cdk-local 0.74.0 → 0.75.0

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { K as createLocalInvokeAgentCoreCommand, f as createLocalStartServiceCommand, gt as createLocalStartApiCommand, h as createLocalRunTaskCommand, mt as createLocalInvokeCommand, n as createLocalListCommand, o as createLocalStartAlbCommand } from "./local-list-Dn0Al276.js";
+import { K as createLocalInvokeAgentCoreCommand, f as createLocalStartServiceCommand, gt as createLocalStartApiCommand, h as createLocalRunTaskCommand, mt as createLocalInvokeCommand, n as createLocalListCommand, o as createLocalStartAlbCommand } from "./local-list-CFINvNxo.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.74.0");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.75.0");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalInvokeAgentCoreCommand());
 program.addCommand(createLocalStartApiCommand());

package/dist/index.js

@@ -1,4 +1,4 @@
 import { c as getEmbedConfig, l as resetEmbedConfig, u as setEmbedConfig } from "./docker-cmd-Dqx2YENO.js";
-import { An as rejectExplicitCfnStackWithMultipleStacks, Bn as listTargets, Cn as substituteAgainstState, Dn as LocalStateSourceError, En as substituteEnvVarsFromStateAsync, Fn as collectSsmParameterRefs, In as resolveSsmParameters, K as createLocalInvokeAgentCoreCommand, Mn as resolveCfnRegion, Nn as resolveCfnStackName, On as createLocalStateProvider, Pn as CfnLocalStateProvider, Tn as substituteEnvVarsFromState, f as createLocalStartServiceCommand, gt as createLocalStartApiCommand, h as createLocalRunTaskCommand, jn as resolveCfnFallbackRegion, kn as isCfnFlagPresent, mt as createLocalInvokeCommand, n as createLocalListCommand, o as createLocalStartAlbCommand, r as formatTargetListing, wn as substituteAgainstStateAsync, zn as countTargets } from "./local-list-Dn0Al276.js";
+import { An as rejectExplicitCfnStackWithMultipleStacks, Bn as listTargets, Cn as substituteAgainstState, Dn as LocalStateSourceError, En as substituteEnvVarsFromStateAsync, Fn as collectSsmParameterRefs, In as resolveSsmParameters, K as createLocalInvokeAgentCoreCommand, Mn as resolveCfnRegion, Nn as resolveCfnStackName, On as createLocalStateProvider, Pn as CfnLocalStateProvider, Tn as substituteEnvVarsFromState, f as createLocalStartServiceCommand, gt as createLocalStartApiCommand, h as createLocalRunTaskCommand, jn as resolveCfnFallbackRegion, kn as isCfnFlagPresent, mt as createLocalInvokeCommand, n as createLocalListCommand, o as createLocalStartAlbCommand, r as formatTargetListing, wn as substituteAgainstStateAsync, zn as countTargets } from "./local-list-CFINvNxo.js";
 
 export { CfnLocalStateProvider, LocalStateSourceError, collectSsmParameterRefs, countTargets, createLocalInvokeAgentCoreCommand, createLocalInvokeCommand, createLocalListCommand, createLocalRunTaskCommand, createLocalStartAlbCommand, createLocalStartApiCommand, createLocalStartServiceCommand, createLocalStateProvider, formatTargetListing, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resetEmbedConfig, resolveCfnFallbackRegion, resolveCfnRegion, resolveCfnStackName, resolveSsmParameters, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync };

package/dist/internal.js

@@ -1,3 +1,3 @@
-import { $ as MCP_PROTOCOL_VERSION, $n as pickAgentCoreCandidateStack, $t as applyAuthorizerOverlay, A as mergeForService, At as startApiServer, B as DEFAULT_SHADOW_READY_TIMEOUT_MS, Bt as buildMethodArn, C as parseRestartPolicy, Ct as materializeLayerFromArn, D as ImageOverrideError, Dt as filterRoutesByApiIdentifiers, E as runEcsServiceEmulator, Et as filterRoutesByApiIdentifier, F as isLocalCdkAssetImage, Ft as buildJwksUrlFromIssuer, G as addInvokeAgentCoreSpecificOptions, Gn as pickRefLogicalId, Gt as attachAuthorizers, H as setShadowReadyTimeoutMs, Hn as discoverWebSocketApisOrThrow, Ht as evaluateCachedLambdaPolicy, I as listPinnedTargets, It as createJwksCache, J as A2A_CONTAINER_PORT, Jn as AGENTCORE_AGUI_PROTOCOL, Jt as buildCorsConfigFromCloudFrontChain, Kn as resolveLambdaArnIntrinsic, Kt as applyCorsResponseHeaders, L as buildCloudMapIndex, Ln as resolveWatchConfig, Lt as verifyCognitoJwt, M as resolveImageOverrides, Mt as resolveServiceIntegrationParameters, N as runImageOverrideBuilds, Nt as defaultCredentialsLoader, O as buildImageOverrideTag, Ot as groupRoutesByServer, P as describePinnedImageUri, Pt as buildCognitoJwksUrl, Q as MCP_PATH, Qn as AgentCoreResolutionError, Qt as translateLambdaResponse, R as CloudMapRegistry, Rn as resolveSingleTarget, Rt as verifyJwtAuthorizer, S as parseMaxTasks, Sn as EcsTaskResolutionError, St as buildStageMap, T as resolveSharedSidecarCredentials, Tt as availableApiIdentifiers, U as getContainerNetworkIp, Un as parseSelectionExpressionPath, Ut as invokeRequestAuthorizer, V as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, Vn as discoverWebSocketApis, Vt as computeRequestIdentityHash, W as attachContainerLogStreamer, Wn as discoverRoutes, Wt as invokeTokenAuthorizer, X as a2aInvokeOnce, Xn as AGENTCORE_MCP_PROTOCOL, Xt as matchPreflight, Y as A2A_PATH, Yn as AGENTCORE_HTTP_PROTOCOL, Yt as isFunctionUrlOacFronted, Z as MCP_CONTAINER_PORT, Zn as AGENTCORE_RUNTIME_TYPE, Zt as matchRoute, _ as addCommonEcsServiceOptions, _n as architectureToPlatform, _t as createWatchPredicates, a as albStrategy, an as tryParseStatus, ar as LocalInvokeBuildError, at as invokeAgentCore, b as buildEcsImageResolutionContext, bn as resolveRuntimeFileExtension, bt as createFileWatcher, c as resolveAlbTarget, cn as probeHostGatewaySupport, ct as SUPPORTED_CODE_RUNTIMES, d as addStartServiceSpecificOptions, dn as buildMgmtEndpointEnvUrl, dt as renderCodeDockerfile, en as buildHttpApiV2Event, er as resolveAgentCoreTarget, et as mcpInvokeOnce, fn as handleConnectionsRequest, ft as toCmdArgv, g as MAX_TASKS_SUBNET_RANGE_CAP, gn as buildMessageEvent, hn as buildDisconnectEvent, ht as addStartApiSpecificOptions, i as addAlbSpecificOptions, in as selectIntegrationResponse, ir as tryResolveImageFnJoin, it as AGENTCORE_SESSION_ID_HEADER, j as parseImageOverrideFlags, jt as resolveSelectionExpression, k as enforceImageOverrideOrphans, kt as readMtlsMaterialsFromDisk, l as isApplicationLoadBalancer, ln as bufferToBody, lt as buildAgentCoreCodeImage, m as addRunTaskSpecificOptions, mn as buildConnectEvent, nn as evaluateResponseParameters, nr as formatStateRemedy, nt as AGENTCORE_SIGV4_SERVICE, on as VtlEvaluationError, or as buildStsClientConfig, ot as waitForAgentCorePing, p as serviceStrategy, pn as parseConnectionsPath, pt as addInvokeSpecificOptions, q as invokeAgentCoreWs, qn as AGENTCORE_A2A_PROTOCOL, qt as buildCorsConfigByApiId, rn as pickResponseTemplate, rr as substituteImagePlaceholders, rt as signAgentCoreInvocation, s as parseLbPortOverrides, sn as HOST_GATEWAY_MIN_VERSION, sr as resolveProfileCredentials, st as downloadAndExtractS3Bundle, t as addListSpecificOptions, tn as buildRestV1Event, tr as derivePseudoParametersFromRegion, tt as parseSseForJsonRpc, u as resolveAlbFrontDoor, un as ConnectionRegistry, ut as computeCodeImageTag, v as addEcsAssumeRoleOptions, vn as buildContainerImage, vt as resolveApiTargetSubset, w as resolveEcsAssumeRoleOption, wt as resolveEnvVars, x as ecsClusterOption, xn as resolveRuntimeImage, xt as attachStageContext, y as addImageOverrideOptions, yn as resolveRuntimeCodeMountPath, yt as createAuthorizerCache, z as classifySourceChange, zt as verifyJwtViaDiscovery } from "./local-list-Dn0Al276.js";
+import { $ as MCP_PROTOCOL_VERSION, $n as pickAgentCoreCandidateStack, $t as applyAuthorizerOverlay, A as mergeForService, At as startApiServer, B as DEFAULT_SHADOW_READY_TIMEOUT_MS, Bt as buildMethodArn, C as parseRestartPolicy, Ct as materializeLayerFromArn, D as ImageOverrideError, Dt as filterRoutesByApiIdentifiers, E as runEcsServiceEmulator, Et as filterRoutesByApiIdentifier, F as isLocalCdkAssetImage, Ft as buildJwksUrlFromIssuer, G as addInvokeAgentCoreSpecificOptions, Gn as pickRefLogicalId, Gt as attachAuthorizers, H as setShadowReadyTimeoutMs, Hn as discoverWebSocketApisOrThrow, Ht as evaluateCachedLambdaPolicy, I as listPinnedTargets, It as createJwksCache, J as A2A_CONTAINER_PORT, Jn as AGENTCORE_AGUI_PROTOCOL, Jt as buildCorsConfigFromCloudFrontChain, Kn as resolveLambdaArnIntrinsic, Kt as applyCorsResponseHeaders, L as buildCloudMapIndex, Ln as resolveWatchConfig, Lt as verifyCognitoJwt, M as resolveImageOverrides, Mt as resolveServiceIntegrationParameters, N as runImageOverrideBuilds, Nt as defaultCredentialsLoader, O as buildImageOverrideTag, Ot as groupRoutesByServer, P as describePinnedImageUri, Pt as buildCognitoJwksUrl, Q as MCP_PATH, Qn as AgentCoreResolutionError, Qt as translateLambdaResponse, R as CloudMapRegistry, Rn as resolveSingleTarget, Rt as verifyJwtAuthorizer, S as parseMaxTasks, Sn as EcsTaskResolutionError, St as buildStageMap, T as resolveSharedSidecarCredentials, Tt as availableApiIdentifiers, U as getContainerNetworkIp, Un as parseSelectionExpressionPath, Ut as invokeRequestAuthorizer, V as SOFT_RELOAD_COMPLETION_LOG_SUFFIX, Vn as discoverWebSocketApis, Vt as computeRequestIdentityHash, W as attachContainerLogStreamer, Wn as discoverRoutes, Wt as invokeTokenAuthorizer, X as a2aInvokeOnce, Xn as AGENTCORE_MCP_PROTOCOL, Xt as matchPreflight, Y as A2A_PATH, Yn as AGENTCORE_HTTP_PROTOCOL, Yt as isFunctionUrlOacFronted, Z as MCP_CONTAINER_PORT, Zn as AGENTCORE_RUNTIME_TYPE, Zt as matchRoute, _ as addCommonEcsServiceOptions, _n as architectureToPlatform, _t as createWatchPredicates, a as albStrategy, an as tryParseStatus, ar as LocalInvokeBuildError, at as invokeAgentCore, b as buildEcsImageResolutionContext, bn as resolveRuntimeFileExtension, bt as createFileWatcher, c as resolveAlbTarget, cn as probeHostGatewaySupport, ct as SUPPORTED_CODE_RUNTIMES, d as addStartServiceSpecificOptions, dn as buildMgmtEndpointEnvUrl, dt as renderCodeDockerfile, en as buildHttpApiV2Event, er as resolveAgentCoreTarget, et as mcpInvokeOnce, fn as handleConnectionsRequest, ft as toCmdArgv, g as MAX_TASKS_SUBNET_RANGE_CAP, gn as buildMessageEvent, hn as buildDisconnectEvent, ht as addStartApiSpecificOptions, i as addAlbSpecificOptions, in as selectIntegrationResponse, ir as tryResolveImageFnJoin, it as AGENTCORE_SESSION_ID_HEADER, j as parseImageOverrideFlags, jt as resolveSelectionExpression, k as enforceImageOverrideOrphans, kt as readMtlsMaterialsFromDisk, l as isApplicationLoadBalancer, ln as bufferToBody, lt as buildAgentCoreCodeImage, m as addRunTaskSpecificOptions, mn as buildConnectEvent, nn as evaluateResponseParameters, nr as formatStateRemedy, nt as AGENTCORE_SIGV4_SERVICE, on as VtlEvaluationError, or as buildStsClientConfig, ot as waitForAgentCorePing, p as serviceStrategy, pn as parseConnectionsPath, pt as addInvokeSpecificOptions, q as invokeAgentCoreWs, qn as AGENTCORE_A2A_PROTOCOL, qt as buildCorsConfigByApiId, rn as pickResponseTemplate, rr as substituteImagePlaceholders, rt as signAgentCoreInvocation, s as parseLbPortOverrides, sn as HOST_GATEWAY_MIN_VERSION, sr as resolveProfileCredentials, st as downloadAndExtractS3Bundle, t as addListSpecificOptions, tn as buildRestV1Event, tr as derivePseudoParametersFromRegion, tt as parseSseForJsonRpc, u as resolveAlbFrontDoor, un as ConnectionRegistry, ut as computeCodeImageTag, v as addEcsAssumeRoleOptions, vn as buildContainerImage, vt as resolveApiTargetSubset, w as resolveEcsAssumeRoleOption, wt as resolveEnvVars, x as ecsClusterOption, xn as resolveRuntimeImage, xt as attachStageContext, y as addImageOverrideOptions, yn as resolveRuntimeCodeMountPath, yt as createAuthorizerCache, z as classifySourceChange, zt as verifyJwtViaDiscovery } from "./local-list-CFINvNxo.js";
 
 export { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_HTTP_PROTOCOL, AGENTCORE_MCP_PROTOCOL, AGENTCORE_RUNTIME_TYPE, AGENTCORE_SESSION_ID_HEADER, AGENTCORE_SIGV4_SERVICE, AgentCoreResolutionError, CloudMapRegistry, ConnectionRegistry, DEFAULT_SHADOW_READY_TIMEOUT_MS, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, ImageOverrideError, LocalInvokeBuildError, MAX_TASKS_SUBNET_RANGE_CAP, MCP_CONTAINER_PORT, MCP_PATH, MCP_PROTOCOL_VERSION, SOFT_RELOAD_COMPLETION_LOG_SUFFIX, SUPPORTED_CODE_RUNTIMES, VtlEvaluationError, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addEcsAssumeRoleOptions, addImageOverrideOptions, addInvokeAgentCoreSpecificOptions, addInvokeSpecificOptions, addListSpecificOptions, addRunTaskSpecificOptions, addStartApiSpecificOptions, addStartServiceSpecificOptions, albStrategy, applyAuthorizerOverlay, applyCorsResponseHeaders, architectureToPlatform, attachAuthorizers, attachContainerLogStreamer, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCloudMapIndex, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildEcsImageResolutionContext, buildHttpApiV2Event, buildImageOverrideTag, buildJwksUrlFromIssuer, buildMessageEvent, buildMethodArn, buildMgmtEndpointEnvUrl, buildRestV1Event, buildStageMap, buildStsClientConfig, classifySourceChange, computeCodeImageTag, computeRequestIdentityHash, createAuthorizerCache, createFileWatcher, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, describePinnedImageUri, discoverRoutes, discoverWebSocketApis, discoverWebSocketApisOrThrow, downloadAndExtractS3Bundle, ecsClusterOption, enforceImageOverrideOrphans, evaluateCachedLambdaPolicy, evaluateResponseParameters, filterRoutesByApiIdentifier, filterRoutesByApiIdentifiers, formatStateRemedy, getContainerNetworkIp, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, invokeRequestAuthorizer, invokeTokenAuthorizer, isApplicationLoadBalancer, isFunctionUrlOacFronted, isLocalCdkAssetImage, listPinnedTargets, matchPreflight, matchRoute, materializeLayerFromArn, mcpInvokeOnce, mergeForService, parseConnectionsPath, parseImageOverrideFlags, parseLbPortOverrides, parseMaxTasks, parseRestartPolicy, parseSelectionExpressionPath, parseSseForJsonRpc, pickAgentCoreCandidateStack, pickRefLogicalId, pickResponseTemplate, probeHostGatewaySupport, readMtlsMaterialsFromDisk, renderCodeDockerfile, resolveAgentCoreTarget, resolveAlbFrontDoor, resolveAlbTarget, resolveApiTargetSubset, resolveEcsAssumeRoleOption, resolveEnvVars, resolveImageOverrides, resolveLambdaArnIntrinsic, resolveProfileCredentials, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSelectionExpression, resolveServiceIntegrationParameters, resolveSharedSidecarCredentials, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, runImageOverrideBuilds, selectIntegrationResponse, serviceStrategy, setShadowReadyTimeoutMs, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, toCmdArgv, translateLambdaResponse, tryParseStatus, tryResolveImageFnJoin, verifyCognitoJwt, verifyJwtAuthorizer, verifyJwtViaDiscovery, waitForAgentCorePing };

package/dist/{local-list-Dn0Al276.js → local-list-CFINvNxo.js}

@@ -113,6 +113,35 @@ function parseAssumeRoleToken(raw, previous) {
 	return acc;
 }
 /**
+* Compose `--assume-role` (value-form accumulator) and the separate
+* `--assume-role-auto` boolean flag into the in-process
+* representation `localStartApiCommand` consumes downstream.
+*
+*   - both unset -> `undefined` (pass dev creds through)
+*   - only `--assume-role-auto` -> `{ perLambda: {}, bareAutoResolve: true }`
+*     (per-Lambda auto-resolve for every routed Lambda)
+*   - only `--assume-role` -> the value-form accumulator (global ARN
+*     and/or per-Lambda map) as-is
+*   - both -> accumulator with `bareAutoResolve = true` overlaid;
+*     the per-Lambda map still wins for named Lambdas, auto-resolve
+*     fills in for every Lambda the map does NOT name
+*
+* Enforces the mutual-exclusion guard: `--assume-role-auto` and a
+* global ARN (`--assume-role <arn>`) both occupy the "default for
+* every other Lambda" slot, so the combination is ambiguous and
+* rejected at boot with a clear error. The per-Lambda map IS
+* compatible with either side.
+*/
+function normalizeStartApiAssumeRole(raw, autoResolve) {
+	if (raw === void 0) return autoResolve ? {
+		perLambda: {},
+		bareAutoResolve: true
+	} : void 0;
+	if (autoResolve && raw.globalArn) throw new Error(`--assume-role-auto auto-resolves EACH routed Lambda's own execution role, but --assume-role ${raw.globalArn} also names a single global default. These are mutually exclusive on the global slot. Either drop the global ARN to keep --assume-role-auto for every Lambda, or drop --assume-role-auto to keep the global default. Per-Lambda overrides (--assume-role <LogicalId>=<arn>) are compatible with either side.`);
+	if (autoResolve) raw.bareAutoResolve = true;
+	return raw;
+}
+/**
 * Resolve the effective IAM role ARN for a given Lambda. Per-Lambda
 * override wins; otherwise the global default; otherwise `undefined`
 * (no role to assume — pass developer creds through).
@@ -15265,6 +15294,9 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 	const interactivePicked = { value: false };
 	const allStacksConflictList = allStacksConflicts(options, targets, apiFilters);
 	if (allStacksConflictList.length > 0) throw new Error(`--all-stacks serves every stack's API and cannot be combined with a target subset selector (${allStacksConflictList.join(", ")}). Drop --all-stacks to target specific APIs, or drop the selector to serve them all. The bare --from-cfn-stack flag (no value) IS compatible with --all-stacks.`);
+	const normalizedAssumeRole = normalizeStartApiAssumeRole(options.assumeRole, options.assumeRoleAuto ?? false);
+	if (normalizedAssumeRole === void 0) delete options.assumeRole;
+	else options.assumeRole = normalizedAssumeRole;
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region,
@@ -15376,7 +15408,7 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 				logicalId,
 				stacks: targetStacks,
 				overrides,
-				assumeRole: options.assumeRole,
+				assumeRole: normalizedAssumeRole,
 				containerHost: options.containerHost,
 				...debugPortBase !== void 0 && { debugPort: debugPortBase + i },
 				stsRegion: options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"],
@@ -16041,6 +16073,59 @@ function warnIamRoutes(routesWithAuth) {
 	return true;
 }
 /**
+* Resolve the effective IAM role ARN to assume for a single routed
+* Lambda, honoring the four `--assume-role` forms of issue #256
+* Option 1 (non-breaking step):
+*
+*   - per-Lambda override (`<LogicalId>=<arn>`) — wins over every other
+*     form for the named Lambda.
+*   - global default (bare ARN) — used when the per-Lambda map misses.
+*   - bare-auto-resolve (`--assume-role` with no value) — when neither
+*     the per-Lambda map nor a global default applies, resolves THIS
+*     Lambda's own `Role` (its `AWS::Lambda::Function`'s `Role`
+*     property -> role ARN). Resolution sources, in order:
+*       1. literal-ARN form of `Properties.Role` in the SYNTHESIZED
+*          template (rare in CDK output but possible);
+*       2. deployed state (`stateBundle.state.resources`) when
+*          `--from-cfn-stack` (or a host-provided extension) is
+*          active, via the same shared helper
+*          `resolveExecutionRoleArnFromState` `cdkl invoke`'s bare-
+*          form uses.
+*   - flag absent / `--no-assume-role-auto` — returns `undefined`
+*     (per-Lambda map and global default already filtered out by the
+*     null-check at the top; bare-auto-resolve = false short-circuits
+*     before the state lookup).
+*
+* The shape-level mutual exclusion (bare-auto-resolve + global ARN
+* together) is caught at boot by
+* {@link normalizeStartApiAssumeRole}; this resolver only sees a
+* well-formed `AssumeRoleOption`.
+*
+* Bare-auto-resolve misses (no literal-ARN, no state, state did not
+* carry the role attribute) warn-and-fall-through to the
+* dev-creds-passed-through branch — same trade-off `cdkl invoke
+* --assume-role` makes when bare auto-resolve cannot find an ARN.
+*
+* Exported for unit testing.
+*/
+function resolveStartApiAssumeRoleArn(args) {
+	const { logicalId, assumeRole, lambdaResource, stateBundle } = args;
+	if (!assumeRole) return void 0;
+	const explicit = effectiveAssumeRoleArn(logicalId, assumeRole);
+	if (explicit) return explicit;
+	if (!assumeRole.bareAutoResolve) return void 0;
+	const roleProp = (lambdaResource.Properties ?? {})["Role"];
+	if (typeof roleProp === "string" && roleProp.startsWith("arn:")) return roleProp;
+	if (stateBundle) {
+		const fromState = resolveExecutionRoleArnFromState(stateBundle.state, logicalId);
+		if (fromState) {
+			getLogger().info(`--assume-role: auto-resolved execution role for '${logicalId}' from state: ${fromState}`);
+			return fromState;
+		}
+	}
+	getLogger().warn(`--assume-role: could not auto-resolve the execution role ARN for '${logicalId}'. Pair --assume-role with --from-cfn-stack (or a host-provided state-source extension) so the deployed Role's ARN can be looked up, OR pin the ARN explicitly with --assume-role ${logicalId}=<arn>. Falling back to the developer's shell credentials for this Lambda.`);
+}
+/**
 * Build the per-Lambda container spec — code dir, env vars (template +
 * --env-vars overlay), STS-issued creds when --assume-role names this
 * Lambda, optional --debug-port reservation. Errors out with a clear
@@ -16111,7 +16196,12 @@ async function buildContainerSpec(args) {
 		AWS_LAMBDA_LOG_STREAM_NAME: "local",
 		...envResult.resolved
 	};
-	const roleArn = effectiveAssumeRoleArn(logicalId, assumeRole);
+	const roleArn = resolveStartApiAssumeRoleArn({
+		logicalId,
+		assumeRole,
+		lambdaResource: lambda.resource,
+		stateBundle
+	});
 	if (roleArn) {
 		const creds = await assumeLambdaExecutionRole$1(roleArn, stsRegion, profile);
 		dockerEnv["AWS_ACCESS_KEY_ID"] = creds.accessKeyId;
@@ -16944,7 +17034,7 @@ function createLocalStartApiCommand(opts = {}) {
 * `--help` clusters. Chainable: returns `cmd`.
 */
 function addStartApiSpecificOptions(cmd) {
-	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(new Option("--all-stacks", "Serve every stack's API in a multi-stack app (each API on its own port) instead of erroring out. Mutually exclusive with a positional target subset, --stack, and an explicit --from-cfn-stack <name>; the bare --from-cfn-stack flag stays compatible (binds each routed stack to its own CFn stack).").default(false)).addOption(new Option("--warm", "Pre-start one container per Lambda at server boot").default(false)).addOption(new Option("--per-lambda-concurrency <n>", "Pool size cap per Lambda (default 2, max 4)").default("2")).addOption(new Option("--no-pull", "Skip docker pull (cached image)")).addOption(new Option("--no-build", "Skip docker build on every container Lambda local-asset build (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ZIP Lambdas and the IMAGE ECR-pull path. Compatible with --no-pull.")).addOption(new Option("--container-host <host>", "IP the host uses to bind/probe the RIE port (must be a numeric IP — `docker run -p <ip>:<port>:8080` rejects hostnames). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--debug-port-base <port>", "Reserve a contiguous --debug-port range (one per Lambda)")).addOption(new Option("--debug-port <port>", "Alias of --debug-port-base for parity with `cdkl invoke --debug-port`. Reserves a contiguous --debug-port range (one per Lambda) starting at <port>.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries on the container-Lambda ECR-pull fallback. Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--assume-role <arn-or-pair>", "Assume the Lambda's execution role and forward STS-issued temp creds. Bare <arn> = global default; <LogicalId>=<arn> = per-Lambda override (repeatable). Per-Lambda > global > unset (developer creds passed through).").argParser((raw, prev) => parseAssumeRoleToken(raw, prev))).addOption(new Option("--watch", "Hot-reload: re-synth + re-discover routes when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). Off by default; the server keeps the previous version serving when synth fails mid-reload.").default(false)).addOption(new Option("--stage <name>", "Select an API Gateway Stage by its 'StageName'. Default: the first Stage attached to each API. Drives event.stageVariables for both REST v1 and HTTP API v2. NOTE: For HTTP API v2 routes, requestContext.stage is always '$default' regardless of this flag (AWS-side limitation — HTTP API only exposes one stage to the integration event); only event.stageVariables is affected for v2 routes. For REST v1 routes the selected StageName is also threaded into requestContext.stage.")).addOption(new Option("--api <id>", "DEPRECATED — use the positional <targets...> argument instead. Accepts a SINGLE identifier; for a subset pass multiple positional targets. Same accepted forms (bare logical id, stack-qualified, Construct path, ancestor prefix). Will be removed in a future major release.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in Lambda env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name per routed stack; pass an explicit value when a single CFn stack should serve every routed stack. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--mtls-truststore <path>", `PEM-encoded CA bundle for client-certificate verification (mutual TLS). When set, the local server switches from HTTP to HTTPS and the TLS handshake rejects clients whose certificate doesn't chain to one of these CAs. Verified certs are surfaced on the Lambda event under requestContext.identity.clientCert (REST v1) / requestContext.authentication.clientCert (HTTP API v2). Must be set together with --mtls-cert + --mtls-key; partial flag sets are rejected. Generate a CA + server + client cert for local dev: openssl req -x509 -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.pem -subj "/CN=${getEmbedConfig().resourceNamePrefix}-ca" -days 365; openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-csr.pem -subj "/CN=localhost"; openssl x509 -req -in server-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365; openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-csr.pem -subj "/CN=client"; openssl x509 -req -in client-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365; curl --cacert ca.pem --cert client-cert.pem --key client-key.pem https://localhost:<port>/...`)).addOption(new Option("--mtls-cert <path>", "PEM-encoded server certificate for mutual TLS. Self-signed is fine for local dev. Must be set together with --mtls-truststore + --mtls-key.")).addOption(new Option("--mtls-key <path>", "PEM-encoded server private key matching --mtls-cert. Must be set together with --mtls-truststore + --mtls-cert.")).addOption(new Option("--strict-sigv4", "Opt-in: DENY AWS_IAM SigV4 requests that cannot be cryptographically verified (foreign access-key-id — e.g. a federated / Cognito Identity Pool / cross-account signer — OR no local AWS credentials configured) instead of the default warn-and-pass. DEFAULT off: cdk-local warn-and-passes unverifiable IAM requests with a placeholder principalId so local dev exercises app logic without reproducing an auth boundary it cannot fully emulate. OAC-fronted Function URLs always warn-and-pass regardless.").default(false));
+	return cmd.addOption(new Option("--port <port>", "HTTP server port (default: auto-allocate)").default("0")).addOption(new Option("--host <host>", "Bind address").default("127.0.0.1")).addOption(new Option("--stack <name>", "Stack to start (single-stack apps auto-detect)")).addOption(new Option("--all-stacks", "Serve every stack's API in a multi-stack app (each API on its own port) instead of erroring out. Mutually exclusive with a positional target subset, --stack, and an explicit --from-cfn-stack <name>; the bare --from-cfn-stack flag stays compatible (binds each routed stack to its own CFn stack).").default(false)).addOption(new Option("--warm", "Pre-start one container per Lambda at server boot").default(false)).addOption(new Option("--per-lambda-concurrency <n>", "Pool size cap per Lambda (default 2, max 4)").default("2")).addOption(new Option("--no-pull", "Skip docker pull (cached image)")).addOption(new Option("--no-build", "Skip docker build on every container Lambda local-asset build (use the previously-built tag). Requires the deterministic tag to already be in the local registry; errors with an actionable message when missing. No-op for ZIP Lambdas and the IMAGE ECR-pull path. Compatible with --no-pull.")).addOption(new Option("--container-host <host>", "IP the host uses to bind/probe the RIE port (must be a numeric IP — `docker run -p <ip>:<port>:8080` rejects hostnames). Defaults to 127.0.0.1.").default("127.0.0.1")).addOption(new Option("--debug-port-base <port>", "Reserve a contiguous --debug-port range (one per Lambda)")).addOption(new Option("--debug-port <port>", "Alias of --debug-port-base for parity with `cdkl invoke --debug-port`. Reserves a contiguous --debug-port range (one per Lambda) starting at <port>.")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries on the container-Lambda ECR-pull fallback. Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. Same-account / same-region pulls do not need this flag.")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"LogicalId\":{\"KEY\":\"VALUE\"}, \"Parameters\": {...}})")).addOption(new Option("--assume-role <arn-or-pair>", "Assume the Lambda's execution role and forward STS-issued temp creds. Two forms: (1) `--assume-role <arn>` sets a single global default ARN used for every routed Lambda; (2) `--assume-role <LogicalId>=<arn>` (repeatable) is a per-Lambda override (wins over the global default and over --assume-role-auto for the named Lambda). Pair with --assume-role-auto to auto-resolve every other Lambda. Precedence: per-Lambda > (--assume-role-auto OR global default) > unset (developer creds passed through).").argParser((raw, prev) => parseAssumeRoleToken(raw, prev))).addOption(new Option("--assume-role-auto", "Auto-resolve EACH routed Lambda's own execution role per-Lambda (literal ARN / Fn::GetAtt against template / --from-cfn-stack state). Slower boot — one STS call per Lambda — but the right shape when each Lambda's deployed role differs. Mutually exclusive with `--assume-role <arn>` (global default); errors at boot. Compatible with `--assume-role <LogicalId>=<arn>` per-Lambda overrides — the map wins for named Lambdas, auto-resolve handles the rest.").default(false)).addOption(new Option("--watch", "Hot-reload: re-synth + re-discover routes when the CDK app's source changes (honors cdk.json watch.include/exclude; cdk.out, node_modules, .git are always excluded). Off by default; the server keeps the previous version serving when synth fails mid-reload.").default(false)).addOption(new Option("--stage <name>", "Select an API Gateway Stage by its 'StageName'. Default: the first Stage attached to each API. Drives event.stageVariables for both REST v1 and HTTP API v2. NOTE: For HTTP API v2 routes, requestContext.stage is always '$default' regardless of this flag (AWS-side limitation — HTTP API only exposes one stage to the integration event); only event.stageVariables is affected for v2 routes. For REST v1 routes the selected StageName is also threaded into requestContext.stage.")).addOption(new Option("--api <id>", "DEPRECATED — use the positional <targets...> argument instead. Accepts a SINGLE identifier; for a subset pass multiple positional targets. Same accepted forms (bare logical id, stack-qualified, Construct path, ancestor prefix). Will be removed in a future major release.")).addOption(new Option("--layer-role-arn <arn>", "Role to sts:AssumeRole before calling lambda:GetLayerVersion on every literal-ARN entry in Properties.Layers (issue #448). Use only when the dev credentials cannot read the layer — typically cross-account layers. AWS-published public layers (e.g. Lambda Powertools) are readable from every account and need no role.")).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in Lambda env vars with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the resolved stack name per routed stack; pass an explicit value when a single CFn stack should serve every routed stack. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-cfn-stack as the CFn client region.")).addOption(new Option("--mtls-truststore <path>", `PEM-encoded CA bundle for client-certificate verification (mutual TLS). When set, the local server switches from HTTP to HTTPS and the TLS handshake rejects clients whose certificate doesn't chain to one of these CAs. Verified certs are surfaced on the Lambda event under requestContext.identity.clientCert (REST v1) / requestContext.authentication.clientCert (HTTP API v2). Must be set together with --mtls-cert + --mtls-key; partial flag sets are rejected. Generate a CA + server + client cert for local dev: openssl req -x509 -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.pem -subj "/CN=${getEmbedConfig().resourceNamePrefix}-ca" -days 365; openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-csr.pem -subj "/CN=localhost"; openssl x509 -req -in server-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 365; openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -out client-csr.pem -subj "/CN=client"; openssl x509 -req -in client-csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365; curl --cacert ca.pem --cert client-cert.pem --key client-key.pem https://localhost:<port>/...`)).addOption(new Option("--mtls-cert <path>", "PEM-encoded server certificate for mutual TLS. Self-signed is fine for local dev. Must be set together with --mtls-truststore + --mtls-key.")).addOption(new Option("--mtls-key <path>", "PEM-encoded server private key matching --mtls-cert. Must be set together with --mtls-truststore + --mtls-cert.")).addOption(new Option("--strict-sigv4", "Opt-in: DENY AWS_IAM SigV4 requests that cannot be cryptographically verified (foreign access-key-id — e.g. a federated / Cognito Identity Pool / cross-account signer — OR no local AWS credentials configured) instead of the default warn-and-pass. DEFAULT off: cdk-local warn-and-passes unverifiable IAM requests with a placeholder principalId so local dev exercises app logic without reproducing an auth boundary it cannot fully emulate. OAC-fronted Function URLs always warn-and-pass regardless.").default(false));
 }
 
 //#endregion
@@ -27350,4 +27440,4 @@ function addListSpecificOptions(cmd) {
 
 //#endregion
 export { MCP_PROTOCOL_VERSION as $, pickAgentCoreCandidateStack as $n, applyAuthorizerOverlay as $t, mergeForService as A, rejectExplicitCfnStackWithMultipleStacks as An, startApiServer as At, DEFAULT_SHADOW_READY_TIMEOUT_MS as B, listTargets as Bn, buildMethodArn as Bt, parseRestartPolicy as C, substituteAgainstState as Cn, materializeLayerFromArn as Ct, ImageOverrideError as D, LocalStateSourceError as Dn, filterRoutesByApiIdentifiers as Dt, runEcsServiceEmulator as E, substituteEnvVarsFromStateAsync as En, filterRoutesByApiIdentifier as Et, isLocalCdkAssetImage as F, collectSsmParameterRefs as Fn, buildJwksUrlFromIssuer as Ft, addInvokeAgentCoreSpecificOptions as G, pickRefLogicalId as Gn, attachAuthorizers as Gt, setShadowReadyTimeoutMs as H, discoverWebSocketApisOrThrow as Hn, evaluateCachedLambdaPolicy as Ht, listPinnedTargets as I, resolveSsmParameters as In, createJwksCache as It, A2A_CONTAINER_PORT as J, AGENTCORE_AGUI_PROTOCOL as Jn, buildCorsConfigFromCloudFrontChain as Jt, createLocalInvokeAgentCoreCommand as K, resolveLambdaArnIntrinsic as Kn, applyCorsResponseHeaders as Kt, buildCloudMapIndex as L, resolveWatchConfig as Ln, verifyCognitoJwt as Lt, resolveImageOverrides as M, resolveCfnRegion as Mn, resolveServiceIntegrationParameters as Mt, runImageOverrideBuilds as N, resolveCfnStackName as Nn, defaultCredentialsLoader as Nt, buildImageOverrideTag as O, createLocalStateProvider as On, groupRoutesByServer as Ot, describePinnedImageUri as P, CfnLocalStateProvider as Pn, buildCognitoJwksUrl as Pt, MCP_PATH as Q, AgentCoreResolutionError as Qn, translateLambdaResponse as Qt, CloudMapRegistry as R, resolveSingleTarget as Rn, verifyJwtAuthorizer as Rt, parseMaxTasks as S, EcsTaskResolutionError as Sn, buildStageMap as St, resolveSharedSidecarCredentials as T, substituteEnvVarsFromState as Tn, availableApiIdentifiers as Tt, getContainerNetworkIp as U, parseSelectionExpressionPath as Un, invokeRequestAuthorizer as Ut, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as V, discoverWebSocketApis as Vn, computeRequestIdentityHash as Vt, attachContainerLogStreamer as W, discoverRoutes as Wn, invokeTokenAuthorizer as Wt, a2aInvokeOnce as X, AGENTCORE_MCP_PROTOCOL as Xn, matchPreflight as Xt, A2A_PATH as Y, AGENTCORE_HTTP_PROTOCOL as Yn, isFunctionUrlOacFronted as Yt, MCP_CONTAINER_PORT as Z, AGENTCORE_RUNTIME_TYPE as Zn, matchRoute as Zt, addCommonEcsServiceOptions as _, architectureToPlatform as _n, createWatchPredicates as _t, albStrategy as a, tryParseStatus as an, LocalInvokeBuildError as ar, invokeAgentCore as at, buildEcsImageResolutionContext$1 as b, resolveRuntimeFileExtension as bn, createFileWatcher as bt, resolveAlbTarget as c, probeHostGatewaySupport as cn, SUPPORTED_CODE_RUNTIMES as ct, addStartServiceSpecificOptions as d, buildMgmtEndpointEnvUrl as dn, renderCodeDockerfile as dt, buildHttpApiV2Event as en, resolveAgentCoreTarget as er, mcpInvokeOnce as et, createLocalStartServiceCommand as f, handleConnectionsRequest as fn, toCmdArgv as ft, MAX_TASKS_SUBNET_RANGE_CAP as g, buildMessageEvent as gn, createLocalStartApiCommand as gt, createLocalRunTaskCommand as h, buildDisconnectEvent as hn, addStartApiSpecificOptions as ht, addAlbSpecificOptions as i, selectIntegrationResponse as in, tryResolveImageFnJoin as ir, AGENTCORE_SESSION_ID_HEADER as it, parseImageOverrideFlags as j, resolveCfnFallbackRegion as jn, resolveSelectionExpression as jt, enforceImageOverrideOrphans as k, isCfnFlagPresent as kn, readMtlsMaterialsFromDisk as kt, isApplicationLoadBalancer as l, bufferToBody as ln, buildAgentCoreCodeImage as lt, addRunTaskSpecificOptions as m, buildConnectEvent as mn, createLocalInvokeCommand as mt, createLocalListCommand as n, evaluateResponseParameters as nn, formatStateRemedy as nr, AGENTCORE_SIGV4_SERVICE as nt, createLocalStartAlbCommand as o, VtlEvaluationError as on, buildStsClientConfig as or, waitForAgentCorePing as ot, serviceStrategy as p, parseConnectionsPath as pn, addInvokeSpecificOptions as pt, invokeAgentCoreWs as q, AGENTCORE_A2A_PROTOCOL as qn, buildCorsConfigByApiId as qt, formatTargetListing as r, pickResponseTemplate as rn, substituteImagePlaceholders as rr, signAgentCoreInvocation as rt, parseLbPortOverrides as s, HOST_GATEWAY_MIN_VERSION as sn, resolveProfileCredentials as sr, downloadAndExtractS3Bundle as st, addListSpecificOptions as t, buildRestV1Event as tn, derivePseudoParametersFromRegion as tr, parseSseForJsonRpc as tt, resolveAlbFrontDoor as u, ConnectionRegistry as un, computeCodeImageTag as ut, addEcsAssumeRoleOptions as v, buildContainerImage as vn, resolveApiTargetSubset as vt, resolveEcsAssumeRoleOption as w, substituteAgainstStateAsync as wn, resolveEnvVars as wt, ecsClusterOption as x, resolveRuntimeImage as xn, attachStageContext as xt, addImageOverrideOptions as y, resolveRuntimeCodeMountPath as yn, createAuthorizerCache as yt, classifySourceChange as z, countTargets as zn, verifyJwtViaDiscovery as zt };
-//# sourceMappingURL=local-list-Dn0Al276.js.map
+//# sourceMappingURL=local-list-CFINvNxo.js.map