cdk-local 0.149.3 → 0.149.4

package/dist/{local-studio-BbLfdSy4.js → local-studio-Cdq8klwg.js}

@@ -1699,6 +1699,393 @@ function effectiveAssumeRoleArn(logicalId, opt) {
 	return opt.perLambda?.[logicalId] ?? opt.globalArn;
 }
 
+//#endregion
+//#region src/utils/assembly-path.ts
+/**
+* `true` when `candidate` names something strictly beneath `base`, both given
+* as already-resolved absolute paths.
+*
+* The `..` test is SEPARATOR-AWARE rather than a bare `startsWith('..')`,
+* which would also reject a legitimate sibling named `..foo`. The empty-string
+* case is `base` itself; callers decide whether that counts as an escape,
+* because an asset path legitimately names a DIRECTORY while a template path
+* does not.
+*/
+function isInside(base, candidate) {
+	const rel = relative(base, candidate);
+	if (rel === "" || rel === "..") return false;
+	if (rel.startsWith(`..${sep}`)) return false;
+	return !isAbsolute(rel);
+}
+/**
+* `realpath(3)`, or `undefined` for a path that does not fully resolve.
+*
+* `.native` is load-bearing and must not be simplified to `fs.realpathSync`.
+* The plain form is a JavaScript walker that folds `..` LEXICALLY, so it
+* disagrees with the kernel on a target carrying a `..` after a symlinked
+* component — answering `ENOENT` for a path the kernel resolves, and on a
+* case-insensitive filesystem (APFS by default) it can spin on the same shape.
+* `.native` is libuv's `realpath(3)` and throws the same
+* `ENOENT` / `ELOOP` / `EACCES`.
+*/
+function tryRealpath(p) {
+	try {
+		return realpathSync.native(p);
+	} catch {
+		return;
+	}
+}
+/** `fs.readlinkSync`, or `undefined` when `p` is not a symbolic link. */
+function tryReadlink(p) {
+	try {
+		return readlinkSync(p);
+	} catch {
+		return;
+	}
+}
+/**
+* Link follows before the walk gives up and reports the path as unresolvable.
+* It does NOT refuse: an exhausted budget answers `undefined`, which leaves
+* the symlink arm silent and the lexical verdict standing. Safe because the OS
+* gives up first (macOS caps at 32, `ELOOP`), so a chain that reaches this cap
+* is one nothing can open anyway.
+*/
+const MAX_LINK_HOPS = 40;
+/**
+* Unresolvable path COMPONENTS the climb walks before giving up. Bounds the
+* recursion below, which is one frame per component, so a pathological value
+* cannot raise a `RangeError` from inside {@link tryRealpath}'s own `try` (its
+* `catch` would swallow the crash into a silent `undefined`).
+*
+* KNOW THAT EXHAUSTING THIS FAILS OPEN, and why that is accepted rather than
+* unnoticed. Unlike {@link MAX_LINK_HOPS}, which has the OS's own `ELOOP` cap
+* behind it, nothing else stops a path of 1 001 absent components: the climb
+* gives up, the symlink arm goes silent, and a value that would land outside
+* reads as CONTAINED on the lexical verdict alone. It is not reachable in
+* effect — such a path cannot exist, so `cdkl invoke`'s `existsSync` refuses it
+* and `start-api`'s `docker run` fails to mount it — but that safety lives in
+* the CONSUMERS, not here. A consumer that neither checks existence nor mounts
+* would need its own answer.
+*/
+const MAX_PATH_COMPONENTS = 1e3;
+/**
+* Where `target` REALLY points, for a path that may not exist yet.
+*
+* `realpathSync` answers only for a path that fully resolves, and it throws
+* `ENOENT` for a DANGLING symbolic link exactly as it does for an absent file.
+* `cdkl start-api` resolves an asset path without an existence check, so an
+* absent or dangling component must not silence the symlink arm.
+*
+* Each unresolvable component is therefore handled by hand: climb to the
+* deepest ancestor that DOES resolve, then re-apply the remaining components,
+* following any symbolic link with `readlink` and re-resolving its target.
+* `undefined` means the walk could not resolve the path at all.
+*
+* For a path that FULLY RESOLVES the answer is the kernel's and is exact. For
+* one that does not exist yet this is a best-effort MODEL of kernel
+* resolution; the known edge is a `..` INSIDE an unresolvable link's target,
+* folded lexically here while the kernel folds it only after following each
+* preceding component. That edge is benign for THESE callers rather than in
+* general: it needs the target to be absent, and both consumers resolve the
+* path and then open or mount it, so the divergence is between this model and
+* a path nothing can reach. A caller that CREATED a file through such a path
+* would need an `lstat` of its own.
+*
+* `EACCES` is folded into "does not resolve" along with `ENOENT`, so a link
+* under a directory this process cannot traverse reads as contained. Same
+* bound: the consumer's own `existsSync` / mount runs as the same user and
+* fails identically.
+*/
+function resolveThroughLinks(target, hops = 0, climbs = 0) {
+	const direct = tryRealpath(target);
+	if (direct !== void 0) return direct;
+	if (hops >= MAX_LINK_HOPS) return void 0;
+	if (climbs >= MAX_PATH_COMPONENTS) return void 0;
+	const parent = dirname(target);
+	if (parent === target) return void 0;
+	const realParent = resolveThroughLinks(parent, hops, climbs + 1);
+	if (realParent === void 0) return void 0;
+	const link = tryReadlink(target);
+	if (link === void 0) return join(realParent, basename(target));
+	return resolveThroughLinks(resolve(realParent, link), hops + 1, climbs);
+}
+/**
+* Resolve an assembly-supplied `candidate` against `dir` and report whether
+* the result stays inside it.
+*
+* The lexical arm joins exactly the way the call sites used to (`path.join`,
+* NOT `path.resolve`), so the verdict is about the path the caller will
+* actually use. `join`'s handling of an absolute candidate makes this arm
+* strictly more permissive than a `resolve`-based one would be; an absolute
+* value is therefore answered by {@link absoluteAssemblyPathEscape} instead,
+* because this function structurally cannot.
+*
+* The SYMLINK arm exists because the lexical arm alone leaves an equivalent
+* hole: `cdk.out/link -> /etc` plus a candidate of `link/passwd` is lexically
+* contained and still reaches `/etc/passwd`. Both sides go through
+* {@link resolveThroughLinks}, so an assembly directory REACHED through a link
+* (macOS spells `/tmp` as `/private/tmp`) is unaffected.
+*
+* The verdict is about the assembly AS IT SITS ON DISK. It is NOT a defence
+* against a process rewriting that directory concurrently — the caller uses
+* the path after this returns.
+*/
+function resolveAssemblyPath(dir, candidate, options) {
+	const base = resolve(dir);
+	const bound = options?.containWithin === void 0 ? base : resolve(options.containWithin);
+	const joined = resolve(join(base, candidate));
+	if (!isInside(bound, joined)) return {
+		contained: false,
+		escape: "lexical",
+		path: joined
+	};
+	const realBound = resolveThroughLinks(bound);
+	if (realBound !== void 0) {
+		const realTarget = resolveThroughLinks(joined);
+		if (realTarget !== void 0 && !isInside(realBound, realTarget)) return {
+			contained: false,
+			escape: "symlink",
+			path: joined,
+			realPath: realTarget
+		};
+	}
+	return {
+		contained: true,
+		path: joined
+	};
+}
+/**
+* Whether an ALREADY-ABSOLUTE assembly-supplied path lies outside `bound`.
+*
+* {@link resolveAssemblyPath} cannot answer this, and the reason is structural
+* rather than an oversight: its lexical arm joins with `path.join`, which does
+* NOT honour a leading separator, so an absolute candidate is folded INTO the
+* directory and the verdict would describe a path no caller opens. A site that
+* HONOURS an absolute value needs the verdict about the value itself.
+*
+* The callers are `cdkl invoke`'s and `cdkl start-api`'s
+* `Metadata['aws:asset:path']` resolution. Those honour an absolute path
+* because `cdk synth --no-staging` emits one — CDK writes the asset's absolute
+* SOURCE directory under `aws:cdk:disable-asset-staging`, usually outside the
+* outdir — and they WARN rather than refuse when it leaves the bound, so this
+* returns a verdict rather than throwing. The asset-MANIFEST readers that
+* honour an absolute value take the same verdict: `'honour-warn'` (the
+* start-cloudfront origin) warns when the value is a folder inside the user's
+* project not under a credential or version-control directory, and refuses
+* otherwise, `'honour'` (the soft-reload
+* sources) refuses (#745).
+*
+* It lives HERE so the containment rule has one spelling: it reuses this
+* module's own {@link isInside} and {@link resolveThroughLinks}, symlink arm
+* included, rather than letting a caller re-spell `path.relative` and drift.
+*
+* `bound` itself is NOT an escape, unlike in {@link resolveAssemblyPath},
+* where an empty `path.relative` means "names the directory rather than a file
+* inside it". An asset path legitimately names a DIRECTORY, so a value equal
+* to the bound is inside it and reporting it as outside would be false.
+*
+* THE REAL PATHS DECIDE IN BOTH DIRECTIONS, which is the one place this
+* deliberately does more than {@link resolveAssemblyPath}'s lexical-first
+* ordering. The lexical verdict here is about a SPELLING, and two spellings of
+* the same directory are common rather than exotic: macOS resolves `/tmp` to
+* `/private/tmp` and `/var` to `/private/var`, and a user may symlink `cdk.out`
+* itself. With an outdir of `/tmp/cdk.out` and a `--no-staging` value of
+* `/private/tmp/cdk.out/src`, a lexical-only verdict cries "pointing outside
+* the assembly ... treat this assembly as untrusted" about an asset that is
+* plainly inside it — and this arm exists to make an UNEXPECTED path visible,
+* so a false alarm is the failure that costs it its meaning.
+*
+* Exonerating requires the kernel to answer for BOTH operands: an unresolvable
+* one leaves the lexical verdict standing, so the arm stays loud when it cannot
+* see. (`resolveAssemblyPath` cannot take the same shape: its verdict is about
+* a path built with `path.join`, and letting a real path overrule the lexical
+* `..` there would answer about a location the caller never opens.)
+*/
+function absoluteAssemblyPathEscape(bound, absolutePath) {
+	const resolvedBound = resolve(bound);
+	const target = resolve(absolutePath);
+	const lexicallyOutside = !isInside(resolvedBound, target) && target !== resolvedBound;
+	const realBound = resolveThroughLinks(resolvedBound);
+	const realTarget = resolveThroughLinks(target);
+	const reallyOutside = realBound === void 0 || realTarget === void 0 ? void 0 : !isInside(realBound, realTarget) && realTarget !== realBound;
+	if (lexicallyOutside) {
+		if (reallyOutside === false) return void 0;
+		return {
+			contained: false,
+			escape: "lexical",
+			path: target
+		};
+	}
+	if (reallyOutside === true) return {
+		contained: false,
+		escape: "symlink",
+		path: target,
+		realPath: realTarget
+	};
+}
+/**
+* Whether `candidate` names the SAME directory as `bound` — lexically, or
+* through a symbolic link on either side.
+*
+* An asset source legitimately names a DIRECTORY, so a value that resolves
+* onto the output directory itself is not an escape; but it hands the WHOLE
+* assembly to the sink, which is worth a line. A caller that re-spells this as
+* `resolve(a) === resolve(b)` misses every second spelling of the bound
+* (macOS `/tmp` vs `/private/tmp`, a symlinked `cdk.out`), and
+* {@link absoluteAssemblyPathEscape} exonerates exactly those spellings as
+* inside — so the equality beside it would stay silent for them.
+*
+* Conservative on failure: an unresolvable side answers from the lexical
+* comparison alone, so it can only say "not the same", never wrongly claim
+* identity.
+*/
+function namesTheSameDirectory(bound, candidate) {
+	const resolvedBound = resolve(bound);
+	const target = resolve(candidate);
+	if (target === resolvedBound) return true;
+	const realBound = resolveThroughLinks(resolvedBound);
+	const realTarget = resolveThroughLinks(target);
+	return realBound !== void 0 && realTarget !== void 0 && realBound === realTarget;
+}
+/**
+* The escape verdict for an assembly-supplied path WITHOUT throwing, taking
+* whichever arm the value's own shape calls for: {@link absoluteAssemblyPathEscape}
+* for an absolute value, {@link resolveAssemblyPath} for a relative one.
+*
+* For a caller that only WARNS and has many values to judge — the BuildKit
+* passthroughs in `src/assets/buildkit-passthrough-warnings.ts`. `base` is what
+* a relative value resolves against, `bound` what it must stay inside.
+* Returns `undefined` when the value is fine, including when it names `bound`
+* itself ({@link namesTheSameDirectory}).
+*/
+function assemblyPathEscape(base, bound, candidate) {
+	if (isAbsolute(candidate)) return absoluteAssemblyPathEscape(bound, candidate);
+	const resolved = resolveAssemblyPath(base, candidate, { containWithin: bound });
+	if (resolved.contained || namesTheSameDirectory(bound, resolved.path)) return void 0;
+	return resolved;
+}
+/**
+* The shared tail of a containment refusal: what the value resolved to, what
+* it escaped, and why that means the assembly is not CDK-generated. The call
+* site supplies its own subject ("Lambda 'X' has ... which ") and its own
+* error class. `action` completes "Refusing to ..." and is REQUIRED rather
+* than defaulted: a default is a branch no caller takes, so it can neither be
+* fenced nor be right for the next caller.
+*
+* `provenanceOverride` replaces that whole closing sentence for a caller that
+* does NOT refuse — the BuildKit passthrough warnings, where "Refusing to ..."
+* would be a false statement about a value that is forwarded anyway.
+*/
+function renderAssemblyPathEscape(escape, dir, action, provenanceOverride) {
+	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
+	const base = resolve(dir);
+	const realBase = resolveThroughLinks(base) ?? base;
+	const shownPath = displayUntrustedValue(escape.path);
+	const shownBase = displayUntrustedValue(base);
+	if (escape.escape === "symlink") {
+		if (escape.realPath === realBase) return `resolves to ${shownPath}, a symbolic link to the directory ${shownBase} itself rather than to a path inside it. ${provenance}`;
+		return `resolves to ${shownPath}, which leads through a symbolic link to ${displayUntrustedValue(escape.realPath)}, outside ${shownBase}. ${provenance}`;
+	}
+	if (escape.path === base) return `names the directory ${shownBase} itself rather than a path inside it. ${provenance}`;
+	return `resolves to ${shownPath}, outside ${shownBase}. ${provenance}`;
+}
+/**
+* A letter or digit that neither draws as a blank nor reads as a quote.
+* `\p{L}` alone admits both, so two classes are carved out: the
+* default-ignorables, which hold letters that draw as a blank (the Hangul
+* fillers U+3164 and U+FFA0), and the quote-shaped letters — the Spacing
+* Modifier Letters block (U+02BA reads as `"`, U+02BC as `'`) plus the ones
+* outside it (U+0374, U+0559, U+07F4-U+07F5, U+A78B-U+A78C, and the halfwidth
+* sound marks U+FF9E-U+FF9F). Not all of `\p{Lm}`: U+30FC is in it, and it is
+* an ordinary character of a Japanese directory name.
+*/
+const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Point}\u02b0-\u02ff\u0374\u0559\u07f4\u07f5\ua78b\ua78c\uff9e\uff9f])[\p{L}\p{N}]$`, "u");
+/**
+* A combining mark, which counts only DIRECTLY after a visible letter (or a
+* mark that itself counted): on a space or on punctuation it draws on its own,
+* and U+030B / U+030E there look like a quote.
+*/
+const COMBINING_MARK = /^\p{M}$/u;
+/**
+* A default-ignorable code point, which draws as NOTHING. Tested before the
+* mark rule, because some are combining marks (U+034F, U+17B4, U+180B, the
+* variation selectors U+FE00-U+FE0F and U+E0100-U+E01EF): after a letter they
+* would otherwise pass as bare, and `/home/me/.ss\u034fh` would print exactly
+* like `.ssh` while naming a different path. The host's classifier
+* (go-to-k/cdkd#3509) does not carve these out; this one does.
+*/
+const DEFAULT_IGNORABLE = /^\p{Default_Ignorable_Code_Point}$/u;
+/**
+* The ASCII a bare value may carry besides letters and digits. Everything else
+* — any whitespace, any quote, any other symbol — takes the boundary, which
+* costs a legitimate path nothing but a pair of quotes.
+*/
+const BARE_PUNCTUATION = /^[/\\._~+@:=-]$/;
+/**
+* Classify each code point: `bare` (allowed in a bare value), `shown` (shown
+* as itself inside the boundary), or `escaped`. An ALLOWLIST, because a
+* denylist has to enumerate every character that draws as a blank or reads as
+* a quote.
+*
+* Each test is ONE character and this walks the value — never `^(...)+$` over
+* the whole of it: alternatives that overlap under a quantifier backtrack
+* exponentially on a long value that fails near its end.
+*/
+function classify(chars) {
+	let afterLetter = false;
+	return chars.map((ch) => {
+		if (DEFAULT_IGNORABLE.test(ch)) {
+			afterLetter = false;
+			return "escaped";
+		}
+		if (COMBINING_MARK.test(ch)) return afterLetter ? "bare" : "escaped";
+		afterLetter = VISIBLE_LETTER.test(ch);
+		if (afterLetter || BARE_PUNCTUATION.test(ch)) return "bare";
+		return ch >= " " && ch <= "~" ? "shown" : "escaped";
+	});
+}
+/**
+* Render an untrusted value — a filesystem path, identifier or command an
+* assembly chose, or a key a request supplied — into cdk-local's own prose
+* (go-to-k/cdk-local#758; the host's `displayAssemblyPath`, go-to-k/cdkd#3509).
+* The caller writes NO quotes around the result.
+*
+* `sanitizeServiceExceptionMessage` alone is not enough inside quotes of ours:
+* it flattens control characters and passes `'`, so a value carrying one
+* closed the quote and wrote a clause of its own into the message. This keeps
+* a plain value bare and puts any other one inside a JSON string literal.
+* Inside it, `"` and `\` are escaped as JSON escapes them, and so is every
+* character that is neither printable ASCII nor a visible letter — a curly or
+* fullwidth quote that could pass for the boundary's own closing `"`, and a
+* blank that could pass for a space. The result stays valid JSON: `JSON.parse`
+* returns the sanitized value.
+*
+* A legitimate value with a space or any symbol outside `/ \ . _ ~ + @ : = -`
+* (`/Users/me/My Project/cdk.out`) renders quoted; a non-ASCII letter is
+* shown as itself, and a non-letter non-ASCII character (an emoji, `©`) as
+* its `\u` escape. A value the sanitizer ALTERED (a control character
+* flattened, an over-long value truncated) did not arrive plain, so it always
+* takes the boundary. The empty string renders as `""`.
+*
+* The sanitizer also CAPS the value at 512 code points, so a longer path
+* prints truncated (inside the boundary, with its true length named). That
+* is deliberate: an unbounded assembly-chosen value would otherwise make the
+* log line as long as the attacker likes, and a real path is far shorter.
+*/
+function displayUntrustedValue(value) {
+	const clean = sanitizeServiceExceptionMessage(value);
+	const chars = Array.from(clean);
+	const kinds = classify(chars);
+	if (clean === value && chars.length > 0 && kinds.every((k) => k === "bare")) return clean;
+	let body = "";
+	chars.forEach((ch, i) => {
+		if (ch === "\"" || ch === "\\") body += `\\${ch}`;
+		else if (kinds[i] !== "escaped") body += ch;
+		else for (let u = 0; u < ch.length; u++) body += `\\u${ch.charCodeAt(u).toString(16).padStart(4, "0")}`;
+	});
+	return `"${body}"`;
+}
+
 //#endregion
 //#region src/utils/error-handler.ts
 /**
@@ -2383,297 +2770,6 @@ function stringifyValue(value) {
 	}
 }
 
-//#endregion
-//#region src/utils/assembly-path.ts
-/**
-* `true` when `candidate` names something strictly beneath `base`, both given
-* as already-resolved absolute paths.
-*
-* The `..` test is SEPARATOR-AWARE rather than a bare `startsWith('..')`,
-* which would also reject a legitimate sibling named `..foo`. The empty-string
-* case is `base` itself; callers decide whether that counts as an escape,
-* because an asset path legitimately names a DIRECTORY while a template path
-* does not.
-*/
-function isInside(base, candidate) {
-	const rel = relative(base, candidate);
-	if (rel === "" || rel === "..") return false;
-	if (rel.startsWith(`..${sep}`)) return false;
-	return !isAbsolute(rel);
-}
-/**
-* `realpath(3)`, or `undefined` for a path that does not fully resolve.
-*
-* `.native` is load-bearing and must not be simplified to `fs.realpathSync`.
-* The plain form is a JavaScript walker that folds `..` LEXICALLY, so it
-* disagrees with the kernel on a target carrying a `..` after a symlinked
-* component — answering `ENOENT` for a path the kernel resolves, and on a
-* case-insensitive filesystem (APFS by default) it can spin on the same shape.
-* `.native` is libuv's `realpath(3)` and throws the same
-* `ENOENT` / `ELOOP` / `EACCES`.
-*/
-function tryRealpath(p) {
-	try {
-		return realpathSync.native(p);
-	} catch {
-		return;
-	}
-}
-/** `fs.readlinkSync`, or `undefined` when `p` is not a symbolic link. */
-function tryReadlink(p) {
-	try {
-		return readlinkSync(p);
-	} catch {
-		return;
-	}
-}
-/**
-* Link follows before the walk gives up and reports the path as unresolvable.
-* It does NOT refuse: an exhausted budget answers `undefined`, which leaves
-* the symlink arm silent and the lexical verdict standing. Safe because the OS
-* gives up first (macOS caps at 32, `ELOOP`), so a chain that reaches this cap
-* is one nothing can open anyway.
-*/
-const MAX_LINK_HOPS = 40;
-/**
-* Unresolvable path COMPONENTS the climb walks before giving up. Bounds the
-* recursion below, which is one frame per component, so a pathological value
-* cannot raise a `RangeError` from inside {@link tryRealpath}'s own `try` (its
-* `catch` would swallow the crash into a silent `undefined`).
-*
-* KNOW THAT EXHAUSTING THIS FAILS OPEN, and why that is accepted rather than
-* unnoticed. Unlike {@link MAX_LINK_HOPS}, which has the OS's own `ELOOP` cap
-* behind it, nothing else stops a path of 1 001 absent components: the climb
-* gives up, the symlink arm goes silent, and a value that would land outside
-* reads as CONTAINED on the lexical verdict alone. It is not reachable in
-* effect — such a path cannot exist, so `cdkl invoke`'s `existsSync` refuses it
-* and `start-api`'s `docker run` fails to mount it — but that safety lives in
-* the CONSUMERS, not here. A consumer that neither checks existence nor mounts
-* would need its own answer.
-*/
-const MAX_PATH_COMPONENTS = 1e3;
-/**
-* Where `target` REALLY points, for a path that may not exist yet.
-*
-* `realpathSync` answers only for a path that fully resolves, and it throws
-* `ENOENT` for a DANGLING symbolic link exactly as it does for an absent file.
-* `cdkl start-api` resolves an asset path without an existence check, so an
-* absent or dangling component must not silence the symlink arm.
-*
-* Each unresolvable component is therefore handled by hand: climb to the
-* deepest ancestor that DOES resolve, then re-apply the remaining components,
-* following any symbolic link with `readlink` and re-resolving its target.
-* `undefined` means the walk could not resolve the path at all.
-*
-* For a path that FULLY RESOLVES the answer is the kernel's and is exact. For
-* one that does not exist yet this is a best-effort MODEL of kernel
-* resolution; the known edge is a `..` INSIDE an unresolvable link's target,
-* folded lexically here while the kernel folds it only after following each
-* preceding component. That edge is benign for THESE callers rather than in
-* general: it needs the target to be absent, and both consumers resolve the
-* path and then open or mount it, so the divergence is between this model and
-* a path nothing can reach. A caller that CREATED a file through such a path
-* would need an `lstat` of its own.
-*
-* `EACCES` is folded into "does not resolve" along with `ENOENT`, so a link
-* under a directory this process cannot traverse reads as contained. Same
-* bound: the consumer's own `existsSync` / mount runs as the same user and
-* fails identically.
-*/
-function resolveThroughLinks(target, hops = 0, climbs = 0) {
-	const direct = tryRealpath(target);
-	if (direct !== void 0) return direct;
-	if (hops >= MAX_LINK_HOPS) return void 0;
-	if (climbs >= MAX_PATH_COMPONENTS) return void 0;
-	const parent = dirname(target);
-	if (parent === target) return void 0;
-	const realParent = resolveThroughLinks(parent, hops, climbs + 1);
-	if (realParent === void 0) return void 0;
-	const link = tryReadlink(target);
-	if (link === void 0) return join(realParent, basename(target));
-	return resolveThroughLinks(resolve(realParent, link), hops + 1, climbs);
-}
-/**
-* Resolve an assembly-supplied `candidate` against `dir` and report whether
-* the result stays inside it.
-*
-* The lexical arm joins exactly the way the call sites used to (`path.join`,
-* NOT `path.resolve`), so the verdict is about the path the caller will
-* actually use. `join`'s handling of an absolute candidate makes this arm
-* strictly more permissive than a `resolve`-based one would be; an absolute
-* value is therefore answered by {@link absoluteAssemblyPathEscape} instead,
-* because this function structurally cannot.
-*
-* The SYMLINK arm exists because the lexical arm alone leaves an equivalent
-* hole: `cdk.out/link -> /etc` plus a candidate of `link/passwd` is lexically
-* contained and still reaches `/etc/passwd`. Both sides go through
-* {@link resolveThroughLinks}, so an assembly directory REACHED through a link
-* (macOS spells `/tmp` as `/private/tmp`) is unaffected.
-*
-* The verdict is about the assembly AS IT SITS ON DISK. It is NOT a defence
-* against a process rewriting that directory concurrently — the caller uses
-* the path after this returns.
-*/
-function resolveAssemblyPath(dir, candidate, options) {
-	const base = resolve(dir);
-	const bound = options?.containWithin === void 0 ? base : resolve(options.containWithin);
-	const joined = resolve(join(base, candidate));
-	if (!isInside(bound, joined)) return {
-		contained: false,
-		escape: "lexical",
-		path: joined
-	};
-	const realBound = resolveThroughLinks(bound);
-	if (realBound !== void 0) {
-		const realTarget = resolveThroughLinks(joined);
-		if (realTarget !== void 0 && !isInside(realBound, realTarget)) return {
-			contained: false,
-			escape: "symlink",
-			path: joined,
-			realPath: realTarget
-		};
-	}
-	return {
-		contained: true,
-		path: joined
-	};
-}
-/**
-* Whether an ALREADY-ABSOLUTE assembly-supplied path lies outside `bound`.
-*
-* {@link resolveAssemblyPath} cannot answer this, and the reason is structural
-* rather than an oversight: its lexical arm joins with `path.join`, which does
-* NOT honour a leading separator, so an absolute candidate is folded INTO the
-* directory and the verdict would describe a path no caller opens. A site that
-* HONOURS an absolute value needs the verdict about the value itself.
-*
-* The callers are `cdkl invoke`'s and `cdkl start-api`'s
-* `Metadata['aws:asset:path']` resolution. Those honour an absolute path
-* because `cdk synth --no-staging` emits one — CDK writes the asset's absolute
-* SOURCE directory under `aws:cdk:disable-asset-staging`, usually outside the
-* outdir — and they WARN rather than refuse when it leaves the bound, so this
-* returns a verdict rather than throwing. The asset-MANIFEST readers that
-* honour an absolute value take the same verdict: `'honour-warn'` (the
-* start-cloudfront origin) warns when the value is a folder inside the user's
-* project not under a credential or version-control directory, and refuses
-* otherwise, `'honour'` (the soft-reload
-* sources) refuses (#745).
-*
-* It lives HERE so the containment rule has one spelling: it reuses this
-* module's own {@link isInside} and {@link resolveThroughLinks}, symlink arm
-* included, rather than letting a caller re-spell `path.relative` and drift.
-*
-* `bound` itself is NOT an escape, unlike in {@link resolveAssemblyPath},
-* where an empty `path.relative` means "names the directory rather than a file
-* inside it". An asset path legitimately names a DIRECTORY, so a value equal
-* to the bound is inside it and reporting it as outside would be false.
-*
-* THE REAL PATHS DECIDE IN BOTH DIRECTIONS, which is the one place this
-* deliberately does more than {@link resolveAssemblyPath}'s lexical-first
-* ordering. The lexical verdict here is about a SPELLING, and two spellings of
-* the same directory are common rather than exotic: macOS resolves `/tmp` to
-* `/private/tmp` and `/var` to `/private/var`, and a user may symlink `cdk.out`
-* itself. With an outdir of `/tmp/cdk.out` and a `--no-staging` value of
-* `/private/tmp/cdk.out/src`, a lexical-only verdict cries "pointing outside
-* the assembly ... treat this assembly as untrusted" about an asset that is
-* plainly inside it — and this arm exists to make an UNEXPECTED path visible,
-* so a false alarm is the failure that costs it its meaning.
-*
-* Exonerating requires the kernel to answer for BOTH operands: an unresolvable
-* one leaves the lexical verdict standing, so the arm stays loud when it cannot
-* see. (`resolveAssemblyPath` cannot take the same shape: its verdict is about
-* a path built with `path.join`, and letting a real path overrule the lexical
-* `..` there would answer about a location the caller never opens.)
-*/
-function absoluteAssemblyPathEscape(bound, absolutePath) {
-	const resolvedBound = resolve(bound);
-	const target = resolve(absolutePath);
-	const lexicallyOutside = !isInside(resolvedBound, target) && target !== resolvedBound;
-	const realBound = resolveThroughLinks(resolvedBound);
-	const realTarget = resolveThroughLinks(target);
-	const reallyOutside = realBound === void 0 || realTarget === void 0 ? void 0 : !isInside(realBound, realTarget) && realTarget !== realBound;
-	if (lexicallyOutside) {
-		if (reallyOutside === false) return void 0;
-		return {
-			contained: false,
-			escape: "lexical",
-			path: target
-		};
-	}
-	if (reallyOutside === true) return {
-		contained: false,
-		escape: "symlink",
-		path: target,
-		realPath: realTarget
-	};
-}
-/**
-* Whether `candidate` names the SAME directory as `bound` — lexically, or
-* through a symbolic link on either side.
-*
-* An asset source legitimately names a DIRECTORY, so a value that resolves
-* onto the output directory itself is not an escape; but it hands the WHOLE
-* assembly to the sink, which is worth a line. A caller that re-spells this as
-* `resolve(a) === resolve(b)` misses every second spelling of the bound
-* (macOS `/tmp` vs `/private/tmp`, a symlinked `cdk.out`), and
-* {@link absoluteAssemblyPathEscape} exonerates exactly those spellings as
-* inside — so the equality beside it would stay silent for them.
-*
-* Conservative on failure: an unresolvable side answers from the lexical
-* comparison alone, so it can only say "not the same", never wrongly claim
-* identity.
-*/
-function namesTheSameDirectory(bound, candidate) {
-	const resolvedBound = resolve(bound);
-	const target = resolve(candidate);
-	if (target === resolvedBound) return true;
-	const realBound = resolveThroughLinks(resolvedBound);
-	const realTarget = resolveThroughLinks(target);
-	return realBound !== void 0 && realTarget !== void 0 && realBound === realTarget;
-}
-/**
-* The escape verdict for an assembly-supplied path WITHOUT throwing, taking
-* whichever arm the value's own shape calls for: {@link absoluteAssemblyPathEscape}
-* for an absolute value, {@link resolveAssemblyPath} for a relative one.
-*
-* For a caller that only WARNS and has many values to judge — the BuildKit
-* passthroughs in `src/assets/buildkit-passthrough-warnings.ts`. `base` is what
-* a relative value resolves against, `bound` what it must stay inside.
-* Returns `undefined` when the value is fine, including when it names `bound`
-* itself ({@link namesTheSameDirectory}).
-*/
-function assemblyPathEscape(base, bound, candidate) {
-	if (isAbsolute(candidate)) return absoluteAssemblyPathEscape(bound, candidate);
-	const resolved = resolveAssemblyPath(base, candidate, { containWithin: bound });
-	if (resolved.contained || namesTheSameDirectory(bound, resolved.path)) return void 0;
-	return resolved;
-}
-/**
-* The shared tail of a containment refusal: what the value resolved to, what
-* it escaped, and why that means the assembly is not CDK-generated. The call
-* site supplies its own subject ("Lambda 'X' has ... which ") and its own
-* error class. `action` completes "Refusing to ..." and is REQUIRED rather
-* than defaulted: a default is a branch no caller takes, so it can neither be
-* fenced nor be right for the next caller.
-*
-* `provenanceOverride` replaces that whole closing sentence for a caller that
-* does NOT refuse — the BuildKit passthrough warnings, where "Refusing to ..."
-* would be a false statement about a value that is forwarded anyway.
-*/
-function renderAssemblyPathEscape(escape, dir, action, provenanceOverride) {
-	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
-	const base = resolve(dir);
-	const realBase = resolveThroughLinks(base) ?? base;
-	const shownPath = sanitizeServiceExceptionMessage(escape.path);
-	const shownBase = sanitizeServiceExceptionMessage(base);
-	if (escape.escape === "symlink") {
-		if (escape.realPath === realBase) return `resolves to '${shownPath}', a symbolic link to the directory '${shownBase}' itself rather than to a path inside it. ${provenance}`;
-		return `resolves to '${shownPath}', which leads through a symbolic link to '${sanitizeServiceExceptionMessage(escape.realPath)}', outside '${shownBase}'. ${provenance}`;
-	}
-	if (escape.path === base) return `names the directory '${shownBase}' itself rather than a path inside it. ${provenance}`;
-	return `resolves to '${shownPath}', outside '${shownBase}'. ${provenance}`;
-}
-
 //#endregion
 //#region src/local/lambda-resolver.ts
 /**
@@ -2999,7 +3095,7 @@ function resolveAssetCodeDirectory(manifestDir, assetPath, wrapError, assetOutdi
 	if (isAbsolute(assetPath)) {
 		const absolute = resolve(assetPath);
 		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
-		if (escape !== void 0) getLogger().warn(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' has an absolute Metadata['aws:asset:path'] pointing outside the assembly: '${sanitizeServiceExceptionMessage(absolute)}'` + (escape.escape === "symlink" ? ` (through a symbolic link to '${sanitizeServiceExceptionMessage(escape.realPath)}')` : "") + `. ${getEmbedConfig().productName} will read that directory and expose its contents to the container — bind-mounted read-only, or copied when the asset is a .zip or one of several merged layers — where the code in this assembly can read it. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted.`);
+		if (escape !== void 0) getLogger().warn(`Lambda ${displayUntrustedValue(logicalId)} has an absolute Metadata['aws:asset:path'] pointing outside the assembly: ${displayUntrustedValue(absolute)}` + (escape.escape === "symlink" ? ` (through a symbolic link to ${displayUntrustedValue(escape.realPath)})` : "") + `. ${getEmbedConfig().productName} will read that directory and expose its contents to the container — bind-mounted read-only, or copied when the asset is a .zip or one of several merged layers — where the code in this assembly can read it. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted.`);
 		warnOutsideNamedDirectory(assetOutdir, absolute);
 		return absolute;
 	}
@@ -3011,7 +3107,7 @@ function resolveAssetCodeDirectory(manifestDir, assetPath, wrapError, assetOutdi
 	if (!resolved.contained) {
 		const climbsOut = assetPath === ".." || assetPath.startsWith(`..${sep}`) || assetPath.startsWith("../");
 		const stageHint = basename(assetOutdir).startsWith("assembly-") && climbsOut ? " This directory is named like a cdk.Stage sub-assembly, but its parent is not an assembly (no manifest.json), so it was treated as the assembly root. If you meant to point --app at a Stage inside an app's output directory, point it at that output directory." : "";
-		throw wrapError(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' has Metadata['aws:asset:path']='${sanitizeServiceExceptionMessage(assetPath)}' which ${renderAssemblyPathEscape(resolved, assetOutdir, "mount it")}${stageHint}`);
+		throw wrapError(`Lambda ${displayUntrustedValue(logicalId)} has Metadata['aws:asset:path']=${displayUntrustedValue(assetPath)} which ${renderAssemblyPathEscape(resolved, assetOutdir, "mount it")}${stageHint}`);
 	}
 	warnOutsideNamedDirectory(assetOutdir, resolved.path);
 	return resolved.path;
@@ -3265,7 +3361,7 @@ function warnOutsideNamedDirectory(assetOutdir, resolved) {
 	if (absoluteAssemblyPathEscape(named, resolved) === void 0) return;
 	if (warnedOutsideNamed.has(resolved)) return;
 	warnedOutsideNamed.add(resolved);
-	getLogger().warn(`'${sanitizeServiceExceptionMessage(resolved)}' is outside '${sanitizeServiceExceptionMessage(named)}', the directory --app named. It is inside the assembly root derived from it, so ${getEmbedConfig().productName} is using it.`);
+	getLogger().warn(`${displayUntrustedValue(resolved)} is outside ${displayUntrustedValue(named)}, the directory --app named. It is inside the assembly root derived from it, so ${getEmbedConfig().productName} is using it.`);
 }
 /**
 * Say that the assembly root was DERIVED rather than given.
@@ -3278,7 +3374,7 @@ function warnOutsideNamedDirectory(assetOutdir, resolved) {
 function warnDerivedAssemblyRoot(named, derived) {
 	if (warnedDerivedRoots.has(derived)) return;
 	warnedDerivedRoots.add(derived);
-	getLogger().warn(`'${sanitizeServiceExceptionMessage(named)}' is a cdk.Stage sub-assembly, so ${getEmbedConfig().productName} is treating its parent '${sanitizeServiceExceptionMessage(derived)}' as the assembly root — that is where cdk synth stages a Stage's assets. Everything under that parent is now inside the containment bound, including siblings of the directory you named. If you did not expect the wider directory, point --app at the app's own output directory instead.`);
+	getLogger().warn(`${displayUntrustedValue(named)} is a cdk.Stage sub-assembly, so ${getEmbedConfig().productName} is treating its parent ${displayUntrustedValue(derived)} as the assembly root — that is where cdk synth stages a Stage's assets. Everything under that parent is now inside the containment bound, including siblings of the directory you named. If you did not expect the wider directory, point --app at the app's own output directory instead.`);
 }
 /**
 * Resolve the local directory that corresponds to a function's deployed
@@ -3297,14 +3393,14 @@ function warnDerivedAssemblyRoot(named, derived) {
 */
 function resolveAssetCodePath$1(stack, logicalId, resource, options = {}) {
 	const assetPath = resource.Metadata?.["aws:asset:path"];
-	if (typeof assetPath !== "string" || assetPath.length === 0) throw new LocalInvokeResolutionError(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' has no Metadata['aws:asset:path']. ${getEmbedConfig().cliName} invoke needs this hint to find the local asset directory. Re-synthesize the app (without \`--output <stale-dir>\`) and retry.`);
+	if (typeof assetPath !== "string" || assetPath.length === 0) throw new LocalInvokeResolutionError(`Lambda ${displayUntrustedValue(logicalId)} has no Metadata['aws:asset:path']. ${getEmbedConfig().cliName} invoke needs this hint to find the local asset directory. Re-synthesize the app (without \`--output <stale-dir>\`) and retry.`);
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
 	const abs = resolveAssetCodeDirectory(manifestDir, assetPath, (message) => new LocalInvokeResolutionError(message), assetOutdir, logicalId);
-	if (!existsSync(abs)) throw new LocalInvokeResolutionError(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' asset path '${sanitizeServiceExceptionMessage(abs)}' does not exist. Re-synthesize the app and retry.`);
+	if (!existsSync(abs)) throw new LocalInvokeResolutionError(`Lambda ${displayUntrustedValue(logicalId)} asset path ${displayUntrustedValue(abs)} does not exist. Re-synthesize the app and retry.`);
 	const stat = statSync(abs);
 	if (stat.isDirectory()) return abs;
 	if (options.allowZip && stat.isFile() && abs.toLowerCase().endsWith(".zip")) return abs;
-	throw new LocalInvokeResolutionError(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' asset path '${sanitizeServiceExceptionMessage(abs)}' is not a directory` + (options.allowZip ? " or a .zip archive" : "") + ". Re-synthesize the app and retry.");
+	throw new LocalInvokeResolutionError(`Lambda ${displayUntrustedValue(logicalId)} asset path ${displayUntrustedValue(abs)} is not a directory` + (options.allowZip ? " or a .zip archive" : "") + ". Re-synthesize the app and retry.");
 }
 /**
 * Turn a resolved function-code asset path into a directory ready to
@@ -3323,14 +3419,14 @@ function resolveAssetCodePath$1(stack, logicalId, resource, options = {}) {
 * existing tmpdir cleanup.
 */
 function materializeAssetCodeDir(codePath) {
-	if (!existsSync(codePath)) throw new LocalInvokeResolutionError(`Lambda asset path '${sanitizeServiceExceptionMessage(codePath)}' does not exist. Re-synthesize the app and retry.`);
+	if (!existsSync(codePath)) throw new LocalInvokeResolutionError(`Lambda asset path ${displayUntrustedValue(codePath)} does not exist. Re-synthesize the app and retry.`);
 	if (statSync(codePath).isDirectory()) return { dir: codePath };
 	const zipBytes = readFileSync(codePath);
 	let files;
 	try {
 		files = unzipSync(zipBytes);
 	} catch (err) {
-		throw new LocalInvokeResolutionError(`Lambda asset '${sanitizeServiceExceptionMessage(codePath)}' is a file but could not be read as a ZIP archive: ${err instanceof Error ? err.message : String(err)}. Re-synthesize the app and retry.`);
+		throw new LocalInvokeResolutionError(`Lambda asset ${displayUntrustedValue(codePath)} is a file but could not be read as a ZIP archive: ${err instanceof Error ? err.message : String(err)}. Re-synthesize the app and retry.`);
 	}
 	const modes = parseZipUnixModes(zipBytes);
 	const S_IFMT = 61440;
@@ -6750,7 +6846,7 @@ var CfnLocalStateProvider = class {
 				return map.get(exportName);
 			},
 			async resolveGetStackOutput(producerStack, producerRegion, outputName) {
-				logger.warn(`${label}: Fn::GetStackOutput '${producerStack}.${outputName}' (${producerRegion}) has no CloudFormation equivalent and cannot be resolved when reading state from a CloudFormation stack. Use Fn::ImportValue against an exported output instead.`);
+				logger.warn(`${label}: Fn::GetStackOutput ${displayUntrustedValue(producerStack)}.${displayUntrustedValue(outputName)} (${displayUntrustedValue(producerRegion)}) has no CloudFormation equivalent and cannot be resolved when reading state from a CloudFormation stack. Use Fn::ImportValue against an exported output instead.`);
 			}
 		};
 	}
@@ -7665,7 +7761,7 @@ async function resolveImportValueAsync(arg, context) {
 	const exportName = inner.value;
 	if (!context.crossStackResolver) return {
 		kind: "unresolved",
-		reason: `Fn::ImportValue '${exportName}': no cross-stack resolver supplied (pass a state-source flag, e.g. --from-cfn-stack, and ensure the producer stack was deployed)`
+		reason: `Fn::ImportValue ${displayUntrustedValue(exportName)}: no cross-stack resolver supplied (pass a state-source flag, e.g. --from-cfn-stack, and ensure the producer stack was deployed)`
 	};
 	let resolved;
 	try {
@@ -7673,12 +7769,12 @@ async function resolveImportValueAsync(arg, context) {
 	} catch (err) {
 		return {
 			kind: "unresolved",
-			reason: `Fn::ImportValue '${flattenToOneLine(exportName)}': lookup failed: ${describeAwsFailureForWarn(err, "CrossStackResolver.resolveImport (Fn::ImportValue)")}`
+			reason: `Fn::ImportValue ${displayUntrustedValue(exportName)}: lookup failed: ${describeAwsFailureForWarn(err, "CrossStackResolver.resolveImport (Fn::ImportValue)")}`
 		};
 	}
 	if (resolved === void 0) return {
 		kind: "unresolved",
-		reason: `Fn::ImportValue '${exportName}': export not found in any deployed stack in this region`
+		reason: `Fn::ImportValue ${displayUntrustedValue(exportName)}: export not found in any deployed stack in this region`
 	};
 	return {
 		kind: "literal",
@@ -7732,15 +7828,15 @@ async function resolveGetStackOutputAsync(arg, context) {
 	} else region = context.consumerRegion ?? context.pseudoParameters?.region;
 	if (!region) return {
 		kind: "unresolved",
-		reason: `Fn::GetStackOutput '${stackName}.${outputName}': no Region supplied and consumer region is unknown (set --region, AWS_REGION, or env.region on the CDK stack)`
+		reason: `Fn::GetStackOutput ${displayUntrustedValue(stackName)}.${displayUntrustedValue(outputName)}: no Region supplied and consumer region is unknown (set --region, AWS_REGION, or env.region on the CDK stack)`
 	};
 	if (args["RoleArn"] !== void 0 && args["RoleArn"] !== null) return {
 		kind: "unresolved",
-		reason: `Fn::GetStackOutput '${stackName}.${outputName}': RoleArn (cross-account) is not yet supported by the state source — tracked under issue #449`
+		reason: `Fn::GetStackOutput ${displayUntrustedValue(stackName)}.${displayUntrustedValue(outputName)}: RoleArn (cross-account) is not yet supported by the state source — tracked under issue #449`
 	};
 	if (!context.crossStackResolver) return {
 		kind: "unresolved",
-		reason: `Fn::GetStackOutput '${stackName}.${outputName}': no cross-stack resolver supplied (pass a state-source flag, e.g. --from-cfn-stack, and ensure the producer stack was deployed)`
+		reason: `Fn::GetStackOutput ${displayUntrustedValue(stackName)}.${displayUntrustedValue(outputName)}: no cross-stack resolver supplied (pass a state-source flag, e.g. --from-cfn-stack, and ensure the producer stack was deployed)`
 	};
 	let resolved;
 	try {
@@ -7748,12 +7844,12 @@ async function resolveGetStackOutputAsync(arg, context) {
 	} catch (err) {
 		return {
 			kind: "unresolved",
-			reason: `Fn::GetStackOutput '${flattenToOneLine(stackName)}.${flattenToOneLine(outputName)}' (${flattenToOneLine(region)}): lookup failed: ${describeAwsFailureForWarn(err, "CrossStackResolver.resolveGetStackOutput (Fn::GetStackOutput)")}`
+			reason: `Fn::GetStackOutput ${displayUntrustedValue(stackName)}.${displayUntrustedValue(outputName)} (${displayUntrustedValue(region)}): lookup failed: ${describeAwsFailureForWarn(err, "CrossStackResolver.resolveGetStackOutput (Fn::GetStackOutput)")}`
 		};
 	}
 	if (resolved === void 0) return {
 		kind: "unresolved",
-		reason: `Fn::GetStackOutput '${stackName}.${outputName}' (${region}): output not found in producer stack state`
+		reason: `Fn::GetStackOutput ${displayUntrustedValue(stackName)}.${displayUntrustedValue(outputName)} (${displayUntrustedValue(region)}): output not found in producer stack state`
 	};
 	return {
 		kind: "literal",
@@ -9065,14 +9161,14 @@ function resolveRuntimeCodeMountPath(runtime) {
 */
 function resolveAssetSourcePath(opts) {
 	const { manifestDir, value, assetOutdir, field, subject, action, wrapError } = opts;
-	const shownValue = sanitizeServiceExceptionMessage(value);
+	const shownValue = displayUntrustedValue(value);
 	if (isAbsolute(value) && opts.absolute !== "fold") {
 		const absolute = resolve(value);
 		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
-		if (escape !== void 0 && opts.absolute === "honour") throw wrapError(`${subject} has an absolute ${field}='${shownValue}' which ` + renderAssemblyPathEscape(escape, assetOutdir, action));
+		if (escape !== void 0 && opts.absolute === "honour") throw wrapError(`${subject} has an absolute ${field}=${shownValue} which ` + renderAssemblyPathEscape(escape, assetOutdir, action));
 		if (escape !== void 0) {
 			const refusal = originScopeRefusal(absolute, assetOutdir);
-			if (refusal !== void 0) throw wrapError(`${subject} has an absolute ${field}='${shownValue}' which ${refusal}. An absolute ${field} is accepted only as a cdk synth --no-staging source folder: a directory inside your project (the git work tree holding the output directory, or the current directory when it contains the output directory or is a git work-tree root), not under a credential or version-control directory. Refusing to ${action}.`);
+			if (refusal !== void 0) throw wrapError(`${subject} has an absolute ${field}=${shownValue} which ${refusal}. An absolute ${field} is accepted only as a cdk synth --no-staging source folder: a directory inside your project (the git work tree holding the output directory, or the current directory when it contains the output directory or is a git work-tree root), not under a credential or version-control directory. Refusing to ${action}.`);
 			warnAbsoluteOutsideAssembly(opts, absolute, escape);
 			return absolute;
 		}
@@ -9085,7 +9181,7 @@ function resolveAssetSourcePath(opts) {
 		warnWholeAssemblyAsSource(opts, resolved.path);
 		return resolved.path;
 	}
-	throw wrapError(`${subject} has ${field}='${shownValue}' which ` + renderAssemblyPathEscape(resolved, assetOutdir, action));
+	throw wrapError(`${subject} has ${field}=${shownValue} which ` + renderAssemblyPathEscape(resolved, assetOutdir, action));
 }
 /**
 * Why an accepted-absolute root is too broad to be a `--no-staging` source, or
@@ -9139,9 +9235,9 @@ function originScopeRefusal(absolute, assetOutdir) {
 		hidden = dotted;
 	}
 	if (isProjectRoot) return "is your project root itself; name a folder inside it";
-	if (hidden !== void 0) return `passes through the credential / version-control directory '${sanitizeServiceExceptionMessage(hidden)}' inside your project`;
-	const shown = projects.map((p) => `'${sanitizeServiceExceptionMessage(p)}'`).join(" or ");
-	return projects.length === 0 ? "is outside any usable project root (the current directory and the git work tree are too broad to scope it)" : `resolves to '${sanitizeServiceExceptionMessage(root)}', outside your project (${shown})`;
+	if (hidden !== void 0) return `passes through the credential / version-control directory ${displayUntrustedValue(hidden)} inside your project`;
+	const shown = projects.map((p) => displayUntrustedValue(p)).join(" or ");
+	return projects.length === 0 ? "is outside any usable project root (the current directory and the git work tree are too broad to scope it)" : `resolves to ${displayUntrustedValue(root)}, outside your project (${shown})`;
 }
 /**
 * Directory names no `--no-staging` site folder sits under: credential stores
@@ -9235,7 +9331,7 @@ function realPath(p, hops = 0) {
 const warnedAbsoluteOutside = /* @__PURE__ */ new Set();
 function warnAbsoluteOutsideAssembly(opts, absolute, escape) {
 	const logger = getLogger().child("assets");
-	const line = `${opts.subject} has an absolute ${opts.field} pointing outside the assembly: '${sanitizeServiceExceptionMessage(absolute)}'` + (escape.escape === "symlink" ? ` (through a symbolic link to '${sanitizeServiceExceptionMessage(escape.realPath)}')` : "") + `. ${getEmbedConfig().productName} will ${opts.sink}. ` + (escape.escape === "lexical" ? "This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted." : "No CDK synth writes this, so treat this assembly as untrusted unless you made that link yourself.");
+	const line = `${opts.subject} has an absolute ${opts.field} pointing outside the assembly: ` + displayUntrustedValue(absolute) + (escape.escape === "symlink" ? ` (through a symbolic link to ${displayUntrustedValue(escape.realPath)})` : "") + `. ${getEmbedConfig().productName} will ${opts.sink}. ` + (escape.escape === "lexical" ? "This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted." : "No CDK synth writes this, so treat this assembly as untrusted unless you made that link yourself.");
 	if (warnedAbsoluteOutside.has(line)) {
 		logger.debug(line);
 		return;
@@ -9252,7 +9348,7 @@ function warnAbsoluteOutsideAssembly(opts, absolute, escape) {
 const warnedWholeAssembly = /* @__PURE__ */ new Set();
 function warnWholeAssemblyAsSource(opts, outdir) {
 	const logger = getLogger().child("assets");
-	const line = `${opts.subject} has ${opts.field} naming the assembly's output directory ITSELF: '${sanitizeServiceExceptionMessage(outdir)}'. ${getEmbedConfig().productName} will ${opts.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`;
+	const line = `${opts.subject} has ${opts.field} naming the assembly's output directory ITSELF: ${displayUntrustedValue(outdir)}. ${getEmbedConfig().productName} will ${opts.sink} — that is the WHOLE assembly, every template and every staged asset, not one asset directory. No CDK synth emits this, so treat this assembly as untrusted unless you wrote that path yourself.`;
 	if (warnedWholeAssembly.has(line)) {
 		logger.debug(line);
 		return;
@@ -9405,7 +9501,7 @@ function warnEscapingBuildKitPaths(source, base, bound) {
 		const escape = assemblyPathEscape(base, bound, ref.path);
 		if (escape === void 0) continue;
 		const verb = ref.write ? "WRITE to" : "read";
-		const line = `Docker asset ${ref.field}` + (ref.where === ref.field ? "" : `['${sanitizeServiceExceptionMessage(ref.where)}']`) + ` names a host path outside the assembly, which ` + renderAssemblyPathEscape(escape, bound, "load", `${getEmbedConfig().productName} will ${verb} it during the image build, matching the CDK CLI — a pre-synthesized assembly is trusted input. If you did not produce this assembly, that is a host path it chose and the CloudFormation template does not show.`);
+		const line = `Docker asset ${ref.field}` + (ref.where === ref.field ? "" : `[${displayUntrustedValue(ref.where)}]`) + ` names a host path outside the assembly, which ` + renderAssemblyPathEscape(escape, bound, "load", `${getEmbedConfig().productName} will ${verb} it during the image build, matching the CDK CLI — a pre-synthesized assembly is trusted input. If you did not produce this assembly, that is a host path it chose and the CloudFormation template does not show.`);
 		if (warnedPassthroughs.has(line)) {
 			logger.debug(line);
 			continue;
@@ -9453,9 +9549,10 @@ function warnEscapingBuildKitPaths(source, base, bound) {
 * to `debug`, where the argv already is. Deduping the LINE must never dedupe
 * the WORK: the spawn happens every time regardless.
 *
-* `sanitizeServiceExceptionMessage` for the same reason `assembly-path.ts`
-* uses it: the value is manifest-chosen, it keeps control characters, and an
-* unsanitized one lets the command forge its own log line. It is applied to
+* `displayUntrustedValue` for the same reason `assembly-path.ts` uses it: the
+* value is manifest-chosen, it keeps control characters and quotes, and an
+* unsanitized one lets the command forge its own log line or close a quote
+* of ours (go-to-k/cdk-local#758). It is applied to
 * the DISPLAYED command only — the dedupe key is built from the raw argv and
 * cwd, so two commands differing only in control characters stay distinct
 * keys.
@@ -9465,12 +9562,12 @@ function warnManifestExecutable(cmd, executable, cwd) {
 	const logger = getLogger().child("docker-build");
 	const key = JSON.stringify([cwd, executable]);
 	if (warnedExecutables.has(key)) {
-		logger.debug(`source.executable already announced this process: ${sanitizeServiceExceptionMessage(cmd)} (cwd=${cwd})`);
+		logger.debug(`source.executable already announced this process: ${displayUntrustedValue(cmd)} (cwd=${displayUntrustedValue(cwd)})`);
 		return;
 	}
 	warnedExecutables.add(key);
 	const argCount = executable.length - 1;
-	logger.warn(`Docker asset source.executable runs a command this asset manifest chose, on this machine: '${sanitizeServiceExceptionMessage(cmd)}'` + (argCount > 0 ? ` (with ${argCount} argument(s); --verbose shows them)` : "") + ". cdk-local runs it, matching the CDK CLI — a pre-synthesized assembly is trusted input. Note that this means running a local command against a pre-synthesized assembly DOES execute code from it, which the CloudFormation template does not show.");
+	logger.warn(`Docker asset source.executable runs a command this asset manifest chose, on this machine: ${displayUntrustedValue(cmd)}` + (argCount > 0 ? ` (with ${argCount} argument(s); --verbose shows them)` : "") + `. ${getEmbedConfig().productName} runs it, matching the CDK CLI — a pre-synthesized assembly is trusted input. Note that this means running a local command against a pre-synthesized assembly DOES execute code from it, which the CloudFormation template does not show.`);
 }
 /**
 * Build a Docker image from a CDK asset source. Returns the local image
@@ -9506,7 +9603,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
 		const cwd = source.directory ? contextDirectory(source.directory, "run this asset's source.executable with that directory as its working directory") : cdkOutDir;
-		logger.debug(`Building Docker image via executable: ${sanitizeServiceExceptionMessage(source.executable.join(" "))} (cwd=${sanitizeServiceExceptionMessage(cwd)})`);
+		logger.debug(`Building Docker image via executable: ${sanitizeServiceExceptionMessage(source.executable.join(" "))} (cwd=${displayUntrustedValue(cwd)})`);
 		warnManifestExecutable(cmd, source.executable, cwd);
 		let result;
 		try {
@@ -10275,7 +10372,7 @@ var AssetManifestLoader = class {
 	*/
 	async loadManifest(cdkOutputDir, stackName) {
 		const resolved = resolveAssemblyPath(cdkOutputDir, `${stackName}.assets.json`);
-		if (!resolved.contained) throw new Error(`Refusing to read the asset manifest for stack '${sanitizeServiceExceptionMessage(stackName)}': it ` + renderAssemblyPathEscape(resolved, cdkOutputDir, "read it"));
+		if (!resolved.contained) throw new Error(`Refusing to read the asset manifest for stack ${displayUntrustedValue(stackName)}: it ` + renderAssemblyPathEscape(resolved, cdkOutputDir, "read it"));
 		const manifestPath = join$1(cdkOutputDir, `${stackName}.assets.json`);
 		try {
 			this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
@@ -15053,7 +15150,7 @@ function parseHttpV2IdentitySources(raw) {
 */
 function parseCognitoUserPoolArn(arn, location) {
 	const m = /^arn:aws[a-z0-9-]*:cognito-idp:([a-z0-9-]+):[0-9]+:userpool\/(.+)$/.exec(arn);
-	if (!m) throw new RouteDiscoveryError(`${location}: malformed Cognito User Pool ARN '${arn}'. Expected 'arn:aws:cognito-idp:<region>:<account>:userpool/<id>'.`);
+	if (!m) throw new RouteDiscoveryError(`${location}: malformed Cognito User Pool ARN ${displayUntrustedValue(arn)}. Expected 'arn:aws:cognito-idp:<region>:<account>:userpool/<id>'.`);
 	return {
 		region: m[1],
 		userPoolId: m[2]
@@ -20117,7 +20214,7 @@ function resolveImageLambda(args) {
 */
 function resolveAssetCodePath(stack, logicalId, resource) {
 	const assetPath = resource.Metadata?.["aws:asset:path"];
-	if (typeof assetPath !== "string" || assetPath.length === 0) throw new Error(`Lambda '${sanitizeServiceExceptionMessage(logicalId)}' has no Metadata['aws:asset:path']. ${getEmbedConfig().cliName} start-api needs this hint to find the local asset directory. Re-synthesize the app and retry.`);
+	if (typeof assetPath !== "string" || assetPath.length === 0) throw new Error(`Lambda ${displayUntrustedValue(logicalId)} has no Metadata['aws:asset:path']. ${getEmbedConfig().cliName} start-api needs this hint to find the local asset directory. Re-synthesize the app and retry.`);
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
 	return resolveAssetCodeDirectory(manifestDir, assetPath, (message) => new Error(message), assetOutdir, logicalId);
 }
@@ -21630,7 +21727,7 @@ async function buildAgentCoreCodeImage(options) {
 		], { progressLabel: `Building agent image (runtime=${options.runtime})` });
 	} catch (err) {
 		const stderr = err.stderr?.trim();
-		throw new LocalInvokeBuildError(`docker build failed for AgentCore code artifact (${flattenToOneLine(options.sourceDir)})${stderr ? `: ${stderr}` : ""}`);
+		throw new LocalInvokeBuildError(`docker build failed for AgentCore code artifact (${displayUntrustedValue(options.sourceDir)})${stderr ? `: ${stderr}` : ""}`);
 	} finally {
 		await rm(buildDir, {
 			recursive: true,
@@ -21675,14 +21772,14 @@ async function warnIfDependenciesNotVendored(sourceDir, runtime, isNode, logger)
 	}
 	const has = (name) => entries.includes(name);
 	if (isNode) {
-		if (has("package.json") && !has("node_modules")) logger.warn(`AgentCore code bundle '${flattenToOneLine(sourceDir)}' declares package.json but does not vendor node_modules. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail to resolve them. Vendor dependencies into the bundle (e.g. 'npm install --omit=dev' in the bundle dir) so the deploy artifact is self-contained. cdk-local runs the bundle as-is to match the deployed runtime.`);
+		if (has("package.json") && !has("node_modules")) logger.warn(`AgentCore code bundle ${displayUntrustedValue(sourceDir)} declares package.json but does not vendor node_modules. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail to resolve them. Vendor dependencies into the bundle (e.g. 'npm install --omit=dev' in the bundle dir) so the deploy artifact is self-contained. cdk-local runs the bundle as-is to match the deployed runtime.`);
 		return;
 	}
 	const manifest = await pythonManifestDeclaringDeps(sourceDir, entries);
 	const vendored = entries.some((e) => e.endsWith(".dist-info"));
 	if (manifest && !vendored) {
 		const pyVersion = runtime.replace("PYTHON_", "").replace("_", ".");
-		logger.warn(`AgentCore code bundle '${flattenToOneLine(sourceDir)}' declares ${manifest} but does not vendor its dependencies. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail with ModuleNotFoundError. Vendor arm64 wheels into the bundle, e.g.:
+		logger.warn(`AgentCore code bundle ${displayUntrustedValue(sourceDir)} declares ${manifest} but does not vendor its dependencies. The AgentCore managed runtime does NOT install dependencies at runtime, so the deployed agent will fail with ModuleNotFoundError. Vendor arm64 wheels into the bundle, e.g.:
   uv pip install --python-platform aarch64-manylinux2014 --python-version ${pyVersion} --target <bundle-dir> -r requirements.txt\ncdk-local runs the bundle as-is to match the deployed runtime.`);
 	}
 }
@@ -23018,10 +23115,10 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	if (!asset) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' code bundle (asset ${code.codeAssetHash}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
 	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, {
 		assetOutdir: assetPathDirs(resolved.stack).assetOutdir,
-		subject: `AgentCore Runtime '${flattenToOneLine(resolved.logicalId)}' code bundle`,
+		subject: `AgentCore Runtime ${displayUntrustedValue(resolved.logicalId)} code bundle`,
 		wrapError: (message) => new CdkLocalError(message, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_ESCAPES_ASSEMBLY")
 	});
-	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkLocalError(`AgentCore Runtime '${flattenToOneLine(resolved.logicalId)}' code bundle source '${flattenToOneLine(sourceDir)}' does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
+	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkLocalError(`AgentCore Runtime ${displayUntrustedValue(resolved.logicalId)} code bundle source ${displayUntrustedValue(sourceDir)} does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
 	return buildAgentCoreCodeImage({
 		sourceDir,
 		runtime: code.runtime,
@@ -23786,7 +23883,7 @@ async function loadAgentCoreAssetContext(args) {
 		if (!asset) return void 0;
 		const sourceDir = assetLoader.getAssetSourcePath(watchManifestDir(newCandidate, cdkOutDir), asset, {
 			assetOutdir: outputAssetBound(newCandidate, cdkOutDir),
-			subject: `AgentCore Runtime '${flattenToOneLine(resolved.logicalId)}' code bundle`,
+			subject: `AgentCore Runtime ${displayUntrustedValue(resolved.logicalId)} code bundle`,
 			wrapError: (message) => new CdkLocalError(message, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_ESCAPES_ASSEMBLY")
 		});
 		return {
@@ -23810,7 +23907,7 @@ async function loadAgentCoreAssetContext(args) {
 		assetOutdir: outputAssetBound(newCandidate, cdkOutDir),
 		absolute: "honour",
 		field: "source.directory",
-		subject: `AgentCore Runtime '${flattenToOneLine(resolved.logicalId)}' image asset`,
+		subject: `AgentCore Runtime ${displayUntrustedValue(resolved.logicalId)} image asset`,
 		action: "copy from it",
 		sink: "copy that directory into the running agent container on a soft reload",
 		wrapError: (message) => new CdkLocalError(message, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_ESCAPES_ASSEMBLY")
@@ -24388,7 +24485,7 @@ async function resolveOne(entry, secretsClient, ssmClient) {
 	switch (shape.kind) {
 		case "secrets-manager": return resolveSecretsManager(entry, shape, secretsClient);
 		case "ssm": return resolveSsm(entry, shape, ssmClient);
-		case "unknown": throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' references an unsupported ValueFrom shape '${arn}'. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
+		case "unknown": throw new EcsSecretsResolutionError(`Container ${displayUntrustedValue(entry.containerName)} secret ${displayUntrustedValue(entry.name)} references an unsupported ValueFrom shape ${displayUntrustedValue(arn)}. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
 	}
 }
 /**
@@ -24880,7 +24977,7 @@ async function realizeDockerVolumes(volumes, state) {
 	const out = /* @__PURE__ */ new Map();
 	for (const v of volumes) {
 		if (v.kind === "host") {
-			if (v.hostPath && !checkVolumeHostPath(v.hostPath)) logger.warn(`Volume '${v.name}': host path '${v.hostPath}' does not exist or is not a directory. Docker will create an anonymous bind mount; create the host path before run-task if you expected to bind-mount it.`);
+			if (v.hostPath && !checkVolumeHostPath(v.hostPath)) logger.warn(`Volume ${displayUntrustedValue(v.name)}: host path ${displayUntrustedValue(v.hostPath)} does not exist or is not a directory. Docker will create an anonymous bind mount; create the host path before run-task if you expected to bind-mount it.`);
 			out.set(v.name, v);
 			continue;
 		}
@@ -29764,7 +29861,7 @@ async function loadAssetContextForTarget(args) {
 		assetOutdir: outputAssetBound(candidate, cdkOutDir),
 		absolute: "honour",
 		field: "source.directory",
-		subject: `Docker image asset '${sanitizeServiceExceptionMessage(newAssetHash)}' of stack '${sanitizeServiceExceptionMessage(candidate.stackName)}'`,
+		subject: `Docker image asset ${displayUntrustedValue(newAssetHash)} of stack ${displayUntrustedValue(candidate.stackName)}`,
 		action: "copy from it",
 		sink: "copy that directory into the running replicas on a soft reload",
 		wrapError: (message) => new Error(message)
@@ -30293,11 +30390,11 @@ async function resolvePlaceholderAccount$1(arn, region, profile) {
 	}));
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new LocalStartServiceError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'.`);
+		if (!account) throw new LocalStartServiceError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${displayUntrustedValue(arn)}.`);
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
 	} catch (err) {
 		if (err instanceof LocalStartServiceError) throw err;
-		throw new LocalStartServiceError(`--assume-task-role: STS GetCallerIdentity failed while resolving placeholder ARN '${flattenToOneLine(arn)}': ${describeAwsFailureForWarn(err, "STS GetCallerIdentity (task-role placeholder)")}. Pass the ARN explicitly: --assume-task-role <arn>`);
+		throw new LocalStartServiceError(`--assume-task-role: STS GetCallerIdentity failed while resolving placeholder ARN ${displayUntrustedValue(arn)}: ${describeAwsFailureForWarn(err, "STS GetCallerIdentity (task-role placeholder)")}. Pass the ARN explicitly: --assume-task-role <arn>`);
 	} finally {
 		sts.destroy();
 	}
@@ -30870,13 +30967,13 @@ async function resolvePlaceholderAccount(arn, region, profile) {
 	}));
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new PlaceholderAccountError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'. Pass the ARN explicitly: --assume-task-role <arn>`);
+		if (!account) throw new PlaceholderAccountError(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${displayUntrustedValue(arn)}. Pass the ARN explicitly: --assume-task-role <arn>`);
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
 	} catch (err) {
 		if (err instanceof PlaceholderAccountError) throw err;
-		const shownArn = flattenToOneLine(arn);
+		const shownArn = displayUntrustedValue(arn);
 		const detail = describeAwsFailureForWarn(err, "STS GetCallerIdentity (task-role placeholder)");
-		throw new PlaceholderAccountError(`--assume-task-role: STS GetCallerIdentity failed while resolving placeholder ARN '${shownArn}': ${detail}. Pass the ARN explicitly: --assume-task-role <arn>`);
+		throw new PlaceholderAccountError(`--assume-task-role: STS GetCallerIdentity failed while resolving placeholder ARN ${shownArn}: ${detail}. Pass the ARN explicitly: --assume-task-role <arn>`);
 	} finally {
 		sts.destroy();
 	}
@@ -32744,7 +32841,7 @@ function resolveBucketDeploymentDirs(template, manifest, stack, bucketLogicalId)
 				assetOutdir,
 				absolute: "honour-warn",
 				field: "source.path",
-				subject: `BucketDeployment source asset for bucket '${sanitizeServiceExceptionMessage(bucketLogicalId)}'`,
+				subject: `BucketDeployment source asset for bucket ${displayUntrustedValue(bucketLogicalId)}`,
 				action: "serve it",
 				sink: "serve every file under that directory as this bucket's local S3 origin",
 				wrapError: (message) => new Error(message)
@@ -33307,7 +33404,7 @@ function realPathInsideRoot(root, file) {
 	if (rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel)) return realFile;
 	if (!warnedEscapes.has(file)) {
 		warnedEscapes.add(file);
-		getLogger().warn(`Not serving '${flattenToOneLine(file)}': it is a symbolic link to '${flattenToOneLine(realFile)}', outside the origin directory '${flattenToOneLine(root)}' the asset manifest named. Answering as if the key did not exist.`);
+		getLogger().warn(`Not serving ${displayUntrustedValue(file)}: it is a symbolic link to ${displayUntrustedValue(realFile)}, outside the origin directory ${displayUntrustedValue(root)} the asset manifest named. Answering as if the key did not exist.`);
 	}
 	return false;
 }
@@ -33346,7 +33443,7 @@ function isExistingFile(p) {
 function warnHiddenKey(dir, key, resolved) {
 	if (warnedHiddenKeys.has(resolved)) return;
 	warnedHiddenKeys.add(resolved);
-	getLogger().warn(`Not serving '${flattenToOneLine(key)}' from '${flattenToOneLine(dir)}': it is a hidden entry in a cdk synth --no-staging source folder (your own tree, not a staged asset). Answering as if the key did not exist.`);
+	getLogger().warn(`Not serving ${displayUntrustedValue(key)} from ${displayUntrustedValue(dir)}: it is a hidden entry in a cdk synth --no-staging source folder (your own tree, not a staged asset). Answering as if the key did not exist.`);
 }
 /** Hidden keys already warned about. */
 const warnedHiddenKeys = /* @__PURE__ */ new Set();
@@ -33824,9 +33921,9 @@ function createS3OriginReader(bucketName, options = {}) {
 			};
 			if (direct.kind === "denied" && !deniedWarned) {
 				deniedWarned = true;
-				getLogger().warn(`S3 denied reading '${flattenToOneLine(key)}' from bucket '${flattenToOneLine(bucketName)}'. If this is an OAC-locked / private bucket your credentials cannot read, point the origin at a local directory with --origin <originId>=<dir> (or use credentials with s3:GetObject on the bucket). ${getEmbedConfig().cliName} start-cloudfront reads the origin from real S3.`);
+				getLogger().warn(`S3 denied reading ${displayUntrustedValue(key)} from bucket ${displayUntrustedValue(bucketName)}. If this is an OAC-locked / private bucket your credentials cannot read, point the origin at a local directory with --origin <originId>=<dir> (or use credentials with s3:GetObject on the bucket). ${getEmbedConfig().cliName} start-cloudfront reads the origin from real S3.`);
 			}
-			if (direct.kind === "error") getLogger().warn(`S3 read of '${flattenToOneLine(key)}' from bucket '${flattenToOneLine(bucketName)}' failed: ${direct.message}`);
+			if (direct.kind === "error") getLogger().warn(`S3 read of ${displayUntrustedValue(key)} from bucket ${displayUntrustedValue(bucketName)} failed: ${direct.message}`);
 		}
 		for (const candidate of resolveErrorResponseCandidates(input.customErrorResponses)) {
 			const page = await fetchObject(candidate.errorKey);
@@ -33835,7 +33932,7 @@ function createS3OriginReader(bucketName, options = {}) {
 				headers: { "content-type": contentTypeForKey(candidate.errorKey) },
 				body: page.body
 			};
-			if (page.kind === "denied" || page.kind === "error") getLogger().warn(`S3 could not read custom-error page '${flattenToOneLine(candidate.errorKey)}' from bucket '${flattenToOneLine(bucketName)}' (${page.kind}); falling through.`);
+			if (page.kind === "denied" || page.kind === "error") getLogger().warn(`S3 could not read custom-error page ${displayUntrustedValue(candidate.errorKey)} from bucket ${displayUntrustedValue(bucketName)} (${page.kind}); falling through.`);
 		}
 		return {
 			statusCode: 404,
@@ -41684,4 +41781,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, describeCredentialLoadFailure as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, resolveProfileCredentials as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, buildProxyClientConfig as Ni, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, isProxyEnvConfigured as Pi, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildStsClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, describeAwsFailureForWarn as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-BbLfdSy4.js.map
+//# sourceMappingURL=local-studio-Cdq8klwg.js.map