yet. Supported: ${supportedWebFunctionRuntimes(table).join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_RUNTIME");
+	return spec;
+}
+function defaultWebFunctionPlatform(spec) {
+	return spec.architectures[0] === "x86_64" ? "linux/amd64" : "linux/arm64";
+}
+
+//#endregion
+//#region src/local/web-function-runner.ts
+const execFileAsync$1 = promisify$1(execFile$1);
+const WEB_FUNCTION_CONTAINER_PORT = 8080;
+const READY_FAILURE_LOG_LINES = 20;
+const MAX_PROBE_TIMEOUT_MS = 1e4;
+function planWebFunctionContainer(artifact, spec, env, deps) {
+	if (artifact.kind !== "zip") throw new CdkLocalError("A container-image web function source is not supported yet; only a zip bundle from CodeConfig.S3Object runs locally.", "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_ARTIFACT");
+	const start = spec.buildStart(env, artifact.codeDir, deps);
 	return {
-		containerHost: options.host,
-		skipPull: options.pull === false,
-		envOptions: buildLambdaEnvOptions(options, extraStateProviders),
-		...profileCredentials !== void 0 && { profileCredentials },
-		...extraStateProviders !== void 0 && { extraStateProviders }
+		image: spec.baseImage,
+		mounts: [{
+			hostPath: artifact.codeDir,
+			containerPath: spec.codeMountPath,
+			readOnly: true
+		}],
+		entryPoint: start.entryPoint,
+		cmd: start.cmd,
+		workingDir: spec.codeMountPath,
+		label: start.label
 	};
 }
-function warnUnsupported(distribution, extraStateProviders) {
-	const logger = getLogger();
-	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin ${displayIdent(origin.originId)} is a custom (non-S3, non-Lambda-Function-URL) origin (${displayUntrustedValue(String(origin.domainName))}); ${getEmbedConfig().cliName} start-cloudfront serves S3 origins and Lambda Function URL origins only. Requests routed to it return 502.`);
-	else if (origin.kind === "s3-unresolved") logger.warn(`Origin ${displayIdent(origin.originId)} is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass ${stateSourceFlagNames(extraStateProviders).join(" or ")} to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
+async function startWebFunctionContainer(opts) {
+	const { plan } = opts;
+	return runDetached({
+		image: plan.image,
+		mounts: plan.mounts,
+		env: opts.env,
+		...opts.sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys: opts.sensitiveEnvKeys },
+		entryPoint: plan.entryPoint,
+		cmd: plan.cmd,
+		...plan.workingDir !== void 0 && { workingDir: plan.workingDir },
+		hostPort: opts.hostPort,
+		containerPort: WEB_FUNCTION_CONTAINER_PORT,
+		host: opts.host,
+		platform: opts.platform,
+		name: opts.name,
+		autoRemove: false
+	});
 }
-function warnUnusedCacheOrigin(options, extraStateProviders) {
-	if (options.cacheOrigin === true && !isStateSourceActive(options, extraStateProviders)) {
-		const flags = stateSourceFlagNames(extraStateProviders).join(" or ");
-		getLogger().warn(`--cache-origin has no effect without ${flags}: it caches a deployed-S3 read-through origin, which is only built under a state source. A local BucketDeployment / --origin <id>=<dir> origin serves from disk and is not cached. Pass ${flags} to enable the deployed-S3 origin (then --cache-origin applies), or drop --cache-origin.`);
+var RecentOutput = class {
+	lines = [];
+	partial = "";
+	max;
+	constructor(max = 20) {
+		this.max = max;
 	}
-}
-async function resolveDeployedS3Origins(distribution, stacks, options, profileCredentials, logger, extraStateProviders) {
-	const readers = /* @__PURE__ */ new Map();
-	const buckets = /* @__PURE__ */ new Map();
-	const stateFlag = activeStateSourceFlag(options, extraStateProviders);
-	if (stateFlag === void 0) return {
-		readers,
-		buckets
-	};
-	const synthRegion = stacks.find((s) => s.stackName === distribution.stackName)?.region;
-	const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
-	let record;
-	try {
-		record = provider ? await provider.load(distribution.stackName, synthRegion) : void 0;
-	} finally {
-		provider?.dispose();
+	push(chunk) {
+		const parts = (this.partial + chunk.toString()).split("\n");
+		this.partial = parts.pop() ?? "";
+		for (const line of parts) this.add(line);
+		if (this.partial.length > 4096) {
+			this.add(this.partial);
+			this.partial = "";
+		}
 	}
-	const region = options.stackRegion ?? options.region ?? synthRegion ?? record?.region;
-	const distributionId = record?.resources[distribution.logicalId]?.physicalId;
-	for (const origin of [...distribution.origins.values()]) {
-		if (origin.kind !== "s3-unresolved") continue;
+	tail() {
+		return this.partial.length > 0 ? [...this.lines, this.partial].slice(-this.max) : this.lines;
+	}
+	add(line) {
+		this.lines.push(line.replace(/\r$/, ""));
+		if (this.lines.length > this.max) this.lines.shift();
+	}
+};
+async function waitForWebFunctionReady(args, deps = defaultReadyDeps) {
+	const deadline = deps.now() + args.timeoutMs;
+	let attempt = 0;
+	let last = "refused";
+	while (deps.now() < deadline) {
+		const remaining = Math.max(1, deadline - deps.now());
+		last = await deps.probe(args.host, args.port, Math.min(remaining, MAX_PROBE_TIMEOUT_MS));
+		if (last === "answered") return;
+		attempt++;
+		if (attempt % 4 === 0 && !await deps.isRunning(args.containerId)) throw await containerFailure(`The web function container exited before its server listened on AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
+		if (last === "refused") await deps.sleep(250);
+	}
+	const authority = formatAuthority(args.host, args.port);
+	throw await containerFailure(last === "timeout" ? `The web function server on ${authority} accepted the connection but did not answer GET / within ${args.timeoutMs}ms — it is listening but slow to respond. Raise --timeout, or make / answer sooner (started ${args.label}).` : `The web function server never accepted an HTTP connection on ${authority} within ${args.timeoutMs}ms. It must listen on the host:port given in AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
+}
+async function containerFailure(message, containerId, recent, fetchLogs = readContainerLogTail, code = "LOCAL_START_WEB_FUNCTION_NOT_READY") {
+	let lines = [];
+	try {
+		lines = await fetchLogs(containerId, 20);
+	} catch {
+		lines = [];
+	}
+	if (lines.length === 0) lines = recent.tail();
+	return new CdkLocalError(`${message}${lines.length > 0 ? ` Last ${lines.length} line(s) of container output:\n${lines.map((l) => `  ${displayToolOutput(l)}`).join("\n")}` : " The container printed nothing."}`, code);
+}
+function watchContainerExit(containerId) {
+	let stopped = false;
+	const proc = spawn$1(getDockerCmd(), ["wait", containerId], { stdio: [
+		"ignore",
+		"pipe",
+		"ignore"
+	] });
+	let out = "";
+	proc.stdout?.on("data", (c) => out += c.toString());
+	return {
+		exited: new Promise((resolveExit) => {
+			const done = () => {
+				if (stopped) return;
+				const code = Number.parseInt(out.trim(), 10);
+				resolveExit(Number.isNaN(code) ? void 0 : code);
+			};
+			proc.on("close", done);
+			proc.on("error", done);
+		}),
+		stop: () => {
+			stopped = true;
+			if (!proc.killed) proc.kill("SIGTERM");
+		}
+	};
+}
+function probeHttp(host, port, timeoutMs) {
+	return new Promise((resolveProbe) => {
+		let timedOut = false;
+		let connected = false;
+		const req = request$2({
+			host,
+			port,
+			path: "/",
+			method: "GET",
+			timeout: timeoutMs,
+			headers: { connection: "close" }
+		}, (res) => {
+			res.resume();
+			resolveProbe("answered");
+		});
+		req.on("socket", (socket) => {
+			socket.once("connect", () => {
+				connected = true;
+			});
+		});
+		req.on("timeout", () => {
+			timedOut = true;
+			req.destroy();
+		});
+		req.on("error", () => resolveProbe(timedOut && connected ? "timeout" : "refused"));
+		req.end();
+	});
+}
+async function containerIsRunning(containerId) {
+	try {
+		const { stdout } = await execFileAsync$1(getDockerCmd(), [
+			"inspect",
+			"-f",
+			"{{.State.Running}}",
+			containerId
+		]);
+		return stdout.trim() === "true";
+	} catch {
+		return false;
+	}
+}
+function readContainerLogTail(containerId, lines, spawnFn = spawn$1) {
+	return new Promise((resolveLogs, rejectLogs) => {
+		const proc = spawnFn(getDockerCmd(), [
+			"logs",
+			"--tail",
+			String(lines),
+			containerId
+		], { stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		] });
+		const chunks = [];
+		let size = 0;
+		const take = (c) => {
+			if (size > 4 * 1024 * 1024) return;
+			chunks.push(c);
+			size += c.length;
+		};
+		proc.stdout?.on("data", take);
+		proc.stderr?.on("data", take);
+		proc.on("error", rejectLogs);
+		proc.on("close", (code) => {
+			if (code !== 0) {
+				rejectLogs(/* @__PURE__ */ new Error(`docker logs exited ${code}`));
+				return;
+			}
+			resolveLogs(Buffer.concat(chunks).toString().split("\n").map((l) => l.replace(/\r$/, "")).filter((l) => l.length > 0).slice(-lines));
+		});
+	});
+}
+const defaultReadyDeps = {
+	probe: probeHttp,
+	isRunning: containerIsRunning,
+	fetchLogs: readContainerLogTail,
+	sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+	now: () => Date.now()
+};
+
+//#endregion
+//#region src/cli/commands/web-function-serve.ts
+function prepareWebFunctionServe(resolved) {
+	const code = parseWebFunctionBuildConfig(resolved.revisionLogicalId, resolved.revision.Properties?.["BuildConfig"], resolved.stack.template);
+	return {
+		resolved,
+		code,
+		spec: resolveWebFunctionRuntime(code.runtime),
+		serviceConfig: readWebFunctionServiceConfig(resolved.revision)
+	};
+}
+function webFunctionConnectHost(host) {
+	if (host === "0.0.0.0") return "127.0.0.1";
+	if (host === "::" || host === "[::]") return "::1";
+	return host;
+}
+var WebFunctionServe = class {
+	artifact;
+	artifactInFlight;
+	runInFlight;
+	id;
+	name;
+	stopLogs;
+	exitWatch;
+	teardownPromise;
+	waitingOnRunFlag = false;
+	recent = new RecentOutput();
+	prepared;
+	options;
+	constructor(prepared, options) {
+		this.prepared = prepared;
+		this.options = options;
+	}
+	get waitingOnRun() {
+		return this.waitingOnRunFlag;
+	}
+	get containerName() {
+		return this.name;
+	}
+	get tornDown() {
+		return this.teardownPromise !== void 0;
+	}
+	get exited() {
+		return this.exitWatch?.exited;
+	}
+	async start() {
+		const logger = getLogger();
+		const { resolved, code, spec, serviceConfig } = this.prepared;
+		const opts = this.options;
+		this.artifactInFlight = resolveWebFunctionArtifact(resolved.stack, resolved.revisionLogicalId, code);
+		this.artifact = await this.artifactInFlight;
+		if (this.tornDown) return void 0;
+		const assumeRole = webFunctionAssumeRole(opts.envOptions.assumeRole, serviceConfig);
+		const containerEnv = await resolveLambdaContainerEnv(buildWebFunctionLambdaView(resolved, serviceConfig, spec.runtime), {
+			...opts.envOptions,
+			...assumeRole !== void 0 && { assumeRole },
+			deployedFunctionLookups: false
+		}, opts.profileCredentials, opts.extraStateProviders);
+		const { env, replacedHttpEndpoint } = finalizeWebFunctionEnv(containerEnv.env, {
+			functionName: resolved.functionName,
+			containerPort: WEB_FUNCTION_CONTAINER_PORT,
+			timeoutSeconds: serviceConfig.timeoutSeconds,
+			logGroup: serviceConfig.logGroup
+		});
+		if (replacedHttpEndpoint) logger.warn(`The revision's ${WEB_FUNCTION_HTTP_ENDPOINT_ENV} is replaced with 0.0.0.0:${WEB_FUNCTION_CONTAINER_PORT}: the runtime owns that variable, and the local port is published to it.`);
+		const plan = planWebFunctionContainer(this.artifact, spec, env);
+		const platform = opts.platform ?? defaultWebFunctionPlatform(spec);
+		await pullImage(plan.image, opts.skipPull, platform);
+		if (this.tornDown) return void 0;
+		const hostPort = opts.port === 0 ? await pickFreePort() : opts.port;
+		if (this.tornDown) return void 0;
+		const name = this.name = `${getEmbedConfig().resourceNamePrefix}-webfn-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+		logger.info(`Starting web function container (image=${plan.image}, start=${plan.label}, port=${hostPort} -> ${WEB_FUNCTION_CONTAINER_PORT})...`);
+		this.runInFlight = startWebFunctionContainer({
+			plan,
+			env,
+			sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys),
+			host: opts.host,
+			hostPort,
+			platform,
+			name
+		});
+		const id = await this.runInFlight;
+		if (this.tornDown) return void 0;
+		this.id = id;
+		this.stopLogs = streamLogs(id, { onOutput: (chunk) => this.recent.push(chunk) });
+		this.exitWatch = watchContainerExit(id);
+		const host = webFunctionConnectHost(opts.host);
+		await waitForWebFunctionReady({
+			containerId: id,
+			host,
+			port: hostPort,
+			timeoutMs: opts.timeoutMs,
+			recent: this.recent,
+			label: plan.label
+		});
+		if (this.tornDown) return void 0;
+		return {
+			host,
+			port: hostPort
+		};
+	}
+	exitFailure(message) {
+		return containerFailure(message, this.id ?? "", this.recent, void 0, "LOCAL_START_WEB_FUNCTION_EXITED");
+	}
+	disposeArtifactNow() {
+		disposeWebFunctionArtifact(this.artifact);
+	}
+	teardown() {
+		return this.teardownPromise ??= this.doTeardown();
+	}
+	async doTeardown() {
+		const logger = getLogger();
+		this.exitWatch?.stop();
+		if (this.artifact === void 0 && this.artifactInFlight !== void 0) try {
+			this.artifact = await this.artifactInFlight;
+		} catch {}
+		if (this.id === void 0 && this.runInFlight !== void 0) {
+			this.waitingOnRunFlag = true;
+			try {
+				this.id = await this.runInFlight;
+			} catch {} finally {
+				this.waitingOnRunFlag = false;
+			}
+		}
+		if (this.stopLogs) try {
+			this.stopLogs();
+		} catch (err) {
+			logger.debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		if (this.id) await removeContainer(this.id);
+		disposeWebFunctionArtifact(this.artifact);
+	}
+};
+
+//#endregion
+//#region src/cli/commands/local-start-cloudfront.ts
+var LocalStartCloudFrontError = class extends CdkLocalError {
+	constructor(message, cause) {
+		super(message, "LOCAL_START_CLOUDFRONT_ERROR", cause);
+	}
+};
+function parseOriginOverrides(values) {
+	const out = /* @__PURE__ */ new Map();
+	for (const raw of values ?? []) {
+		const eq = raw.indexOf("=");
+		if (eq <= 0 || eq === raw.length - 1) throw new LocalStartCloudFrontError(`Invalid --origin '${raw}'. Expected <originId>=<dir> (e.g. MyOrigin=./site).`);
+		out.set(raw.slice(0, eq).trim(), raw.slice(eq + 1).trim());
+	}
+	return out;
+}
+function parseKvsFileOverrides(values) {
+	const out = /* @__PURE__ */ new Map();
+	for (const raw of values ?? []) {
+		const eq = raw.indexOf("=");
+		if (eq <= 0 || eq === raw.length - 1) throw new LocalStartCloudFrontError(`Invalid --kvs-file '${raw}'. Expected <key>=<file.json> (e.g. RoutesKvs=./kvs.json).`);
+		out.set(raw.slice(0, eq).trim(), raw.slice(eq + 1).trim());
+	}
+	return out;
+}
+function collectKvsStoreIdentities(template) {
+	const out = [];
+	for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+		if (resource.Type !== "AWS::CloudFront::KeyValueStore") continue;
+		const cdkPath = readCdkPath(resource) || void 0;
+		const constructPath = cdkPath?.endsWith("/Resource") ? cdkPath.slice(0, -9) : cdkPath;
+		const constructId = constructPath?.split("/").pop();
+		out.push({
+			logicalId,
+			...cdkPath !== void 0 && { cdkPath },
+			...constructPath !== void 0 && { constructPath },
+			...constructId !== void 0 && constructId !== "" && { constructId }
+		});
+	}
+	return out;
+}
+function normalizeKvsFileKeys(kvsFiles, template) {
+	if (kvsFiles.size === 0) return kvsFiles;
+	const stores = collectKvsStoreIdentities(template);
+	const candidates = () => stores.map((s) => s.constructPath ? `${displayIdent(s.logicalId, { listMember: true })} (${displayStackName(s.constructPath)})` : displayIdent(s.logicalId, { listMember: true })).join(", ") || "(none in this distribution)";
+	const out = /* @__PURE__ */ new Map();
+	for (const [key, filePath] of kvsFiles) {
+		const matched = [
+			stores.filter((s) => s.logicalId === key),
+			stores.filter((s) => s.constructPath === key || s.cdkPath === key),
+			stores.filter((s) => s.constructId === key)
+		].find((t) => t.length > 0) ?? [];
+		if (matched.length === 0) throw new LocalStartCloudFrontError(`--kvs-file key '${key}' matched no AWS::CloudFront::KeyValueStore in the distribution. Pass a store's logical id, construct path, or bare construct id. Candidates: ${candidates()}.`);
+		if (matched.length > 1) throw new LocalStartCloudFrontError(`--kvs-file key '${key}' is ambiguous — it matched ${matched.length} KeyValueStores (${matched.map((s) => displayIdent(s.logicalId, { listMember: true })).join(", ")}). Use the logical id or full construct path.`);
+		out.set(matched[0].logicalId, filePath);
+	}
+	return out;
+}
+async function attachKvsModules(distribution, stacks, options, profileCredentials, logger, extraStateProviders) {
+	const stack = stacks.find((s) => s.stackName === distribution.stackName);
+	const synthRegion = stack?.region;
+	const kvsFiles = stack ? normalizeKvsFileKeys(parseKvsFileOverrides(options.kvsFile), stack.template) : parseKvsFileOverrides(options.kvsFile);
+	const resolveDeployedKvs = isStateSourceActive(options, extraStateProviders) ? async (kvsLogicalId) => {
+		const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
+		if (!provider) return void 0;
+		let record;
+		try {
+			record = await provider.load(distribution.stackName, synthRegion);
+		} finally {
+			provider.dispose();
+		}
+		const physicalId = record?.resources[kvsLogicalId]?.physicalId;
+		if (!physicalId) return void 0;
+		if (physicalId.startsWith("arn:")) {
+			const id = idFromArn(physicalId);
+			return {
+				arn: physicalId,
+				...id !== void 0 && { id }
+			};
+		}
+		return resolveDeployedKvsArnByName(physicalId, { ...profileCredentials !== void 0 && { credentials: profileCredentials } });
+	} : void 0;
+	const { warnings } = await resolveKvsModulesForDistribution(distribution, {
+		...kvsFiles.size > 0 && { kvsFiles },
+		...resolveDeployedKvs !== void 0 && { resolveDeployedKvs },
+		...profileCredentials !== void 0 && { credentials: profileCredentials }
+	});
+	for (const warning of warnings) logger.warn(warning);
+}
+function resolveCloudFrontTarget(target, stacks) {
+	if (stacks.length === 0) throw new LocalStartCloudFrontError("No stacks found in the synthesized assembly.");
+	const parsed = parseEcsTarget(target);
+	const stack = pickStack(parsed, stacks, target);
+	const resources = stack.template.Resources ?? {};
+	if (parsed.isPath) {
+		const index = buildCdkPathIndex(stack.template);
+		const dists = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId }) => {
+			const r = resources[logicalId];
+			return r !== void 0 && r.Type === "AWS::CloudFront::Distribution";
+		});
+		if (dists.length === 0) throw notFound(target, stack, resources);
+		if (dists.length > 1) throw new LocalStartCloudFrontError(`Target '${target}' matches ${dists.length} distributions in ${stack.stackName}: ${dists.map((d) => d.logicalId).join(", ")}. Refine the path or use the stack:LogicalId form.`);
+		return {
+			stack,
+			logicalId: dists[0].logicalId
+		};
+	}
+	const res = resources[parsed.pathOrId];
+	if (!res || res.Type !== "AWS::CloudFront::Distribution") throw notFound(target, stack, resources);
+	return {
+		stack,
+		logicalId: parsed.pathOrId
+	};
+}
+function pickStack(parsed, stacks, target) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new LocalStartCloudFrontError(`Target '${target}' has no stack prefix, and the assembly contains ${stacks.length} stacks: ${describeStacks(stacks)}. Pass it as 'Stack/Path' or 'Stack:LogicalId'.`);
+		case "not-found": throw new LocalStartCloudFrontError(`No stack matches '${selection.pattern}'. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new LocalStartCloudFrontError(`Multiple stacks match '${selection.pattern}': ${describeStacks(selection.matched)}. Refine the pattern, or use the stack's display path (path form).`);
+	}
+}
+function notFound(target, stack, resources) {
+	const dists = Object.entries(resources).filter(([, r]) => r.Type === CLOUDFRONT_DISTRIBUTION_TYPE).map(([logicalId]) => logicalId);
+	const available = dists.length > 0 ? ` Available distributions in ${stack.stackName}: ${dists.join(", ")}.` : ` ${stack.stackName} declares no ${CLOUDFRONT_DISTRIBUTION_TYPE} resources.`;
+	return new LocalStartCloudFrontError(`Target '${target}' did not match a CloudFront distribution in ${stack.stackName}.${available}`);
+}
+async function bootLambdaUrlOrigins(distribution, stacks, opts) {
+	const logger = getLogger();
+	const invokers = /* @__PURE__ */ new Map();
+	const runners = [];
+	const functionLogicalIds = /* @__PURE__ */ new Set();
+	for (const origin of distribution.origins.values()) if (origin.kind === "lambda-url") functionLogicalIds.add(origin.functionLogicalId);
+	for (const functionLogicalId of functionLogicalIds) {
+		let runner;
+		try {
+			const lambda = resolveLambdaTarget(`${distribution.stackName}:${functionLogicalId}`, stacks);
+			const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
+			runner = createFrontDoorLambdaRunner(lambda, {
+				containerHost: opts.containerHost,
+				skipPull: opts.skipPull,
+				...opts.envOptions.region !== void 0 && { region: opts.envOptions.region },
+				containerEnv: containerEnv.env,
+				...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
+			});
+			logger.info(`Booting Lambda Function URL origin container for ${functionLogicalId} (the backing Lambda runs locally via RIE)...`);
+			await runner.start();
+		} catch (err) {
+			await Promise.all(runners.map((r) => r.stop().catch(() => void 0)));
+			throw new LocalStartCloudFrontError(`Failed to boot the Lambda Function URL origin's backing function ${displayIdent(functionLogicalId)}: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
+		}
+		runners.push(runner);
+		invokers.set(functionLogicalId, (event) => runner.invoke(event));
+	}
+	return {
+		invokers,
+		runners
+	};
+}
+async function drainWebFunctionServes(serves) {
+	let done = 0;
+	while (done < serves.length) {
+		const batch = serves.slice(done);
+		done = serves.length;
+		await Promise.all(batch.map((s) => s.teardown().catch(() => void 0)));
+	}
+}
+const WEB_FUNCTION_ORIGIN_READY_TIMEOUT_MS = 6e4;
+async function bootWebFunctionOrigins(distribution, stacks, opts) {
+	const logger = getLogger();
+	const targets = /* @__PURE__ */ new Map();
+	const serves = opts.sink ?? [];
+	const endpointLogicalIds = /* @__PURE__ */ new Set();
+	for (const origin of distribution.origins.values()) if (origin.kind === "web-function") endpointLogicalIds.add(origin.endpointLogicalId);
+	if (endpointLogicalIds.size === 0) return {
+		targets,
+		serves
+	};
+	for (const endpointLogicalId of endpointLogicalIds) try {
+		if (serves.length === 0) await ensureDockerAvailable();
+		const resolved = resolveWebFunctionTarget(`${distribution.stackName}:${endpointLogicalId}`, stacks);
+		const prepared = prepareWebFunctionServe(resolved);
+		for (const line of webFunctionFidelityWarnings(resolved, prepared.serviceConfig)) logger.warn(line);
+		logger.info(`Booting Lambda Web Function endpoint origin server for ${displayIdent(endpointLogicalId)} (revision ${displayIdent(resolved.revisionLogicalId)}, ${prepared.spec.runtime})...`);
+		const serve = new WebFunctionServe(prepared, {
+			envOptions: opts.envOptions,
+			...opts.profileCredentials !== void 0 && { profileCredentials: opts.profileCredentials },
+			...opts.extraStateProviders !== void 0 && { extraStateProviders: opts.extraStateProviders },
+			host: opts.containerHost,
+			port: 0,
+			skipPull: opts.skipPull,
+			timeoutMs: opts.timeoutMs ?? WEB_FUNCTION_ORIGIN_READY_TIMEOUT_MS
+		});
+		serves.push(serve);
+		const address = await serve.start();
+		if (!address) throw new Error("the server was stopped while starting");
+		targets.set(endpointLogicalId, address);
+		serve.exited?.then((code) => {
+			if (serve.tornDown) return;
+			logger.warn(`The Lambda Web Function endpoint origin server for ${displayIdent(endpointLogicalId)} exited (exit code ${code ?? "unknown"}); requests routed to it return 502. Restart start-cloudfront.`);
+		});
+	} catch (err) {
+		await Promise.all(serves.map((s) => s.teardown().catch(() => void 0)));
+		throw new LocalStartCloudFrontError(`Failed to boot the Lambda Web Function endpoint origin ${displayIdent(endpointLogicalId)}: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
+	}
+	return {
+		targets,
+		serves
+	};
+}
+async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
+	const logger = getLogger();
+	const invokers = /* @__PURE__ */ new Map();
+	const runners = [];
+	const functionLogicalIds = /* @__PURE__ */ new Set();
+	for (const behavior of distribution.behaviors) {
+		const edge = behavior.lambdaEdge;
+		if (!edge) continue;
+		for (const assoc of [
+			edge.viewerRequest,
+			edge.originRequest,
+			edge.originResponse,
+			edge.viewerResponse
+		]) if (assoc) functionLogicalIds.add(assoc.functionLogicalId);
+	}
+	for (const functionLogicalId of functionLogicalIds) try {
+		const lambda = resolveLambdaTarget(`${distribution.stackName}:${functionLogicalId}`, stacks);
+		const containerEnv = await resolveLambdaContainerEnv(lambda, opts.envOptions, opts.profileCredentials, opts.extraStateProviders);
+		const runner = createFrontDoorLambdaRunner(lambda, {
+			containerHost: opts.containerHost,
+			skipPull: opts.skipPull,
+			...opts.envOptions.region !== void 0 && { region: opts.envOptions.region },
+			containerEnv: containerEnv.env,
+			...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) }
+		});
+		logger.info(`Booting Lambda@Edge container for ${functionLogicalId} (the function runs locally via RIE)...`);
+		await runner.start();
+		runners.push(runner);
+		invokers.set(functionLogicalId, (event) => runner.invoke(event));
+	} catch (err) {
+		logger.warn(`Could not boot Lambda@Edge function ${displayIdent(functionLogicalId)}; its stage will be skipped: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	return {
+		invokers,
+		runners
+	};
+}
+function buildLambdaEnvOptions(options, extraStateProviders) {
+	return {
+		...hostStateSourceFields(options, extraStateProviders),
+		...options.fromCfnStack !== void 0 && { fromCfnStack: options.fromCfnStack },
+		...options.assumeRole !== void 0 && { assumeRole: options.assumeRole },
+		...options.region !== void 0 && { region: options.region },
+		...options.profile !== void 0 && { profile: options.profile },
+		...options.stackRegion !== void 0 && { stackRegion: options.stackRegion }
+	};
+}
+function buildLambdaBootOptions(options, profileCredentials, extraStateProviders) {
+	return {
+		containerHost: options.host,
+		skipPull: options.pull === false,
+		envOptions: buildLambdaEnvOptions(options, extraStateProviders),
+		...profileCredentials !== void 0 && { profileCredentials },
+		...extraStateProviders !== void 0 && { extraStateProviders }
+	};
+}
+function warnUnsupported(distribution, extraStateProviders) {
+	const logger = getLogger();
+	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin ${displayIdent(origin.originId)} is a custom (non-S3, non-Lambda) origin (${displayUntrustedValue(String(origin.domainName))}); ${getEmbedConfig().cliName} start-cloudfront serves S3, Lambda Function URL and Lambda Web Function endpoint origins only. Requests routed to it return 502.`);
+	else if (origin.kind === "s3-unresolved") logger.warn(`Origin ${displayIdent(origin.originId)} is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass ${stateSourceFlagNames(extraStateProviders).join(" or ")} to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
+}
+function warnUnusedCacheOrigin(options, extraStateProviders) {
+	if (options.cacheOrigin === true && !isStateSourceActive(options, extraStateProviders)) {
+		const flags = stateSourceFlagNames(extraStateProviders).join(" or ");
+		getLogger().warn(`--cache-origin has no effect without ${flags}: it caches a deployed-S3 read-through origin, which is only built under a state source. A local BucketDeployment / --origin <id>=<dir> origin serves from disk and is not cached. Pass ${flags} to enable the deployed-S3 origin (then --cache-origin applies), or drop --cache-origin.`);
+	}
+}
+async function resolveDeployedS3Origins(distribution, stacks, options, profileCredentials, logger, extraStateProviders) {
+	const readers = /* @__PURE__ */ new Map();
+	const buckets = /* @__PURE__ */ new Map();
+	const stateFlag = activeStateSourceFlag(options, extraStateProviders);
+	if (stateFlag === void 0) return {
+		readers,
+		buckets
+	};
+	const synthRegion = stacks.find((s) => s.stackName === distribution.stackName)?.region;
+	const provider = createLocalStateProvider(options, distribution.stackName, synthRegion, extraStateProviders);
+	let record;
+	try {
+		record = provider ? await provider.load(distribution.stackName, synthRegion) : void 0;
+	} finally {
+		provider?.dispose();
+	}
+	const region = options.stackRegion ?? options.region ?? synthRegion ?? record?.region;
+	const distributionId = record?.resources[distribution.logicalId]?.physicalId;
+	for (const origin of [...distribution.origins.values()]) {
+		if (origin.kind !== "s3-unresolved") continue;
 		let bucketName;
 		let via;
 		if (origin.bucketLogicalId !== void 0) {
@@ -24497,10 +25481,32 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 	warnUnusedCacheOrigin(options, extraStateProviders);
 	await attachKvsModules(initial.distribution, initial.stacks, options, profileCredentials, logger, extraStateProviders);
 	const bootOpts = buildLambdaBootOptions(options, profileCredentials, extraStateProviders);
+	const webFunctionServes = [];
+	let bootAborted = false;
+	const onBootSignal = (signal) => {
+		if (bootAborted) return;
+		bootAborted = true;
+		logger.info(`Received ${signal} during start-up; removing the web function containers...`);
+		drainWebFunctionServes(webFunctionServes).then(() => process.exit(signal === "SIGINT" ? 130 : 0));
+	};
+	const bootSigint = () => onBootSignal("SIGINT");
+	const bootSigterm = () => onBootSignal("SIGTERM");
+	const disarmBootSignals = () => {
+		process.off("SIGINT", bootSigint);
+		process.off("SIGTERM", bootSigterm);
+	};
+	if ([...initial.distribution.origins.values()].some((o) => o.kind === "web-function")) {
+		process.on("SIGINT", bootSigint);
+		process.on("SIGTERM", bootSigterm);
+	}
 	const { invokers: lambdaInvokers, runners: lambdaRunners } = await bootLambdaUrlOrigins(initial.distribution, initial.stacks, bootOpts);
 	const { invokers: edgeInvokers, runners: edgeRunners } = await bootLambdaEdgeFunctions(initial.distribution, initial.stacks, bootOpts);
 	let server;
 	try {
+		const webFunctions = await bootWebFunctionOrigins(initial.distribution, initial.stacks, {
+			...bootOpts,
+			sink: webFunctionServes
+		});
 		let tls;
 		if (tlsRequested) tls = await resolveFrontDoorTlsMaterials({
 			certPath: options.tlsCert,
@@ -24513,12 +25519,17 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 			...tls && { tls },
 			...lambdaInvokers.size > 0 && { lambdaInvokers },
 			...edgeInvokers.size > 0 && { edgeInvokers },
-			...deployedS3.readers.size > 0 && { s3OriginReaders: deployedS3.readers }
+			...deployedS3.readers.size > 0 && { s3OriginReaders: deployedS3.readers },
+			...webFunctions.targets.size > 0 && { webFunctionOrigins: webFunctions.targets }
 		});
 	} catch (err) {
-		await Promise.all([...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch(() => void 0)));
+		await Promise.all([...[...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch(() => void 0)), ...webFunctionServes.map((s) => s.teardown().catch(() => void 0))]);
+		if (bootAborted) return await new Promise(() => void 0);
+		disarmBootSignals();
 		throw err;
 	}
+	disarmBootSignals();
+	if (bootAborted) return await new Promise(() => void 0);
 	process.stdout.write(`CloudFront distribution serving on ${server.url}  (${displayIdent(initial.distribution.logicalId)})\n`);
 	process.stdout.write("^C to stop.\n");
 	let watcher;
@@ -24564,9 +25575,11 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 		try {
 			await server.close();
 		} catch {}
-		await Promise.all([...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch((err) => {
+		await Promise.all([...[...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch((err) => {
 			logger.debug(`Lambda runner stop failed: ${err instanceof Error ? err.message : String(err)}`);
-		})));
+		})), ...webFunctionServes.map((s) => s.teardown().catch((err) => {
+			logger.debug(`Web function server teardown failed: ${err instanceof Error ? err.message : String(err)}`);
+		}))]);
 		await Promise.all([...deployedS3.readers.values()].map((reader) => reader.close()));
 		process.exit(exitCode);
 	};
@@ -24576,7 +25589,7 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 }
 function createLocalStartCloudFrontCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("start-cloudfront").description("Run a long-running local server that serves a CloudFront distribution: its S3 origin content (resolved from the BucketDeployment source in the cloud assembly) and its Lambda Function URL origins (the backing Lambda is run locally via RIE), plus its viewer-request / viewer-response CloudFront Functions, reproducing the distribution routing locally so a rewrite / routing change is verifiable in seconds. Serves S3 and Lambda Function URL origins, and runs Lambda@Edge functions in local RIE containers. Both Lambda kinds need Docker: a Function URL origin that fails to boot stops start-up, while a Lambda@Edge function that fails to boot is warn-and-skipped (its stage does not run). Other custom origins are not run (warn-and-skip; requests routed to one return 502). Tip: omit the target in a terminal to pick interactively.").argument("[target]", "CloudFront distribution to serve. Accepts the CDK Construct path ('MyStack/MyDist'), an ancestor prefix, or the stack-qualified logical id ('MyStack:MyDist'). When omitted in a TTY, an interactive picker opens.").action(withErrorHandling(async (target, options) => {
+	const cmd = new Command("start-cloudfront").description("Run a long-running local server that serves a CloudFront distribution: its S3 origin content (resolved from the BucketDeployment source in the cloud assembly), its Lambda Function URL origins (the backing Lambda is run locally via RIE) and its Lambda Web Function endpoint origins (the revision the endpoint weights pick, run as start-web-function runs it), plus its viewer-request / viewer-response CloudFront Functions, reproducing the distribution routing locally so a rewrite / routing change is verifiable in seconds. Serves S3, Lambda Function URL and Web Function endpoint origins, and runs Lambda@Edge functions in local RIE containers. The Lambda kinds need Docker: a Function URL origin that fails to boot stops start-up (as does a Web Function origin), while a Lambda@Edge function that fails to boot is warn-and-skipped (its stage does not run). Other custom origins are not run (warn-and-skip; requests routed to one return 502). Tip: omit the target in a terminal to pick interactively.").argument("[target]", "CloudFront distribution to serve. Accepts the CDK Construct path ('MyStack/MyDist'), an ancestor prefix, or the stack-qualified logical id ('MyStack:MyDist'). When omitted in a TTY, an interactive picker opens.").action(withErrorHandling(async (target, options) => {
 		await localStartCloudFrontCommand(target, options, opts.extraStateProviders, opts.synthesizer);
 	}));
 	addStartCloudFrontSpecificOptions(cmd);
@@ -24589,7 +25602,7 @@ function createLocalStartCloudFrontCommand(opts = {}) {
 	return cmd;
 }
 function addStartCloudFrontSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <key=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is a KeyValueStore handle — its AWS::CloudFront::KeyValueStore resource logical id, its construct path, or its bare construct id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind to a deployed CloudFormation stack (ListStackResources). Resolves an S3 origin that has no local BucketDeployment source to its deployed bucket and serves it from real S3 on demand (the front/back-split case: files uploaded out of band), and resolves a Lambda Function URL / Lambda@Edge function's env vars to the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs.")).addOption(new Option("--cache-origin", "For a deployed-S3 origin (served from real S3 under --from-cfn-stack): keep fetched objects in memory for the session instead of re-reading on every request. Faster repeat reads / fewer S3 GETs, but an out-of-band S3 content change is not reflected until a --watch reload (which clears the cache) or a restart. Off by default (every request re-reads, always current). Not CloudFront CDN caching.").default(false)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's deployed execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
+	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--origin <originId=dir>", "Point a distribution origin at a local directory (repeatable). Use when cdk-local cannot resolve the origin's BucketDeployment source automatically (content uploaded out of band, or a non-CDK bucket).").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--kvs-file <key=file.json>", "Back a CloudFront Function's KeyValueStore reads (cf.kvs().get()) with a local JSON map (repeatable). The key is a KeyValueStore handle — its AWS::CloudFront::KeyValueStore resource logical id, its construct path, or its bare construct id; the file is a flat { \"key\": \"value\" } object. The AWS-free alternative to --from-cfn-stack, which instead reads the deployed store via the GetKey API.").argParser((value, prev) => [...prev ?? [], value])).addOption(new Option("--tls", "Terminate real TLS (HTTPS). Uses --tls-cert / --tls-key when supplied, else an auto-generated self-signed cert.").default(false)).addOption(new Option("--tls-cert <path>", "PEM server certificate for --tls (implies --tls).")).addOption(new Option("--tls-key <path>", "PEM server private key for --tls (implies --tls).")).addOption(new Option("--no-pull", "Skip 'docker pull' for a Lambda Function URL / Web Function origin's base image (use the locally cached image).")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Bind to a deployed CloudFormation stack (ListStackResources). Resolves an S3 origin that has no local BucketDeployment source to its deployed bucket and serves it from real S3 on demand (the front/back-split case: files uploaded out of band), and resolves a Lambda Function URL / Lambda@Edge function's or a Web Function origin revision's env vars to the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass a value when the CFn stack name differs.")).addOption(new Option("--cache-origin", "For a deployed-S3 origin (served from real S3 under --from-cfn-stack): keep fetched objects in memory for the session instead of re-reading on every request. Faster repeat reads / fewer S3 GETs, but an out-of-band S3 content change is not reflected until a --watch reload (which clears the cache) or a restart. Off by default (every request re-reads, always current). Not CloudFront CDN caching.").default(false)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--assume-role [arn]", "Assume a Lambda Function URL origin's (or a Web Function origin revision's) execution role and forward STS-issued temp credentials into its container so the handler runs with the deployed permissions. Three forms: `--assume-role <arn>` (explicit ARN); `--assume-role` (bare, auto-resolves from state — requires --from-cfn-stack); `--no-assume-role` (opt out). Off by default (the dev shell credentials are forwarded).")).addOption(new Option("--watch", "Hot-reload: re-synth + re-resolve the distribution when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). The server keeps the previous version serving when synth fails mid-reload.").default(false));
 }
 
 //#endregion
@@ -24892,7 +25905,7 @@ function readAuthorizationHeader(headers) {
 
 //#endregion
 //#region src/cli/commands/local-start-agentcore.ts
-function parsePort$1(raw) {
+function parsePort$2(raw) {
 	const n = Number(raw);
 	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
 	return n;
@@ -25219,629 +26232,1126 @@ function createLocalStartAgentCoreCommand(opts = {}) {
 	cmd.addOption(regionOption);
 	return cmd;
 }
-function addStartAgentCoreSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort$1)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--watch", "Re-synth + reload the warm container in place on a CDK source change, keeping the serve up. A per-firing classifier picks rebuild (boot a fresh container, re-point the serve) vs soft-reload (docker cp + docker restart the same container) — the same pattern as start-service / invoke-agentcore --ws --watch.")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
-}
-
-//#endregion
-//#region src/local/web-function-resolver.ts
-const WEB_FUNCTION_TYPE = "AWS::Lambda::WebFunction";
-const WEB_FUNCTION_REVISION_TYPE = "AWS::Lambda::WebFunctionRevision";
-const WEB_FUNCTION_ENDPOINT_TYPE = "AWS::Lambda::WebFunctionEndpoint";
-const WEB_TYPES = [
-	WEB_FUNCTION_ENDPOINT_TYPE,
-	WEB_FUNCTION_TYPE,
-	WEB_FUNCTION_REVISION_TYPE
-];
-var WebFunctionResolutionError = class WebFunctionResolutionError extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "WebFunctionResolutionError";
-		Object.setPrototypeOf(this, WebFunctionResolutionError.prototype);
-	}
-};
-function resolveWebFunctionTarget(target, stacks, revisionFlag) {
-	if (stacks.length === 0) throw new WebFunctionResolutionError("No stacks found in the synthesized assembly.");
-	const parsed = parseTarget(target);
-	const stack = pickStack(parsed, stacks, target);
-	const resources = stack.template.Resources ?? {};
-	const { logicalId, resource } = matchWebResource(parsed, target, stack, resources);
-	const functions = logicalIdsOfType(resources, WEB_FUNCTION_TYPE);
-	const linked = (value) => linkedFunctionLogicalId(value, resources, functions);
-	let functionLogicalId;
-	let endpoint;
-	let revisionLogicalId;
-	let selection;
-	if (resource.Type === "AWS::Lambda::WebFunctionRevision") {
-		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
-		revisionLogicalId = logicalId;
-		selection = "target-revision";
-	} else if (resource.Type === "AWS::Lambda::WebFunctionEndpoint") {
-		functionLogicalId = linked(resource.Properties?.["FunctionName"]);
-		endpoint = readEndpoint(logicalId, resource, resources);
-	} else functionLogicalId = logicalId;
-	const revisionsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_REVISION_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
-	const endpointsOfFunction = () => functionLogicalId === void 0 ? [] : logicalIdsOfType(resources, WEB_FUNCTION_ENDPOINT_TYPE).filter((id) => linked(resources[id]?.Properties?.["FunctionName"]) === functionLogicalId);
-	if (revisionFlag !== void 0) {
-		const flagged = resources[revisionFlag];
-		if (!flagged || flagged.Type !== "AWS::Lambda::WebFunctionRevision") throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} is not an ${WEB_FUNCTION_REVISION_TYPE} logical id in ${displayStackName(stack.stackName)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
-		const owner = linked(flagged.Properties?.["FunctionName"]);
-		if (functionLogicalId !== void 0 && owner !== functionLogicalId) throw new WebFunctionResolutionError(`--revision ${displayIdent(revisionFlag)} belongs to a different web function than ${displayIdent(logicalId)}. ${describeRevisions(revisionsOfFunction(), stack)}`);
-		functionLogicalId ??= owner;
-		revisionLogicalId = revisionFlag;
-		selection = "revision-flag";
-	}
-	if (revisionLogicalId === void 0 && endpoint !== void 0) {
-		revisionLogicalId = pickHighestWeight(endpoint);
-		if (revisionLogicalId !== void 0) selection = "endpoint-weight";
-	}
-	if (revisionLogicalId === void 0) {
-		const revisions = revisionsOfFunction();
-		if (revisions.length === 1) {
-			revisionLogicalId = revisions[0];
-			selection = "only-revision";
-		} else if (endpoint === void 0 && revisions.length > 1) {
-			const endpoints = endpointsOfFunction();
-			if (endpoints.length === 1) {
-				endpoint = readEndpoint(endpoints[0], resources[endpoints[0]], resources);
-				revisionLogicalId = pickHighestWeight(endpoint);
-				if (revisionLogicalId !== void 0) selection = "endpoint-weight";
-			}
-		}
-		if (revisionLogicalId === void 0) throw new WebFunctionResolutionError(revisions.length === 0 ? `${displayIdent(logicalId)} in ${displayStackName(stack.stackName)} resolves to no ${WEB_FUNCTION_REVISION_TYPE} in this template, so there is no code to serve. Target the revision itself, or pass --revision <logicalId>.` : `${displayIdent(logicalId)} has ${revisions.length} revisions and no single endpoint that picks one. Pass --revision <logicalId>, or target one of the function's endpoints. ${describeRevisions(revisions, stack)}`);
-	}
-	if (endpoint === void 0) {
-		const routing = endpointsOfFunction().map((id) => readEndpoint(id, resources[id], resources)).filter((e) => e.weights.some((w) => w.revisionLogicalId === revisionLogicalId));
-		if (routing.length === 1) endpoint = routing[0];
-	}
-	const fnName = (functionLogicalId !== void 0 ? resources[functionLogicalId] : void 0)?.Properties?.["FunctionName"];
-	return {
-		stack,
-		functionLogicalId,
-		functionName: typeof fnName === "string" && fnName.length > 0 ? fnName : functionLogicalId ?? revisionLogicalId,
-		revisionLogicalId,
-		revision: resources[revisionLogicalId],
-		endpoint,
-		selection: selection ?? "only-revision"
-	};
-}
-function pickStack(parsed, stacks, target) {
-	const selection = selectTargetStack(parsed, target, stacks);
-	switch (selection.kind) {
-		case "found": return selection.stack;
-		case "no-prefix": throw new WebFunctionResolutionError(`Multiple stacks in app, target ${displayIdent(parsed.pathOrId)} is missing a stack prefix. Use StackName:<logicalId> or StackName/... (path form). Available stacks: ${describeStacks(stacks)}.`);
-		case "not-found": throw new WebFunctionResolutionError(`Stack ${displayStackName(selection.pattern)} not found. Available stacks: ${describeStacks(stacks)}.`);
-		case "ambiguous": throw new WebFunctionResolutionError(`Stack pattern ${displayStackName(selection.pattern)} matched ${selection.matched.length} stacks: ${describeStacks(selection.matched)}. Use a more specific pattern, or the stack's display path.`);
-	}
-}
-function matchWebResource(parsed, target, stack, resources) {
-	if (parsed.isPath) {
-		const matches = resolveCdkPathToLogicalIds(parsed.pathOrId, buildCdkPathIndex(stack.template)).filter(({ logicalId }) => WEB_TYPES.includes(resources[logicalId]?.Type ?? ""));
-		for (const type of WEB_TYPES) {
-			const ofType = matches.filter(({ logicalId }) => resources[logicalId].Type === type);
-			if (ofType.length === 1) {
-				const id = ofType[0].logicalId;
-				return {
-					logicalId: id,
-					resource: resources[id]
-				};
-			}
-			if (ofType.length > 1) throw new WebFunctionResolutionError(`Target ${displayStackName(target)} matches ${ofType.length} ${type} resources: ${ofType.map((m) => displayIdent(m.logicalId)).join(", ")}. Refine the path or use the StackName:<logicalId> form.`);
-		}
-		throw notFoundError(target, stack, resources);
-	}
-	const resource = resources[parsed.pathOrId];
-	if (!resource) throw notFoundError(target, stack, resources);
-	if (!WEB_TYPES.includes(resource.Type)) throw new WebFunctionResolutionError(`Resource ${displayIdent(parsed.pathOrId)} in ${displayStackName(stack.stackName)} is ${displayIdent(resource.Type)}, not a Lambda web function. ${getEmbedConfig().cliName} start-web-function serves ${WEB_TYPES.join(" / ")} targets.`);
-	return {
-		logicalId: parsed.pathOrId,
-		resource
-	};
-}
-function notFoundError(target, stack, resources) {
-	const available = WEB_TYPES.flatMap((t) => logicalIdsOfType(resources, t));
-	const hint = available.length > 0 ? `Web function resources in ${displayStackName(stack.stackName)}: ${available.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_TYPE} resources found in ${displayStackName(stack.stackName)}.`;
-	return new WebFunctionResolutionError(`Target ${displayStackName(target)} not found. ${hint}`);
-}
-function logicalIdsOfType(resources, type) {
-	return Object.keys(resources).filter((id) => resources[id]?.Type === type);
-}
-function linkedFunctionLogicalId(value, resources, functions) {
-	const ref = referencedLogicalId(value);
-	if (ref !== void 0) return functions.includes(ref) ? ref : void 0;
-	if (typeof value !== "string") return void 0;
-	const byName = functions.filter((id) => resources[id]?.Properties?.["FunctionName"] === value);
-	return byName.length === 1 ? byName[0] : void 0;
-}
-function referencedLogicalId(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-	const obj = value;
-	if (typeof obj["Ref"] === "string") return obj["Ref"];
-	const getAtt = obj["Fn::GetAtt"];
-	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
-	if (typeof getAtt === "string") return getAtt.split(".")[0];
-}
-function readEndpoint(logicalId, resource, resources) {
-	const props = resource.Properties ?? {};
-	const rawWeights = props["RevisionWeights"];
-	const weights = [];
-	if (Array.isArray(rawWeights)) for (const entry of rawWeights) {
-		if (!entry || typeof entry !== "object") continue;
-		const e = entry;
-		const ref = referencedLogicalId(e["RevisionId"]);
-		weights.push({
-			revisionLogicalId: ref !== void 0 && resources[ref]?.Type === "AWS::Lambda::WebFunctionRevision" ? ref : void 0,
-			weight: typeof e["Weight"] === "number" ? e["Weight"] : 0
-		});
-	}
-	const str = (v) => typeof v === "string" ? v : void 0;
-	return {
-		logicalId,
-		endpointType: str(props["EndpointType"]),
-		authType: str(props["AuthType"]),
-		weights
-	};
-}
-function pickHighestWeight(endpoint) {
-	let best;
-	for (const w of endpoint.weights) {
-		if (w.revisionLogicalId === void 0) continue;
-		if (best === void 0 || w.weight > best.weight) best = w;
-	}
-	return best?.revisionLogicalId;
-}
-function describeRevisions(revisions, stack) {
-	return revisions.length > 0 ? `Revisions: ${revisions.map((id) => displayIdent(id)).join(", ")}.` : `No ${WEB_FUNCTION_REVISION_TYPE} linked to it in ${displayStackName(stack.stackName)}.`;
+function addStartAgentCoreSpecificOptions(cmd) {
+	return cmd.addOption(new Option("--port <n>", "Serve bind port the client connects to (HTTP contract + /ws on the same port). Default 0 (OS-assigned).").default(0).argParser(parsePort$2)).addOption(new Option("--host <ip>", "Serve bind host. Default 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--session-id <id>", "Pin one AgentCore runtime session id header value for every forwarded request / /ws connection (default: a fresh random UUID each, so each is its own session).")).addOption(new Option("--bearer-token <jwt>", "Bearer JWT to present when the runtime declares a customJwtAuthorizer. Verified against the runtime's OIDC discovery URL before the container starts, then injected as Authorization: Bearer <jwt> on every forwarded request and the container /ws upgrade.")).addOption(new Option("--no-verify-auth", "Skip inbound JWT verification even when the runtime declares a customJwtAuthorizer (local-dev escape hatch). A --bearer-token, if given, is still forwarded.")).addOption(new Option("--sigv4", "Sign each forwarded request with AWS SigV4 (service bedrock-agentcore) when the runtime declares NO customJwtAuthorizer, so the warm container sees the same Authorization / X-Amz-* headers the cloud receives. Mutually exclusive with --bearer-token; ignored (with a warning) when a customJwtAuthorizer is declared.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--platform <platform>", "docker --platform for the agent container (linux/amd64 or linux/arm64). Defaults to linux/arm64 because the cloud AgentCore Runtime requires arm64.").choices(["linux/amd64", "linux/arm64"]).default("linux/arm64")).addOption(new Option("--watch", "Re-synth + reload the warm container in place on a CDK source change, keeping the serve up. A per-firing classifier picks rebuild (boot a fresh container, re-point the serve) vs soft-reload (docker cp + docker restart the same container) — the same pattern as start-service / invoke-agentcore --ws --watch.")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for the local-build path")).addOption(new Option("--no-build", "Skip docker build on the local-asset path (use the previously-built tag). No-op for the ECR / registry pull paths.")).addOption(new Option("--container-host <host>", "Host IP used to bind the agent container port. Must be a numeric IP. Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the container to become ready (the GET /ping readiness deadline). Default 120000.").default(12e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the runtime's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the runtime's literal RoleArn; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars / image URIs with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
 //#endregion
-//#region src/local/web-function-artifact.ts
-const SUPPORTED_CODE_CONFIG_KEYS = ["S3Object"];
-function parseWebFunctionBuildConfig(revisionLogicalId, buildConfig) {
-	const subject = `Web function revision ${displayIdent(revisionLogicalId)}`;
-	const build = asObject$1(buildConfig);
-	const runtime = asObject$1(build?.["RuntimeConfig"])?.["Runtime"];
-	if (typeof runtime !== "string" || runtime.length === 0) throw new CdkLocalError(`${subject} has no literal BuildConfig.RuntimeConfig.Runtime.`, "LOCAL_START_WEB_FUNCTION_NO_RUNTIME");
-	const codeConfig = asObject$1(build?.["CodeConfig"]);
-	if (!codeConfig) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
-	const unknownKeys = Object.keys(codeConfig).filter((k) => !SUPPORTED_CODE_CONFIG_KEYS.includes(k));
-	if (unknownKeys.length > 0) throw new CdkLocalError(`${subject} uses BuildConfig.CodeConfig.${unknownKeys.map((k) => displayIdent(k)).join(", ")}, which ${getEmbedConfig().cliName} start-web-function does not support yet. Supported: ${SUPPORTED_CODE_CONFIG_KEYS.join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_CODE_CONFIG");
-	const s3 = asObject$1(codeConfig["S3Object"]);
-	if (!s3) throw new CdkLocalError(`${subject} has no BuildConfig.CodeConfig.S3Object.`, "LOCAL_START_WEB_FUNCTION_NO_CODE_CONFIG");
-	const key = s3["Key"];
-	if (typeof key !== "string" || key.length === 0) throw new CdkLocalError(`${subject} has a CodeConfig.S3Object.Key that is not a literal string (${describeValue(key)}). The code must come from a CDK asset in this app (for example an s3assets.Asset passing asset.s3BucketName / asset.s3ObjectKey), whose key synthesizes as a literal.`, "LOCAL_START_WEB_FUNCTION_CODE_KEY_NOT_LITERAL");
-	const versionId = s3["VersionId"];
-	return {
-		runtime,
-		s3Object: {
-			bucket: s3["Bucket"],
-			key,
-			...typeof versionId === "string" && { versionId }
-		}
-	};
+//#region src/cli/commands/local-start-web-function.ts
+function parsePort$1(raw) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
+	return n;
 }
-function findFileAssetForObjectKey(manifest, key) {
-	for (const [hash, asset] of Object.entries(manifest.files ?? {})) for (const dest of Object.values(asset.destinations ?? {})) if (dest.objectKey === key || dest.objectKey.endsWith(`/${key}`)) return {
-		hash,
-		asset
+async function localStartWebFunctionCommand(target, options, extraStateProviders, hostSynthesizer) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	const forever = () => new Promise(() => void 0);
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region,
+		profile: options.profile
+	});
+	await ensureDockerAvailable();
+	const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
+	const appCmd = resolveApp(options.app);
+	if (!appCmd) throw new Error(`No CDK app specified. Pass --app, set ${getEmbedConfig().envPrefix}_APP, or add "app" to cdk.json.`);
+	logger.info("Synthesizing CDK app...");
+	const synthesizer = hostSynthesizer ?? new Synthesizer();
+	const context = parseContextOptions(options.context);
+	const synthOpts = {
+		app: appCmd,
+		output: options.output,
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile },
+		...Object.keys(context).length > 0 && { context }
 	};
-	const hash = key.replace(/^.*\//, "").replace(/\.zip$/, "");
-	const byHash = Object.hasOwn(manifest.files ?? {}, hash) ? manifest.files[hash] : void 0;
-	return byHash ? {
-		hash,
-		asset: byHash
-	} : void 0;
-}
-async function resolveWebFunctionArtifact(stack, revisionLogicalId, code, loader = new AssetManifestLoader()) {
-	const subject = `Web function revision ${displayUntrustedValue(revisionLogicalId)} code bundle`;
-	const notFound = () => new CdkLocalError(`${subject} (S3Object bucket ${describeValue(code.s3Object.bucket)}, key ${displayUntrustedValue(code.s3Object.key)}) matches no file asset in this app's cdk.out. ${getEmbedConfig().cliName} start-web-function runs code that comes from a CDK asset in this app (for example an s3assets.Asset of a directory); it does not download deployed code. Re-synthesize the app, or point the revision at an asset.`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NOT_FOUND");
-	const manifestPath = stack.assetManifestPath;
-	if (!manifestPath) throw notFound();
-	const manifestDir = dirname$1(manifestPath);
-	const manifest = await loader.loadStackManifest(stack, manifestDir);
-	const match = manifest ? findFileAssetForObjectKey(manifest, code.s3Object.key) : void 0;
-	if (!match) throw notFound();
-	if (typeof match.asset.source.path !== "string" || match.asset.source.path.length === 0) throw new CdkLocalError(`${subject} matches file asset ${displayIdent(match.hash)}, which has no source.path (it is produced by source.executable at publish time), so there is no staged bundle in cdk.out to mount. Give the revision an asset of a directory or a .zip file (for example s3assets.Asset with path: '<dir>').`, "LOCAL_START_WEB_FUNCTION_CODE_ASSET_NO_PATH");
-	const sourcePath = resolveAssetSourcePath({
-		manifestDir,
-		value: match.asset.source.path,
-		assetOutdir: assetPathDirs(stack).assetOutdir,
-		absolute: "honour-warn",
-		field: "source.path",
-		subject,
-		action: "mount it",
-		sink: "bind-mount that directory into the web function container",
-		wrapError: (message) => new CdkLocalError(message, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	const { stacks } = await synthesizer.synthesize(synthOpts);
+	const resolved = resolveWebFunctionTarget(await resolveSingleTarget(target, {
+		entries: listTargets(stacks).webFunctions,
+		message: "Select a Lambda web function to serve",
+		noun: "Lambda web functions",
+		onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} start-web-function requires a <target> (a WebFunction, WebFunctionEndpoint or WebFunctionRevision display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_START_WEB_FUNCTION_TARGET_REQUIRED")
+	}), stacks, options.revision);
+	const prepared = prepareWebFunctionServe(resolved);
+	const selectionNote = {
+		"target-revision": "the target revision",
+		"revision-flag": "--revision",
+		"endpoint-weight": `highest weight on endpoint ${displayIdent(resolved.endpoint?.logicalId ?? "")}`,
+		"only-revision": "the function's only revision"
+	};
+	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.revisionLogicalId}`)} (${prepared.spec.runtime}; revision chosen by ${selectionNote[resolved.selection]})`);
+	for (const line of webFunctionFidelityWarnings(resolved, prepared.serviceConfig)) logger.warn(line);
+	const serve = new WebFunctionServe(prepared, {
+		envOptions: options,
+		...profileCredentials !== void 0 && { profileCredentials },
+		...extraStateProviders !== void 0 && { extraStateProviders },
+		host: options.host,
+		port: options.port,
+		...options.platform !== void 0 && { platform: options.platform },
+		skipPull: options.pull === false,
+		timeoutMs: options.timeout
 	});
-	if (!existsSync$1(sourcePath)) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} does not exist. Re-synthesize the app and retry.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_MISSING");
-	if (!statSync$1(sourcePath).isDirectory() && !sourcePath.endsWith(".zip")) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} is neither a directory nor a .zip archive, so it is not a code bundle.`, "LOCAL_START_WEB_FUNCTION_CODE_SOURCE_NOT_BUNDLE");
-	const materialized = materializeAssetCodeDir(sourcePath);
-	return {
-		kind: "zip",
-		runtime: code.runtime,
-		codeDir: materialized.dir,
-		...materialized.tmpDir !== void 0 && { tmpDir: materialized.tmpDir },
-		assetHash: match.hash
+	let shuttingDown = false;
+	const shutdown = async (signal, exitCode) => {
+		if (shuttingDown) {
+			if (!serve.waitingOnRun) {
+				logger.info(`Received ${signal} again; still removing the container, please wait...`);
+				return;
+			}
+			serve.disposeArtifactNow();
+			logger.warn(`Received ${signal} again; exiting without waiting for docker run to return. The container may still be starting, and its environment holds the forwarded AWS credentials. Remove it by its name (this works even if it is created after this exit): docker rm -f ${serve.containerName ?? "<name>"}`);
+			process.exit(signal === "SIGINT" ? 130 : 143);
+			return;
+		}
+		shuttingDown = true;
+		logger.info(`Received ${signal}, shutting down...`);
+		await serve.teardown();
+		process.exit(exitCode);
 	};
-}
-function disposeWebFunctionArtifact(artifact) {
-	if (artifact?.kind !== "zip" || artifact.tmpDir === void 0) return;
-	try {
-		if (existsSync$1(artifact.tmpDir)) rmSync$1(artifact.tmpDir, {
-			recursive: true,
-			force: true
-		});
-	} catch {}
-}
-function asObject$1(value) {
-	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function describeValue(value) {
-	if (typeof value === "string") return displayUntrustedValue(value);
-	let json;
+	process.on("SIGINT", () => void shutdown("SIGINT", 130));
+	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
 	try {
-		json = JSON.stringify(value);
-	} catch {
-		json = void 0;
+		const address = await serve.start();
+		if (!address) return await forever();
+		logger.info(`Server listening on http://${formatAuthority(address.host, address.port)}  (${displayIdent(resolved.functionName)} (Lambda web function))`);
+		logger.info("Press ^C to shut down.");
+	} catch (err) {
+		if (shuttingDown) return await forever();
+		await serve.teardown();
+		throw err;
 	}
-	return displayUntrustedValue(json ?? String(value));
-}
-
-//#endregion
-//#region src/local/web-function-runtime.ts
-const NODE_CODE_MOUNT = "/var/task";
-const NODE_ENTRYPOINT_ENV = "AWS_LAMBDA_NODEJS_ENTRYPOINT";
-const NODE_DEFAULT_ENTRY = "index.js";
-function buildNodeEntryFileStart(runtime, env, codeDir, fileExists = existsSync$1) {
-	const configured = env[NODE_ENTRYPOINT_ENV];
-	const entryFile = configured !== void 0 && configured.length > 0 ? configured : NODE_DEFAULT_ENTRY;
-	const hostPath = resolve$1(codeDir, entryFile);
-	const rel = relative$1(codeDir, hostPath);
-	if (isAbsolute$1(entryFile) || rel === "" || rel === ".." || rel.startsWith(`..${sep$1}`) || isAbsolute$1(rel)) throw new CdkLocalError(`${NODE_ENTRYPOINT_ENV}=${displayUntrustedValue(entryFile)} must name a file inside the code bundle, relative to its root.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_OUTSIDE_BUNDLE");
-	if (!fileExists(hostPath)) throw new CdkLocalError(`The ${runtime} web function entry file ${displayUntrustedValue(entryFile)} was not found in the code bundle ${displayUntrustedValue(codeDir)}. The runtime loads ${NODE_DEFAULT_ENTRY} from the package root unless ${NODE_ENTRYPOINT_ENV} names another file.`, "LOCAL_START_WEB_FUNCTION_ENTRYPOINT_MISSING");
-	const posixRel = sep$1 === "\\" ? rel.split("\\").join("/") : rel;
-	return {
-		entryPoint: ["/var/lang/bin/node"],
-		cmd: [posix.join(NODE_CODE_MOUNT, posixRel)],
-		label: entryFile
-	};
-}
-const WEB_FUNCTION_RUNTIMES = { "nodejs24.x": {
-	runtime: "nodejs24.x",
-	baseImage: "public.ecr.aws/lambda/nodejs:24",
-	codeMountPath: NODE_CODE_MOUNT,
-	architectures: ["arm64"],
-	buildStart: (env, codeDir, deps) => buildNodeEntryFileStart("nodejs24.x", env, codeDir, deps?.fileExists)
-} };
-function supportedWebFunctionRuntimes(table = WEB_FUNCTION_RUNTIMES) {
-	return Object.keys(table).sort();
+	const exited = serve.exited;
+	if (!exited) return await forever();
+	const exitCode = await exited;
+	if (shuttingDown || serve.tornDown) return await forever();
+	const failure = await serve.exitFailure(`The web function container exited (exit code ${exitCode ?? "unknown"}) while serving.`);
+	await serve.teardown();
+	throw failure;
 }
-function resolveWebFunctionRuntime(runtime, table = WEB_FUNCTION_RUNTIMES) {
-	const spec = Object.hasOwn(table, runtime) ? table[runtime] : void 0;
-	if (!spec) throw new CdkLocalError(`Web function runtime ${displayIdent(runtime)} is not supported by ${getEmbedConfig().cliName} start-web-function yet. Supported: ${supportedWebFunctionRuntimes(table).join(", ")}.`, "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_RUNTIME");
-	return spec;
+function createLocalStartWebFunctionCommand(opts = {}) {
+	setEmbedConfig(opts.embedConfig);
+	const cmd = new Command("start-web-function").description("Serve an AWS Lambda Web Function locally. Resolves a WebFunction, WebFunctionEndpoint or WebFunctionRevision target to one revision (an endpoint serves its highest-weight revision; --revision overrides), runs its code bundle from cdk.out in a container whose server listens on AWS_LAMBDA_HTTP_ENDPOINT, and publishes it on a local port with the revision's ServiceConfig environment. Target accepts a CDK display path or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C.").argument("[target]", "CDK display path or stack-qualified logical ID of the WebFunction / WebFunctionEndpoint / WebFunctionRevision (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
+		await localStartWebFunctionCommand(target, options, opts.extraStateProviders, opts.synthesizer);
+	}));
+	addStartWebFunctionSpecificOptions(cmd);
+	[
+		...commonOptions(),
+		...appOptions(),
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(regionOption);
+	return cmd;
 }
-function defaultWebFunctionPlatform(spec) {
-	return spec.architectures[0] === "x86_64" ? "linux/amd64" : "linux/arm64";
+function addStartWebFunctionSpecificOptions(cmd) {
+	return cmd.addOption(new Option("--revision <logicalId>", "Serve this WebFunctionRevision (logical ID) instead of the one the endpoint weights pick.")).addOption(new Option("--port <n>", "Local port to serve on. Default 0 (OS-assigned).").default(0).argParser(parsePort$1)).addOption(new Option("--host <ip>", "Address to publish the port on.").default("127.0.0.1")).addOption(new Option("--platform <platform>", "docker --platform for the server container. Defaults to the runtime's cloud architecture (linux/arm64 for nodejs24.x).").choices(["linux/amd64", "linux/arm64"])).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"RevisionLogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--no-pull", "Skip docker pull of the runtime base image (use the cached image)")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the server to answer HTTP. Default 60000.").default(6e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the revision's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the revision's ServiceConfig.ExecutionRoleArn: a literal ARN as written, or the Fn::GetAtt / Ref CDK synthesizes resolved against --from-cfn-stack deployed state; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
 //#endregion
-//#region src/local/web-function-service-config.ts
-const WEB_FUNCTION_HTTP_ENDPOINT_ENV = "AWS_LAMBDA_HTTP_ENDPOINT";
-const APPLICATION_MANAGED_AUTH = "ApplicationManaged";
-const HOME_REGION_ENDPOINT = "HomeRegion";
-function readWebFunctionServiceConfig(revision) {
-	const sc = asObject(revision.Properties?.["ServiceConfig"]) ?? {};
-	const envRaw = sc["EnvironmentVariables"];
-	const envObj = asObject(envRaw);
-	const envKeys = envObj ? Object.keys(envObj) : [];
-	const env = envKeys.length === 1 && (envKeys[0] === "Ref" || envKeys[0].startsWith("Fn::")) ? void 0 : envObj;
-	const logGroup = asObject(asObject(sc["TelemetryConfig"])?.["LoggingConfig"])?.["LogGroup"];
+//#region src/local/microvm-image.ts
+const MICROVM_IMAGE_TYPE = "AWS::Lambda::MicrovmImage";
+const MICROVM_DEFAULT_INGRESS_PORT = 8080;
+var MicrovmResolutionError = class MicrovmResolutionError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MicrovmResolutionError";
+		Object.setPrototypeOf(this, MicrovmResolutionError.prototype);
+	}
+};
+function resolveMicrovmImageTarget(target, stacks) {
+	if (stacks.length === 0) throw new MicrovmResolutionError("No stacks found in the synthesized assembly.");
+	const parsed = parseTarget(target);
+	const selection = selectTargetStack(parsed, target, stacks);
+	let stack;
+	switch (selection.kind) {
+		case "found":
+			stack = selection.stack;
+			break;
+		case "no-prefix": throw new MicrovmResolutionError(`Multiple stacks in app, target ${displayIdent(parsed.pathOrId)} is missing a stack prefix. Use StackName:<logicalId> or StackName/... (path form). Available stacks: ${describeStacks(stacks)}.`);
+		case "not-found": throw new MicrovmResolutionError(`Stack ${displayStackName(selection.pattern)} not found. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new MicrovmResolutionError(`Stack pattern ${displayStackName(selection.pattern)} matched ${selection.matched.length} stacks: ${describeStacks(selection.matched)}. Use a more specific pattern, or the stack's display path.`);
+	}
+	const resources = stack.template.Resources ?? {};
+	const images = Object.keys(resources).filter((id) => resources[id]?.Type === MICROVM_IMAGE_TYPE);
+	const notFound = () => new MicrovmResolutionError(`Target ${displayStackName(target)} not found. ` + (images.length > 0 ? `MicroVM images in ${displayStackName(stack.stackName)}: ${images.map((id) => displayIdent(id)).join(", ")}.` : `No ${MICROVM_IMAGE_TYPE} resources found in ${displayStackName(stack.stackName)}.`));
+	if (parsed.isPath) {
+		const matches = resolveCdkPathToLogicalIds(parsed.pathOrId, buildCdkPathIndex(stack.template)).filter(({ logicalId }) => resources[logicalId]?.Type === MICROVM_IMAGE_TYPE);
+		if (matches.length === 1) {
+			const id = matches[0].logicalId;
+			return {
+				stack,
+				logicalId: id,
+				resource: resources[id]
+			};
+		}
+		if (matches.length > 1) throw new MicrovmResolutionError(`Target ${displayStackName(target)} matches ${matches.length} ${MICROVM_IMAGE_TYPE} resources: ${matches.map((m) => displayIdent(m.logicalId)).join(", ")}. Refine the path or use the StackName:<logicalId> form.`);
+		throw notFound();
+	}
+	const resource = resources[parsed.pathOrId];
+	if (!resource) throw notFound();
+	if (resource.Type !== "AWS::Lambda::MicrovmImage") throw new MicrovmResolutionError(`Resource ${displayIdent(parsed.pathOrId)} in ${displayStackName(stack.stackName)} is ${displayIdent(resource.Type)}, not a MicroVM image. ${getEmbedConfig().cliName} start-microvm runs ${MICROVM_IMAGE_TYPE} targets.`);
 	return {
-		environmentVariables: env,
-		environmentUnreadable: envRaw !== void 0 && env === void 0,
-		executionRoleArn: sc["ExecutionRoleArn"],
-		egressNetworkConnectorArn: sc["EgressNetworkConnectorArn"],
-		timeoutSeconds: typeof sc["TimeoutSeconds"] === "number" ? sc["TimeoutSeconds"] : void 0,
-		logGroup: typeof logGroup === "string" && logGroup.length > 0 ? logGroup : void 0
+		stack,
+		logicalId: parsed.pathOrId,
+		resource
 	};
 }
-function buildWebFunctionLambdaView(resolved, config, runtime) {
+const HOOK_KEYS = {
+	ready: {
+		group: "MicrovmImageHooks",
+		key: "Ready"
+	},
+	validate: {
+		group: "MicrovmImageHooks",
+		key: "Validate"
+	},
+	run: {
+		group: "MicrovmHooks",
+		key: "Run"
+	},
+	suspend: {
+		group: "MicrovmHooks",
+		key: "Suspend"
+	},
+	resume: {
+		group: "MicrovmHooks",
+		key: "Resume"
+	},
+	terminate: {
+		group: "MicrovmHooks",
+		key: "Terminate"
+	}
+};
+function readMicrovmImageConfig(logicalId, resource) {
+	const subject = `MicroVM image ${displayIdent(logicalId)}`;
+	const props = resource.Properties ?? {};
+	const name = typeof props["Name"] === "string" && props["Name"].length > 0 ? props["Name"] : logicalId;
+	const uri = asObject(props["CodeArtifact"])?.["Uri"];
+	const codeKey = s3KeyOfUri(uri);
+	if (codeKey === void 0) throw new CdkLocalError(`${subject} has a CodeArtifact.Uri whose object key is not a literal (${describeValue(uri)}). The code must come from a CDK asset in this app (for example an s3assets.Asset of a directory holding the Dockerfile, passing asset.s3ObjectUrl), whose key synthesizes as a literal.`, "LOCAL_START_MICROVM_CODE_URI_NOT_LITERAL");
+	const cpu = props["CpuConfigurations"];
+	const archRaw = Array.isArray(cpu) ? asObject(cpu[0])?.["Architecture"] : void 0;
+	const architecture = typeof archRaw === "string" ? normalizeArchitecture(archRaw) : void 0;
+	const environment = {};
+	const envRaw = props["EnvironmentVariables"];
+	const unemulated = [];
+	if (Array.isArray(envRaw)) for (const entry of envRaw) {
+		const e = asObject(entry);
+		if (e && typeof e["Key"] === "string") environment[e["Key"]] = e["Value"];
+	}
+	else if (envRaw !== void 0) unemulated.push("EnvironmentVariables is an intrinsic rather than a list, so none of its variables reach the container (supply them with --env-vars)");
+	const hooksObj = asObject(props["Hooks"]);
+	const hooks = {};
+	for (const [hook, where] of Object.entries(HOOK_KEYS)) {
+		const group = asObject(hooksObj?.[where.group]);
+		const value = group?.[where.key];
+		if (value === void 0 || value === "DISABLED") continue;
+		if (value !== "ENABLED") throw new CdkLocalError(`${subject} has Hooks.${where.group}.${where.key} ${describeValue(value)}; only the literal ENABLED or DISABLED can run locally.`, "LOCAL_START_MICROVM_HOOK_VALUE");
+		const timeout = group?.[`${where.key}TimeoutInSeconds`];
+		hooks[hook] = { timeoutSeconds: typeof timeout === "number" && timeout > 0 ? timeout : void 0 };
+	}
+	const port = hooksObj?.["Port"];
+	const hooksPort = typeof port === "number" && Number.isInteger(port) && port > 0 && port < 65536 ? port : void 0;
+	if (Object.keys(hooks).length > 0 && hooksPort === void 0) throw new CdkLocalError(`${subject} enables lifecycle hooks (${Object.keys(hooks).join(", ")}) but has no literal Hooks.Port. Lambda requires the hooks port whenever a hook is configured; set Hooks.Port to the port the application serves /aws/lambda-microvms/runtime/v1/ on.`, "LOCAL_START_MICROVM_NO_HOOKS_PORT");
+	const present = (key) => {
+		const v = props[key];
+		if (v === void 0 || v === null) return false;
+		if (Array.isArray(v)) return v.length > 0;
+		if (typeof v === "object") return Object.keys(v).length > 0;
+		return true;
+	};
+	if (present("EgressNetworkConnectors")) unemulated.push("EgressNetworkConnectors (the container uses Docker's default network egress)");
+	if (present("AdditionalOsCapabilities")) unemulated.push("AdditionalOsCapabilities (the container runs with Docker's default capabilities)");
+	if (present("Resources")) unemulated.push("Resources sizing (the container gets no memory limit)");
+	if (present("BaseImageVersion")) unemulated.push("BaseImageVersion (the local build uses whatever the Dockerfile names)");
+	if (present("Logging")) unemulated.push("Logging (container output is printed here instead of sent to CloudWatch Logs)");
 	return {
-		kind: "zip",
-		stack: resolved.stack,
-		logicalId: resolved.revisionLogicalId,
-		resource: {
-			Type: resolved.revision.Type,
-			Properties: {
-				...config.environmentVariables !== void 0 && { Environment: { Variables: config.environmentVariables } },
-				...config.executionRoleArn !== void 0 && { Role: config.executionRoleArn }
-			},
-			...resolved.revision.Metadata !== void 0 && { Metadata: resolved.revision.Metadata }
-		},
-		memoryMb: 128,
-		timeoutSec: config.timeoutSeconds ?? 0,
-		layers: [],
-		runtime,
-		handler: "",
-		codePath: null,
-		architecture: "arm64"
+		logicalId,
+		name,
+		codeKey,
+		architecture,
+		environment,
+		hooksPort,
+		hooks,
+		unemulated
 	};
 }
-function webFunctionAssumeRole(assumeRole, config) {
-	if (assumeRole === true && isIamRoleArn(config.executionRoleArn)) return config.executionRoleArn;
-	return assumeRole;
+function normalizeArchitecture(raw) {
+	const s = raw.toLowerCase().replace(/_/g, "");
+	if (s === "arm64") return "arm64";
+	if (s === "x8664") return "x86_64";
 }
-function finalizeWebFunctionEnv(lambdaEnv, opts) {
-	const env = { ...lambdaEnv };
-	delete env["AWS_LAMBDA_FUNCTION_MEMORY_SIZE"];
-	delete env["AWS_LAMBDA_FUNCTION_VERSION"];
-	delete env["AWS_LAMBDA_FUNCTION_TIMEOUT"];
-	env["AWS_LAMBDA_FUNCTION_NAME"] = opts.functionName;
-	env["AWS_LAMBDA_LOG_GROUP_NAME"] = opts.logGroup ?? `/aws/lambda/${opts.functionName}`;
-	if (opts.timeoutSeconds !== void 0) env["AWS_LAMBDA_FUNCTION_TIMEOUT"] = String(opts.timeoutSeconds);
-	const replacedHttpEndpoint = Object.hasOwn(lambdaEnv, WEB_FUNCTION_HTTP_ENDPOINT_ENV);
-	env[WEB_FUNCTION_HTTP_ENDPOINT_ENV] = `0.0.0.0:${opts.containerPort}`;
-	return {
-		env,
-		replacedHttpEndpoint
-	};
+function s3KeyOfUri(value) {
+	const flat = flattenTemplateString(value);
+	if (flat === void 0) return void 0;
+	const m = /^s3:\/\/[^/]*\/(.+)$/.exec(flat);
+	if (!m) return void 0;
+	const key = m[1];
+	return key.includes("\0") || key.includes("${") ? void 0 : key;
 }
-function webFunctionFidelityWarnings(resolved, config) {
-	const out = [];
-	const rev = displayIdent(resolved.revisionLogicalId);
-	if (config.egressNetworkConnectorArn !== void 0) out.push(`Revision ${rev} sets ServiceConfig.EgressNetworkConnectorArn; the network connector is not emulated, so the container reaches the network through Docker's default bridge.`);
-	if (config.environmentUnreadable) out.push(`Revision ${rev} declares ServiceConfig.EnvironmentVariables as an intrinsic rather than a map; none of its variables reach the container. Supply them with --env-vars.`);
-	const endpoint = resolved.endpoint;
-	if (endpoint) {
-		const ep = displayIdent(endpoint.logicalId);
-		if (endpoint.endpointType !== void 0 && endpoint.endpointType !== "HomeRegion") out.push(`Endpoint ${ep} has EndpointType ${displayIdent(endpoint.endpointType)}; only a single ${HOME_REGION_ENDPOINT} endpoint is reproduced, on one local port.`);
-		if (endpoint.authType !== void 0 && endpoint.authType !== "ApplicationManaged") out.push(`Endpoint ${ep} has AuthType ${displayIdent(endpoint.authType)}; it is not enforced locally — every request reaches the server unauthenticated.`);
-		const routed = endpoint.weights.filter((w) => w.weight > 0);
-		if (routed.length > 1) out.push(`Endpoint ${ep} splits traffic across ${routed.length} revisions; weighted routing is not emulated — every request goes to revision ${rev}.`);
+function flattenTemplateString(value) {
+	if (typeof value === "string") return value;
+	const obj = asObject(value);
+	if (!obj) return void 0;
+	const join = obj["Fn::Join"];
+	if (Array.isArray(join) && typeof join[0] === "string" && Array.isArray(join[1])) return join[1].map((p) => flattenTemplateString(p) ?? "\0").join(join[0]);
+	const sub = obj["Fn::Sub"];
+	if (typeof sub === "string") return sub.replace(/\$\{[^}]*\}/g, "\0");
+	if (Array.isArray(sub) && typeof sub[0] === "string") return sub[0].replace(/\$\{[^}]*\}/g, "\0");
+	return "\0";
+}
+async function resolveMicrovmCodeArtifact(stack, config, loader = new AssetManifestLoader()) {
+	const subject = `MicroVM image ${displayUntrustedValue(config.logicalId)} code artifact`;
+	const notFound = () => new CdkLocalError(`${subject} (key ${displayUntrustedValue(config.codeKey)}) matches no file asset in this app's cdk.out. ${getEmbedConfig().cliName} start-microvm builds code that comes from a CDK asset in this app (for example an s3assets.Asset of a directory holding the Dockerfile); it does not download deployed code. Re-synthesize the app, or point CodeArtifact.Uri at an asset.`, "LOCAL_START_MICROVM_CODE_ASSET_NOT_FOUND");
+	const manifestPath = stack.assetManifestPath;
+	if (!manifestPath) throw notFound();
+	const manifestDir = dirname$1(manifestPath);
+	const manifest = await loader.loadStackManifest(stack, manifestDir);
+	const match = manifest ? findFileAssetForObjectKey(manifest, config.codeKey) : void 0;
+	if (!match) throw notFound();
+	if (typeof match.asset.source.path !== "string" || match.asset.source.path.length === 0) throw new CdkLocalError(`${subject} matches file asset ${displayIdent(match.hash)}, which has no source.path (it is produced by source.executable at publish time), so there is no staged bundle in cdk.out to build. Give the image an asset of a directory or a .zip file.`, "LOCAL_START_MICROVM_CODE_ASSET_NO_PATH");
+	const sourcePath = resolveAssetSourcePath({
+		manifestDir,
+		value: match.asset.source.path,
+		assetOutdir: assetPathDirs(stack).assetOutdir,
+		absolute: "honour-warn",
+		field: "source.path",
+		subject,
+		action: "build it",
+		sink: "send that directory to docker build as the MicroVM image context",
+		wrapError: (message) => new CdkLocalError(message, "LOCAL_START_MICROVM_CODE_SOURCE_ESCAPES_ASSEMBLY")
+	});
+	if (!existsSync$1(sourcePath)) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} does not exist. Re-synthesize the app and retry.`, "LOCAL_START_MICROVM_CODE_SOURCE_MISSING");
+	if (!statSync$1(sourcePath).isDirectory() && !sourcePath.endsWith(".zip")) throw new CdkLocalError(`${subject} source ${displayUntrustedValue(sourcePath)} is neither a directory nor a .zip archive, so it is not a code bundle.`, "LOCAL_START_MICROVM_CODE_SOURCE_NOT_BUNDLE");
+	const materialized = materializeAssetCodeDir(sourcePath);
+	const artifact = {
+		contextDir: materialized.dir,
+		...materialized.tmpDir !== void 0 && { tmpDir: materialized.tmpDir },
+		assetHash: match.hash
+	};
+	if (!existsSync$1(join$1(materialized.dir, "Dockerfile"))) {
+		disposeMicrovmCodeArtifact(artifact);
+		throw new CdkLocalError(`${subject} has no Dockerfile at its root. A MicroVM image's code artifact is a zip with a Dockerfile at the root plus the application files.`, "LOCAL_START_MICROVM_NO_DOCKERFILE");
 	}
-	return out;
+	return artifact;
+}
+function disposeMicrovmCodeArtifact(artifact) {
+	if (artifact?.tmpDir === void 0) return;
+	try {
+		if (existsSync$1(artifact.tmpDir)) rmSync$1(artifact.tmpDir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
 }
 function asObject(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
+function describeValue(value) {
+	if (typeof value === "string") return displayUntrustedValue(value);
+	let json;
+	try {
+		json = JSON.stringify(value);
+	} catch {
+		json = void 0;
+	}
+	return displayUntrustedValue(json ?? String(value));
+}
 
 //#endregion
-//#region src/local/web-function-runner.ts
-const execFileAsync = promisify$1(execFile$1);
-const WEB_FUNCTION_CONTAINER_PORT = 8080;
-const READY_FAILURE_LOG_LINES = 20;
-const MAX_PROBE_TIMEOUT_MS = 1e4;
-function planWebFunctionContainer(artifact, spec, env, deps) {
-	if (artifact.kind !== "zip") throw new CdkLocalError("A container-image web function source is not supported yet; only a zip bundle from CodeConfig.S3Object runs locally.", "LOCAL_START_WEB_FUNCTION_UNSUPPORTED_ARTIFACT");
-	const start = spec.buildStart(env, artifact.codeDir, deps);
-	return {
-		image: spec.baseImage,
-		mounts: [{
-			hostPath: artifact.codeDir,
-			containerPath: spec.codeMountPath,
-			readOnly: true
-		}],
-		entryPoint: start.entryPoint,
-		cmd: start.cmd,
-		workingDir: spec.codeMountPath,
-		label: start.label
-	};
+//#region src/local/microvm-hooks.ts
+const MICROVM_HOOK_PATH_PREFIX = "/aws/lambda-microvms/runtime/v1/";
+const MAX_RUN_HOOK_PAYLOAD_BYTES = 16 * 1024;
+const HOOK_RETRY_INTERVAL_MS = 250;
+var MicrovmHookError = class MicrovmHookError extends CdkLocalError {
+	constructor(message, code = "LOCAL_START_MICROVM_HOOK_FAILED") {
+		super(message, code);
+		this.name = "MicrovmHookError";
+		Object.setPrototypeOf(this, MicrovmHookError.prototype);
+	}
+};
+function generateMicrovmId() {
+	return `mvm-${randomUUID$1()}`;
 }
-async function startWebFunctionContainer(opts) {
-	const { plan } = opts;
-	return runDetached({
-		image: plan.image,
-		mounts: plan.mounts,
-		env: opts.env,
-		...opts.sensitiveEnvKeys.size > 0 && { sensitiveEnvKeys: opts.sensitiveEnvKeys },
-		entryPoint: plan.entryPoint,
-		cmd: plan.cmd,
-		...plan.workingDir !== void 0 && { workingDir: plan.workingDir },
-		hostPort: opts.hostPort,
-		containerPort: WEB_FUNCTION_CONTAINER_PORT,
-		host: opts.host,
-		platform: opts.platform,
-		name: opts.name,
-		autoRemove: false
+function runHookBody(microvmId, runHookPayload) {
+	return JSON.stringify({
+		microvmId,
+		...runHookPayload !== void 0 && { runHookPayload }
 	});
 }
-var RecentOutput = class {
-	lines = [];
-	partial = "";
-	max;
-	constructor(max = 20) {
-		this.max = max;
-	}
-	push(chunk) {
-		const parts = (this.partial + chunk.toString()).split("\n");
-		this.partial = parts.pop() ?? "";
-		for (const line of parts) this.add(line);
-		if (this.partial.length > 4096) {
-			this.add(this.partial);
-			this.partial = "";
-		}
-	}
-	tail() {
-		return this.partial.length > 0 ? [...this.lines, this.partial].slice(-this.max) : this.lines;
-	}
-	add(line) {
-		this.lines.push(line.replace(/\r$/, ""));
-		if (this.lines.length > this.max) this.lines.shift();
-	}
-};
-async function waitForWebFunctionReady(args, deps = defaultReadyDeps) {
-	const deadline = deps.now() + args.timeoutMs;
+async function pollBuildHook(hook, endpoint, timeoutMs, deps = defaultHookDeps) {
+	const path = `${MICROVM_HOOK_PATH_PREFIX}${hook}`;
+	const deadline = deps.now() + timeoutMs;
+	let attempts = 0;
+	let last = { kind: "refused" };
+	while (deps.now() < deadline) {
+		const remaining = Math.max(1, deadline - deps.now());
+		last = await deps.post(endpoint.host, endpoint.port, path, void 0, remaining);
+		attempts++;
+		if (last.kind === "status" && last.status === 200) return attempts;
+		if (last.kind === "timeout") throw new MicrovmHookError(`The /${hook} hook held the request open for ${timeoutMs}ms without answering. Answer 503 immediately while not ready (the cloud ends the image build when a held request reaches the timeout), or raise ${timeoutField(hook)}.`, "LOCAL_START_MICROVM_HOOK_TIMEOUT");
+		if (last.kind === "status" && last.status !== 503) throw new MicrovmHookError(`The /${hook} hook answered HTTP ${last.status}; it must answer 200 when done or 503 to be retried.${bodySuffix(last.body)}`);
+		if (deps.isAlive && attempts % 4 === 0 && !await deps.isAlive()) throw new MicrovmHookError(`The MicroVM container exited while cdk-local polled its /${hook} hook.`, "LOCAL_START_MICROVM_EXITED");
+		await deps.sleep(250);
+	}
+	const lastSeen = last.kind === "status" ? `its last answer was HTTP ${last.status}` : `nothing answered on ${formatAuthority(endpoint.host, endpoint.port)} (the hooks port)`;
+	throw new MicrovmHookError(`The /${hook} hook did not answer 200 within ${timeoutMs}ms (${timeoutField(hook)}); ${lastSeen}.`, "LOCAL_START_MICROVM_HOOK_TIMEOUT");
+}
+async function callRuntimeHook(hook, endpoint, timeoutMs, body, deps = defaultHookDeps) {
+	const path = `${MICROVM_HOOK_PATH_PREFIX}${hook}`;
+	const result = await deps.post(endpoint.host, endpoint.port, path, body, timeoutMs);
+	if (result.kind === "status" && result.status === 200) return;
+	if (result.kind === "timeout") throw new MicrovmHookError(`The /${hook} hook did not answer within ${timeoutMs}ms (${timeoutField(hook)}).`, "LOCAL_START_MICROVM_HOOK_TIMEOUT");
+	if (result.kind === "refused") throw new MicrovmHookError(`The /${hook} hook could not be reached: nothing answered on the hooks port (${formatAuthority(endpoint.host, endpoint.port)}).`);
+	throw new MicrovmHookError(`The /${hook} hook answered HTTP ${result.status}; it must answer 200.${bodySuffix(result.body)}`);
+}
+async function waitForAppAnswer(endpoint, timeoutMs, deps = {
+	probe: probeHttp,
+	sleep: defaultHookDeps.sleep,
+	now: defaultHookDeps.now
+}) {
+	const deadline = deps.now() + timeoutMs;
 	let attempt = 0;
-	let last = "refused";
 	while (deps.now() < deadline) {
 		const remaining = Math.max(1, deadline - deps.now());
-		last = await deps.probe(args.host, args.port, Math.min(remaining, MAX_PROBE_TIMEOUT_MS));
-		if (last === "answered") return;
+		const outcome = await deps.probe(endpoint.host, endpoint.port, Math.min(remaining, 1e4));
+		if (outcome === "answered") return;
 		attempt++;
-		if (attempt % 4 === 0 && !await deps.isRunning(args.containerId)) throw await containerFailure(`The web function container exited before its server listened on AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
-		if (last === "refused") await deps.sleep(250);
+		if (deps.isAlive && attempt % 4 === 0 && !await deps.isAlive()) throw new MicrovmHookError("The MicroVM container exited before its application answered HTTP.", "LOCAL_START_MICROVM_EXITED");
+		if (outcome === "refused") await deps.sleep(250);
 	}
-	const authority = formatAuthority(args.host, args.port);
-	throw await containerFailure(last === "timeout" ? `The web function server on ${authority} accepted the connection but did not answer GET / within ${args.timeoutMs}ms — it is listening but slow to respond. Raise --timeout, or make / answer sooner (started ${args.label}).` : `The web function server never accepted an HTTP connection on ${authority} within ${args.timeoutMs}ms. It must listen on the host:port given in AWS_LAMBDA_HTTP_ENDPOINT (started ${args.label}).`, args.containerId, args.recent, deps.fetchLogs);
+	throw new MicrovmHookError(`The MicroVM application never answered HTTP on ${formatAuthority(endpoint.host, endpoint.port)} within ${timeoutMs}ms. With no /ready hook, cdk-local waits for the app to answer before driving the next hook; raise --timeout, or enable the /ready hook.`, "LOCAL_START_MICROVM_NOT_READY");
 }
-async function containerFailure(message, containerId, recent, fetchLogs = readContainerLogTail, code = "LOCAL_START_WEB_FUNCTION_NOT_READY") {
-	let lines = [];
-	try {
-		lines = await fetchLogs(containerId, 20);
-	} catch {
-		lines = [];
-	}
-	if (lines.length === 0) lines = recent.tail();
-	return new CdkLocalError(`${message}${lines.length > 0 ? ` Last ${lines.length} line(s) of container output:\n${lines.map((l) => `  ${displayToolOutput(l)}`).join("\n")}` : " The container printed nothing."}`, code);
+function timeoutField(hook) {
+	return `${hook.charAt(0).toUpperCase() + hook.slice(1)}TimeoutInSeconds, or --timeout when it is unset`;
 }
-function watchContainerExit(containerId) {
-	let stopped = false;
-	const proc = spawn$1(getDockerCmd(), ["wait", containerId], { stdio: [
-		"ignore",
-		"pipe",
-		"ignore"
-	] });
-	let out = "";
-	proc.stdout?.on("data", (c) => out += c.toString());
-	return {
-		exited: new Promise((resolveExit) => {
-			const done = () => {
-				if (stopped) return;
-				const code = Number.parseInt(out.trim(), 10);
-				resolveExit(Number.isNaN(code) ? void 0 : code);
-			};
-			proc.on("close", done);
-			proc.on("error", done);
-		}),
-		stop: () => {
-			stopped = true;
-			if (!proc.killed) proc.kill("SIGTERM");
-		}
-	};
+function bodySuffix(body) {
+	const trimmed = body.trim();
+	if (trimmed.length === 0) return "";
+	return ` Body: ${displayToolOutput(trimmed.length > 500 ? `${trimmed.slice(0, 500)}...` : trimmed)}`;
 }
-function probeHttp(host, port, timeoutMs) {
-	return new Promise((resolveProbe) => {
-		let timedOut = false;
-		let connected = false;
+function postHook(host, port, path, body, timeoutMs) {
+	return new Promise((resolvePost) => {
+		let settled = false;
+		const settle = (r) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			resolvePost(r);
+		};
+		const payload = body ?? "";
 		const req = request$2({
 			host,
 			port,
-			path: "/",
-			method: "GET",
-			timeout: timeoutMs,
-			headers: { connection: "close" }
+			path,
+			method: "POST",
+			headers: {
+				connection: "close",
+				"content-length": Buffer.byteLength(payload),
+				...body !== void 0 && { "content-type": "application/json" }
+			}
 		}, (res) => {
-			res.resume();
-			resolveProbe("answered");
+			const chunks = [];
+			let size = 0;
+			res.on("data", (c) => {
+				if (size < 64 * 1024) chunks.push(c);
+				size += c.length;
+			});
+			res.on("end", () => settle({
+				kind: "status",
+				status: res.statusCode ?? 0,
+				body: Buffer.concat(chunks).toString("utf-8")
+			}));
+			res.on("error", () => settle({
+				kind: "status",
+				status: res.statusCode ?? 0,
+				body: ""
+			}));
 		});
-		req.on("socket", (socket) => {
-			socket.once("connect", () => {
-				connected = true;
+		const timer = setTimeout(() => {
+			settle({ kind: "timeout" });
+			req.destroy();
+		}, timeoutMs);
+		req.on("error", () => settle({ kind: "refused" }));
+		req.end(payload);
+	});
+}
+const defaultHookDeps = {
+	post: postHook,
+	sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+	now: () => Date.now()
+};
+
+//#endregion
+//#region src/local/microvm-front-door.ts
+const MICROVM_CONTROL_PATH = "/_cdkl/microvm";
+const PROXY_PORT_HEADER = "x-aws-proxy-port";
+const MICROVM_WS_BASE_PROTOCOL = "lambda-microvms";
+const CLOSE_GRACE_MS = 1e3;
+function selectTargetPort(headers) {
+	const fromHeader = firstHeader(headers[PROXY_PORT_HEADER]);
+	const fromProtocol = fromHeader === void 0 ? subprotocols(headers).find((p) => p.startsWith(`${MICROVM_WS_BASE_PROTOCOL}.port.`)) : void 0;
+	const raw = fromHeader ?? (fromProtocol !== void 0 ? fromProtocol.slice(`${"lambda-microvms"}.port.`.length) : void 0);
+	if (raw === void 0) return {
+		ok: true,
+		port: MICROVM_DEFAULT_INGRESS_PORT
+	};
+	const trimmed = raw.trim();
+	const n = /^\d{1,5}$/.test(trimmed) ? Number(trimmed) : NaN;
+	if (!Number.isInteger(n) || n < 1 || n > 65535) return {
+		ok: false,
+		status: 400,
+		message: `Invalid ${fromHeader === void 0 ? "WebSocket subprotocol lambda-microvms.port." : "X-aws-proxy-port"} value '${trimmed.slice(0, 32)}': it must be a port number 1-65535.`
+	};
+	return {
+		ok: true,
+		port: n
+	};
+}
+function stripMicrovmProxyHeaders(headers) {
+	for (const name of Object.keys(headers)) if (name.toLowerCase().startsWith("x-aws-proxy-")) delete headers[name];
+	const offered = subprotocols(headers);
+	if (offered.length === 0) return false;
+	const kept = offered.filter((p) => !isMicrovmProtocol(p));
+	if (kept.length > 0) headers["sec-websocket-protocol"] = kept.join(", ");
+	else delete headers["sec-websocket-protocol"];
+	return offered.includes(MICROVM_WS_BASE_PROTOCOL);
+}
+function isMicrovmProtocol(p) {
+	return p === "lambda-microvms" || p.startsWith(`${"lambda-microvms"}.`);
+}
+function subprotocols(headers) {
+	const raw = headers["sec-websocket-protocol"];
+	const joined = Array.isArray(raw) ? raw.join(",") : raw;
+	if (!joined) return [];
+	return joined.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
+}
+function firstHeader(value) {
+	if (Array.isArray(value)) return value[0];
+	if (typeof value === "string") return value.split(",")[0];
+}
+function startMicrovmFrontDoor(opts) {
+	const logger = getLogger().child("microvm");
+	const bound = { port: opts.port };
+	const server = createServer((req, res) => {
+		handleRequest$1(req, res, opts, bound.port).catch((err) => {
+			logger.debug(`microvm front door error: ${err instanceof Error ? err.message : String(err)}`);
+			if (!res.headersSent) writeText(res, 502, "The MicroVM front door failed to forward the request.");
+			else res.destroy();
+		});
+	});
+	const upgraded = /* @__PURE__ */ new Set();
+	const track = (sock) => {
+		upgraded.add(sock);
+		sock.once("close", () => upgraded.delete(sock));
+	};
+	server.on("upgrade", (req, socket, head) => {
+		track(socket);
+		handleUpgrade(req, socket, head, opts, track).catch((err) => {
+			logger.debug(`microvm upgrade error: ${err instanceof Error ? err.message : String(err)}`);
+			writeRawHttpError(socket, 502, "The MicroVM front door failed to forward the upgrade.");
+		});
+	});
+	return new Promise((resolveStart, rejectStart) => {
+		server.once("error", rejectStart);
+		server.listen(opts.port, opts.host, () => {
+			server.off("error", rejectStart);
+			const address = server.address();
+			const port = typeof address === "object" && address !== null ? address.port : opts.port;
+			bound.port = port;
+			resolveStart({
+				port,
+				close: () => new Promise((resolveClose) => {
+					server.close(() => resolveClose());
+					server.closeIdleConnections();
+					for (const sock of upgraded) sock.end();
+					setTimeout(() => {
+						server.closeAllConnections();
+						for (const sock of upgraded) sock.destroy();
+					}, CLOSE_GRACE_MS).unref();
+				})
+			});
+		});
+	});
+}
+async function admit(opts) {
+	const id = opts.target.microvmId;
+	let state = opts.target.state();
+	if ((state === "suspended" || state === "suspending" || state === "resuming") && opts.autoResume) {
+		try {
+			await opts.target.resume();
+		} catch (err) {
+			const now = opts.target.state();
+			if (err instanceof MicrovmStateError && (now === "terminating" || now === "terminated")) return {
+				status: 503,
+				message: `MicroVM ${id} is ${now}.`
+			};
+			return {
+				status: 502,
+				message: `MicroVM ${id} could not be resumed for this request: ${err instanceof Error ? err.message : String(err)}`
+			};
+		}
+		state = opts.target.state();
+	}
+	if (state === "running") return void 0;
+	if (state === "terminating" || state === "terminated") return {
+		status: 503,
+		message: `MicroVM ${id} is ${state}.`
+	};
+	return {
+		status: 503,
+		message: `MicroVM ${id} is ${state}. Resume it with POST ${MICROVM_CONTROL_PATH}/resume (or start with --auto-resume to resume on the first request).`
+	};
+}
+async function handleRequest$1(req, res, opts, boundPort) {
+	const path = (req.url ?? "/").split("?")[0];
+	if (path === "/_cdkl/microvm" || path.startsWith(`${"/_cdkl/microvm"}/`)) {
+		const refusal = controlRequestRefusal(req.headers, opts.host, boundPort);
+		if (refusal !== void 0) {
+			req.resume();
+			writeText(res, 403, refusal);
+			return;
+		}
+		await handleControl(req, res, path, opts);
+		return;
+	}
+	const selection = selectTargetPort(req.headers);
+	if (!selection.ok) {
+		req.resume();
+		writeText(res, selection.status, selection.message);
+		return;
+	}
+	const upstream = opts.target.upstreamFor(selection.port);
+	if (!upstream) {
+		req.resume();
+		writeText(res, 403, notRoutableMessage(selection.port, opts.target));
+		return;
+	}
+	const refusal = await admit(opts);
+	if (refusal) {
+		req.resume();
+		writeText(res, refusal.status, refusal.message);
+		return;
+	}
+	const headers = { ...req.headers };
+	stripHopByHopHeaders(headers);
+	stripMicrovmProxyHeaders(headers);
+	await new Promise((resolveForward) => {
+		const proxyReq = request({
+			host: upstream.host,
+			port: upstream.port,
+			method: req.method,
+			path: req.url,
+			headers
+		}, (proxyRes) => {
+			const resHeaders = { ...proxyRes.headers };
+			stripHopByHopHeaders(resHeaders);
+			res.writeHead(proxyRes.statusCode ?? 502, resHeaders);
+			proxyRes.pipe(res);
+			proxyRes.on("end", resolveForward);
+			proxyRes.on("error", () => {
+				if (!res.writableEnded) res.destroy();
+				resolveForward();
 			});
 		});
-		req.on("timeout", () => {
-			timedOut = true;
-			req.destroy();
+		proxyReq.on("error", () => {
+			if (!res.headersSent) writeText(res, 502, `The application in MicroVM ${opts.target.microvmId} is not responding on port ${selection.port}.`);
+			else if (!res.writableEnded) res.destroy();
+			resolveForward();
 		});
-		req.on("error", () => resolveProbe(timedOut && connected ? "timeout" : "refused"));
-		req.end();
+		res.on("close", () => {
+			if (!res.writableEnded) proxyReq.destroy();
+			resolveForward();
+		});
+		req.pipe(proxyReq);
 	});
 }
-async function containerIsRunning(containerId) {
+async function handleControl(req, res, path, opts) {
+	req.resume();
+	const target = opts.target;
+	const action = path.slice(14).replace(/^\//, "");
+	if (action === "") {
+		if (req.method !== "GET" && req.method !== "HEAD") {
+			writeText(res, 405, `Use GET ${MICROVM_CONTROL_PATH}.`);
+			return;
+		}
+		writeJson(res, 200, {
+			microvmId: target.microvmId,
+			state: target.state(),
+			ports: target.routablePorts()
+		});
+		return;
+	}
+	if (action !== "suspend" && action !== "resume" && action !== "terminate") {
+		writeText(res, 404, `Unknown control action '${action.slice(0, 32)}'. Use POST ${MICROVM_CONTROL_PATH}/suspend, /resume or /terminate.`);
+		return;
+	}
+	if (req.method !== "POST") {
+		writeText(res, 405, `Use POST ${MICROVM_CONTROL_PATH}/${action}.`);
+		return;
+	}
+	try {
+		await (action === "suspend" ? target.suspend() : action === "resume" ? target.resume() : target.terminate());
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		writeText(res, err instanceof MicrovmStateError ? 409 : 502, message);
+		return;
+	}
+	writeJson(res, 200, {
+		microvmId: target.microvmId,
+		state: target.state()
+	});
+}
+const LOOPBACK_NAMES = [
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+];
+function isWildcard(host) {
+	return host === "0.0.0.0" || host === "::" || host === "[::]";
+}
+function isIpLiteral(name) {
+	return /^\d{1,3}(\.\d{1,3}){3}$/.test(name) || /^\[[0-9a-f:.]+\]$/i.test(name);
+}
+function controlRequestRefusal(headers, boundHost, boundPort) {
+	const fetchSite = firstHeader(headers["sec-fetch-site"])?.trim().toLowerCase();
+	if (fetchSite !== void 0 && fetchSite !== "same-origin" && fetchSite !== "none") return `Refusing a ${fetchSite} request to the MicroVM control endpoint: it accepts requests from this origin only (curl, or a page this front door served).`;
+	const host = (Array.isArray(headers.host) ? headers.host[0] : headers.host)?.trim().toLowerCase();
+	const m = host === void 0 ? null : /^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(host);
+	const name = m?.[1];
+	const port = m ? m[2] !== void 0 ? Number(m[2]) : 80 : NaN;
+	const bindName = boundHost.includes(":") && !boundHost.startsWith("[") ? `[${boundHost}]` : boundHost;
+	const loopbackBind = isWildcard(boundHost) || LOOPBACK_NAMES.includes(bindName.toLowerCase());
+	if (!(name !== void 0 && (name === bindName.toLowerCase() || loopbackBind && LOOPBACK_NAMES.includes(name) || isWildcard(boundHost) && isIpLiteral(name))) || port !== boundPort) return `Refusing a MicroVM control request whose Host header (${(host ?? "<none>").slice(0, 64)}) is not this front door's address.`;
+	const origin = firstHeader(headers.origin)?.trim().toLowerCase();
+	if (origin !== void 0 && origin !== `http://${host}`) return `Refusing a MicroVM control request from origin ${origin.slice(0, 64)}: it accepts requests from this origin only.`;
+}
+var MicrovmStateError = class MicrovmStateError extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MicrovmStateError";
+		Object.setPrototypeOf(this, MicrovmStateError.prototype);
+	}
+};
+async function handleUpgrade(req, clientSocket, head, opts, track) {
+	const selection = selectTargetPort(req.headers);
+	if (!selection.ok) {
+		writeRawHttpError(clientSocket, selection.status, selection.message);
+		return;
+	}
+	const upstream = opts.target.upstreamFor(selection.port);
+	if (!upstream) {
+		writeRawHttpError(clientSocket, 403, notRoutableMessage(selection.port, opts.target));
+		return;
+	}
+	const refusal = await admit(opts);
+	if (refusal) {
+		writeRawHttpError(clientSocket, refusal.status, refusal.message);
+		return;
+	}
+	const headers = { ...req.headers };
+	const offeredBase = stripMicrovmProxyHeaders(headers);
+	const appProtocolsLeft = headers["sec-websocket-protocol"] !== void 0;
+	const upstreamSocket = connect({
+		host: upstream.host,
+		port: upstream.port
+	});
+	track(upstreamSocket);
+	upstreamSocket.setNoDelay(true);
+	let connected = false;
+	let responseHead = Buffer.alloc(0);
+	upstreamSocket.on("connect", () => {
+		connected = true;
+		const lines = [`${req.method ?? "GET"} ${req.url ?? "/"} HTTP/${req.httpVersion}`];
+		for (const [name, value] of Object.entries(headers)) {
+			if (value === void 0) continue;
+			for (const v of Array.isArray(value) ? value : [value]) lines.push(`${name}: ${v}`);
+		}
+		upstreamSocket.write(`${lines.join("\r\n")}\r\n\r\n`);
+		if (head.length > 0) upstreamSocket.write(head);
+		clientSocket.pipe(upstreamSocket, { end: false });
+	});
+	const onHead = (chunk) => {
+		responseHead = Buffer.concat([responseHead, chunk]);
+		const end = responseHead.indexOf("\r\n\r\n");
+		if (end === -1 && responseHead.length < 64 * 1024) return;
+		upstreamSocket.pause();
+		upstreamSocket.off("data", onHead);
+		const out = end === -1 ? responseHead : Buffer.concat([Buffer.from(rewriteUpgradeResponseHead(responseHead.subarray(0, end).toString("latin1"), offeredBase && !appProtocolsLeft) + "\r\n\r\n", "latin1"), responseHead.subarray(end + 4)]);
+		responseHead = void 0;
+		clientSocket.write(out);
+		upstreamSocket.pipe(clientSocket);
+	};
+	upstreamSocket.on("data", onHead);
+	const closeBoth = () => {
+		if (!clientSocket.destroyed) clientSocket.destroy();
+		if (!upstreamSocket.destroyed) upstreamSocket.destroy();
+	};
+	let answered = false;
+	const answer502 = (why) => {
+		if (answered || clientSocket.destroyed) return;
+		answered = true;
+		writeRawHttpError(clientSocket, 502, `The application in MicroVM ${opts.target.microvmId} ${why} on port ${selection.port}.`);
+	};
+	upstreamSocket.on("end", () => clientSocket.unpipe(upstreamSocket));
+	upstreamSocket.on("error", () => {
+		if (!connected) return answer502("is not responding");
+		if (responseHead === void 0) closeBoth();
+	});
+	upstreamSocket.on("close", (hadError) => {
+		if (responseHead !== void 0) return answer502("closed the connection before answering the upgrade");
+		if (hadError) closeBoth();
+		else if (!clientSocket.writableEnded) clientSocket.end();
+	});
+	clientSocket.on("error", closeBoth);
+	clientSocket.on("end", () => {
+		if (!upstreamSocket.destroyed && !upstreamSocket.writableEnded) upstreamSocket.end();
+	});
+	clientSocket.on("close", () => {
+		if (!upstreamSocket.destroyed) upstreamSocket.destroy();
+	});
+}
+function rewriteUpgradeResponseHead(head, addBase) {
+	if (!addBase) return head;
+	const lines = head.split("\r\n");
+	if (!/^HTTP\/1\.[01] 101\b/.test(lines[0] ?? "")) return head;
+	if (lines.some((l) => /^sec-websocket-protocol\s*:/i.test(l))) return head;
+	return [...lines, `Sec-WebSocket-Protocol: ${MICROVM_WS_BASE_PROTOCOL}`].join("\r\n");
+}
+function notRoutableMessage(port, target) {
+	return `Port ${port} of MicroVM ${target.microvmId} is not reachable locally. cdk-local publishes 8080, Hooks.Port, the image's EXPOSE ports and every --proxy-port; published: ${target.routablePorts().join(", ")}.`;
+}
+function writeText(res, status, message) {
+	res.writeHead(status, { "content-type": "text/plain; charset=utf-8" });
+	res.end(`${message}\n`);
+}
+function writeJson(res, status, body) {
+	res.writeHead(status, { "content-type": "application/json" });
+	res.end(JSON.stringify(body));
+}
+
+//#endregion
+//#region src/local/microvm-runner.ts
+const execFileAsync = promisify$1(execFile$1);
+const DEFAULT_TERMINATE_HOOK_TIMEOUT_MS = 1e4;
+function microvmImageTag(artifact) {
+	return `${getEmbedConfig().resourceNamePrefix}-microvm-${artifact.assetHash.slice(0, 16).toLowerCase()}`;
+}
+async function buildMicrovmImage(opts) {
+	const tag = microvmImageTag(opts.artifact);
+	const parent = dirname$1(opts.artifact.contextDir);
+	getLogger().info(`Building MicroVM image ${tag}${opts.platform ? ` (platform=${opts.platform})` : ""}...`);
+	await buildDockerImage({ source: {
+		directory: basename$1(opts.artifact.contextDir),
+		...opts.noCache && { cacheDisabled: true }
+	} }, parent, {
+		tag,
+		...opts.platform !== void 0 && { platform: opts.platform },
+		assetOutdir: parent,
+		progressLabel: "Building MicroVM image",
+		wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for the MicroVM image's Dockerfile: ${stderr}`)
+	});
+	return tag;
+}
+async function readExposedPorts(image) {
 	try {
 		const { stdout } = await execFileAsync(getDockerCmd(), [
+			"image",
 			"inspect",
 			"-f",
-			"{{.State.Running}}",
-			containerId
+			"{{json .Config.ExposedPorts}}",
+			image
 		]);
-		return stdout.trim() === "true";
+		const parsed = JSON.parse(stdout.trim() || "null");
+		if (!parsed) return [];
+		return Object.keys(parsed).filter((k) => k.endsWith("/tcp") || !k.includes("/")).map((k) => Number(k.split("/")[0])).filter((n) => Number.isInteger(n) && n > 0 && n < 65536);
 	} catch {
-		return false;
+		return [];
 	}
 }
-function readContainerLogTail(containerId, lines, spawnFn = spawn$1) {
-	return new Promise((resolveLogs, rejectLogs) => {
-		const proc = spawnFn(getDockerCmd(), [
-			"logs",
-			"--tail",
-			String(lines),
-			containerId
-		], { stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		] });
-		const chunks = [];
-		let size = 0;
-		const take = (c) => {
-			if (size > 4 * 1024 * 1024) return;
-			chunks.push(c);
-			size += c.length;
+function planMicrovmPorts(hooksPort, exposed, extra) {
+	const out = [MICROVM_DEFAULT_INGRESS_PORT];
+	for (const p of [
+		...hooksPort !== void 0 ? [hooksPort] : [],
+		...exposed,
+		...extra
+	]) if (!out.includes(p)) out.push(p);
+	return out;
+}
+async function setContainerPaused(containerId, paused) {
+	try {
+		await execFileAsync(getDockerCmd(), [paused ? "pause" : "unpause", containerId]);
+	} catch (error) {
+		const err = error;
+		throw new CdkLocalError(`docker ${paused ? "pause" : "unpause"} failed: ${displayToolOutput(err.stderr?.trim() || err.message || String(error))}`, "LOCAL_START_MICROVM_PAUSE_FAILED");
+	}
+}
+const defaultDeps = {
+	setPaused: setContainerPaused,
+	remove: removeContainer
+};
+var LocalMicrovm = class {
+	microvmId;
+	containerId;
+	current = "booting";
+	resuming;
+	suspending;
+	paused = false;
+	terminating;
+	opts;
+	deps;
+	constructor(opts, deps = {}) {
+		this.opts = opts;
+		this.deps = {
+			...defaultDeps,
+			...deps
 		};
-		proc.stdout?.on("data", take);
-		proc.stderr?.on("data", take);
-		proc.on("error", rejectLogs);
-		proc.on("close", (code) => {
-			if (code !== 0) {
-				rejectLogs(/* @__PURE__ */ new Error(`docker logs exited ${code}`));
-				return;
+		this.microvmId = opts.microvmId;
+		this.containerId = opts.containerId;
+	}
+	state() {
+		return this.current === "booting" ? "resuming" : this.current;
+	}
+	upstreamFor(containerPort) {
+		return this.opts.ports.get(containerPort);
+	}
+	routablePorts() {
+		return [...this.opts.ports.keys()];
+	}
+	log(message) {
+		getLogger().info(`MicroVM ${this.microvmId}: ${message}`);
+	}
+	hookEndpoint() {
+		const port = this.opts.config.hooksPort;
+		const endpoint = port !== void 0 ? this.opts.ports.get(port) : void 0;
+		if (!endpoint) throw new CdkLocalError("The hooks port is not published.", "LOCAL_START_MICROVM_HOOK_FAILED");
+		return endpoint;
+	}
+	hookTimeoutMs(hook) {
+		const seconds = this.opts.config.hooks[hook]?.timeoutSeconds;
+		if (seconds !== void 0) return seconds * 1e3;
+		return hook === "terminate" ? DEFAULT_TERMINATE_HOOK_TIMEOUT_MS : this.opts.timeoutMs;
+	}
+	hookDeps() {
+		return {
+			...this.deps.hooks ?? defaultHookDeps,
+			...this.deps.isAlive && { isAlive: this.deps.isAlive }
+		};
+	}
+	async runtimeHook(hook, body) {
+		if (!this.opts.config.hooks[hook]) return false;
+		await callRuntimeHook(hook, this.hookEndpoint(), this.hookTimeoutMs(hook), body, this.hookDeps());
+		this.log(`/${hook} hook answered 200`);
+		return true;
+	}
+	async boot(runHookPayload) {
+		const { hooks } = this.opts.config;
+		const deps = this.hookDeps();
+		if (hooks.ready) {
+			const attempts = await pollBuildHook("ready", this.hookEndpoint(), this.hookTimeoutMs("ready"), deps);
+			this.log(`/ready hook answered 200 after ${attempts} attempt(s)`);
+		} else {
+			const port = this.opts.config.hooksPort ?? 8080;
+			const endpoint = this.opts.ports.get(port);
+			await (this.deps.waitForAnswer ?? waitForAppAnswer)(endpoint, this.opts.timeoutMs, {
+				probe: probeHttp,
+				sleep: deps.sleep,
+				now: deps.now,
+				...this.deps.isAlive && { isAlive: this.deps.isAlive }
+			});
+			this.log("application answered HTTP (no /ready hook)");
+		}
+		if (hooks.validate) {
+			const attempts = await pollBuildHook("validate", this.hookEndpoint(), this.hookTimeoutMs("validate"), deps);
+			this.log(`/validate hook answered 200 after ${attempts} attempt(s)`);
+		}
+		await this.runtimeHook("run", runHookBody(this.microvmId, runHookPayload));
+		if (this.current === "booting") this.current = "running";
+	}
+	async setPaused(paused) {
+		await this.deps.setPaused(this.containerId, paused);
+		this.paused = paused;
+	}
+	suspend() {
+		if (this.current !== "running") return Promise.reject(new MicrovmStateError(`MicroVM ${this.microvmId} is ${this.state()}; only a running MicroVM can be suspended.`));
+		this.current = "suspending";
+		this.suspending = (async () => {
+			try {
+				await this.runtimeHook("suspend");
+				await this.setPaused(true);
+			} catch (err) {
+				if (this.current === "suspending") this.current = "running";
+				throw err;
+			} finally {
+				this.suspending = void 0;
 			}
-			resolveLogs(Buffer.concat(chunks).toString().split("\n").map((l) => l.replace(/\r$/, "")).filter((l) => l.length > 0).slice(-lines));
-		});
-	});
-}
-const defaultReadyDeps = {
-	probe: probeHttp,
-	isRunning: containerIsRunning,
-	fetchLogs: readContainerLogTail,
-	sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
-	now: () => Date.now()
+			if (this.current === "suspending") {
+				this.current = "suspended";
+				this.log("suspended (container paused)");
+			}
+		})();
+		return this.suspending;
+	}
+	resume() {
+		if (this.current === "resuming" && this.resuming) return this.resuming;
+		if (this.current === "suspending" && this.suspending) return this.suspending.then(() => this.resume(), () => void 0);
+		if (this.current !== "suspended") return Promise.reject(new MicrovmStateError(`MicroVM ${this.microvmId} is ${this.state()}; only a suspended MicroVM can be resumed.`));
+		this.current = "resuming";
+		this.resuming = (async () => {
+			try {
+				await this.setPaused(false);
+				try {
+					await this.runtimeHook("resume");
+				} catch (err) {
+					if (this.current === "resuming") await this.setPaused(true).catch(() => void 0);
+					throw err;
+				}
+			} catch (err) {
+				if (this.current === "resuming") this.current = "suspended";
+				throw err;
+			} finally {
+				this.resuming = void 0;
+			}
+			if (this.current === "resuming") {
+				this.current = "running";
+				this.log("resumed");
+			}
+		})();
+		return this.resuming;
+	}
+	terminate() {
+		this.terminating ??= (async () => {
+			const wasBooting = this.current === "booting";
+			this.current = "terminating";
+			await Promise.allSettled([this.suspending, this.resuming].filter((p) => p !== void 0));
+			try {
+				if (this.paused) await this.setPaused(false).catch(() => void 0);
+				if (!wasBooting) await this.runtimeHook("terminate");
+			} catch (err) {
+				getLogger().warn(`MicroVM ${this.microvmId}: ${err instanceof Error ? err.message : String(err)} Removing its container anyway.`);
+			}
+			await this.deps.remove(this.containerId);
+			this.current = "terminated";
+			this.log("terminated (container removed)");
+			this.opts.onTerminated?.(this);
+		})();
+		return this.terminating;
+	}
 };
 
 //#endregion
-//#region src/cli/commands/local-start-web-function.ts
+//#region src/cli/commands/local-start-microvm.ts
 function parsePort(raw) {
 	const n = Number(raw);
 	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
 	return n;
 }
+function parseCount(raw) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 1 || n > 64) throw new InvalidArgumentError(`--count must be an integer 1-64, got '${raw}'.`);
+	return n;
+}
+function parseProxyPort(raw, previous) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 1 || n > 65535) throw new InvalidArgumentError(`--proxy-port must be an integer 1-65535, got '${raw}'.`);
+	return [...previous ?? [], n];
+}
 function connectHost(host) {
 	if (host === "0.0.0.0") return "127.0.0.1";
 	if (host === "::" || host === "[::]") return "::1";
 	return host;
 }
-async function localStartWebFunctionCommand(target, options, extraStateProviders, hostSynthesizer) {
+function readRunHookPayload(options, readFile = (p) => readFileSync$1(p, "utf-8")) {
+	if (options.runHookPayload !== void 0 && options.runHookPayloadFile !== void 0) throw new CdkLocalError("--run-hook-payload and --run-hook-payload-file are mutually exclusive.", "LOCAL_START_MICROVM_PAYLOAD_CONFLICT");
+	let payload = options.runHookPayload;
+	if (options.runHookPayloadFile !== void 0) try {
+		payload = readFile(options.runHookPayloadFile);
+	} catch (err) {
+		throw new CdkLocalError(`Cannot read --run-hook-payload-file ${displayUntrustedValue(options.runHookPayloadFile)}: ${err instanceof Error ? err.message : String(err)}`, "LOCAL_START_MICROVM_PAYLOAD_UNREADABLE");
+	}
+	if (payload !== void 0 && Buffer.byteLength(payload) > 16384) throw new CdkLocalError(`The run hook payload is ${Buffer.byteLength(payload)} bytes; run-microvm accepts at most ${MAX_RUN_HOOK_PAYLOAD_BYTES} (16 KB).`, "LOCAL_START_MICROVM_PAYLOAD_TOO_LARGE");
+	return payload;
+}
+function buildMicrovmLambdaView(resolved, config) {
+	return {
+		kind: "zip",
+		stack: resolved.stack,
+		logicalId: resolved.logicalId,
+		resource: {
+			Type: resolved.resource.Type,
+			Properties: { Environment: { Variables: config.environment } },
+			...resolved.resource.Metadata !== void 0 && { Metadata: resolved.resource.Metadata }
+		},
+		memoryMb: 128,
+		timeoutSec: 0,
+		layers: [],
+		runtime: "",
+		handler: "",
+		codePath: null,
+		architecture: config.architecture ?? "arm64"
+	};
+}
+const LAMBDA_RUNTIME_ENV_KEYS = [
+	"AWS_LAMBDA_FUNCTION_NAME",
+	"AWS_LAMBDA_FUNCTION_MEMORY_SIZE",
+	"AWS_LAMBDA_FUNCTION_TIMEOUT",
+	"AWS_LAMBDA_FUNCTION_VERSION",
+	"AWS_LAMBDA_LOG_GROUP_NAME",
+	"AWS_LAMBDA_LOG_STREAM_NAME"
+];
+function finalizeMicrovmEnv(lambdaEnv, declared) {
+	const env = { ...lambdaEnv };
+	for (const key of LAMBDA_RUNTIME_ENV_KEYS) if (!Object.hasOwn(declared, key)) delete env[key];
+	return env;
+}
+function microvmFidelityWarnings(config) {
+	const image = displayIdent(config.logicalId);
+	const out = [
+		`MicroVM image ${image}: each MicroVM is a Docker container started fresh from the built image, not a MicroVM restored from a snapshot — state the app initializes before /ready answers 200 is NOT shared across MicroVMs (each one runs its own startup), and there is no VM isolation or memory checkpoint (suspend is docker pause).`,
+		`MicroVM image ${image}: requests are accepted without X-aws-proxy-auth — the JWE token the cloud endpoint requires is not checked locally (the header is still stripped).`,
+		`MicroVM image ${image}: the idle policy is not emulated — a MicroVM suspends, resumes and terminates only through ${MICROVM_CONTROL_PATH}/suspend|resume|terminate (and --auto-resume).`,
+		`MicroVM image ${image}: the Dockerfile is built by the local Docker engine, not on the Lambda-managed MicroVM base OS (BaseImageArn).`
+	];
+	if (config.hooks.validate) out.push(`MicroVM image ${image}: /validate is called on the same container as /ready (the cloud calls it on a fresh MicroVM started from the built snapshot).`);
+	for (const what of config.unemulated) out.push(`MicroVM image ${image}: ${what} is not emulated.`);
+	return out;
+}
+async function localStartMicrovmCommand(target, options, extraStateProviders, hostSynthesizer) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
-	let containerId;
-	let stopLogs;
-	let exitWatch;
-	let artifact;
+	const runHookPayload = readRunHookPayload(options);
+	const vms = [];
+	const frontDoors = /* @__PURE__ */ new Map();
+	const logStops = [];
+	const exitWatches = [];
+	const bareContainers = /* @__PURE__ */ new Set();
 	let runInFlight;
+	let containerName;
+	let artifact;
 	let teardownPromise;
 	let shuttingDown = false;
 	let waitingOnRun = false;
-	let containerName;
 	const forever = () => new Promise(() => void 0);
 	const doTeardown = async () => {
-		exitWatch?.stop();
-		if (containerId === void 0 && runInFlight !== void 0) {
+		for (const w of exitWatches) w.stop();
+		if (runInFlight !== void 0) {
 			waitingOnRun = true;
 			try {
-				containerId = await runInFlight;
+				bareContainers.add(await runInFlight);
 			} catch {} finally {
 				waitingOnRun = false;
 			}
 		}
-		if (stopLogs) try {
-			stopLogs();
+		await Promise.allSettled(vms.map((vm) => vm.terminate()));
+		for (const vm of vms) bareContainers.delete(vm.containerId);
+		await Promise.allSettled([...bareContainers].map((id) => removeContainer(id)));
+		await Promise.allSettled([...frontDoors.values()].map((fd) => fd.close()));
+		for (const stop of logStops) try {
+			stop();
 		} catch (err) {
 			logger.debug(`streamLogs stop failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
-		if (containerId) await removeContainer(containerId);
-		disposeWebFunctionArtifact(artifact);
+		disposeMicrovmCodeArtifact(artifact);
 	};
 	const teardown = () => teardownPromise ??= doTeardown();
 	await applyRoleArnIfSet({
@@ -25864,107 +27374,155 @@ async function localStartWebFunctionCommand(target, options, extraStateProviders
 		...Object.keys(context).length > 0 && { context }
 	};
 	const { stacks } = await synthesizer.synthesize(synthOpts);
-	const resolved = resolveWebFunctionTarget(await resolveSingleTarget(target, {
-		entries: listTargets(stacks).webFunctions,
-		message: "Select a Lambda web function to serve",
-		noun: "Lambda web functions",
-		onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} start-web-function requires a <target> (a WebFunction, WebFunctionEndpoint or WebFunctionRevision display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_START_WEB_FUNCTION_TARGET_REQUIRED")
-	}), stacks, options.revision);
-	const code = parseWebFunctionBuildConfig(resolved.revisionLogicalId, resolved.revision.Properties?.["BuildConfig"]);
-	const spec = resolveWebFunctionRuntime(code.runtime);
-	const selectionNote = {
-		"target-revision": "the target revision",
-		"revision-flag": "--revision",
-		"endpoint-weight": `highest weight on endpoint ${displayIdent(resolved.endpoint?.logicalId ?? "")}`,
-		"only-revision": "the function's only revision"
-	};
-	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.revisionLogicalId}`)} (${spec.runtime}; revision chosen by ${selectionNote[resolved.selection]})`);
-	const serviceConfig = readWebFunctionServiceConfig(resolved.revision);
-	for (const line of webFunctionFidelityWarnings(resolved, serviceConfig)) logger.warn(line);
-	artifact = await resolveWebFunctionArtifact(resolved.stack, resolved.revisionLogicalId, code);
+	const resolved = resolveMicrovmImageTarget(await resolveSingleTarget(target, {
+		entries: listTargets(stacks).microvmImages,
+		message: "Select a Lambda MicroVM image to run",
+		noun: "Lambda MicroVM images",
+		onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} start-microvm requires a <target> (a MicrovmImage display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_START_MICROVM_TARGET_REQUIRED")
+	}), stacks);
+	const config = readMicrovmImageConfig(resolved.logicalId, resolved.resource);
+	const platform = options.platform ?? (config.architecture !== void 0 ? architectureToPlatform(config.architecture) : void 0);
+	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.logicalId}`)} (MicroVM image ${displayIdent(config.name)}; hooks: ${Object.keys(config.hooks).join(", ") || "none"}${platform ? `; ${platform}` : ""})`);
+	for (const line of microvmFidelityWarnings(config)) logger.warn(line);
+	artifact = await resolveMicrovmCodeArtifact(resolved.stack, config);
 	const shutdown = async (signal, exitCode) => {
 		if (shuttingDown) {
 			if (!waitingOnRun) {
-				logger.info(`Received ${signal} again; still removing the container, please wait...`);
+				logger.info(`Received ${signal} again; still terminating the MicroVMs, please wait...`);
 				return;
 			}
-			disposeWebFunctionArtifact(artifact);
+			disposeMicrovmCodeArtifact(artifact);
 			logger.warn(`Received ${signal} again; exiting without waiting for docker run to return. The container may still be starting, and its environment holds the forwarded AWS credentials. Remove it by its name (this works even if it is created after this exit): docker rm -f ${containerName ?? "<name>"}`);
 			process.exit(signal === "SIGINT" ? 130 : 143);
 			return;
 		}
 		shuttingDown = true;
-		logger.info(`Received ${signal}, shutting down...`);
+		logger.info(`Received ${signal}, terminating ${vms.length} MicroVM(s)...`);
 		await teardown();
 		process.exit(exitCode);
 	};
 	process.on("SIGINT", () => void shutdown("SIGINT", 130));
 	process.on("SIGTERM", () => void shutdown("SIGTERM", 0));
-	const recent = new RecentOutput();
+	const recents = /* @__PURE__ */ new Map();
+	let allTerminated;
+	const everyVmTerminated = new Promise((r) => allTerminated = r);
+	const checkAllTerminated = () => {
+		if (vms.length === options.count && vms.every((v) => v.state() === "terminated")) allTerminated();
+	};
+	let unexpectedExit;
+	const anyUnexpectedExit = new Promise((r) => unexpectedExit = r);
+	const probeHost = connectHost(options.host);
 	try {
-		const assumeRole = webFunctionAssumeRole(options.assumeRole, serviceConfig);
-		const containerEnv = await resolveLambdaContainerEnv(buildWebFunctionLambdaView(resolved, serviceConfig, spec.runtime), {
+		const containerEnv = await resolveLambdaContainerEnv(buildMicrovmLambdaView(resolved, config), {
 			...options,
-			...assumeRole !== void 0 && { assumeRole },
 			deployedFunctionLookups: false
 		}, profileCredentials, extraStateProviders);
-		const { env, replacedHttpEndpoint } = finalizeWebFunctionEnv(containerEnv.env, {
-			functionName: resolved.functionName,
-			containerPort: WEB_FUNCTION_CONTAINER_PORT,
-			timeoutSeconds: serviceConfig.timeoutSeconds,
-			logGroup: serviceConfig.logGroup
-		});
-		if (replacedHttpEndpoint) logger.warn(`The revision's ${WEB_FUNCTION_HTTP_ENDPOINT_ENV} is replaced with 0.0.0.0:${WEB_FUNCTION_CONTAINER_PORT}: the runtime owns that variable, and the local port is published to it.`);
-		const plan = planWebFunctionContainer(artifact, spec, env);
-		const platform = options.platform ?? defaultWebFunctionPlatform(spec);
-		await pullImage(plan.image, options.pull === false, platform);
-		if (teardownPromise) return await forever();
-		const hostPort = options.port === 0 ? await pickFreePort() : options.port;
-		const name = containerName = `${getEmbedConfig().resourceNamePrefix}-webfn-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
-		logger.info(`Starting web function container (image=${plan.image}, start=${plan.label}, port=${hostPort} -> ${WEB_FUNCTION_CONTAINER_PORT})...`);
-		runInFlight = startWebFunctionContainer({
-			plan,
-			env,
-			sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys),
-			host: options.host,
-			hostPort,
+		const env = finalizeMicrovmEnv(containerEnv.env, config.environment);
+		const image = await buildMicrovmImage({
+			artifact,
 			platform,
-			name
+			noCache: options.buildCache === false
 		});
-		const id = await runInFlight;
 		if (teardownPromise) return await forever();
-		containerId = id;
-		stopLogs = streamLogs(id, { onOutput: (chunk) => recent.push(chunk) });
-		exitWatch = watchContainerExit(id);
-		const probeHost = connectHost(options.host);
-		await waitForWebFunctionReady({
-			containerId: id,
-			host: probeHost,
-			port: hostPort,
-			timeoutMs: options.timeout,
-			recent,
-			label: plan.label
-		});
-		logger.info(`Server listening on http://${formatAuthority(probeHost, hostPort)}  (${displayIdent(resolved.functionName)} (Lambda web function))`);
-		logger.info("Press ^C to shut down.");
+		const containerPorts = planMicrovmPorts(config.hooksPort, await readExposedPorts(image), options.proxyPort ?? []);
+		logger.info(`Publishing container ports ${containerPorts.join(", ")} to the front door(s).`);
+		for (let i = 0; i < options.count; i++) {
+			const microvmId = generateMicrovmId();
+			const hostPorts = /* @__PURE__ */ new Map();
+			for (const cp of containerPorts) hostPorts.set(cp, {
+				host: "127.0.0.1",
+				port: await pickFreePort()
+			});
+			const [first, ...rest] = containerPorts;
+			const name = containerName = `${getEmbedConfig().resourceNamePrefix}-microvm-${process.pid}-${i}-${Math.random().toString(36).slice(2, 8)}`;
+			logger.info(`Starting MicroVM ${microvmId} (container ${name})...`);
+			runInFlight = runDetached({
+				image,
+				mounts: [],
+				env,
+				...containerEnv.sensitiveEnvKeys.length > 0 && { sensitiveEnvKeys: new Set(containerEnv.sensitiveEnvKeys) },
+				cmd: [],
+				hostPort: hostPorts.get(first).port,
+				containerPort: first,
+				extraPorts: rest.map((cp) => ({
+					hostPort: hostPorts.get(cp).port,
+					containerPort: cp
+				})),
+				host: "127.0.0.1",
+				...platform !== void 0 && { platform },
+				name,
+				autoRemove: false
+			});
+			const containerId = await runInFlight;
+			runInFlight = void 0;
+			bareContainers.add(containerId);
+			if (teardownPromise) return await forever();
+			const recent = new RecentOutput();
+			recents.set(containerId, recent);
+			logStops.push(streamLogs(containerId, {
+				onOutput: (chunk) => recent.push(chunk),
+				...options.count > 1 && { prefix: `[${microvmId.slice(0, 12)}] ` }
+			}));
+			const watch = watchContainerExit(containerId);
+			exitWatches.push(watch);
+			let exited = false;
+			const vm = new LocalMicrovm({
+				microvmId,
+				containerId,
+				ports: hostPorts,
+				config,
+				timeoutMs: options.timeout,
+				onTerminated: checkAllTerminated
+			}, { isAlive: async () => !exited });
+			vms.push(vm);
+			bareContainers.delete(containerId);
+			watch.exited.then((code) => {
+				exited = true;
+				const s = vm.state();
+				if (s !== "terminating" && s !== "terminated") unexpectedExit({
+					vm,
+					code
+				});
+			});
+			await vm.boot(runHookPayload);
+			if (teardownPromise) return await forever();
+			const fd = await startMicrovmFrontDoor({
+				host: options.host,
+				port: options.port === 0 ? 0 : options.port + i,
+				target: vm,
+				autoResume: options.autoResume === true
+			});
+			frontDoors.set(vm, fd);
+			const base = `http://${formatAuthority(probeHost, fd.port)}`;
+			logger.info(`MicroVM ${microvmId} listening on ${base}  (control: ${base}${MICROVM_CONTROL_PATH})`);
+		}
+		logger.info("Press ^C to terminate the MicroVM(s).");
+		checkAllTerminated();
 	} catch (err) {
 		if (shuttingDown) return await forever();
+		const failed = vms.at(-1);
+		const wrapped = err instanceof MicrovmHookError && failed ? await containerFailure(err.message, failed.containerId, recents.get(failed.containerId) ?? new RecentOutput()).then((f) => new CdkLocalError(f.message, err.code)) : err;
 		await teardown();
-		throw err;
+		throw wrapped;
+	}
+	const outcome = await Promise.race([everyVmTerminated.then(() => void 0), anyUnexpectedExit]);
+	if (shuttingDown) return await forever();
+	if (outcome === void 0) {
+		logger.info("Every MicroVM is terminated; shutting down.");
+		await teardown();
+		return;
 	}
-	if (!exitWatch || !containerId) return await forever();
-	const exitCode = await exitWatch.exited;
-	if (shuttingDown || teardownPromise) return await forever();
-	const failure = await containerFailure(`The web function container exited (exit code ${exitCode ?? "unknown"}) while serving.`, containerId, recent, void 0, "LOCAL_START_WEB_FUNCTION_EXITED");
+	if (teardownPromise) return await forever();
+	const failure = await containerFailure(`MicroVM ${outcome.vm.microvmId}'s container exited (exit code ${outcome.code ?? "unknown"}) while running.`, outcome.vm.containerId, recents.get(outcome.vm.containerId) ?? new RecentOutput());
 	await teardown();
-	throw failure;
+	throw new CdkLocalError(failure.message, "LOCAL_START_MICROVM_EXITED");
 }
-function createLocalStartWebFunctionCommand(opts = {}) {
+function createLocalStartMicrovmCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("start-web-function").description("Serve an AWS Lambda Web Function locally. Resolves a WebFunction, WebFunctionEndpoint or WebFunctionRevision target to one revision (an endpoint serves its highest-weight revision; --revision overrides), runs its code bundle from cdk.out in a container whose server listens on AWS_LAMBDA_HTTP_ENDPOINT, and publishes it on a local port with the revision's ServiceConfig environment. Target accepts a CDK display path or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C.").argument("[target]", "CDK display path or stack-qualified logical ID of the WebFunction / WebFunctionEndpoint / WebFunctionRevision (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
-		await localStartWebFunctionCommand(target, options, opts.extraStateProviders, opts.synthesizer);
+	const cmd = new Command("start-microvm").description("Run AWS Lambda MicroVMs locally. Builds a MicrovmImage code artifact (a Dockerfile plus the app, from cdk.out) once, starts --count containers with its EnvironmentVariables, drives the /ready, /validate and /run lifecycle hooks in the cloud order, and serves each MicroVM on its own local URL: X-aws-proxy-port / lambda-microvms.port.N routing (default 8080), X-aws-proxy-* stripping, and a control endpoint for suspend / resume / terminate. Target accepts a CDK display path or stack-qualified logical ID; single-stack apps may omit the prefix. Omit <target> in a TTY to pick from a list. Runs until ^C, which calls /terminate.").argument("[target]", "CDK display path or stack-qualified logical ID of the MicrovmImage (omit to pick interactively in a TTY)").action(withErrorHandling(async (target, options) => {
+		await localStartMicrovmCommand(target, options, opts.extraStateProviders, opts.synthesizer);
 	}));
-	addStartWebFunctionSpecificOptions(cmd);
+	addStartMicrovmSpecificOptions(cmd);
 	[
 		...commonOptions(),
 		...appOptions(),
@@ -25973,8 +27531,8 @@ function createLocalStartWebFunctionCommand(opts = {}) {
 	cmd.addOption(regionOption);
 	return cmd;
 }
-function addStartWebFunctionSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--revision <logicalId>", "Serve this WebFunctionRevision (logical ID) instead of the one the endpoint weights pick.")).addOption(new Option("--port <n>", "Local port to serve on. Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Address to publish the port on.").default("127.0.0.1")).addOption(new Option("--platform <platform>", "docker --platform for the server container. Defaults to the runtime's cloud architecture (linux/arm64 for nodejs24.x).").choices(["linux/amd64", "linux/arm64"])).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"RevisionLogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--no-pull", "Skip docker pull of the runtime base image (use the cached image)")).addOption(new Option("--timeout <ms>", "Maximum time in milliseconds to wait for the server to answer HTTP. Default 60000.").default(6e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role [arn]", "Assume the revision's execution role and forward STS-issued temp credentials to the container. (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) uses the revision's ServiceConfig.ExecutionRoleArn: a literal ARN as written, or the Fn::GetAtt / Ref CDK synthesizes resolved against --from-cfn-stack deployed state; (3) `--no-assume-role` opts out. Off by default.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
+function addStartMicrovmSpecificOptions(cmd) {
+	return cmd.addOption(new Option("--count <n>", "Number of independent MicroVMs to run, each with its own URL.").default(1).argParser(parseCount)).addOption(new Option("--run-hook-payload <string>", "The runHookPayload string delivered to each MicroVM's /run hook (max 16 KB).")).addOption(new Option("--run-hook-payload-file <path>", "Read the runHookPayload from a file (mutually exclusive with --run-hook-payload).")).addOption(new Option("--port <n>", "Local port of the first MicroVM; MicroVM i listens on <n>+i. Default 0 (OS-assigned).").default(0).argParser(parsePort)).addOption(new Option("--host <ip>", "Address the MicroVM URLs listen on.").default("127.0.0.1")).addOption(new Option("--platform <platform>", "docker --platform for the build and the containers. Defaults to the image's CpuConfigurations architecture.").choices(["linux/amd64", "linux/arm64"])).addOption(new Option("--proxy-port <port>", "An extra container port X-aws-proxy-port may route to (repeatable). 8080, Hooks.Port and the image's EXPOSE ports are always routable.").argParser(parseProxyPort)).addOption(new Option("--auto-resume", "Resume a suspended MicroVM on its next request instead of answering 503 (autoResumeEnabled).")).addOption(new Option("--no-build-cache", "Build the image with docker build --no-cache.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"MicrovmImageLogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--timeout <ms>", "Default deadline in milliseconds for each hook without its own <Hook>TimeoutInSeconds (/terminate defaults to 10000), and for the app to answer HTTP when there is no /ready hook. Default 60000.").default(6e4).argParser(parseTimeoutMs)).addOption(new Option("--assume-role <arn>", "Assume this role (the MicroVM's execution role, a run-microvm parameter rather than part of the template) and forward STS-issued temp credentials to the containers. Off by default: the shell credentials are forwarded.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Bare form uses the resolved stack name.")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region."));
 }
 
 //#endregion
@@ -26003,7 +27561,7 @@ async function localListCommand(options) {
 	process.stdout.write(`${formatTargetListing(listing, getEmbedConfig().cliName, { long: options.long })}\n`);
 }
 function formatTargetListing(listing, cliName, options = {}) {
-	if (countTargets(listing) === 0) return `No runnable targets (Lambda functions, APIs, ECS services / tasks, AgentCore Runtimes, load balancers, CloudFront distributions, Lambda web functions) found in this CDK app.`;
+	if (countTargets(listing) === 0) return `No runnable targets (Lambda functions, APIs, ECS services / tasks, AgentCore Runtimes, load balancers, CloudFront distributions, Lambda web functions, Lambda MicroVM images) found in this CDK app.`;
 	const long = options.long ?? false;
 	return "\n" + [
 		formatSection("Lambda Functions", `${cliName} invoke <target>`, listing.lambdas, long),
@@ -26013,7 +27571,8 @@ function formatTargetListing(listing, cliName, options = {}) {
 		formatSection("AgentCore Runtimes", `${cliName} invoke-agentcore <target>`, listing.agentCoreRuntimes, long),
 		formatSection("Application Load Balancers", `${cliName} start-alb <target...>`, listing.loadBalancers, long),
 		formatSection("CloudFront Distributions", `${cliName} start-cloudfront <target>`, listing.cloudFrontDistributions, long),
-		formatSection("Lambda Web Functions", `${cliName} start-web-function <target>`, listing.webFunctions, long)
+		formatSection("Lambda Web Functions", `${cliName} start-web-function <target>`, listing.webFunctions, long),
+		formatSection("Lambda MicroVM Images", `${cliName} start-microvm <target>`, listing.microvmImages, long)
 	].filter((lines) => lines.length > 0).map((lines) => lines.join("\n")).join("\n\n");
 }
 function formatSection(title, command, entries, long) {
@@ -31289,5 +32848,5 @@ function addStudioSpecificOptions(cmd) {
 }
 
 //#endregion
-export { WEB_FUNCTION_TYPE as $, AgentCoreResolutionError as $i, invokeAgentCore as $n, pickResponseTemplate as $r, parseLbPortOverrides as $t, containerFailure as A, resolveCfnRegion as Ai, listPinnedTargets as An, buildCognitoJwksUrl as Ar, buildEdgeRequestEvent as At, webFunctionAssumeRole as B, discoverWebSocketApis as Bi, bridgeAgentCoreWs as Bn, invokeTokenAuthorizer as Br, pickLambdaEdgeFunctionLogicalId as Bt, addListSpecificOptions as C, workloadClientConfig as Ca, substituteEnvVarsFromState as Ci, mergeForService as Cn, filterRoutesByApiIdentifiers as Cr, matchBehavior as Ct, createLocalStartWebFunctionCommand as D, buildProxyClientConfig as Da, isCfnFlagPresent as Di, describePinnedImageUri as Dn, resolveSelectionExpression as Dr, serveLambdaUrlOrigin as Dt, addStartWebFunctionSpecificOptions as E, resolveProfileCredentials as Ea, createLocalStateProvider as Ei, runImageOverrideBuilds as En, startApiServer as Er, serveFromStaticOrigin as Et, watchContainerExit as F, resolveWatchConfig as Fi, setShadowReadyTimeoutMs as Fn, verifyJwtViaDiscovery as Fr, describeS3OriginDomain as Ft, resolveWebFunctionRuntime as G, discoverRoutes as Gi, MCP_CONTAINER_PORT as Gn, isFunctionUrlOacFronted as Gr, runViewerResponse as Gt, WEB_FUNCTION_RUNTIMES as H, filterWebSocketApisByIdentifiers as Hi, A2A_CONTAINER_PORT as Hn, applyCorsResponseHeaders as Hr, resolveCloudFrontDistribution as Ht, WEB_FUNCTION_HTTP_ENDPOINT_ENV as I, resolveSingleTarget as Ii, getContainerNetworkIp as In, buildMethodArn as Ir, extractKvsAssociations as It, findFileAssetForObjectKey as J, AGENTCORE_A2A_PROTOCOL as Ji, mcpInvokeOnce as Jn, translateLambdaResponse as Jr, createLocalFileKvsDataSource as Jt, supportedWebFunctionRuntimes as K, pickRefLogicalId as Ki, MCP_PATH as Kn, matchPreflight as Kr, stripCloudFrontImport as Kt, buildWebFunctionLambdaView as L, countTargets as Li, attachContainerLogStreamer as Ln, computeRequestIdentityHash as Lr, isCloudFrontDistribution as Lt, readContainerLogTail as M, CfnLocalStateProvider as Mi, CloudMapRegistry as Mn, createJwksCache as Mr, edgeHeadersToHttp as Mt, startWebFunctionContainer as N, collectSsmParameterRefs as Ni, DEFAULT_SHADOW_READY_TIMEOUT_MS as Nn, verifyCognitoJwt as Nr, httpHeadersToEdge as Nt, RecentOutput as O, isProxyEnvConfigured as Oa, rejectExplicitCfnStackWithMultipleStacks as Oi, imageOverrideKeyAliases as On, resolveServiceIntegrationParameters as Or, applyEdgeRequestResult as Ot, waitForWebFunctionReady as P, resolveSsmParameters as Pi, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Pn, verifyJwtAuthorizer as Pr, CLOUDFRONT_DISTRIBUTION_TYPE as Pt, WEB_FUNCTION_REVISION_TYPE as Q, AGENTCORE_RUNTIME_TYPE as Qi, AGENTCORE_SESSION_ID_HEADER as Qn, evaluateResponseParameters as Qr, createLocalStartAlbCommand as Qt, finalizeWebFunctionEnv as R, listTargets as Ri, addInvokeAgentCoreSpecificOptions as Rn, evaluateCachedLambdaPolicy as Rr, pickFunctionUrlLogicalIdFromOrigin as Rt, StudioEventBus as S, resetWorkloadIdentity as Sa, substituteAgainstStateAsync as Si, enforceImageOverrideOrphans as Sn, filterRoutesByApiIdentifier as Sr, createS3OriginReader as St, formatTargetListing as T, buildStsClientConfig as Ta, LocalStateSourceError as Ti, resolveImageOverrides as Tn, readMtlsMaterialsFromDisk as Tr, resolveErrorResponseCandidates as Tt, buildNodeEntryFileStart as U, parseSelectionExpressionPath as Ui, A2A_PATH as Un, buildCorsConfigByApiId as Ur, compileCloudFrontFunction as Ut, webFunctionFidelityWarnings as V, discoverWebSocketApisOrThrow as Vi, invokeAgentCoreWs as Vn, attachAuthorizers as Vr, pickTargetFunctionLogicalId as Vt, defaultWebFunctionPlatform as W, webSocketApiMatchesIdentifier as Wi, a2aInvokeOnce as Wn, buildCorsConfigFromCloudFrontChain as Wr, runViewerRequest as Wt, resolveWebFunctionArtifact as X, AGENTCORE_HTTP_PROTOCOL as Xi, AGENTCORE_SIGV4_SERVICE as Xn, buildHttpApiV2Event as Xr, addAlbSpecificOptions as Xt, parseWebFunctionBuildConfig as Y, AGENTCORE_AGUI_PROTOCOL as Yi, parseSseForJsonRpc as Yn, applyAuthorizerOverlay as Yr, createUnboundCloudFrontModule as Yt, WEB_FUNCTION_ENDPOINT_TYPE as Z, AGENTCORE_MCP_PROTOCOL as Zi, signAgentCoreInvocation as Zn, buildRestV1Event as Zr, albStrategy as Zt, filterStudioTargetGroups as _, SECOND_ASSUME_MESSAGE as _a, resolveRuntimeCodeMountPath as _i, resolveSharedSidecarCredentials as _n, attachStageContext as _r, resolveKvsModulesForDistribution as _t, createLocalStudioCommand as a, tryResolveImageFnJoin as aa, probeHostGatewaySupport as ai, serviceStrategy as an, computeCodeImageTag as ar, selectServeInboundAuth as at, renderStudioHtml as b, readEnvCallerCredentials as ba, EcsTaskResolutionError as bi, buildImageOverrideTag as bn, resolveEnvVars$1 as br, resolveDeployedOriginBucket as bt, startStudioProxy as c, DynamicReferenceResolver as ca, ConnectionRegistry as ci, MAX_TASKS_SUBNET_RANGE_CAP as cn, classifySourceChange as cr, startAgentCoreWsBridge as ct, createStudioDispatcher as d, firstUsableRegion as da, parseConnectionsPath as di, addImageOverrideOptions as dn, addStartApiSpecificOptions as dr, createLocalStartCloudFrontCommand as dt, pickAgentCoreCandidateStack as ea, selectIntegrationResponse as ei, resolveAlbTarget as en, waitForAgentCoreHttpReady as er, WebFunctionResolutionError as et, filterStudioCustomResources as f, keysNotFromTemplate as fa, buildConnectEvent as fi, buildEcsImageResolutionContext$1 as fn, createLocalStartApiCommand as fr, normalizeKvsFileKeys as ft, annotatePinnedEcsTargets as g, withoutKeys as ga, buildContainerImage as gi, resolveEcsAssumeRoleOption as gn, createFileWatcher as gr, idFromArn as gt, annotateEcsTaskPinnedTargets as h, resolveDynamicReferencesInEnv as ha, architectureToPlatform as hi, parseRestartPolicy as hn, createAuthorizerCache as hr, resolveCloudFrontTarget as ht, coerceStopRequest as i, substituteImagePlaceholders as ia, HOST_GATEWAY_MIN_VERSION as ii, createLocalStartServiceCommand as in, buildAgentCoreCodeImage as ir, buildAgentCoreServeAuthCheck as it, planWebFunctionContainer as j, resolveCfnStackName as ji, buildCloudMapIndex as jn, buildJwksUrlFromIssuer as jr, buildEdgeResponseEvent as jt, WEB_FUNCTION_CONTAINER_PORT as k, resolveCfnFallbackRegion as ki, isLocalCdkAssetImage as kn, defaultCredentialsLoader as kr, applyEdgeResponseResult as kt, relayServeRequest as l, containsDynamicReference as la, buildMgmtEndpointEnvUrl as li, addCommonEcsServiceOptions as ln, addInvokeSpecificOptions as lr, LocalStartCloudFrontError as lt, annotateAlbPinnedBackingServices as m, parseDynamicReference as ma, buildMessageEvent as mi, parseMaxTasks as mn, resolveApiTargetSubset as mr, parseOriginOverrides as mt, coerceRunRequest as n, derivePseudoParametersFromRegion as na, VtlEvaluationError as ni, resolveAlbFrontDoor as nn, downloadAndExtractS3Bundle as nr, addStartAgentCoreSpecificOptions as nt, resolveServeBaseUrl as o, LocalInvokeBuildError as oa, resolveHostGatewayExtraHosts as oi, addRunTaskSpecificOptions as on, renderCodeDockerfile as or, startAgentCoreHttpServer as ot, isCustomResourceLambdaTarget as p, keysOverriddenBy as pa, buildDisconnectEvent as pi, ecsClusterOption as pn, createWatchPredicates as pr, parseKvsFileOverrides as pt, disposeWebFunctionArtifact as q, resolveLambdaArnIntrinsic as qi, MCP_PROTOCOL_VERSION as qn, matchRoute as qr, createCloudFrontModule as qt, coerceServeRequest as r, formatStateRemedy as ra, HOST_DOCKER_INTERNAL_GATEWAY as ri, addStartServiceSpecificOptions as rn, SUPPORTED_CODE_RUNTIMES as rr, createLocalStartAgentCoreCommand as rt, createStudioServeManager as s, DynamicReferenceResolutionError as sa, bufferToBody as si, createLocalRunTaskCommand as sn, toCmdArgv as sr, attachAgentCoreWsBridge as st, addStudioSpecificOptions as t, resolveAgentCoreTarget as ta, tryParseStatus as ti, isApplicationLoadBalancer as tn, waitForAgentCorePing as tr, resolveWebFunctionTarget as tt, reinvoke as u, deployedFillMayBeSecret as ua, handleConnectionsRequest as ui, addEcsAssumeRoleOptions as un, createLocalInvokeCommand as ur, addStartCloudFrontSpecificOptions as ut, startStudioServer as v, assumedRoleRecorded as va, resolveRuntimeFileExtension as vi, runEcsServiceEmulator as vn, buildStageMap as vr, createDeployedKvsDataSource as vt, createLocalListCommand as w, workloadStsClientConfig as wa, substituteEnvVarsFromStateAsync as wi, parseImageOverrideFlags as wn, groupRoutesByServer as wr, startCloudFrontServer as wt, createStudioStore as x, recordAssumedRole as xa, substituteAgainstState as xi, canonicalizeImageOverrideKeys as xn, availableApiIdentifiers as xr, classifyS3Error as xt, toStudioTargetGroups as y, deployAccountStsClientConfig as ya, resolveRuntimeImage as yi, ImageOverrideError as yn, materializeLayerFromArn as yr, resolveDeployedKvsArnByName as yt, readWebFunctionServiceConfig as z, availableWebSocketApiIdentifiers as zi, createLocalInvokeAgentCoreCommand as zn, invokeRequestAuthorizer as zr, pickKvsLogicalIdFromArn as zt };
-//# sourceMappingURL=local-studio-CsftJJ1r.js.map
+export { postHook as $, firstUsableRegion as $a, parseConnectionsPath as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, filterWebSocketApisByIdentifiers as Aa, applyCorsResponseHeaders as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AGENTCORE_RUNTIME_TYPE as Ba, evaluateResponseParameters as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveWatchConfig as Ca, verifyJwtViaDiscovery as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, availableWebSocketApiIdentifiers as Da, invokeRequestAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, listTargets as Ea, evaluateCachedLambdaPolicy as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, resolveLambdaArnIntrinsic as Fa, matchRoute as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, formatStateRemedy as Ga, HOST_DOCKER_INTERNAL_GATEWAY as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, pickAgentCoreCandidateStack as Ha, selectIntegrationResponse as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, AGENTCORE_A2A_PROTOCOL as Ia, translateLambdaResponse as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, LocalInvokeBuildError as Ja, resolveHostGatewayExtraHosts as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, substituteImagePlaceholders as Ka, HOST_GATEWAY_MIN_VERSION as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_AGUI_PROTOCOL as La, applyAuthorizerOverlay as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, webSocketApiMatchesIdentifier as Ma, buildCorsConfigFromCloudFrontChain as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, discoverRoutes as Na, isFunctionUrlOacFronted as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, discoverWebSocketApis as Oa, invokeTokenAuthorizer as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, pickRefLogicalId as Pa, matchPreflight as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, deployedFillMayBeSecret as Qa, handleConnectionsRequest as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_HTTP_PROTOCOL as Ra, buildHttpApiV2Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, resolveSsmParameters as Sa, verifyJwtAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, countTargets as Ta, computeRequestIdentityHash as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, resolveAgentCoreTarget as Ua, tryParseStatus as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, AgentCoreResolutionError as Va, pickResponseTemplate as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, derivePseudoParametersFromRegion as Wa, VtlEvaluationError as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, DynamicReferenceResolver as Xa, ConnectionRegistry as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, DynamicReferenceResolutionError as Ya, bufferToBody as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, containsDynamicReference as Za, buildMgmtEndpointEnvUrl as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveCfnFallbackRegion as _a, defaultCredentialsLoader as _i, pickKvsLogicalIdFromArn as _n, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, resolveRuntimeCodeMountPath as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, SECOND_ASSUME_MESSAGE as ao, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, CfnLocalStateProvider as ba, createJwksCache as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, EcsTaskResolutionError as ca, resolveEnvVars$1 as ci, buildEdgeRequestEvent as cn, readEnvCallerCredentials as co, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, substituteEnvVarsFromState as da, filterRoutesByApiIdentifiers as di, httpHeadersToEdge as dn, workloadClientConfig as do, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildConnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, keysNotFromTemplate as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, substituteEnvVarsFromStateAsync as fa, groupRoutesByServer as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, workloadStsClientConfig as fo, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, rejectExplicitCfnStackWithMultipleStacks as ga, resolveServiceIntegrationParameters as gi, pickFunctionUrlLogicalIdFromOrigin as gn, isProxyEnvConfigured as go, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, isCfnFlagPresent as ha, resolveSelectionExpression as hi, isCloudFrontDistribution as hn, buildProxyClientConfig as ho, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, buildContainerImage as ia, createFileWatcher as ii, serveFromStaticOrigin as in, withoutKeys as io, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, parseSelectionExpressionPath as ja, buildCorsConfigByApiId as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, discoverWebSocketApisOrThrow as ka, attachAuthorizers as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, substituteAgainstState as la, availableApiIdentifiers as li, buildEdgeResponseEvent as ln, recordAssumedRole as lo, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, createLocalStateProvider as ma, startApiServer as mi, extractKvsAssociations as mn, resolveProfileCredentials as mo, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, buildMessageEvent as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, parseDynamicReference as no, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, resolveRuntimeFileExtension as oa, buildStageMap as oi, applyEdgeRequestResult as on, assumedRoleRecorded as oo, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, LocalStateSourceError as pa, readMtlsMaterialsFromDisk as pi, describeS3OriginDomain as pn, buildStsClientConfig as po, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, tryResolveImageFnJoin as qa, probeHostGatewaySupport as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, architectureToPlatform as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, resolveDynamicReferencesInEnv as ro, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, resolveRuntimeImage as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, deployAccountStsClientConfig as so, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildDisconnectEvent as ta, createWatchPredicates as ti, matchBehavior as tn, keysOverriddenBy as to, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteAgainstStateAsync as ua, filterRoutesByApiIdentifier as ui, edgeHeadersToHttp as un, resetWorkloadIdentity as uo, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnRegion as va, buildCognitoJwksUrl as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, resolveSingleTarget as wa, buildMethodArn as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, collectSsmParameterRefs as xa, verifyCognitoJwt as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, resolveCfnStackName as ya, buildJwksUrlFromIssuer as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_MCP_PROTOCOL as za, buildRestV1Event as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
+//# sourceMappingURL=local-studio-DKMdamzH.js.map