fix(lambda-nodejs): use powershell for spawn steps on Windows

packages/aws-cdk-lib/aws-lambda-nodejs/lib/bundling.ts

@@ -365,10 +365,20 @@ export class Bundling implements cdk.BundlingOptions {
               }
               break;
             case 'spawn':
-              exec(step.command[0], step.command.slice(1), {
-                ...execOptions,
-                cwd: step.cwd ?? cwd,
-              });
+              // On Windows with Node 22+, spawnSync fails with EINVAL when invoking
+              // .cmd shims (e.g. npx.cmd) directly. Route through powershell instead.
+              // See https://github.com/aws/aws-cdk/issues/37387
+              if (osPlatform === 'win32') {
+                exec('powershell.exe', ['-NoProfile', '-Command', `& ${preparePosixShellCommand(step.command)}`], {
+                  ...execOptions,
+                  cwd: step.cwd ?? cwd,
+                });
+              } else {
+                exec(step.command[0], step.command.slice(1), {
+                  ...execOptions,
+                  cwd: step.cwd ?? cwd,
+                });
+              }
               break;
             case 'callback':
               try {

packages/aws-cdk-lib/aws-lambda-nodejs/test/bundling.test.ts

@@ -1499,6 +1499,81 @@ test('Local bundling with shell metacharacters in externalModules does not cause
   spawnSyncMock.mockRestore();
 });
 
+test('Local bundling on Windows uses powershell for spawn steps', () => {
+  const osPlatformMock = jest.spyOn(os, 'platform').mockReturnValue('win32');
+  const spawnSyncMock = jest.spyOn(child_process, 'spawnSync').mockReturnValue(spawnSyncMockReturnValue);
+
+  const bundler = new Bundling(stack, {
+    entry,
+    projectRoot,
+    depsLockFilePath,
+    runtime: STANDARD_RUNTIME,
+    architecture: Architecture.X86_64,
+  });
+
+  bundler.local?.tryBundle('/outdir', { image: STANDARD_RUNTIME.bundlingDockerImage });
+
+  // Esbuild is invoked via powershell with single-quoted args
+  expect(spawnSyncMock).toHaveBeenCalledWith(
+    'powershell.exe',
+    ['-NoProfile', '-Command', expect.stringContaining('--bundle')],
+    expect.objectContaining({ cwd: '/project' }),
+  );
+
+  // Args are single-quoted (posixShellEscape)
+  const psCall = spawnSyncMock.mock.calls.find(c => c[0] === 'powershell.exe' && (c[1] as string[])[2]?.includes('--bundle'));
+  expect(psCall).toBeDefined();
+  const cmdString = (psCall![1] as string[])[2];
+  expect(cmdString).toContain("'--bundle'");
+  expect(cmdString).toContain("'--platform=node'");
+
+  spawnSyncMock.mockRestore();
+  osPlatformMock.mockRestore();
+});
+
+test('Local bundling on Windows uses cmd for shell steps', () => {
+  const osPlatformMock = jest.spyOn(os, 'platform').mockReturnValue('win32');
+  const spawnSyncMock = jest.spyOn(child_process, 'spawnSync').mockReturnValue(spawnSyncMockReturnValue);
+
+  const bundler = new Bundling(stack, {
+    entry,
+    projectRoot,
+    depsLockFilePath,
+    runtime: STANDARD_RUNTIME,
+    architecture: Architecture.X86_64,
+    commandHooks: {
+      beforeBundling(_inputDir: string, _outputDir: string): string[] {
+        return ['echo hello'];
+      },
+      afterBundling(): string[] {
+        return [];
+      },
+      beforeInstall(): string[] {
+        return [];
+      },
+    },
+  });
+
+  bundler.local?.tryBundle('/outdir', { image: STANDARD_RUNTIME.bundlingDockerImage });
+
+  // Shell hooks still use cmd on Windows
+  expect(spawnSyncMock).toHaveBeenCalledWith(
+    'cmd',
+    ['/c', 'echo hello'],
+    expect.objectContaining({ windowsVerbatimArguments: true }),
+  );
+
+  // But esbuild spawn step uses powershell
+  expect(spawnSyncMock).toHaveBeenCalledWith(
+    'powershell.exe',
+    ['-NoProfile', '-Command', expect.stringContaining('--bundle')],
+    expect.anything(),
+  );
+
+  spawnSyncMock.mockRestore();
+  osPlatformMock.mockRestore();
+});
+
 test('Local bundling with pnpm uses fs for workspace yaml and cleanup', () => {
   const spawnSyncMock = jest.spyOn(child_process, 'spawnSync').mockReturnValue(spawnSyncMockReturnValue);
   const writeFileSyncMock = jest.spyOn(fs, 'writeFileSync').mockReturnValue();