cdk-local 0.30.0 → 0.32.0

package/dist/{local-list-Qa6V8bzl.js → local-list-DdmjsVLF.js}

@@ -1,4 +1,4 @@
-import { a as runDockerStreaming, c as getEmbedConfig, i as runDockerForeground, n as formatDockerLoginError, o as spawnStreaming, r as getDockerCmd, s as getLogger, u as setEmbedConfig } from "./docker-cmd-DvoehoBl.js";
+import { a as runDockerStreaming, c as getEmbedConfig, i as runDockerForeground, n as formatDockerLoginError, o as spawnStreaming, r as getDockerCmd, s as getLogger, u as setEmbedConfig } from "./docker-cmd--8TRSn9z.js";
 import { cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import * as path from "node:path";
@@ -91,17 +91,6 @@ function appOptions() {
 * Context options.
 */
 const contextOptions = [new Option("-c, --context <key=value...>", "Set context values (can be specified multiple times)")];
-/**
-* `-i, --interactive` — present an arrow-key picker to choose the
-* target(s) for this command instead of typing a CDK path / logical ID.
-* Added to the four run commands (NOT `list`, which lists everything).
-* Requires a TTY; in a non-interactive shell the command errors with a
-* clear message. The required-target commands (`invoke` / `run-task` /
-* `start-service`) also auto-launch the picker when the target is
-* omitted in a TTY; `start-api` shows it only with the explicit flag
-* (a bare `start-api` keeps serving every discovered API).
-*/
-const interactiveOption = new Option("-i, --interactive", "Pick the target(s) from an interactive list instead of passing them as arguments (requires a TTY)").default(false);
 const IAM_ROLE_ARN_REGEX = /^arn:[^:]+:iam::\d+:role\//;
 function parseAssumeRoleToken(raw, previous) {
 	const acc = previous ?? { perLambda: {} };
@@ -2000,7 +1989,7 @@ function readApiCdkPath(logicalId, template) {
 
 //#endregion
 //#region src/local/target-lister.ts
-function makeEntry(stackName, logicalId, cdkPath) {
+function makeEntry(stackName, logicalId, cdkPath, kind) {
 	const entry = {
 		logicalId,
 		stackName,
@@ -2008,8 +1997,17 @@ function makeEntry(stackName, logicalId, cdkPath) {
 	};
 	const display = cdkPath ? cdkPath.replace(/\/Resource$/, "") : void 0;
 	if (display) entry.displayPath = display;
+	if (kind) entry.kind = kind;
 	return entry;
 }
+/** Map a discovered route's `source` to the human-readable surface kind. */
+function apiKindLabel(source) {
+	switch (source) {
+		case "http-api": return "HTTP API v2";
+		case "rest-v1": return "REST API v1";
+		case "function-url": return "Function URL";
+	}
+}
 function scanByType(stacks, type) {
 	const entries = [];
 	for (const stack of stacks) {
@@ -2038,22 +2036,22 @@ function scanByType(stacks, type) {
 */
 function listApiSurfaces(stacks) {
 	const byKey = /* @__PURE__ */ new Map();
-	const add = (stackName, logicalId, cdkPath) => {
+	const add = (stackName, logicalId, cdkPath, kind) => {
 		const key = `${stackName}:${logicalId}`;
-		if (!byKey.has(key)) byKey.set(key, makeEntry(stackName, logicalId, cdkPath));
+		if (!byKey.has(key)) byKey.set(key, makeEntry(stackName, logicalId, cdkPath, kind));
 	};
 	try {
 		for (const route of discoverRoutes(stacks)) {
 			if (!route.apiStackName) continue;
 			const logicalId = route.source === "function-url" ? route.lambdaLogicalId : route.apiLogicalId;
 			if (!logicalId) continue;
-			add(route.apiStackName, logicalId, route.apiCdkPath);
+			add(route.apiStackName, logicalId, route.apiCdkPath, apiKindLabel(route.source));
 		}
 	} catch (err) {
 		getLogger().warn(`Could not enumerate REST / HTTP / Function URL targets: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	const { apis, errors } = discoverWebSocketApis(stacks);
-	for (const api of apis) add(api.apiStackName, api.apiLogicalId, api.apiCdkPath);
+	for (const api of apis) add(api.apiStackName, api.apiLogicalId, api.apiCdkPath, "WebSocket");
 	for (const e of errors) getLogger().warn(`Could not enumerate a WebSocket API target: ${e}`);
 	return [...byKey.values()];
 }
@@ -2099,7 +2097,7 @@ function toOption(entry) {
 		value,
 		label: value
 	};
-	if (entry.displayPath) option.hint = entry.qualifiedId;
+	if (entry.kind) option.hint = entry.kind;
 	return option;
 }
 /**
@@ -2123,19 +2121,25 @@ async function pickOneTarget(message, entries) {
 * The key hint is baked into the message because multi-select's
 * space-to-toggle is not discoverable — users expect enter to pick the
 * highlighted row and miss that nothing is selected yet.
+*
+* When `preselectAll` is true, every row starts selected (via
+* `@clack/prompts` `initialValues`) so a bare Enter confirms the whole
+* set — used by `start-api`, whose long-standing default is "serve every
+* discovered API". The user deselects rows to serve a subset.
 */
-async function pickManyTargets(message, entries) {
+async function pickManyTargets(message, entries, options = {}) {
+	const opts = entries.map(toOption);
 	const chosen = await multiselect({
 		message: `${message} (space to select, enter to confirm)`,
-		options: entries.map(toOption),
-		required: true
+		options: opts,
+		required: true,
+		...options.preselectAll && { initialValues: opts.map((o) => o.value) }
 	});
 	if (isCancel(chosen)) throw new TargetSelectionCancelledError();
 	return chosen;
 }
-function ensureCanPrompt(interactive, onMissing) {
+function ensureCanPrompt(onMissing) {
 	if (isInteractive()) return;
-	if (interactive) throw new InteractiveTtyRequiredError("`-i/--interactive` requires an interactive terminal, but stdin/stdout is not a TTY.");
 	throw onMissing();
 }
 function ensureHasCandidates(count, noun) {
@@ -2144,17 +2148,15 @@ function ensureHasCandidates(count, noun) {
 }
 /**
 * Resolve a single positional target, prompting interactively when the
-* user passed `-i/--interactive` or omitted the target in a TTY.
+* target is omitted in a TTY.
 *
-* - `provided` set and no `-i` → returned as-is (no prompt).
-* - `-i` set → always prompt (any `provided` value is ignored).
+* - `provided` set → returned as-is (no prompt).
 * - omitted, TTY → prompt.
 * - omitted, no TTY → `onMissing()` (the command's required-arg error).
 */
 async function resolveSingleTarget(provided, params) {
-	if (provided && !params.interactive) return provided;
-	if (provided && params.interactive) getLogger().warn(`-i/--interactive ignores the provided target '${provided}' — pick one from the list instead.`);
-	ensureCanPrompt(params.interactive, params.onMissing);
+	if (provided) return provided;
+	ensureCanPrompt(params.onMissing);
 	ensureHasCandidates(params.entries.length, params.noun);
 	return pickOneTarget(params.message, params.entries);
 }
@@ -2164,9 +2166,8 @@ async function resolveSingleTarget(provided, params) {
 * rules as {@link resolveSingleTarget}.
 */
 async function resolveMultiTarget(provided, params) {
-	if (provided.length > 0 && !params.interactive) return provided;
-	if (provided.length > 0 && params.interactive) getLogger().warn(`-i/--interactive ignores the provided target(s) [${provided.join(", ")}] — pick from the list instead.`);
-	ensureCanPrompt(params.interactive, params.onMissing);
+	if (provided.length > 0) return provided;
+	ensureCanPrompt(params.onMissing);
 	ensureHasCandidates(params.entries.length, params.noun);
 	return pickManyTargets(params.message, params.entries);
 }
@@ -7303,11 +7304,10 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 		};
 		const { stacks } = await synthesizer.synthesize(synthOpts);
 		const lambda = resolveLambdaTarget(await resolveSingleTarget(target, {
-			interactive: options.interactive,
 			entries: listTargets(stacks).lambdas,
 			message: "Select a Lambda function to invoke",
 			noun: "Lambda functions",
-			onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} invoke requires a <target> (a Lambda display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or pass -i to pick interactively.`, "LOCAL_INVOKE_TARGET_REQUIRED")
+			onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} invoke requires a <target> (a Lambda display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_INVOKE_TARGET_REQUIRED")
 		}), stacks);
 		const targetLabel = lambda.kind === "zip" ? lambda.runtime : "container image";
 		logger.info(`Target: ${lambda.stack.stackName}/${lambda.logicalId} (${targetLabel})`);
@@ -7781,7 +7781,7 @@ function pickReferencedLogicalId(intrinsic) {
 }
 function createLocalInvokeCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const invoke = new Command("invoke").description("Run a Lambda function locally in a Docker container (RIE-backed). Target accepts a CDK display path (MyStack/MyApi/Handler) or stack-qualified logical ID (MyStack:MyApiHandler1234ABCD). Single-stack apps may omit the stack prefix. Omit <target> in an interactive terminal (or pass -i) to pick the Lambda from a list.").argument("[target]", "CDK display path or stack-qualified logical ID of the Lambda to invoke (omit to pick interactively in a TTY)").addOption(new Option("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option("--event-stdin", "Read event JSON from stdin").default(false)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}})")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for IMAGE local-build path; `docker build` does not pull base layers by default")).addOption(new Option("--no-build", "Skip docker build on the IMAGE local-build path (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ZIP Lambdas and the IMAGE ECR-pull path. Compatible with --no-pull.")).addOption(new Option("--debug-port <port>", "Node --inspect-brk port (default: off)")).addOption(new Option("--container-host <host>", "Host to bind the RIE port to").default("127.0.0.1")).addOption(new Option("--assume-role [arn]", "Assume the Lambda's deployed execution role and forward STS-issued temp credentials to the container so the handler runs with the deployed function's narrow permissions. Three forms: (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) auto-resolves the function's execution role ARN from state (requires an active state source); (3) `--no-assume-role` explicitly opts out. Off by default — when omitted, the developer's shell credentials are forwarded unchanged (SAM-compatible default). STS failures degrade to a warn + dev-creds fallback.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers. Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass an explicit value when CFn stack name differs. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).action(withErrorHandling(async (target, options) => {
+	const invoke = new Command("invoke").description("Run a Lambda function locally in a Docker container (RIE-backed). Target accepts a CDK display path (MyStack/MyApi/Handler) or stack-qualified logical ID (MyStack:MyApiHandler1234ABCD). Single-stack apps may omit the stack prefix. Omit <target> in an interactive terminal to pick the Lambda from a list.").argument("[target]", "CDK display path or stack-qualified logical ID of the Lambda to invoke (omit to pick interactively in a TTY)").addOption(new Option("-e, --event <file>", "JSON event payload file (default: {})")).addOption(new Option("--event-stdin", "Read event JSON from stdin").default(false)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}})")).addOption(new Option("--no-pull", "Skip docker pull (use cached image) — no-op for IMAGE local-build path; `docker build` does not pull base layers by default")).addOption(new Option("--no-build", "Skip docker build on the IMAGE local-build path (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ZIP Lambdas and the IMAGE ECR-pull path. Compatible with --no-pull.")).addOption(new Option("--debug-port <port>", "Node --inspect-brk port (default: off)")).addOption(new Option("--container-host <host>", "Host to bind the RIE port to").default("127.0.0.1")).addOption(new Option("--assume-role [arn]", "Assume the Lambda's deployed execution role and forward STS-issued temp credentials to the container so the handler runs with the deployed function's narrow permissions. Three forms: (1) `--assume-role <arn>` assumes the explicit ARN; (2) `--assume-role` (bare) auto-resolves the function's execution role ARN from state (requires an active state source); (3) `--no-assume-role` explicitly opts out. Off by default — when omitted, the developer's shell credentials are forwarded unchanged (SAM-compatible default). STS failures degrade to a warn + dev-creds fallback.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers. Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name; pass an explicit value when CFn stack name differs. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).action(withErrorHandling(async (target, options) => {
 		await localInvokeCommand(target, options, opts.extraStateProviders);
 	}));
 	[
@@ -7789,7 +7789,6 @@ function createLocalInvokeCommand(opts = {}) {
 		...appOptions(),
 		...contextOptions
 	].forEach((option) => invoke.addOption(option));
-	invoke.addOption(interactiveOption);
 	invoke.addOption(deprecatedRegionOption);
 	return invoke;
 }
@@ -13031,14 +13030,15 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 		local = await loadCredentials();
 	} catch (err) {
 		const reason = err instanceof Error ? err.message : String(err);
+		const { sigV4StrictByDefault, sigV4OptFlag: optFlag } = getEmbedConfig();
 		if (opts.strict && !opts.oacFronted) {
-			logger.warn(`AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified. --strict-sigv4 is set, so cdk-local denies unverifiable IAM requests; remove --strict-sigv4 to warn-and-pass (the default), or configure AWS credentials cdk-local can read.`);
+			logger.warn(sigV4StrictByDefault ? `AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified. cdk-local denies unverifiable IAM requests by default; pass ${optFlag} to warn-and-pass, or configure AWS credentials cdk-local can read.` : `AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified. ${optFlag} is set, so cdk-local denies unverifiable IAM requests; remove ${optFlag} to warn-and-pass (the default), or configure AWS credentials cdk-local can read.`);
 			return {
 				allow: false,
 				identityHash: void 0
 			};
 		}
-		logger.warn(opts.oacFronted ? `AWS_IAM authorizer: Function URL is fronted by CloudFront OAC (CloudFront re-signs origin requests in production), and local AWS credentials could not be resolved (${reason}). Passing through with unverified principalId 'unverified-no-creds'. Do NOT trust event.requestContext.identity.accessKey in handler code.` : `AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it against AWS's copy of the secret). Passing through with unverified principalId 'unverified-no-creds' — cdk-local's default for unverifiable IAM requests; pass --strict-sigv4 to deny instead. Do NOT trust event.requestContext.identity.accessKey in handler code.`);
+		logger.warn(opts.oacFronted ? `AWS_IAM authorizer: Function URL is fronted by CloudFront OAC (CloudFront re-signs origin requests in production), and local AWS credentials could not be resolved (${reason}). Passing through with unverified principalId 'unverified-no-creds'. Do NOT trust event.requestContext.identity.accessKey in handler code.` : sigV4StrictByDefault ? `AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it against AWS's copy of the secret). ${optFlag} is set; passing through with unverified principalId 'unverified-no-creds'. Do NOT trust event.requestContext.identity.accessKey in handler code.` : `AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it against AWS's copy of the secret). Passing through with unverified principalId 'unverified-no-creds' — cdk-local's default for unverifiable IAM requests; pass ${optFlag} to deny instead. Do NOT trust event.requestContext.identity.accessKey in handler code.`);
 		return {
 			allow: true,
 			principalId: "unverified-no-creds",
@@ -13048,9 +13048,10 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 	if (local.accessKeyId.toLowerCase() !== parsed.credentialAccessKeyId.toLowerCase()) {
 		const warned = opts.warnedForeignIds;
 		const dedupKey = parsed.credentialAccessKeyId.toLowerCase();
+		const { sigV4StrictByDefault, sigV4OptFlag: optFlag } = getEmbedConfig();
 		if (opts.strict && !opts.oacFronted) {
 			if (!warned || !warned.has(dedupKey)) {
-				logger.warn(`AWS_IAM authorizer: request signed with access-key-id '${parsed.credentialAccessKeyId}', which differs from the AWS credentials cdk-local resolved locally — SigV4 (HMAC / shared-secret) can only be verified with the signer's own credentials, never a federated / Cognito Identity Pool / cross-account signer's. --strict-sigv4 is set, so cdk-local denies it; remove --strict-sigv4 to warn-and-pass (the default), or sign the request with the same credentials cdk-local resolves locally.`);
+				logger.warn(sigV4StrictByDefault ? `AWS_IAM authorizer: request signed with access-key-id '${parsed.credentialAccessKeyId}', which differs from the AWS credentials cdk-local resolved locally — SigV4 (HMAC / shared-secret) can only be verified with the signer's own credentials, never a federated / Cognito Identity Pool / cross-account signer's. cdk-local denies it by default; pass ${optFlag} to warn-and-pass, or sign the request with the same credentials cdk-local resolves locally.` : `AWS_IAM authorizer: request signed with access-key-id '${parsed.credentialAccessKeyId}', which differs from the AWS credentials cdk-local resolved locally — SigV4 (HMAC / shared-secret) can only be verified with the signer's own credentials, never a federated / Cognito Identity Pool / cross-account signer's. ${optFlag} is set, so cdk-local denies it; remove ${optFlag} to warn-and-pass (the default), or sign the request with the same credentials cdk-local resolves locally.`);
 				warned?.add(dedupKey);
 			}
 			return {
@@ -13059,7 +13060,7 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 			};
 		}
 		if (!warned || !warned.has(dedupKey)) {
-			logger.warn(opts.oacFronted ? `AWS_IAM authorizer: Function URL is fronted by CloudFront OAC — in production CloudFront re-signs the origin request, so the local client's signature (access-key-id '${parsed.credentialAccessKeyId}') cannot be verified. Passing through with unverified principalId 'unverified-foreign-identity'. Do NOT trust event.requestContext.authorizer.principalId in handler code.` : `AWS_IAM authorizer: request signed with access-key-id '${parsed.credentialAccessKeyId}', a federated / Cognito Identity Pool / cross-account signer cdk-local cannot verify locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it because AWS holds the secret). Passing through with unverified principalId 'unverified-foreign-identity' — cdk-local's default for unverifiable IAM requests; pass --strict-sigv4 to deny instead. Do NOT trust event.requestContext.authorizer.principalId in handler code.`);
+			logger.warn(opts.oacFronted ? `AWS_IAM authorizer: Function URL is fronted by CloudFront OAC — in production CloudFront re-signs the origin request, so the local client's signature (access-key-id '${parsed.credentialAccessKeyId}') cannot be verified. Passing through with unverified principalId 'unverified-foreign-identity'. Do NOT trust event.requestContext.authorizer.principalId in handler code.` : sigV4StrictByDefault ? `AWS_IAM authorizer: request signed with access-key-id '${parsed.credentialAccessKeyId}', a federated / Cognito Identity Pool / cross-account signer cdk-local cannot verify locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it because AWS holds the secret). ${optFlag} is set; passing through with unverified principalId 'unverified-foreign-identity'. Do NOT trust event.requestContext.authorizer.principalId in handler code.` : `AWS_IAM authorizer: request signed with access-key-id '${parsed.credentialAccessKeyId}', a federated / Cognito Identity Pool / cross-account signer cdk-local cannot verify locally (SigV4 is an HMAC shared-secret signature; the deployed API Gateway verifies it because AWS holds the secret). Passing through with unverified principalId 'unverified-foreign-identity' — cdk-local's default for unverifiable IAM requests; pass ${optFlag} to deny instead. Do NOT trust event.requestContext.authorizer.principalId in handler code.`);
 			warned?.add(dedupKey);
 		}
 		return {
@@ -14659,6 +14660,27 @@ function filterRoutesByApiIdentifier(routes, identifier) {
 	return routes.filter((rwa) => routeMatchesIdentifier(rwa.route, identifier));
 }
 /**
+* Filter the route list to the UNION of several user-supplied
+* identifiers — the variadic `cdkl start-api <target...>` shape, where
+* passing two or more API identifiers serves exactly that subset (each
+* on its own port, via {@link groupRoutesByServer}).
+*
+* A route is kept when it matches ANY of the identifiers (same matching
+* rules as {@link filterRoutesByApiIdentifier}). Output order is the
+* input route order, so {@link groupRoutesByServer}'s stable grouping is
+* preserved. An empty `identifiers` list returns every route unchanged
+* (the "serve all" default path never calls this with an empty set, but
+* the no-op behavior keeps the helper total).
+*
+* Returns an empty array when no route matches any identifier — the
+* caller surfaces a "no API matched" error with the available
+* identifiers (see {@link availableApiIdentifiers}).
+*/
+function filterRoutesByApiIdentifiers(routes, identifiers) {
+	if (identifiers.length === 0) return [...routes];
+	return routes.filter((rwa) => identifiers.some((id) => routeMatchesIdentifier(rwa.route, id)));
+}
+/**
 * Predicate behind {@link filterRoutesByApiIdentifier} and
 * {@link availableApiIdentifiers}'s primary-form selection. Exported
 * for test coverage only — the production code path goes through
@@ -14948,20 +14970,20 @@ function createAuthorizerCache(opts = {}) {
 
 //#endregion
 //#region src/cli/commands/local-start-api.ts
-async function localStartApiCommand(target, options, extraStateProviders) {
+async function localStartApiCommand(targets, options, extraStateProviders) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
-	let apiFilter = target;
+	let apiFilters = [...targets];
 	if (options.api !== void 0) {
-		if (target !== void 0) throw new Error(`Cannot specify both positional target ('${target}') and --api flag ('${options.api}'). Use one or the other. The positional form is preferred — '--api' is a deprecated alias.`);
+		if (targets.length > 0) throw new Error(`Cannot specify both positional target(s) ([${targets.join(", ")}]) and --api flag ('${options.api}'). Use one or the other. The positional form is preferred — '--api' is a deprecated alias.`);
 		logger.warn(`[deprecated] --api <id> will be removed in a future major release. Use the positional argument instead: '${getEmbedConfig().cliName} start-api <id>'.`);
-		apiFilter = options.api;
+		apiFilters = [options.api];
 	}
-	assertStartApiInteractiveAllowed(options.interactive, apiFilter, options.allStacks);
-	let effectiveTarget = target;
+	const shouldPromptBare = shouldPromptBareMultiSelect(apiFilters, options.allStacks, isInteractive());
+	let effectiveTargets = [...apiFilters];
 	const interactivePicked = { value: false };
-	const allStacksConflictList = allStacksConflicts(options, target, apiFilter);
-	if (allStacksConflictList.length > 0) throw new Error(`--all-stacks serves every stack's API and cannot be combined with a single-target selector (${allStacksConflictList.join(", ")}). Drop --all-stacks to target one stack, or drop the selector to serve them all. The bare --from-cfn-stack flag (no value) IS compatible with --all-stacks.`);
+	const allStacksConflictList = allStacksConflicts(options, targets, apiFilters);
+	if (allStacksConflictList.length > 0) throw new Error(`--all-stacks serves every stack's API and cannot be combined with a target subset selector (${allStacksConflictList.join(", ")}). Drop --all-stacks to target specific APIs, or drop the selector to serve them all. The bare --from-cfn-stack flag (no value) IS compatible with --all-stacks.`);
 	warnIfDeprecatedRegion(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
@@ -14982,6 +15004,7 @@ async function localStartApiCommand(target, options, extraStateProviders) {
 	let sigV4CredentialsLoader;
 	const sigV4WarnedForeignIds = /* @__PURE__ */ new Set();
 	const fromCfnTipEmitted = { value: false };
+	const unmatchedTargetWarned = /* @__PURE__ */ new Set();
 	/**
 	* One synth + discover + build pass. Returns the next-state
 	* material. Reused on initial boot AND every hot-reload firing.
@@ -15005,17 +15028,17 @@ async function localStartApiCommand(target, options, extraStateProviders) {
 			...Object.keys(context).length > 0 && { context }
 		};
 		const { stacks } = await synthesizer.synthesize(synthOpts);
-		if (options.interactive && !interactivePicked.value) {
+		if (shouldPromptBare && !interactivePicked.value) {
 			const apis = listTargets(stacks).apis;
 			if (apis.length === 0) throw new Error(`No APIs found in this CDK app to choose from. Run \`${getEmbedConfig().cliName} list\` to see what is available.`);
-			const picked = await pickOneTarget("Select an API to serve", apis);
-			apiFilter = picked;
-			effectiveTarget = picked;
+			const picked = await pickManyTargets("Select APIs to serve", apis, { preselectAll: true });
+			apiFilters = picked;
+			effectiveTargets = picked;
 			interactivePicked.value = true;
 		}
 		const cfnStackFallback = typeof options.fromCfnStack === "string" ? options.fromCfnStack : void 0;
-		const targetStackPrefix = effectiveTarget?.includes("/") === true ? effectiveTarget.slice(0, effectiveTarget.indexOf("/")) : void 0;
-		const targetStacks = pickTargetStacks(stacks, options.stack, cfnStackFallback, targetStackPrefix, options.allStacks);
+		const targetStackPrefix = deriveSynthStackPrefix(effectiveTargets);
+		const targetStacks = pickTargetStacks(stacks, options.stack, cfnStackFallback, targetStackPrefix, options.allStacks || shouldSynthAllStacks(effectiveTargets, options.stack, cfnStackFallback));
 		if (targetStacks.length === 0) throw new Error("No stacks matched. Pass --stack <name> (or --from-cfn-stack <name>) or run from a single-stack app.");
 		const routedStackNames = targetStacks.map((s) => s.stackName);
 		tryEmitFromCfnRedundancyTipOnce(options.fromCfnStack, routedStackNames, fromCfnTipEmitted, (routedStackName) => {
@@ -15041,12 +15064,15 @@ async function localStartApiCommand(target, options, extraStateProviders) {
 		}
 		attachStageContext(routes, stageMap);
 		let routesWithAuth = attachAuthorizers(targetStacks, routes);
-		if (apiFilter !== void 0) {
-			if (!apiFilter.includes(":") && !apiFilter.includes("/") && targetStacks.length > 1) throw new Error(`Multiple stacks in app, target '${apiFilter}' is missing a stack prefix. Use 'StackName:${apiFilter}' or 'StackName/${apiFilter}' (Construct path form). Available stacks: ${targetStacks.map((s) => s.stackName).join(", ")}.`);
-			const filtered = filterRoutesByApiIdentifier(routesWithAuth, apiFilter);
-			if (filtered.length === 0) {
+		if (apiFilters.length > 0) {
+			const { filtered, unmatched } = resolveApiTargetSubset(routesWithAuth, apiFilters, targetStacks.map((s) => s.stackName));
+			if (unmatched.length > 0) {
 				const available = availableApiIdentifiers(routesWithAuth).join(", ") || "(none)";
-				throw new Error(`Target '${apiFilter}' did not match any discovered API. Available identifiers: ${available}.`);
+				for (const id of unmatched) {
+					if (unmatchedTargetWarned.has(id)) continue;
+					unmatchedTargetWarned.add(id);
+					logger.warn(`Target '${id}' did not match any discovered API; it is ignored. Available identifiers: ${available}.`);
+				}
 			}
 			routesWithAuth = filtered;
 		}
@@ -15437,7 +15463,7 @@ function pickTargetStacks(stacks, pattern, cfnStackFallback, targetFallback, all
 }
 /**
 * Issue #55: `--all-stacks` serves every stack's API as a union, so it
-* cannot be combined with a selector that names exactly ONE target.
+* cannot be combined with a selector that names a target subset.
 * Returns the human-readable list of conflicting selectors (empty when
 * `--all-stacks` is off or there is no conflict).
 *
@@ -15451,31 +15477,121 @@ function pickTargetStacks(stacks, pattern, cfnStackFallback, targetFallback, all
 *
 * @internal exported for unit tests.
 */
-function allStacksConflicts(options, target, apiFilter) {
+function allStacksConflicts(options, targets, apiFilters) {
 	if (!options.allStacks) return [];
 	const conflicts = [];
-	if (apiFilter !== void 0) conflicts.push(target !== void 0 ? `target '${target}'` : `--api '${options.api}'`);
+	if (apiFilters.length > 0) conflicts.push(targets.length > 0 ? `target(s) [${targets.join(", ")}]` : `--api '${options.api}'`);
 	if (options.stack !== void 0) conflicts.push(`--stack '${options.stack}'`);
 	if (typeof options.fromCfnStack === "string") conflicts.push(`--from-cfn-stack '${options.fromCfnStack}'`);
 	return conflicts;
 }
 /**
-* Validate `-i/--interactive` for `start-api`. The picker is opt-in here
-* (a bare `start-api` serves every API), so `-i` is mutually exclusive
-* with any single-target selector (`apiFilter` = positional target OR
-* `--api`) and with `--all-stacks`, and it requires a TTY. Throws when
-* the combination is invalid; otherwise returns and the prompt runs
-* later inside `synthesizeAndBuild`.
+* Resolve the variadic `cdkl start-api <target...>` subset against the
+* discovered route surface — the pure core of the subset-serving path.
+*
+* Behavior:
+*  - Rejects a BARE logical id (no `:`, no `/`) when the app has more than
+*    one stack: a bare id is ambiguous because two stacks can carry the
+*    same logical id (mirrors `cdkl invoke` / `cdkl run-task`'s resolver).
+*    THROWS with the disambiguation hint.
+*  - Filters routes to the UNION of the identifiers via
+*    {@link filterRoutesByApiIdentifiers}. THROWS when the union is empty
+*    (no identifier matched anything), listing the available identifiers.
+*  - Returns the surviving union in `filtered` and the identifiers that
+*    matched nothing in `unmatched`. A single typo among valid ids keeps
+*    the siblings in `filtered` and surfaces the typo via `unmatched`;
+*    the caller is responsible for warning (so the warning can be gated
+*    one-shot across `--watch` reloads — see the call site).
+*
+* `availableApiIdentifiers(routes)` is computed ONCE here (not per-id) so
+* the resolution is O(N·M) rather than O(N²·M).
+*
+* @internal exported for unit tests + library consumers (re-exported from
+* the package entry).
+*/
+function resolveApiTargetSubset(routes, identifiers, stackNames) {
+	if (stackNames.length > 1) {
+		for (const id of identifiers) if (!id.includes(":") && !id.includes("/")) throw new Error(`Multiple stacks in app, target '${id}' is missing a stack prefix. Use 'StackName:${id}' or 'StackName/${id}' (Construct path form). Available stacks: ${stackNames.join(", ")}.`);
+	}
+	const filtered = filterRoutesByApiIdentifiers(routes, identifiers);
+	if (filtered.length === 0) {
+		const available = availableApiIdentifiers(routes).join(", ") || "(none)";
+		throw new Error(`Target(s) [${identifiers.join(", ")}] did not match any discovered API. Available identifiers: ${available}.`);
+	}
+	return {
+		filtered,
+		unmatched: identifiers.filter((id) => filterRoutesByApiIdentifiers(routes, [id]).length === 0)
+	};
+}
+/**
+* Derive the single synth stack prefix shared by every supplied target,
+* for the synth-scope optimization (item 5 of the start-api subset UX).
+*
+* Each target's stack prefix is the segment before its first `/` (the
+* `<StackName>/<construct>` Construct-path form). Returns:
+*  - `undefined` when `targets` is empty (serve-all path — no prefix).
+*  - `undefined` when ANY target lacks a `/` (bare logical id — the synth
+*    target can't be inferred from it, so fall back to the existing
+*    single-stack auto-pick / multi-stack rejection path).
+*  - `undefined` when targets span MORE THAN ONE distinct prefix (the
+*    subset crosses stacks, so synth must cover all of them — see
+*    {@link shouldSynthAllStacks}).
+*  - the shared prefix when every target carries the SAME `<StackName>/`
+*    prefix — keeping the single-stack synth optimization.
+*
+* @internal exported for unit tests.
+*/
+function deriveSynthStackPrefix(targets) {
+	if (targets.length === 0) return void 0;
+	const prefixes = /* @__PURE__ */ new Set();
+	for (const t of targets) {
+		const slash = t.indexOf("/");
+		if (slash === -1) return void 0;
+		prefixes.add(t.slice(0, slash));
+	}
+	return prefixes.size === 1 ? [...prefixes][0] : void 0;
+}
+/**
+* Decide whether synth should cover ALL stacks for the given target
+* subset (item 5). Synth is scoped to one stack only when a single stack
+* can be pinned; otherwise we synth every stack and the union is filtered
+* down by `apiFilters` afterwards.
+*
+* Returns `true` (synth all) when there ARE explicit targets but no
+* single stack can be pinned from them — i.e. `--stack` is unset, an
+* explicit `--from-cfn-stack <name>` is unset, AND
+* {@link deriveSynthStackPrefix} can't resolve one shared prefix (targets
+* span stacks, or any target is a bare logical id). Returns `false` when
+* there are no targets (serve-all already synths everything via the
+* regular path) or a stack is otherwise pinned.
+*
+* @internal exported for unit tests.
+*/
+function shouldSynthAllStacks(targets, stackPattern, cfnStackFallback) {
+	if (targets.length === 0) return false;
+	if (stackPattern !== void 0 || cfnStackFallback !== void 0) return false;
+	return deriveSynthStackPrefix(targets) === void 0;
+}
+/**
+* Decide whether bare `start-api` should open the pre-selected-all
+* multi-select picker. The picker runs ONLY when:
+*  - no explicit API subset was named (`apiFilters` empty — neither
+*    positional `<targets...>` nor the deprecated `--api`),
+*  - `--all-stacks` was not passed (that path already serves every API),
+*  - AND stdin/stdout is a TTY.
+*
+* In a non-TTY (CI / pipe) this returns `false`, and the caller serves
+* EVERY discovered API without prompting — start-api's one intentional
+* asymmetry vs invoke / run-task (which error when bare in a non-TTY),
+* because start-api legitimately has a "serve all" default.
 *
-* Extracted as a pure-ish function (TTY is read via {@link isInteractive})
-* so the error contract is unit-testable without booting the server.
+* Extracted as a pure function (TTY is passed in) so the decision is
+* unit-testable without booting the server or juggling global TTY state.
 *
 * @internal exported for unit tests.
 */
-function assertStartApiInteractiveAllowed(interactive, apiFilter, allStacks) {
-	if (!interactive) return;
-	if (apiFilter !== void 0 || allStacks) throw new Error("`-i/--interactive` cannot be combined with a positional target, --api, or --all-stacks; it interactively picks one API to serve. Drop the selector, or drop -i.");
-	if (!isInteractive()) throw new InteractiveTtyRequiredError("`-i/--interactive` requires an interactive terminal, but stdin/stdout is not a TTY.");
+function shouldPromptBareMultiSelect(apiFilters, allStacks, isTty) {
+	return apiFilters.length === 0 && !allStacks && isTty;
 }
 /**
 * Decide whether the `--from-cfn-stack <name>` redundancy tip should
@@ -16563,15 +16679,14 @@ function resolveMtlsConfig(options) {
 */
 function createLocalStartApiCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const startApi = new Command("start-api").description("Run a long-running local HTTP server that maps API Gateway routes (REST v1, HTTP API, Function URL) to Lambda invocations against the AWS Lambda Runtime Interface Emulator (Docker required). Supports Lambda TOKEN/REQUEST authorizers, Cognito User Pool / HTTP v2 JWT authorizers, and AWS_IAM auth (REST v1 `AuthorizationType: AWS_IAM` and Function URL `AuthType: AWS_IAM` — SigV4 signature verification only; IAM policy evaluation is NOT emulated). When JWKS is unreachable, JWT authorizers fall back to pass-through (every token accepted) with a warn line — local dev fallback. VPC-config Lambdas run locally and surface a warn line at startup; their containers do NOT get attached to the deployed VPC subnets, so calls to private RDS / ElastiCache will fail.").argument("[target]", `Optional API filter. Accepts the bare CDK logical id ('MyHttpApi'; single-stack apps only), stack-qualified logical id ('MyStack:MyHttpApi'), full CDK Construct path ('MyStack/MyHttpApi/Resource'), or an ancestor Construct path that prefix-matches ('MyStack/MyHttpApi'). When omitted, every discovered API gets its own server (pass -i to pick one interactively instead). Mirrors \`${getEmbedConfig().cliName} invoke\` / \`${getEmbedConfig().cliName} run-task\` target syntax.`).addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(new Option("--all-stacks", "Serve every stack's API in a multi-stack app (each API on its own port) instead of erroring out. Mutually exclusive with a positional target, --stack, and an explicit --from-cfn-stack <name>; the bare --from-cfn-stack flag stays compatible (binds each routed stack to its own CFn stack).").default(false)).addOption(new Option("--warm", "Pre-start one container per Lambda at server boot").default(false)).addOption(new Option("--per-lambda-concurrency <n>", "Pool size cap per Lambda (default 2, max 4)").default("2")).addOption(new Option("--no-pull", "Skip docker pull (cached image)")).addOption(new Option("--container-host <host>", "IP the host uses to bind/probe the RIE port (must be a numeric IP — `docker run -p <ip>:<port>:8080` rejects hostnames). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--debug-port-base <port>", "Reserve a contiguous --debug-port range (one per Lambda)")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--assume-role <arn-or-pair>", "Assume the Lambda's execution role and forward STS-issued temp creds. Bare <arn> = global default; <LogicalId>=<arn> = per-Lambda override (repeatable). Per-Lambda > global > unset (developer creds passed through).").argParser((raw, prev) => parseAssumeRoleToken(raw, prev))).addOption(new Option("--watch", "Hot-reload: re-synth + re-discover routes when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). Off by default; the server keeps the previous version serving when synth fails mid-reload.").default(false)).addOption(new Option("--stage <name>", "Select an API Gateway Stage by its 'StageName'. Default: the first Stage attached to each API. Drives event.stageVariables for both REST v1 and HTTP API v2. NOTE: For HTTP API v2 routes, requestContext.stage is always '$default' regardless of this flag (AWS-side limitation — HTTP API only exposes one stage to the integration event); only event.stageVariables is affected for v2 routes. For REST v1 routes the selected StageName is also threaded into requestContext.stage.")).addOption(new Option("--api <id>", "DEPRECATED — use the positional <target> argument instead. Same accepted forms (bare logical id, stack-qualified, Construct path, ancestor prefix). Will be removed in a future major release.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in Lambda env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name per routed stack; pass an explicit value when a single CFn stack should serve every routed stack. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--mtls-truststore <path>", `PEM-encoded CA bundle for client-certificate verification (mutual TLS). When set, the local server switches from HTTP to HTTPS and the TLS handshake rejects clients whose certificate doesn't chain to one of these CAs. Verified certs are surfaced on the Lambda event under requestContext.identity.clientCert (REST v1) / requestContext.authentication.clientCert (HTTP API v2). Must be set together with --mtls-cert + --mtls-key; partial flag sets are rejected. Generate a CA + server + client cert for local dev: openssl req -x509 -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.pem -subj "/CN=${getEmbedConfig().resourceNamePrefix}-ca" -days 365; openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-csr.pem -subj "/CN=localhost"; openssl x509 -req -in server-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365; openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-csr.pem -subj "/CN=client"; openssl x509 -req -in client-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365; curl --cacert ca.pem --cert client-cert.pem --key client-key.pem https://localhost:<port>/...`)).addOption(new Option("--mtls-cert <path>", "PEM-encoded server certificate for mutual TLS. Self-signed is fine for local dev. Must be set together with --mtls-truststore + --mtls-key.")).addOption(new Option("--mtls-key <path>", "PEM-encoded server private key matching --mtls-cert. Must be set together with --mtls-truststore + --mtls-cert.")).addOption(new Option("--strict-sigv4", "Opt-in: DENY AWS_IAM SigV4 requests that cannot be cryptographically verified (foreign access-key-id — e.g. a federated / Cognito Identity Pool / cross-account signer — OR no local AWS credentials configured) instead of the default warn-and-pass. DEFAULT off: cdk-local warn-and-passes unverifiable IAM requests with a placeholder principalId so local dev exercises app logic without reproducing an auth boundary it cannot fully emulate. OAC-fronted Function URLs always warn-and-pass regardless.").default(false)).action(withErrorHandling(async (target, options) => {
-		await localStartApiCommand(target, options, opts.extraStateProviders);
+	const startApi = new Command("start-api").description("Run a long-running local HTTP server that maps API Gateway routes (REST v1, HTTP API, Function URL) to Lambda invocations against the AWS Lambda Runtime Interface Emulator (Docker required). Supports Lambda TOKEN/REQUEST authorizers, Cognito User Pool / HTTP v2 JWT authorizers, and AWS_IAM auth (REST v1 `AuthorizationType: AWS_IAM` and Function URL `AuthType: AWS_IAM` — SigV4 signature verification only; IAM policy evaluation is NOT emulated). When JWKS is unreachable, JWT authorizers fall back to pass-through (every token accepted) with a warn line — local dev fallback. VPC-config Lambdas run locally and surface a warn line at startup; their containers do NOT get attached to the deployed VPC subnets, so calls to private RDS / ElastiCache will fail.").argument("[targets...]", `Optional API subset filter. Pass one or more identifiers to serve exactly that subset (the union; each on its own port). Each accepts the bare CDK logical id ('MyHttpApi'; single-stack apps only), stack-qualified logical id ('MyStack:MyHttpApi'), full CDK Construct path ('MyStack/MyHttpApi/Resource'), or an ancestor Construct path that prefix-matches ('MyStack/MyHttpApi'). When omitted in a TTY, a multi-select picker opens with every API pre-selected (Enter serves all, deselect to pick a subset); when omitted in a non-TTY (CI / pipe) every discovered API is served. Mirrors \`${getEmbedConfig().cliName} invoke\` / \`${getEmbedConfig().cliName} run-task\` target syntax.`).addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(new Option("--all-stacks", "Serve every stack's API in a multi-stack app (each API on its own port) instead of erroring out. Mutually exclusive with a positional target subset, --stack, and an explicit --from-cfn-stack <name>; the bare --from-cfn-stack flag stays compatible (binds each routed stack to its own CFn stack).").default(false)).addOption(new Option("--warm", "Pre-start one container per Lambda at server boot").default(false)).addOption(new Option("--per-lambda-concurrency <n>", "Pool size cap per Lambda (default 2, max 4)").default("2")).addOption(new Option("--no-pull", "Skip docker pull (cached image)")).addOption(new Option("--container-host <host>", "IP the host uses to bind/probe the RIE port (must be a numeric IP — `docker run -p <ip>:<port>:8080` rejects hostnames). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--debug-port-base <port>", "Reserve a contiguous --debug-port range (one per Lambda)")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--assume-role <arn-or-pair>", "Assume the Lambda's execution role and forward STS-issued temp creds. Bare <arn> = global default; <LogicalId>=<arn> = per-Lambda override (repeatable). Per-Lambda > global > unset (developer creds passed through).").argParser((raw, prev) => parseAssumeRoleToken(raw, prev))).addOption(new Option("--watch", "Hot-reload: re-synth + re-discover routes when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). Off by default; the server keeps the previous version serving when synth fails mid-reload.").default(false)).addOption(new Option("--stage <name>", "Select an API Gateway Stage by its 'StageName'. Default: the first Stage attached to each API. Drives event.stageVariables for both REST v1 and HTTP API v2. NOTE: For HTTP API v2 routes, requestContext.stage is always '$default' regardless of this flag (AWS-side limitation — HTTP API only exposes one stage to the integration event); only event.stageVariables is affected for v2 routes. For REST v1 routes the selected StageName is also threaded into requestContext.stage.")).addOption(new Option("--api <id>", "DEPRECATED — use the positional <targets...> argument instead. Accepts a SINGLE identifier; for a subset pass multiple positional targets. Same accepted forms (bare logical id, stack-qualified, Construct path, ancestor prefix). Will be removed in a future major release.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in Lambda env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name per routed stack; pass an explicit value when a single CFn stack should serve every routed stack. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--mtls-truststore <path>", `PEM-encoded CA bundle for client-certificate verification (mutual TLS). When set, the local server switches from HTTP to HTTPS and the TLS handshake rejects clients whose certificate doesn't chain to one of these CAs. Verified certs are surfaced on the Lambda event under requestContext.identity.clientCert (REST v1) / requestContext.authentication.clientCert (HTTP API v2). Must be set together with --mtls-cert + --mtls-key; partial flag sets are rejected. Generate a CA + server + client cert for local dev: openssl req -x509 -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.pem -subj "/CN=${getEmbedConfig().resourceNamePrefix}-ca" -days 365; openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-csr.pem -subj "/CN=localhost"; openssl x509 -req -in server-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365; openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-csr.pem -subj "/CN=client"; openssl x509 -req -in client-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365; curl --cacert ca.pem --cert client-cert.pem --key client-key.pem https://localhost:<port>/...`)).addOption(new Option("--mtls-cert <path>", "PEM-encoded server certificate for mutual TLS. Self-signed is fine for local dev. Must be set together with --mtls-truststore + --mtls-key.")).addOption(new Option("--mtls-key <path>", "PEM-encoded server private key matching --mtls-cert. Must be set together with --mtls-truststore + --mtls-cert.")).addOption(new Option("--strict-sigv4", "Opt-in: DENY AWS_IAM SigV4 requests that cannot be cryptographically verified (foreign access-key-id — e.g. a federated / Cognito Identity Pool / cross-account signer — OR no local AWS credentials configured) instead of the default warn-and-pass. DEFAULT off: cdk-local warn-and-passes unverifiable IAM requests with a placeholder principalId so local dev exercises app logic without reproducing an auth boundary it cannot fully emulate. OAC-fronted Function URLs always warn-and-pass regardless.").default(false)).action(withErrorHandling(async (targets, options) => {
+		await localStartApiCommand(targets, options, opts.extraStateProviders);
 	}));
 	[
 		...commonOptions(),
 		...appOptions(),
 		...contextOptions
 	].forEach((opt) => startApi.addOption(opt));
-	startApi.addOption(interactiveOption);
 	startApi.addOption(deprecatedRegionOption);
 	return startApi;
 }
@@ -17627,11 +17742,10 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 		};
 		const { stacks } = await synthesizer.synthesize(synthOpts);
 		const resolvedTarget = await resolveSingleTarget(target, {
-			interactive: options.interactive,
 			entries: listTargets(stacks).ecsTaskDefinitions,
 			message: "Select an ECS task definition to run",
 			noun: "ECS task definitions",
-			onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} run-task requires a <target> (an ECS task definition display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or pass -i to pick interactively.`, "LOCAL_RUN_TASK_TARGET_REQUIRED")
+			onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} run-task requires a <target> (an ECS task definition display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_RUN_TASK_TARGET_REQUIRED")
 		});
 		const candidate = pickCandidateStack$1(parseEcsTarget(resolvedTarget).stackPattern, stacks);
 		stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
@@ -17858,7 +17972,7 @@ async function resolveSidecarCredentials(options, assumedCredentials) {
 }
 function createLocalRunTaskCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("run-task").description("Run an AWS::ECS::TaskDefinition locally — pulls/builds images, sets up a per-task docker network with the AWS-published metadata-endpoints sidecar, and starts every container in dependsOn order. Target accepts a CDK display path (MyStack/MyService/TaskDef) or stack-qualified logical ID (MyStack:MyServiceTaskDefXYZ1234). Single-stack apps may omit the stack prefix. Omit <target> in an interactive terminal (or pass -i) to pick the task definition from a list.").argument("[target]", "CDK display path or stack-qualified logical ID of the AWS::ECS::TaskDefinition to run (omit to pick interactively in a TTY)").addOption(new Option("--cluster <name>", "Cluster name surfaced to ECS_CONTAINER_METADATA_URI_V4 and used as the docker network prefix").default(getEmbedConfig().resourceNamePrefix)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1")).addOption(new Option("--host-port <containerPort=hostPort...>", "Publish a container port on a specific host port (e.g. 80=8080); repeatable. Default: host port == container port. Use this on macOS to map a privileged container port (< 1024) to a non-privileged host port and avoid the Docker Desktop admin-password prompt.")).addOption(new Option("--assume-task-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed function role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override.")).addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--keep-running", "Don't docker rm -f the user containers on task exit (network + sidecar are still torn down). Use when you want to docker exec into a stopped container for post-mortems.").default(false)).addOption(new Option("--detach", "Start the containers in the background and exit (skip log streaming + auto teardown). Useful in CI smoke tests; caller manages container lifecycle.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", `Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (\`cdk deploy\`). Bare form uses the ${getEmbedConfig().binaryName} stack name; pass an explicit value when the CFn stack name differs. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).`)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).action(withErrorHandling(async (target, options) => {
+	const cmd = new Command("run-task").description("Run an AWS::ECS::TaskDefinition locally — pulls/builds images, sets up a per-task docker network with the AWS-published metadata-endpoints sidecar, and starts every container in dependsOn order. Target accepts a CDK display path (MyStack/MyService/TaskDef) or stack-qualified logical ID (MyStack:MyServiceTaskDefXYZ1234). Single-stack apps may omit the stack prefix. Omit <target> in an interactive terminal to pick the task definition from a list.").argument("[target]", "CDK display path or stack-qualified logical ID of the AWS::ECS::TaskDefinition to run (omit to pick interactively in a TTY)").addOption(new Option("--cluster <name>", "Cluster name surfaced to ECS_CONTAINER_METADATA_URI_V4 and used as the docker network prefix").default(getEmbedConfig().resourceNamePrefix)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1")).addOption(new Option("--host-port <containerPort=hostPort...>", "Publish a container port on a specific host port (e.g. 80=8080); repeatable. Default: host port == container port. Use this on macOS to map a privileged container port (< 1024) to a non-privileged host port and avoid the Docker Desktop admin-password prompt.")).addOption(new Option("--assume-task-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed function role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override.")).addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries. Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--keep-running", "Don't docker rm -f the user containers on task exit (network + sidecar are still torn down). Use when you want to docker exec into a stopped container for post-mortems.").default(false)).addOption(new Option("--detach", "Start the containers in the background and exit (skip log streaming + auto teardown). Useful in CI smoke tests; caller manages container lifecycle.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", `Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (\`cdk deploy\`). Bare form uses the ${getEmbedConfig().binaryName} stack name; pass an explicit value when the CFn stack name differs. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).`)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).action(withErrorHandling(async (target, options) => {
 		await localRunTaskCommand(target, options, opts.extraStateProviders);
 	}));
 	[
@@ -17866,7 +17980,6 @@ function createLocalRunTaskCommand(opts = {}) {
 		...appOptions(),
 		...contextOptions
 	].forEach((opt) => cmd.addOption(opt));
-	cmd.addOption(interactiveOption);
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
@@ -18604,7 +18717,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-DvoehoBl.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd--8TRSn9z.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -18624,7 +18737,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-DvoehoBl.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd--8TRSn9z.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -19040,11 +19153,10 @@ async function localStartServiceCommand(targets, options, extraStateProviders) {
 		};
 		const { stacks } = await synthesizer.synthesize(synthOpts);
 		const resolvedTargets = await resolveMultiTarget(targets, {
-			interactive: options.interactive,
 			entries: listTargets(stacks).ecsServices,
 			message: "Select one or more ECS services to run",
 			noun: "ECS services",
-			onMissing: () => new LocalStartServiceError(`${getEmbedConfig().cliName} start-service requires at least one <target>. Pass one or more service paths like 'Stack/Orders' 'Stack/Frontend', or run it in a TTY (or with -i) to pick interactively.`)
+			onMissing: () => new LocalStartServiceError(`${getEmbedConfig().cliName} start-service requires at least one <target>. Pass one or more service paths like 'Stack/Orders' 'Stack/Frontend', or run it in a TTY to pick interactively.`)
 		});
 		rejectExplicitCfnStackWithMultipleStacks(options, resolvedTargets.length);
 		perTarget = resolvedTargets.map((t) => ({
@@ -19336,7 +19448,7 @@ async function resolveSharedSidecarCredentials(options) {
 }
 function createLocalStartServiceCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("start-service").description(`Run one or more AWS::ECS::Service resources locally as a long-running emulator. Spins up DesiredCount task replicas per service (clamped by --max-tasks) using the same per-task docker network + metadata sidecar pattern as \`${getEmbedConfig().cliName} run-task\`, then keeps each replica running and restarts it on exit per --restart-policy. ^C tears every replica + sidecar + network down. Each <target> accepts a CDK display path (MyStack/MyService) or stack-qualified logical ID (MyStack:MyServiceXYZ); single-stack apps may omit the stack prefix. When two or more <target>s are supplied, every service is booted into a shared Cloud Map / Service Connect registry so peer services discover each other via docker --add-host overlay. Omit <targets> in an interactive terminal (or pass -i) to multi-select the services from a list.`).argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ECS::Service resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--cluster <name>", "Cluster name surfaced to ECS_CONTAINER_METADATA_URI_V4 and used as the docker network prefix").default(getEmbedConfig().resourceNamePrefix)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1")).addOption(new Option("--host-port <containerPort=hostPort...>", "Publish a container port on a specific host port (e.g. 80=8080); repeatable. Default: host port == container port. Use this on macOS to map a privileged container port (< 1024) to a non-privileged host port and avoid the Docker Desktop admin-password prompt. (Single-replica services only — multi-replica services do not publish host ports.)")).addOption(new Option("--assume-task-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed task role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override.")).addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--max-tasks <n>", `Hard cap on local replica count. Caps the template DesiredCount so local dev machines don't run an unbounded number of containers. Cannot exceed ${83} due to the per-replica link-local /24 subnet allocator's range.`).default(3).argParser(parseMaxTasks)).addOption(new Option("--restart-policy <policy>", "How to react when an essential container exits. 'on-failure' (default) restarts only on non-zero exit; 'always' restarts on every exit; 'none' shuts the replica down and runs the service degraded.").default("on-failure").argParser(parseRestartPolicy)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", `Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (\`cdk deploy\`). Bare form uses the ${getEmbedConfig().binaryName} stack name; pass an explicit value when the CFn stack name differs. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).`)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).action(withErrorHandling(async (targets, options) => {
+	const cmd = new Command("start-service").description(`Run one or more AWS::ECS::Service resources locally as a long-running emulator. Spins up DesiredCount task replicas per service (clamped by --max-tasks) using the same per-task docker network + metadata sidecar pattern as \`${getEmbedConfig().cliName} run-task\`, then keeps each replica running and restarts it on exit per --restart-policy. ^C tears every replica + sidecar + network down. Each <target> accepts a CDK display path (MyStack/MyService) or stack-qualified logical ID (MyStack:MyServiceXYZ); single-stack apps may omit the stack prefix. When two or more <target>s are supplied, every service is booted into a shared Cloud Map / Service Connect registry so peer services discover each other via docker --add-host overlay. Omit <targets> in an interactive terminal to multi-select the services from a list.`).argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ECS::Service resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--cluster <name>", "Cluster name surfaced to ECS_CONTAINER_METADATA_URI_V4 and used as the docker network prefix").default(getEmbedConfig().resourceNamePrefix)).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1")).addOption(new Option("--host-port <containerPort=hostPort...>", "Publish a container port on a specific host port (e.g. 80=8080); repeatable. Default: host port == container port. Use this on macOS to map a privileged container port (< 1024) to a non-privileged host port and avoid the Docker Desktop admin-password prompt. (Single-replica services only — multi-replica services do not publish host ports.)")).addOption(new Option("--assume-task-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed task role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override.")).addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries.")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--max-tasks <n>", `Hard cap on local replica count. Caps the template DesiredCount so local dev machines don't run an unbounded number of containers. Cannot exceed ${83} due to the per-replica link-local /24 subnet allocator's range.`).default(3).argParser(parseMaxTasks)).addOption(new Option("--restart-policy <policy>", "How to react when an essential container exits. 'on-failure' (default) restarts only on non-zero exit; 'always' restarts on every exit; 'none' shuts the replica down and runs the service degraded.").default("on-failure").argParser(parseRestartPolicy)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", `Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (\`cdk deploy\`). Bare form uses the ${getEmbedConfig().binaryName} stack name; pass an explicit value when the CFn stack name differs. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).`)).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).action(withErrorHandling(async (targets, options) => {
 		await localStartServiceCommand(targets, options, opts.extraStateProviders);
 	}));
 	[
@@ -19344,7 +19456,6 @@ function createLocalStartServiceCommand(opts = {}) {
 		...appOptions(),
 		...contextOptions
 	].forEach((opt) => cmd.addOption(opt));
-	cmd.addOption(interactiveOption);
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
@@ -19388,7 +19499,7 @@ function formatTargetListing(listing, cliName, options = {}) {
 	const long = options.long ?? false;
 	return "\n" + [
 		formatSection("Lambda Functions", `${cliName} invoke <target>`, listing.lambdas, long),
-		formatSection("APIs", `${cliName} start-api [target]`, listing.apis, long),
+		formatSection("APIs", `${cliName} start-api [target...]`, listing.apis, long),
 		formatSection("ECS Services", `${cliName} start-service <target...>`, listing.ecsServices, long),
 		formatSection("ECS Task Definitions", `${cliName} run-task <target>`, listing.ecsTaskDefinitions, long)
 	].filter((lines) => lines.length > 0).map((lines) => lines.join("\n")).join("\n\n");
@@ -19398,14 +19509,14 @@ function formatSection(title, command, entries, long) {
 	const lines = [`${title}  ->  ${command}`];
 	for (const entry of entries) {
 		const primary = entry.displayPath ?? entry.qualifiedId;
-		lines.push(`  ${primary}`);
+		lines.push(entry.kind ? `  ${primary}  (${entry.kind})` : `  ${primary}`);
 		if (long && entry.displayPath) lines.push(`      ${entry.qualifiedId}`);
 	}
 	return lines;
 }
 function createLocalListCommand(opts = {}) {
 	setEmbedConfig(opts.embedConfig);
-	const cmd = new Command("list").alias("ls").description("List the runnable targets in the synthesized CDK app, grouped by the command that runs them: Lambda functions (invoke), API Gateway REST v1 / HTTP v2 / Function URL / WebSocket surfaces (start-api), ECS services (start-service), and ECS task definitions (run-task). Each target is shown by its CDK display path; pass -l to also print the stack-qualified logical ID. Tip: you usually do not need to copy these — just run the command (e.g. `invoke`) and pick from the list, or pass -i.").addOption(new Option("-l, --long", "Also print each target's stack-qualified logical ID (<Stack>:<LogicalId>) beneath it").default(false)).action(withErrorHandling(async (options) => {
+	const cmd = new Command("list").alias("ls").description("List the runnable targets in the synthesized CDK app, grouped by the command that runs them: Lambda functions (invoke), API Gateway REST v1 / HTTP v2 / Function URL / WebSocket surfaces (start-api), ECS services (start-service), and ECS task definitions (run-task). Each target is shown by its CDK display path; pass -l to also print the stack-qualified logical ID. Tip: you usually do not need to copy these — just run the command (e.g. `invoke`) with no target in a terminal and pick from the list.").addOption(new Option("-l, --long", "Also print each target's stack-qualified logical ID (<Stack>:<LogicalId>) beneath it").default(false)).action(withErrorHandling(async (options) => {
 		await localListCommand(options);
 	}));
 	[
@@ -19418,5 +19529,5 @@ function createLocalListCommand(opts = {}) {
 }
 
 //#endregion
-export { resolveRuntimeFileExtension as $, matchPreflight as A, VtlEvaluationError as B, computeRequestIdentityHash as C, discoverWebSocketApis as Ct, applyCorsResponseHeaders as D, pickRefLogicalId as Dt, invokeTokenAuthorizer as E, discoverRoutes as Et, buildRestV1Event as F, buildMgmtEndpointEnvUrl as G, probeHostGatewaySupport as H, evaluateResponseParameters as I, buildConnectEvent as J, handleConnectionsRequest as K, pickResponseTemplate as L, translateLambdaResponse as M, applyAuthorizerOverlay as N, buildCorsConfigByApiId as O, resolveLambdaArnIntrinsic as Ot, buildHttpApiV2Event as P, resolveRuntimeCodeMountPath as Q, selectIntegrationResponse as R, buildMethodArn as S, listTargets as St, invokeRequestAuthorizer as T, parseSelectionExpressionPath as Tt, bufferToBody as U, HOST_GATEWAY_MIN_VERSION as V, ConnectionRegistry as W, buildMessageEvent as X, buildDisconnectEvent as Y, createLocalInvokeCommand as Z, buildCognitoJwksUrl as _, resolveCfnStackName as _t, CloudMapRegistry as a, substituteEnvVarsFromStateAsync as at, verifyCognitoJwt as b, resolveSsmParameters as bt, createLocalStartApiCommand as c, derivePseudoParametersFromRegion as ct, buildStageMap as d, LocalStateSourceError as dt, resolveRuntimeImage as et, availableApiIdentifiers as f, createLocalStateProvider as ft, resolveServiceIntegrationParameters as g, resolveCfnRegion as gt, resolveSelectionExpression as h, resolveCfnFallbackRegion as ht, buildCloudMapIndex as i, substituteEnvVarsFromState as it, matchRoute as j, buildCorsConfigFromCloudFrontChain as k, createAuthorizerCache as l, substituteImagePlaceholders as lt, groupRoutesByServer as m, rejectExplicitCfnStackWithMultipleStacks as mt, formatTargetListing as n, substituteAgainstState as nt, getContainerNetworkIp as o, resolveEnvVars as ot, filterRoutesByApiIdentifier as p, isCfnFlagPresent as pt, parseConnectionsPath as q, createLocalStartServiceCommand as r, substituteAgainstStateAsync as rt, createLocalRunTaskCommand as s, materializeLayerFromArn as st, createLocalListCommand as t, EcsTaskResolutionError as tt, attachStageContext as u, tryResolveImageFnJoin as ut, buildJwksUrlFromIssuer as v, CfnLocalStateProvider as vt, evaluateCachedLambdaPolicy as w, discoverWebSocketApisOrThrow as wt, verifyJwtAuthorizer as x, countTargets as xt, createJwksCache as y, collectSsmParameterRefs as yt, tryParseStatus as z };
-//# sourceMappingURL=local-list-Qa6V8bzl.js.map
+export { handleConnectionsRequest as $, invokeRequestAuthorizer as A, discoverWebSocketApis as At, applyAuthorizerOverlay as B, buildJwksUrlFromIssuer as C, resolveCfnRegion as Ct, buildMethodArn as D, resolveSsmParameters as Dt, verifyJwtAuthorizer as E, collectSsmParameterRefs as Et, buildCorsConfigFromCloudFrontChain as F, resolveLambdaArnIntrinsic as Ft, selectIntegrationResponse as G, buildRestV1Event as H, isFunctionUrlOacFronted as I, HOST_GATEWAY_MIN_VERSION as J, tryParseStatus as K, matchPreflight as L, attachAuthorizers as M, parseSelectionExpressionPath as Mt, applyCorsResponseHeaders as N, discoverRoutes as Nt, computeRequestIdentityHash as O, countTargets as Ot, buildCorsConfigByApiId as P, pickRefLogicalId as Pt, buildMgmtEndpointEnvUrl as Q, matchRoute as R, buildCognitoJwksUrl as S, resolveCfnFallbackRegion as St, verifyCognitoJwt as T, CfnLocalStateProvider as Tt, evaluateResponseParameters as U, buildHttpApiV2Event as V, pickResponseTemplate as W, bufferToBody as X, probeHostGatewaySupport as Y, ConnectionRegistry as Z, readMtlsMaterialsFromDisk as _, tryResolveImageFnJoin as _t, CloudMapRegistry as a, resolveRuntimeCodeMountPath as at, resolveServiceIntegrationParameters as b, isCfnFlagPresent as bt, createLocalStartApiCommand as c, EcsTaskResolutionError as ct, attachStageContext as d, substituteEnvVarsFromState as dt, parseConnectionsPath as et, buildStageMap as f, substituteEnvVarsFromStateAsync as ft, groupRoutesByServer as g, substituteImagePlaceholders as gt, filterRoutesByApiIdentifiers as h, derivePseudoParametersFromRegion as ht, buildCloudMapIndex as i, createLocalInvokeCommand as it, invokeTokenAuthorizer as j, discoverWebSocketApisOrThrow as jt, evaluateCachedLambdaPolicy as k, listTargets as kt, resolveApiTargetSubset as l, substituteAgainstState as lt, filterRoutesByApiIdentifier as m, materializeLayerFromArn as mt, formatTargetListing as n, buildDisconnectEvent as nt, getContainerNetworkIp as o, resolveRuntimeFileExtension as ot, availableApiIdentifiers as p, resolveEnvVars as pt, VtlEvaluationError as q, createLocalStartServiceCommand as r, buildMessageEvent as rt, createLocalRunTaskCommand as s, resolveRuntimeImage as st, createLocalListCommand as t, buildConnectEvent as tt, createAuthorizerCache as u, substituteAgainstStateAsync as ut, startApiServer as v, LocalStateSourceError as vt, createJwksCache as w, resolveCfnStackName as wt, defaultCredentialsLoader as x, rejectExplicitCfnStackWithMultipleStacks as xt, resolveSelectionExpression as y, createLocalStateProvider as yt, translateLambdaResponse as z };
+//# sourceMappingURL=local-list-DdmjsVLF.js.map