cdk-local 0.9.0 → 0.11.0

package/README.md

@@ -108,6 +108,8 @@ Use this for fast iteration on Lambda code, API routing checks, and container ta
 
 Once your stack is deployed to AWS (via the AWS CDK CLI or any other tool), pass `--from-cfn-stack <StackName>` and cdk-local reads the deployed CloudFormation stack to inject real ARNs, Secrets values, and IAM credentials (resolved from your current AWS profile) into the local execution.
 
+For Lambda (`invoke`, `start-api`), this also recovers env-var values that CloudFormation resolved at deploy time but `ListStackResources` does not expose — e.g. `SIBLING_ARN: Fn::GetAtt <OtherFunction>.Arn`. cdk-local reads the deployed function's own resolved `Environment.Variables` (via `lambda:GetFunctionConfiguration`) and fills those keys, so a Lambda that calls a sibling Lambda by ARN runs locally without a manual `--env-vars` entry. (These values enter the local container env in plaintext; Lambda env vars are a non-secret property, so this exposes nothing the deployed function doesn't already surface to any caller with `lambda:GetFunctionConfiguration`.)
+
 #### HTTP APIs & Function URLs — `start-api` (the headline use case)
 
 A local API talking to real AWS — point a frontend at it for end-to-end debugging, including real Cognito JWT verification.

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { i as createLocalStartApiCommand, r as createLocalRunTaskCommand, t as createLocalStartServiceCommand, u as createLocalInvokeCommand } from "./local-start-service-Rit5YxNR.js";
+import { i as createLocalStartApiCommand, r as createLocalRunTaskCommand, t as createLocalStartServiceCommand, v as createLocalInvokeCommand } from "./local-start-service-BwAE8kN7.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.9.0");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.11.0");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalStartApiCommand());
 program.addCommand(createLocalRunTaskCommand());

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","names":[],"sources":["../src/cli/index.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { Command } from 'commander';\nimport { createLocalInvokeCommand } from './commands/local-invoke.js';\nimport { createLocalStartApiCommand } from './commands/local-start-api.js';\nimport { createLocalRunTaskCommand } from './commands/local-run-task.js';\nimport { createLocalStartServiceCommand } from './commands/local-start-service.js';\n\ndeclare const __CDK_LOCAL_VERSION__: string;\n\nconst program = new Command();\nprogram\n  .name('cdkl')\n  .description('Run AWS CDK stacks locally with Docker.')\n  .version(__CDK_LOCAL_VERSION__);\n\nprogram.addCommand(createLocalInvokeCommand());\nprogram.addCommand(createLocalStartApiCommand());\nprogram.addCommand(createLocalRunTaskCommand());\nprogram.addCommand(createLocalStartServiceCommand());\n\nvoid program.parseAsync(process.argv);\n"],"mappings":";;;;;AAUA,MAAM,UAAU,IAAI,SAAS;AAC7B,QACG,KAAK,OAAO,CACZ,YAAY,0CAA0C,CACtD,gBAA8B;AAEjC,QAAQ,WAAW,0BAA0B,CAAC;AAC9C,QAAQ,WAAW,4BAA4B,CAAC;AAChD,QAAQ,WAAW,2BAA2B,CAAC;AAC/C,QAAQ,WAAW,gCAAgC,CAAC;AAE/C,QAAQ,WAAW,QAAQ,KAAK"}
+{"version":3,"file":"cli.js","names":[],"sources":["../src/cli/index.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { Command } from 'commander';\nimport { createLocalInvokeCommand } from './commands/local-invoke.js';\nimport { createLocalStartApiCommand } from './commands/local-start-api.js';\nimport { createLocalRunTaskCommand } from './commands/local-run-task.js';\nimport { createLocalStartServiceCommand } from './commands/local-start-service.js';\n\ndeclare const __CDK_LOCAL_VERSION__: string;\n\nconst program = new Command();\nprogram\n  .name('cdkl')\n  .description('Run AWS CDK stacks locally with Docker.')\n  .version(__CDK_LOCAL_VERSION__);\n\nprogram.addCommand(createLocalInvokeCommand());\nprogram.addCommand(createLocalStartApiCommand());\nprogram.addCommand(createLocalRunTaskCommand());\nprogram.addCommand(createLocalStartServiceCommand());\n\nvoid program.parseAsync(process.argv);\n"],"mappings":";;;;;AAUA,MAAM,UAAU,IAAI,SAAS;AAC7B,QACG,KAAK,OAAO,CACZ,YAAY,0CAA0C,CACtD,iBAA8B;AAEjC,QAAQ,WAAW,0BAA0B,CAAC;AAC9C,QAAQ,WAAW,4BAA4B,CAAC;AAChD,QAAQ,WAAW,2BAA2B,CAAC;AAC/C,QAAQ,WAAW,gCAAgC,CAAC;AAE/C,QAAQ,WAAW,QAAQ,KAAK"}

package/dist/index.d.ts

@@ -43,6 +43,7 @@ interface LocalStateProvider {
   readonly label: string;
   load(stackName: string, synthRegion: string | undefined): Promise<LocalStateRecord | undefined>;
   buildCrossStackResolver(consumerRegion: string): Promise<CrossStackResolver | undefined>;
+  resolveDeployedFunctionEnv?(functionPhysicalId: string): Promise<Record<string, string> | undefined>;
   dispose(): void;
 }
 //#endregion
@@ -75,6 +76,59 @@ interface CdkLocalEmbedConfig {
   envPrefix?: string;
 }
 //#endregion
+//#region src/types/resource.d.ts
+interface CloudFormationTemplate {
+  AWSTemplateFormatVersion?: string;
+  Description?: string;
+  Parameters?: Record<string, TemplateParameter>;
+  Resources: Record<string, TemplateResource>;
+  Outputs?: Record<string, TemplateOutput>;
+  Conditions?: Record<string, unknown>;
+  Mappings?: Record<string, unknown>;
+  Transform?: unknown;
+  Rules?: Record<string, unknown>;
+}
+interface TemplateParameter {
+  Type: string;
+  Default?: unknown;
+  Description?: string;
+  AllowedValues?: unknown[];
+  AllowedPattern?: string;
+  ConstraintDescription?: string;
+}
+interface TemplateResource {
+  Type: string;
+  Properties?: Record<string, unknown>;
+  DependsOn?: string | readonly string[];
+  Condition?: string;
+  Metadata?: Record<string, unknown>;
+  CreationPolicy?: Record<string, unknown>;
+  UpdatePolicy?: Record<string, unknown>;
+  DeletionPolicy?: 'Delete' | 'Retain' | 'Snapshot';
+  UpdateReplacePolicy?: 'Delete' | 'Retain' | 'Snapshot';
+}
+interface TemplateOutput {
+  Value: unknown;
+  Description?: string;
+  Export?: {
+    Name: string;
+  };
+}
+//#endregion
+//#region src/synthesis/assembly-reader.d.ts
+interface StackInfo {
+  stackName: string;
+  displayName: string;
+  artifactId: string;
+  template: CloudFormationTemplate;
+  assetManifestPath?: string | undefined;
+  dependencyNames: string[];
+  region?: string | undefined;
+  account?: string | undefined;
+  terminationProtection?: boolean | undefined;
+  nestedTemplates?: Record<string, string> | undefined;
+}
+//#endregion
 //#region src/cli/commands/local-invoke.d.ts
 interface CreateLocalInvokeCommandOptions {
   extraStateProviders?: ExtraStateProviders;
@@ -82,6 +136,77 @@ interface CreateLocalInvokeCommandOptions {
 }
 declare function createLocalInvokeCommand(opts?: CreateLocalInvokeCommandOptions): Command;
 //#endregion
+//#region src/local/httpv2-service-integration.d.ts
+type SupportedSubtype = 'EventBridge-PutEvents' | 'SQS-SendMessage' | 'SQS-ReceiveMessage' | 'SQS-DeleteMessage' | 'SQS-PurgeQueue' | 'Kinesis-PutRecord' | 'StepFunctions-StartExecution' | 'StepFunctions-StartSyncExecution' | 'StepFunctions-StopExecution' | 'AppConfig-GetConfiguration';
+//#endregion
+//#region src/local/integration-response-selector.d.ts
+interface IntegrationResponseEntry {
+  StatusCode: string;
+  SelectionPattern?: string;
+  ResponseParameters?: Record<string, string>;
+  ResponseTemplates?: Record<string, string>;
+  ContentHandling?: string;
+}
+//#endregion
+//#region src/local/rest-v1-integrations.d.ts
+interface MockIntegrationConfig {
+  kind: 'mock';
+  requestTemplate: string | undefined;
+  responses: IntegrationResponseEntry[];
+}
+interface HttpProxyIntegrationConfig {
+  kind: 'http-proxy';
+  uri: string;
+  integrationHttpMethod?: string;
+  requestParameters?: Record<string, string>;
+  responses: IntegrationResponseEntry[];
+}
+interface HttpIntegrationConfig {
+  kind: 'http';
+  uri: string;
+  integrationHttpMethod?: string;
+  requestParameters?: Record<string, string>;
+  requestTemplates?: Record<string, string>;
+  responses: IntegrationResponseEntry[];
+}
+interface AwsLambdaIntegrationConfig {
+  kind: 'aws-lambda';
+  lambdaLogicalId: string;
+  requestTemplates?: Record<string, string>;
+  responses: IntegrationResponseEntry[];
+}
+//#endregion
+//#region src/local/route-discovery.d.ts
+type RestV1IntegrationConfig = MockIntegrationConfig | HttpProxyIntegrationConfig | HttpIntegrationConfig | AwsLambdaIntegrationConfig;
+interface DiscoveredRoute {
+  method: string;
+  pathPattern: string;
+  lambdaLogicalId: string;
+  source: 'http-api' | 'rest-v1' | 'function-url';
+  apiVersion: 'v1' | 'v2';
+  stage: string;
+  apiLogicalId?: string;
+  apiStackName?: string;
+  apiCdkPath?: string;
+  stageVariables?: Record<string, string> | null;
+  invokeMode?: 'BUFFERED' | 'RESPONSE_STREAM';
+  unsupported?: {
+    reason: string;
+  };
+  mockCors?: {
+    statusCode: number;
+    headers: Record<string, string>;
+  };
+  serviceIntegration?: {
+    subtype: SupportedSubtype;
+    requestParameters: Readonly<Record<string, unknown>>;
+    responseParameters?: Readonly<Record<string, Readonly<Record<string, string>>>>;
+  };
+  restV1Integration?: RestV1IntegrationConfig;
+  declaredAt: string;
+}
+declare function discoverRoutes(stacks: readonly StackInfo[]): DiscoveredRoute[];
+//#endregion
 //#region src/cli/commands/local-start-api.d.ts
 interface CreateLocalStartApiCommandOptions {
   extraStateProviders?: ExtraStateProviders;
@@ -114,10 +239,13 @@ declare class CfnLocalStateProvider implements LocalStateProvider {
   private readonly cfnStackName;
   private readonly region;
   private client;
+  private lambdaClient;
   private readonly clientOptions;
   private disposed;
   constructor(opts: CfnLocalStateProviderOptions);
   private getClient;
+  private getLambdaClient;
+  resolveDeployedFunctionEnv(functionPhysicalId: string): Promise<Record<string, string> | undefined>;
   load(_stackName: string, _synthRegion: string | undefined): Promise<LocalStateRecord | undefined>;
   buildCrossStackResolver(_consumerRegion: string): Promise<CrossStackResolver | undefined>;
   dispose(): void;
@@ -169,5 +297,76 @@ declare function translateLambdaResponse(payload: unknown, version: 'v1' | 'v2')
 //#region src/local/docker-inspect.d.ts
 declare function getContainerNetworkIp(containerId: string, networkName: string): Promise<string | undefined>;
 //#endregion
-export { type CdkLocalEmbedConfig, CfnLocalStateProvider, type CfnLocalStateProviderOptions, type CreateLocalInvokeCommandOptions, type CreateLocalRunTaskCommandOptions, type CreateLocalStartApiCommandOptions, type CreateLocalStartServiceCommandOptions, type CrossStackResolver, type ExtraStateProviders, type LambdaArnResolveOutcome, type LocalStateProvider, type LocalStateProviderFactory, type LocalStateRecord, LocalStateSourceError, type LocalStateSourceOptions, type RequestParameterContext, type ResolveParametersOutcome, type SubstitutionContext, type TranslatedHttpResponse, createLocalInvokeCommand, createLocalRunTaskCommand, createLocalStartApiCommand, createLocalStartServiceCommand, createLocalStateProvider, getContainerNetworkIp, isCfnFlagPresent, pickRefLogicalId, rejectExplicitCfnStackWithMultipleStacks, resolveCfnRegion, resolveCfnStackName, resolveLambdaArnIntrinsic, resolveSelectionExpression, resolveServiceIntegrationParameters, translateLambdaResponse };
+//#region src/local/route-matcher.d.ts
+interface RouteMatchResult {
+  route: DiscoveredRoute;
+  pathParameters: Record<string, string>;
+}
+declare function matchRoute(method: string, requestPath: string, routes: readonly DiscoveredRoute[]): RouteMatchResult | null;
+//#endregion
+//#region src/local/api-gateway-event.d.ts
+interface HttpRequestSnapshot {
+  method: string;
+  rawUrl: string;
+  headers: Record<string, string[]>;
+  body: Buffer;
+  sourceIp?: string;
+  clientCert?: Record<string, unknown>;
+}
+interface MatchedRouteContext {
+  route: DiscoveredRoute;
+  pathParameters: Record<string, string>;
+  matchedPath: string;
+}
+declare function buildHttpApiV2Event(req: HttpRequestSnapshot, ctx: MatchedRouteContext, opts?: {
+  now?: () => Date;
+}): Record<string, unknown>;
+declare function buildRestV1Event(req: HttpRequestSnapshot, ctx: MatchedRouteContext, opts?: {
+  now?: () => Date;
+}): Record<string, unknown>;
+type AuthorizerEventOverlay = {
+  kind: 'lambda-rest-v1';
+  principalId?: string;
+  context?: Record<string, unknown>;
+} | {
+  kind: 'lambda-http-v2';
+  principalId?: string;
+  context?: Record<string, unknown>;
+} | {
+  kind: 'cognito-rest-v1';
+  claims: Record<string, unknown>;
+} | {
+  kind: 'jwt-http-v2';
+  claims: Record<string, unknown>;
+  scopes?: string[];
+};
+declare function applyAuthorizerOverlay(event: Record<string, unknown>, overlay: AuthorizerEventOverlay): Record<string, unknown>;
+//#endregion
+//#region src/local/websocket-route-discovery.d.ts
+interface DiscoveredWebSocketApi {
+  apiLogicalId: string;
+  apiStackName: string;
+  declaredAt: string;
+  apiCdkPath?: string;
+  routeSelectionExpression: string;
+  stage: string;
+  routes: WebSocketRouteEntry[];
+  unsupported?: {
+    reason: string;
+  };
+}
+interface WebSocketRouteEntry {
+  routeKey: string;
+  targetLambdaLogicalId: string;
+  lambdaStackName: string;
+  declaredAt: string;
+}
+declare function discoverWebSocketApis(stacks: readonly StackInfo[]): {
+  apis: DiscoveredWebSocketApi[];
+  errors: string[];
+};
+declare function discoverWebSocketApisOrThrow(stacks: readonly StackInfo[]): DiscoveredWebSocketApi[];
+declare function parseSelectionExpressionPath(expr: string): string[];
+//#endregion
+export { type AuthorizerEventOverlay, type CdkLocalEmbedConfig, CfnLocalStateProvider, type CfnLocalStateProviderOptions, type CreateLocalInvokeCommandOptions, type CreateLocalRunTaskCommandOptions, type CreateLocalStartApiCommandOptions, type CreateLocalStartServiceCommandOptions, type CrossStackResolver, type DiscoveredRoute, type DiscoveredWebSocketApi, type ExtraStateProviders, type HttpRequestSnapshot, type LambdaArnResolveOutcome, type LocalStateProvider, type LocalStateProviderFactory, type LocalStateRecord, LocalStateSourceError, type LocalStateSourceOptions, type MatchedRouteContext, type RequestParameterContext, type ResolveParametersOutcome, type RestV1IntegrationConfig, type RouteMatchResult, type SubstitutionContext, type TranslatedHttpResponse, type WebSocketRouteEntry, applyAuthorizerOverlay, buildHttpApiV2Event, buildRestV1Event, createLocalInvokeCommand, createLocalRunTaskCommand, createLocalStartApiCommand, createLocalStartServiceCommand, createLocalStateProvider, discoverRoutes, discoverWebSocketApis, discoverWebSocketApisOrThrow, getContainerNetworkIp, isCfnFlagPresent, matchRoute, parseSelectionExpressionPath, pickRefLogicalId, rejectExplicitCfnStackWithMultipleStacks, resolveCfnRegion, resolveCfnStackName, resolveLambdaArnIntrinsic, resolveSelectionExpression, resolveServiceIntegrationParameters, translateLambdaResponse };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/local/state-resolver.ts","../src/local/local-state-provider.ts","../src/cli/commands/local-state-source.ts","../src/local/embed-config.ts","../src/cli/commands/local-invoke.ts","../src/cli/commands/local-start-api.ts","../src/cli/commands/local-run-task.ts","../src/cli/commands/local-start-service.ts","../src/local/cfn-local-state-provider.ts","../src/local/intrinsic-utils.ts","../src/local/intrinsic-lambda-arn.ts","../src/local/parameter-mapping.ts","../src/local/api-gateway-response.ts","../src/local/docker-inspect.ts"],"mappings":";;;;UAuLiB,aAAA;EAEf,UAAA;EAGA,YAAA;EAGA,UAAA,EAAY,MAAA;EAcZ,kBAAA,GAAqB,MAAA;EAGrB,UAAA,GAAa,MAAA;EAGb,YAAA;EAGA,QAAA,GAAW,MAAA;EAmBX,cAAA;EAMA,mBAAA;EAyBA,aAAA;AAAA;;;UCxIe,gBAAA;EACf,SAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAqBe,kBAAA;EAOf,aAAA,CAAc,UAAA,WAAqB,OAAA;EAQnC,qBAAA,CACE,aAAA,UACA,cAAA,UACA,UAAA,WACC,OAAA;AAAA;AAAA,UAGY,mBAAA;EAEf,SAAA,EAAW,MAAA,SAAe,aAAA;EAE1B,gBAAA,GAAmB,gBAAA;EAOnB,kBAAA,GAAqB,kBAAA;EAOrB,cAAA;AAAA;;;UCrJe,gBAAA;EAQf,SAAA,EAAW,MAAA,SAAe,aAAA;EAO1B,OAAA,EAAS,MAAA;EAOT,MAAA;AAAA;AAAA,UAsBe,kBAAA;EAAA,SAMN,KAAA;EAQT,IAAA,CAAK,SAAA,UAAmB,WAAA,uBAAkC,OAAA,CAAQ,gBAAA;EAalE,uBAAA,CAAwB,cAAA,WAAyB,OAAA,CAAQ,kBAAA;EAKzD,OAAA;AAAA;;;UC9Ee,uBAAA;EAOf,YAAA;EAEA,MAAA;EAEA,OAAA;EAMA,WAAA;EAAA,CAEC,GAAA;AAAA;AAAA,KAQS,yBAAA,IAA6B,OAAA,EAAS,uBAAA,KAA4B,kBAAA;AAAA,KAUlE,mBAAA,GAAsB,MAAA,SAAe,yBAAA;AAAA,iBAUjC,mBAAA,CAAoB,YAAA,oBAAgC,SAAA;AAAA,iBAapD,gBAAA,CAAiB,IAAA,EAAM,IAAA,CAAK,uBAAA;AAAA,iBAgB5B,gBAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,6BACd,WAAA;AAAA,cAqBW,qBAAA,SAA8B,KAAA;cAC7B,OAAA;AAAA;AAAA,iBAkBE,wCAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,mBACd,gBAAA;AAAA,iBAiCc,wBAAA,CACd,OAAA,EAAS,uBAAA,EACT,SAAA,UACA,WAAA,sBACA,mBAAA,GAAsB,mBAAA,GACrB,kBAAA;;;UCtLc,mBAAA;EAMf,OAAA;EAOA,UAAA;EAMA,WAAA;EAOA,kBAAA;EAMA,gBAAA;EAMA,SAAA;AAAA;;;UC8Ee,+BAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA22BA,wBAAA,CAAyB,IAAA,GAAM,+BAAA,GAAuC,OAAA;;;UCzvBrE,iCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA47FA,0BAAA,CAA2B,IAAA,GAAM,iCAAA,GAAyC,OAAA;;;UCxlGzE,gCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAseA,yBAAA,CAA0B,IAAA,GAAM,gCAAA,GAAwC,OAAA;;;UC5evE,qCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAipBA,8BAAA,CACd,IAAA,GAAM,qCAAA,GACL,OAAA;;;UC/qBc,4BAAA;EAOf,YAAA;EAKA,MAAA;EAiBA,OAAA;AAAA;AAAA,cAGW,qBAAA,YAAiC,kBAAA;EAAA,SAG5B,KAAA;EAAA,iBACC,YAAA;EAAA,iBACA,MAAA;EAAA,QAKT,MAAA;EAAA,iBACS,aAAA;EAAA,QAQT,QAAA;cAEI,IAAA,EAAM,4BAAA;EAAA,QAOV,SAAA;EA+BK,IAAA,CACX,UAAA,UACA,YAAA,uBACC,OAAA,CAAQ,gBAAA;EA4DE,uBAAA,CACX,eAAA,WACC,OAAA,CAAQ,kBAAA;EAiEJ,OAAA,CAAA;AAAA;;;iBC1RO,gBAAA,CAAiB,KAAA;;;KCmCrB,uBAAA;EACN,IAAA;EAAkB,SAAA;AAAA;EAClB,IAAA;EAAqB,MAAA;AAAA;AAAA,iBAuBX,yBAAA,CAA0B,KAAA,YAAiB,uBAAA;;;UCpB1C,uBAAA;EAEf,OAAA,EAAS,QAAA,CAAS,MAAA;EAElB,WAAA,EAAa,QAAA,CAAS,MAAA;EAEtB,cAAA,EAAgB,QAAA,CAAS,MAAA;EAEzB,WAAA;EAEA,IAAA;EAEA,OAAA,EAAS,QAAA,CAAS,MAAA;EAElB,cAAA,EAAgB,QAAA,CAAS,MAAA;EAoBzB,UAAA,GAAa,QAAA,CAAS,MAAA;AAAA;AAAA,KASZ,wBAAA;EACN,IAAA;EAAY,QAAA,EAAU,MAAA;AAAA;EACtB,IAAA;EAAe,MAAA;AAAA;AAAA,iBAQL,mCAAA,CACd,UAAA,EAAY,QAAA,CAAS,MAAA,oBACrB,GAAA,EAAK,uBAAA,GACJ,wBAAA;AAAA,iBAkCa,0BAAA,CAA2B,KAAA,UAAe,GAAA,EAAK,uBAAA;;;UCnH9C,sBAAA;EACf,UAAA;EAMA,OAAA,EAAS,MAAA;EAET,OAAA;EAEA,IAAA,EAAM,MAAA;AAAA;AAAA,iBAgBQ,uBAAA,CACd,OAAA,WACA,OAAA,gBACC,sBAAA;;;iBChCmB,qBAAA,CACpB,WAAA,UACA,WAAA,WACC,OAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/local/state-resolver.ts","../src/local/local-state-provider.ts","../src/cli/commands/local-state-source.ts","../src/local/embed-config.ts","../src/types/resource.ts","../src/synthesis/assembly-reader.ts","../src/cli/commands/local-invoke.ts","../src/local/httpv2-service-integration.ts","../src/local/integration-response-selector.ts","../src/local/rest-v1-integrations.ts","../src/local/route-discovery.ts","../src/cli/commands/local-start-api.ts","../src/cli/commands/local-run-task.ts","../src/cli/commands/local-start-service.ts","../src/local/cfn-local-state-provider.ts","../src/local/intrinsic-utils.ts","../src/local/intrinsic-lambda-arn.ts","../src/local/parameter-mapping.ts","../src/local/api-gateway-response.ts","../src/local/docker-inspect.ts","../src/local/route-matcher.ts","../src/local/api-gateway-event.ts","../src/local/websocket-route-discovery.ts"],"mappings":";;;;UAuLiB,aAAA;EAEf,UAAA;EAGA,YAAA;EAGA,UAAA,EAAY,MAAA;EAcZ,kBAAA,GAAqB,MAAA;EAGrB,UAAA,GAAa,MAAA;EAGb,YAAA;EAGA,QAAA,GAAW,MAAA;EAmBX,cAAA;EAMA,mBAAA;EAyBA,aAAA;AAAA;;;UCxIe,gBAAA;EACf,SAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAqBe,kBAAA;EAOf,aAAA,CAAc,UAAA,WAAqB,OAAA;EAQnC,qBAAA,CACE,aAAA,UACA,cAAA,UACA,UAAA,WACC,OAAA;AAAA;AAAA,UAGY,mBAAA;EAEf,SAAA,EAAW,MAAA,SAAe,aAAA;EAE1B,gBAAA,GAAmB,gBAAA;EAOnB,kBAAA,GAAqB,kBAAA;EAOrB,cAAA;AAAA;;;UCrJe,gBAAA;EAWf,SAAA,EAAW,MAAA,SAAe,aAAA;EAO1B,OAAA,EAAS,MAAA;EAOT,MAAA;AAAA;AAAA,UAsBe,kBAAA;EAAA,SAMN,KAAA;EAQT,IAAA,CAAK,SAAA,UAAmB,WAAA,uBAAkC,OAAA,CAAQ,gBAAA;EAalE,uBAAA,CAAwB,cAAA,WAAyB,OAAA,CAAQ,kBAAA;EA4BzD,0BAAA,EACE,kBAAA,WACC,OAAA,CAAQ,MAAA;EAKX,OAAA;AAAA;;;UC/Ge,uBAAA;EAOf,YAAA;EAEA,MAAA;EAEA,OAAA;EAMA,WAAA;EAAA,CAEC,GAAA;AAAA;AAAA,KAQS,yBAAA,IAA6B,OAAA,EAAS,uBAAA,KAA4B,kBAAA;AAAA,KAUlE,mBAAA,GAAsB,MAAA,SAAe,yBAAA;AAAA,iBAUjC,mBAAA,CAAoB,YAAA,oBAAgC,SAAA;AAAA,iBAapD,gBAAA,CAAiB,IAAA,EAAM,IAAA,CAAK,uBAAA;AAAA,iBAgB5B,gBAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,6BACd,WAAA;AAAA,cAqBW,qBAAA,SAA8B,KAAA;cAC7B,OAAA;AAAA;AAAA,iBAkBE,wCAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,mBACd,gBAAA;AAAA,iBAiCc,wBAAA,CACd,OAAA,EAAS,uBAAA,EACT,SAAA,UACA,WAAA,sBACA,mBAAA,GAAsB,mBAAA,GACrB,kBAAA;;;UCtLc,mBAAA;EAMf,OAAA;EAOA,UAAA;EAMA,WAAA;EAOA,kBAAA;EAMA,gBAAA;EAMA,SAAA;AAAA;;;UCrDe,sBAAA;EACf,wBAAA;EACA,WAAA;EACA,UAAA,GAAa,MAAA,SAAe,iBAAA;EAC5B,SAAA,EAAW,MAAA,SAAe,gBAAA;EAC1B,OAAA,GAAU,MAAA,SAAe,cAAA;EACzB,UAAA,GAAa,MAAA;EACb,QAAA,GAAW,MAAA;EAWX,SAAA;EACA,KAAA,GAAQ,MAAA;AAAA;AAAA,UAMO,iBAAA;EACf,IAAA;EACA,OAAA;EACA,WAAA;EACA,aAAA;EACA,cAAA;EACA,qBAAA;AAAA;AAAA,UAMe,gBAAA;EACf,IAAA;EACA,UAAA,GAAa,MAAA;EACb,SAAA;EACA,SAAA;EACA,QAAA,GAAW,MAAA;EACX,cAAA,GAAiB,MAAA;EACjB,YAAA,GAAe,MAAA;EACf,cAAA;EACA,mBAAA;AAAA;AAAA,UAMe,cAAA;EACf,KAAA;EACA,WAAA;EACA,MAAA;IACE,IAAA;EAAA;AAAA;;;UCxCa,SAAA;EAEf,SAAA;EAOA,WAAA;EAGA,UAAA;EAGA,QAAA,EAAU,sBAAA;EAGV,iBAAA;EAGA,eAAA;EAGA,MAAA;EAGA,OAAA;EAOA,qBAAA;EAcA,eAAA,GAAkB,MAAA;AAAA;;;UCoEH,+BAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAg4BA,wBAAA,CAAyB,IAAA,GAAM,+BAAA,GAAuC,OAAA;;;KCz7B1E,gBAAA;;;UCnCK,wBAAA;EAEf,UAAA;EAOA,gBAAA;EAaA,kBAAA,GAAqB,MAAA;EAQrB,iBAAA,GAAoB,MAAA;EAEpB,eAAA;AAAA;;;UC2Ee,qBAAA;EACf,IAAA;EAOA,eAAA;EAEA,SAAA,EAAW,wBAAA;AAAA;AAAA,UA8FI,0BAAA;EACf,IAAA;EAEA,GAAA;EAEA,qBAAA;EAMA,iBAAA,GAAoB,MAAA;EAEpB,SAAA,EAAW,wBAAA;AAAA;AAAA,UAsGI,qBAAA;EACf,IAAA;EACA,GAAA;EACA,qBAAA;EACA,iBAAA,GAAoB,MAAA;EAEpB,gBAAA,GAAmB,MAAA;EACnB,SAAA,EAAW,wBAAA;AAAA;AAAA,UA2II,0BAAA;EACf,IAAA;EAEA,eAAA;EAEA,gBAAA,GAAmB,MAAA;EAEnB,SAAA,EAAW,wBAAA;AAAA;;;KClfD,uBAAA,GACR,qBAAA,GACA,0BAAA,GACA,qBAAA,GACA,0BAAA;AAAA,UAmCa,eAAA;EAEf,MAAA;EAEA,WAAA;EAEA,eAAA;EAEA,MAAA;EAEA,UAAA;EAUA,KAAA;EAgBA,YAAA;EAQA,YAAA;EAWA,UAAA;EAOA,cAAA,GAAiB,MAAA;EAWjB,UAAA;EAsBA,WAAA;IAAgB,MAAA;EAAA;EAgBhB,QAAA;IAAa,UAAA;IAAoB,OAAA,EAAS,MAAA;EAAA;EAgB1C,kBAAA;IACE,OAAA,EAAS,gBAAA;IACT,iBAAA,EAAmB,QAAA,CAAS,MAAA;IAC5B,kBAAA,GAAqB,QAAA,CAAS,MAAA,SAAe,QAAA,CAAS,MAAA;EAAA;EAaxD,iBAAA,GAAoB,uBAAA;EAEpB,UAAA;AAAA;AAAA,iBAoBc,cAAA,CAAe,MAAA,WAAiB,SAAA,KAAc,eAAA;;;UCqB7C,iCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA4+FA,0BAAA,CAA2B,IAAA,GAAM,iCAAA,GAAyC,OAAA;;;UCzoGzE,gCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAseA,yBAAA,CAA0B,IAAA,GAAM,gCAAA,GAAwC,OAAA;;;UC5evE,qCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAipBA,8BAAA,CACd,IAAA,GAAM,qCAAA,GACL,OAAA;;;UCzqBc,4BAAA;EAOf,YAAA;EAKA,MAAA;EAiBA,OAAA;AAAA;AAAA,cAGW,qBAAA,YAAiC,kBAAA;EAAA,SAG5B,KAAA;EAAA,iBACC,YAAA;EAAA,iBACA,MAAA;EAAA,QAKT,MAAA;EAAA,QAKA,YAAA;EAAA,iBACS,aAAA;EAAA,QAQT,QAAA;cAEI,IAAA,EAAM,4BAAA;EAAA,QAOV,SAAA;EAAA,QAmBA,eAAA;EAyBK,0BAAA,CACX,kBAAA,WACC,OAAA,CAAQ,MAAA;EAmCE,IAAA,CACX,UAAA,UACA,YAAA,uBACC,OAAA,CAAQ,gBAAA;EA4DE,uBAAA,CACX,eAAA,WACC,OAAA,CAAQ,kBAAA;EAiEJ,OAAA,CAAA;AAAA;;;iBCvVO,gBAAA,CAAiB,KAAA;;;KCmCrB,uBAAA;EACN,IAAA;EAAkB,SAAA;AAAA;EAClB,IAAA;EAAqB,MAAA;AAAA;AAAA,iBAuBX,yBAAA,CAA0B,KAAA,YAAiB,uBAAA;;;UCpB1C,uBAAA;EAEf,OAAA,EAAS,QAAA,CAAS,MAAA;EAElB,WAAA,EAAa,QAAA,CAAS,MAAA;EAEtB,cAAA,EAAgB,QAAA,CAAS,MAAA;EAEzB,WAAA;EAEA,IAAA;EAEA,OAAA,EAAS,QAAA,CAAS,MAAA;EAElB,cAAA,EAAgB,QAAA,CAAS,MAAA;EAoBzB,UAAA,GAAa,QAAA,CAAS,MAAA;AAAA;AAAA,KASZ,wBAAA;EACN,IAAA;EAAY,QAAA,EAAU,MAAA;AAAA;EACtB,IAAA;EAAe,MAAA;AAAA;AAAA,iBAQL,mCAAA,CACd,UAAA,EAAY,QAAA,CAAS,MAAA,oBACrB,GAAA,EAAK,uBAAA,GACJ,wBAAA;AAAA,iBAkCa,0BAAA,CAA2B,KAAA,UAAe,GAAA,EAAK,uBAAA;;;UCnH9C,sBAAA;EACf,UAAA;EAMA,OAAA,EAAS,MAAA;EAET,OAAA;EAEA,IAAA,EAAM,MAAA;AAAA;AAAA,iBAgBQ,uBAAA,CACd,OAAA,WACA,OAAA,gBACC,sBAAA;;;iBChCmB,qBAAA,CACpB,WAAA,UACA,WAAA,WACC,OAAA;;;UCHc,gBAAA;EACf,KAAA,EAAO,eAAA;EACP,cAAA,EAAgB,MAAA;AAAA;AAAA,iBAQF,UAAA,CACd,MAAA,UACA,WAAA,UACA,MAAA,WAAiB,eAAA,KAChB,gBAAA;;;UC5Bc,mBAAA;EAEf,MAAA;EAKA,MAAA;EAMA,OAAA,EAAS,MAAA;EAET,IAAA,EAAM,MAAA;EAEN,QAAA;EAwBA,UAAA,GAAa,MAAA;AAAA;AAAA,UAQE,mBAAA;EACf,KAAA,EAAO,eAAA;EACP,cAAA,EAAgB,MAAA;EAEhB,WAAA;AAAA;AAAA,iBA+Bc,mBAAA,CACd,GAAA,EAAK,mBAAA,EACL,GAAA,EAAK,mBAAA,EACL,IAAA;EAAQ,GAAA,SAAY,IAAA;AAAA,IACnB,MAAA;AAAA,iBA4Ea,gBAAA,CACd,GAAA,EAAK,mBAAA,EACL,GAAA,EAAK,mBAAA,EACL,IAAA;EAAQ,GAAA,SAAY,IAAA;AAAA,IACnB,MAAA;AAAA,KAiFS,sBAAA;EACN,IAAA;EAAwB,WAAA;EAAsB,OAAA,GAAU,MAAA;AAAA;EACxD,IAAA;EAAwB,WAAA;EAAsB,OAAA,GAAU,MAAA;AAAA;EACxD,IAAA;EAAyB,MAAA,EAAQ,MAAA;AAAA;EACjC,IAAA;EAAqB,MAAA,EAAQ,MAAA;EAAyB,MAAA;AAAA;AAAA,iBAY5C,sBAAA,CACd,KAAA,EAAO,MAAA,mBACP,OAAA,EAAS,sBAAA,GACR,MAAA;;;UC3Pc,sBAAA;EAEf,YAAA;EAEA,YAAA;EAEA,UAAA;EAMA,UAAA;EAQA,wBAAA;EAOA,KAAA;EAaA,MAAA,EAAQ,mBAAA;EAiBR,WAAA;IAAgB,MAAA;EAAA;AAAA;AAAA,UAID,mBAAA;EAEf,QAAA;EAEA,qBAAA;EAEA,eAAA;EAEA,UAAA;AAAA;AAAA,iBAuBc,qBAAA,CAAsB,MAAA,WAAiB,SAAA;EACrD,IAAA,EAAM,sBAAA;EACN,MAAA;AAAA;AAAA,iBA8Bc,4BAAA,CACd,MAAA,WAAiB,SAAA,KAChB,sBAAA;AAAA,iBAgJa,4BAAA,CAA6B,IAAA"}

package/dist/index.js

@@ -1,3 +1,3 @@
-import { _ as CfnLocalStateProvider, a as resolveSelectionExpression, c as pickRefLogicalId, d as LocalStateSourceError, f as createLocalStateProvider, g as resolveCfnStackName, h as resolveCfnRegion, i as createLocalStartApiCommand, l as resolveLambdaArnIntrinsic, m as rejectExplicitCfnStackWithMultipleStacks, n as getContainerNetworkIp, o as resolveServiceIntegrationParameters, p as isCfnFlagPresent, r as createLocalRunTaskCommand, s as translateLambdaResponse, t as createLocalStartServiceCommand, u as createLocalInvokeCommand } from "./local-start-service-Rit5YxNR.js";
+import { C as resolveCfnRegion, S as rejectExplicitCfnStackWithMultipleStacks, T as CfnLocalStateProvider, _ as resolveLambdaArnIntrinsic, a as resolveSelectionExpression, b as createLocalStateProvider, c as translateLambdaResponse, d as buildRestV1Event, f as discoverWebSocketApis, g as pickRefLogicalId, h as discoverRoutes, i as createLocalStartApiCommand, l as applyAuthorizerOverlay, m as parseSelectionExpressionPath, n as getContainerNetworkIp, o as resolveServiceIntegrationParameters, p as discoverWebSocketApisOrThrow, r as createLocalRunTaskCommand, s as matchRoute, t as createLocalStartServiceCommand, u as buildHttpApiV2Event, v as createLocalInvokeCommand, w as resolveCfnStackName, x as isCfnFlagPresent, y as LocalStateSourceError } from "./local-start-service-BwAE8kN7.js";
 
-export { CfnLocalStateProvider, LocalStateSourceError, createLocalInvokeCommand, createLocalRunTaskCommand, createLocalStartApiCommand, createLocalStartServiceCommand, createLocalStateProvider, getContainerNetworkIp, isCfnFlagPresent, pickRefLogicalId, rejectExplicitCfnStackWithMultipleStacks, resolveCfnRegion, resolveCfnStackName, resolveLambdaArnIntrinsic, resolveSelectionExpression, resolveServiceIntegrationParameters, translateLambdaResponse };
+export { CfnLocalStateProvider, LocalStateSourceError, applyAuthorizerOverlay, buildHttpApiV2Event, buildRestV1Event, createLocalInvokeCommand, createLocalRunTaskCommand, createLocalStartApiCommand, createLocalStartServiceCommand, createLocalStateProvider, discoverRoutes, discoverWebSocketApis, discoverWebSocketApisOrThrow, getContainerNetworkIp, isCfnFlagPresent, matchRoute, parseSelectionExpressionPath, pickRefLogicalId, rejectExplicitCfnStackWithMultipleStacks, resolveCfnRegion, resolveCfnStackName, resolveLambdaArnIntrinsic, resolveSelectionExpression, resolveServiceIntegrationParameters, translateLambdaResponse };

package/dist/{local-start-service-Rit5YxNR.js → local-start-service-BwAE8kN7.js}

@@ -8,6 +8,7 @@ import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk
 import { AssetManifestArtifact } from "@aws-cdk/cloud-assembly-api";
 import { CdkAppMultiContext, NonInteractiveIoHost, Toolkit } from "@aws-cdk/toolkit-lib";
 import { CloudFormationClient, DescribeStacksCommand, ListExportsCommand, ListStackResourcesCommand } from "@aws-sdk/client-cloudformation";
+import { GetFunctionConfigurationCommand, LambdaClient } from "@aws-sdk/client-lambda";
 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -531,13 +532,18 @@ function resolveCdkPathToLogicalIds(input, index) {
 *     map built from `ListStackResources.StackResourceSummaries[]` (one
 *     entry per `(LogicalResourceId, PhysicalResourceId, ResourceType)`
 *     tuple).
-*   - `Fn::GetAtt: [<LogicalId>, <Attr>]` → **warn-and-drop**. CFn's
-*     `ListStackResources` does NOT return per-attribute values
-*     and the v1 policy (issue #606 recommendation (a)) is to surface
-*     a per-key warn instead of pulling in the full provisioning layer
-*     to call provider-specific describe APIs (e.g. `GetQueueAttributes`
-*     for SQS, `GetFunction` for Lambda). Users override the affected
-*     env var via `--env-vars` if the value is critical.
+*   - `Fn::GetAtt: [<LogicalId>, <Attr>]` → not resolvable from
+*     `ListStackResources` (which returns physical IDs only, no
+*     per-attribute values). For a Lambda function's OWN env vars this
+*     gap is closed by {@link CfnLocalStateProvider.resolveDeployedFunctionEnv}:
+*     because `--from-cfn-stack` means the consumer function is itself
+*     deployed, CloudFormation already resolved every intrinsic (incl.
+*     `Fn::GetAtt <Sibling>.Arn`) into the function's
+*     `Environment.Variables` at deploy time, so the env-substitution
+*     layer reads the concrete value back via
+*     `lambda:GetFunctionConfiguration`. Intrinsic values that are NOT a
+*     consumer-Lambda env var (e.g. an ECS container env entry) still
+*     warn-and-drop and can be overridden via `--env-vars`.
 *   - `Fn::ImportValue: <exportName>` → resolved via `ListExports`
 *     (paginated). Same-region only — CFn exports are region-scoped.
 *   - `Fn::GetStackOutput` → rejected with a clear pointer that the
@@ -574,6 +580,7 @@ var CfnLocalStateProvider = class {
 	cfnStackName;
 	region;
 	client;
+	lambdaClient;
 	clientOptions;
 	disposed = false;
 	constructor(opts) {
@@ -590,6 +597,37 @@ var CfnLocalStateProvider = class {
 		});
 		return this.client;
 	}
+	getLambdaClient() {
+		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
+		if (!this.lambdaClient) this.lambdaClient = new LambdaClient({
+			region: this.region,
+			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
+		});
+		return this.lambdaClient;
+	}
+	/**
+	* Read a deployed Lambda function's already-resolved
+	* `Environment.Variables` via `lambda:GetFunctionConfiguration`. See
+	* {@link LocalStateProvider.resolveDeployedFunctionEnv} for why this
+	* closes the `Fn::GetAtt`/`Fn::Sub`/cross-stack gap for a consumer
+	* function's own env vars.
+	*
+	* Best-effort: on any expected miss (function not found, access
+	* denied, throttling) logs a warn and returns `undefined` so the
+	* caller falls back to warn-and-drop on the affected keys. Never
+	* throws out of the substitution pass.
+	*/
+	async resolveDeployedFunctionEnv(functionPhysicalId) {
+		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
+		const logger = getLogger();
+		const client = this.getLambdaClient();
+		try {
+			return (await client.send(new GetFunctionConfigurationCommand({ FunctionName: functionPhysicalId }))).Environment?.Variables ?? {};
+		} catch (err) {
+			logger.warn(`${this.label}: GetFunctionConfiguration(${functionPhysicalId}) failed: ${formatAwsErrorForWarn(err)}. Intrinsic-valued env vars that need the deployed value will warn-and-drop (grant lambda:GetFunctionConfiguration or override via --env-vars).`);
+			return;
+		}
+	}
 	/**
 	* Load the deployed CFn stack's resources + outputs and return them
 	* as a synthetic `LocalStateRecord` (matching the shape the existing
@@ -675,6 +713,10 @@ var CfnLocalStateProvider = class {
 			this.client.destroy();
 			this.client = void 0;
 		}
+		if (this.lambdaClient) {
+			this.lambdaClient.destroy();
+			this.lambdaClient = void 0;
+		}
 	}
 };
 /**
@@ -2597,6 +2639,52 @@ async function substituteEnvVarsFromStateAsync(templateEnv, contextOrResources)
 		audit
 	};
 }
+/**
+* Last-resort fill for env keys that static substitution could not
+* resolve, using the consumer resource's already-deployed environment.
+*
+* When a Lambda / container is bound to a deployed CloudFormation stack
+* (`--from-cfn-stack`), the consumer itself is deployed, so CloudFormation
+* already resolved every intrinsic (`Fn::GetAtt`, `Fn::Sub`,
+* `Fn::ImportValue`, cross-stack `Ref`) into its concrete deployed env
+* value. `ListStackResources` does not return per-attribute values, so
+* the static substituter drops those keys — but the deployed env carries
+* the answer. The provider fetches the deployed env (e.g.
+* `lambda:GetFunctionConfiguration`) and this helper splices it in for
+* the keys that remained unresolved.
+*
+* Precedence: only keys in `unresolved` are touched — statically resolved
+* keys and literal keys are left exactly as the substituter produced
+* them, and a `--env-vars` override still wins downstream. Keys absent
+* from `deployedEnv` stay unresolved so the caller's warn-and-drop fires.
+*
+* Pure: returns new arrays / a new env map, never mutates the inputs.
+*/
+function applyDeployedEnvFallback(resolvedEnv, unresolved, deployedEnv) {
+	if (!deployedEnv) return {
+		env: resolvedEnv,
+		filled: [],
+		stillUnresolved: [...unresolved]
+	};
+	const env = { ...resolvedEnv };
+	const filled = [];
+	const stillUnresolved = [];
+	for (const item of unresolved) {
+		const deployedValue = deployedEnv[item.key];
+		if (deployedValue !== void 0) {
+			env[item.key] = deployedValue;
+			filled.push(item.key);
+		} else stillUnresolved.push({
+			key: item.key,
+			reason: item.reason
+		});
+	}
+	return {
+		env,
+		filled,
+		stillUnresolved
+	};
+}
 
 //#endregion
 //#region src/local/ecs-task-resolver.ts
@@ -5152,10 +5240,28 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 				}
 				const { env, audit } = await substituteEnvVarsFromStateAsync(templateEnv, subContext);
 				templateEnv = env;
-				stateAudit = audit;
 				const label = stateProvider.label;
 				for (const key of audit.resolvedKeys) logger.debug(`${label}: substituted env var ${key}`);
-				for (const { key, reason } of audit.unresolved) logger.warn(`${label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
+				let unresolved = audit.unresolved;
+				const resolvedKeys = [...audit.resolvedKeys];
+				if (unresolved.length > 0 && stateProvider.resolveDeployedFunctionEnv) {
+					const physicalId = loaded.resources[lambda.logicalId]?.physicalId;
+					if (physicalId) {
+						const deployedEnv = await stateProvider.resolveDeployedFunctionEnv(physicalId);
+						const fb = applyDeployedEnvFallback(templateEnv, unresolved, deployedEnv);
+						templateEnv = fb.env;
+						unresolved = fb.stillUnresolved;
+						for (const key of fb.filled) {
+							resolvedKeys.push(key);
+							logger.debug(`${label}: filled env var ${key} from deployed function config`);
+						}
+					}
+				}
+				stateAudit = {
+					resolvedKeys,
+					unresolved
+				};
+				for (const { key, reason } of unresolved) logger.warn(`${label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
 			}
 		} finally {
 			stateProvider.dispose();
@@ -6944,6 +7050,16 @@ function discoverWebSocketApis(stacks) {
 		errors
 	};
 }
+/**
+* Convenience wrapper around {@link discoverWebSocketApis} that
+* throws on any error (mirrors `discoverRoutes` for HTTP — useful in
+* test fixtures where errors should fail fast).
+*/
+function discoverWebSocketApisOrThrow(stacks) {
+	const { apis, errors } = discoverWebSocketApis(stacks);
+	if (errors.length > 0) throw new RouteDiscoveryError(`${getEmbedConfig().cliName} start-api: ${errors.length} malformed WebSocket API(s) in the synthesized template:\n` + errors.map((e) => `  - ${e}`).join("\n"));
+	return apis;
+}
 function discoverOneApi(logicalId, resource, template, stackName) {
 	const props = resource.Properties ?? {};
 	const declaredAt = `${stackName}/${logicalId}`;
@@ -14878,9 +14994,24 @@ async function buildContainerSpec(args) {
 		if (stateBundle.pseudoParameters) context.pseudoParameters = stateBundle.pseudoParameters;
 		const { env, audit } = substituteEnvVarsFromState(templateEnv, context);
 		templateEnv = env;
-		stateAudit = audit;
 		for (const key of audit.resolvedKeys) getLogger().debug(`Lambda ${logicalId}: state source substituted env var ${key}`);
-		for (const { key, reason } of audit.unresolved) getLogger().warn(`Lambda ${logicalId}: state source could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
+		let unresolved = audit.unresolved;
+		const resolvedKeys = [...audit.resolvedKeys];
+		const deployedEnv = stateBundle.deployedEnvByLambda?.get(logicalId);
+		if (unresolved.length > 0 && deployedEnv) {
+			const fb = applyDeployedEnvFallback(templateEnv, unresolved, deployedEnv);
+			templateEnv = fb.env;
+			unresolved = fb.stillUnresolved;
+			for (const key of fb.filled) {
+				resolvedKeys.push(key);
+				getLogger().debug(`Lambda ${logicalId}: filled env var ${key} from deployed function config`);
+			}
+		}
+		stateAudit = {
+			resolvedKeys,
+			unresolved
+		};
+		for (const { key, reason } of unresolved) getLogger().warn(`Lambda ${logicalId}: state source could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
 	}
 	const lambdaCdkPath = readCdkPathOrUndefined(lambda.resource);
 	const envResult = resolveEnvVars(logicalId, lambdaCdkPath, templateEnv, overrides);
@@ -15656,6 +15787,19 @@ async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options,
 				const pseudo = await resolvePseudoParametersForStartApi(loaded.region, options);
 				if (pseudo) bundle.pseudoParameters = pseudo;
 			}
+			if (provider.resolveDeployedFunctionEnv) {
+				const deployedEnvByLambda = /* @__PURE__ */ new Map();
+				for (const logicalId of lambdaIds) {
+					const resource = stack.template.Resources?.[logicalId];
+					if (!resource || resource.Type !== "AWS::Lambda::Function") continue;
+					if (!envHasIntrinsicValue(getTemplateEnv(resource))) continue;
+					const physicalId = loaded.resources[logicalId]?.physicalId;
+					if (!physicalId) continue;
+					const deployedEnv = await provider.resolveDeployedFunctionEnv(physicalId);
+					if (deployedEnv) deployedEnvByLambda.set(logicalId, deployedEnv);
+				}
+				if (deployedEnvByLambda.size > 0) bundle.deployedEnvByLambda = deployedEnvByLambda;
+			}
 			out.set(stackName, bundle);
 			logger.debug(`${provider.label}: loaded state for ${stackName} (${loaded.region})`);
 		} finally {
@@ -18304,5 +18448,5 @@ function createLocalStartServiceCommand(opts = {}) {
 }
 
 //#endregion
-export { CfnLocalStateProvider as _, resolveSelectionExpression as a, pickRefLogicalId as c, LocalStateSourceError as d, createLocalStateProvider as f, resolveCfnStackName as g, resolveCfnRegion as h, createLocalStartApiCommand as i, resolveLambdaArnIntrinsic as l, rejectExplicitCfnStackWithMultipleStacks as m, getContainerNetworkIp as n, resolveServiceIntegrationParameters as o, isCfnFlagPresent as p, createLocalRunTaskCommand as r, translateLambdaResponse as s, createLocalStartServiceCommand as t, createLocalInvokeCommand as u };
-//# sourceMappingURL=local-start-service-Rit5YxNR.js.map
+export { resolveCfnRegion as C, rejectExplicitCfnStackWithMultipleStacks as S, CfnLocalStateProvider as T, resolveLambdaArnIntrinsic as _, resolveSelectionExpression as a, createLocalStateProvider as b, translateLambdaResponse as c, buildRestV1Event as d, discoverWebSocketApis as f, pickRefLogicalId as g, discoverRoutes as h, createLocalStartApiCommand as i, applyAuthorizerOverlay as l, parseSelectionExpressionPath as m, getContainerNetworkIp as n, resolveServiceIntegrationParameters as o, discoverWebSocketApisOrThrow as p, createLocalRunTaskCommand as r, matchRoute as s, createLocalStartServiceCommand as t, buildHttpApiV2Event as u, createLocalInvokeCommand as v, resolveCfnStackName as w, isCfnFlagPresent as x, LocalStateSourceError as y };
+//# sourceMappingURL=local-start-service-BwAE8kN7.js.map